diff --git a/.asf.yaml b/.asf.yaml
new file mode 100644
index 00000000000..3edb5883290
--- /dev/null
+++ b/.asf.yaml
@@ -0,0 +1,58 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+# https://cwiki.apache.org/confluence/display/INFRA/git+-+.asf.yaml+features
+
+github:
+  description: "Apache ZooKeeper"
+  homepage: https://zookeeper.apache.org
+  labels:
+    - java
+    - apache
+    - zookeeper
+    - consensus
+    - coordination
+    - zab
+    - database
+    - key-value
+    - distributed-database
+    - distributed-systems
+    - service-discovery
+    - configuration-management
+    - distributed-configuration
+    - hacktoberfest
+  features:
+    wiki: false
+    issues: false
+    projects: false
+  enabled_merge_buttons:
+    squash:  true
+    merge:   false
+    rebase:  false
+  autolink_jira:
+    - ZOOKEEPER
+  dependabot_alerts:  true
+  dependabot_updates: false
+
+notifications:
+  jira_options: link label worklog
+  commits: commits@zookeeper.apache.org
+  issues: issues@zookeeper.apache.org
+  pullrequests: notifications@zookeeper.apache.org
+
diff --git a/.gitattributes b/.gitattributes
index c3cc5e082bc..3d68ac6cc74 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,3 +1,22 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
 # Auto detect text files and perform LF normalization
 *        text=auto
 
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
new file mode 100644
index 00000000000..6f09ab5c914
--- /dev/null
+++ b/.github/workflows/ci.yaml
@@ -0,0 +1,106 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# This workflow will build a Java project with Maven
+# See also:
+#   https://help.github.com/actions/language-and-framework-guides/building-and-testing-java-with-maven
+
+name: CI
+
+on:
+  push:
+    branches: [ '*' ]
+  pull_request:
+    branches: [ '*' ]
+
+jobs:
+  mvn:
+    strategy:
+      matrix:
+        profile:
+          - name: 'full-build-jdk8'
+            jdk: 8
+            args: '-Pfull-build apache-rat:check verify -DskipTests spotbugs:check checkstyle:check'
+          - name: 'full-build-jdk11'
+            jdk: 11
+            args: '-Pfull-build apache-rat:check verify -DskipTests spotbugs:check checkstyle:check'
+          - name: 'full-build-java-tests'
+            jdk: 11
+            args: '-Pfull-build verify -Dsurefire-forkcount=1 -DskipCppUnit -Dsurefire.rerunFailingTestsCount=5'
+          - name: 'full-build-cppunit-tests'
+            jdk: 11
+            args: '-Pfull-build verify -Dtest=_ -DfailIfNoTests=false'
+      fail-fast: false
+    timeout-minutes: 360
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v6
+    - name: Set up JDK ${{ matrix.profile.jdk }}
+      uses: actions/setup-java@v5
+      with:
+        java-version: ${{ matrix.profile.jdk }}
+        distribution: temurin
+        cache: 'maven'
+    - name: Show the first log message
+      run: git log -n1
+    - name: Install C Dependencies
+      run: |
+        sudo apt update
+        sudo apt install -y libcppunit-dev libsasl2-dev
+    - name: Build with Maven (${{ matrix.profile.name }})
+      run: mvn -B -V -e -ntp "-Dstyle.color=always" ${{ matrix.profile.args }}
+      env:
+        MAVEN_OPTS: -Djansi.force=true
+    - name: Upload unit test results
+      if: ${{ failure() }}
+      uses: actions/upload-artifact@v7
+      with:
+        name: surefire-reports-${{ matrix.profile.name }}
+        path: ./**/target/surefire-reports/
+        if-no-files-found: ignore
+    - name: Upload integration test results
+      if: ${{ failure() }}
+      uses: actions/upload-artifact@v7
+      with:
+        name: failsafe-reports-${{ matrix.profile.name }}
+        path: ./**/target/failsafe-reports/
+        if-no-files-found: ignore
+    - name: Upload cppunit test logs
+      if: ${{ failure() }}
+      uses: actions/upload-artifact@v7
+      with:
+        name: cppunit-logs-${{ matrix.profile.name }}
+        path: ./zookeeper-client/zookeeper-client-c/target/c/TEST-*.txt
+        if-no-files-found: ignore
+  typo-check:
+    name: Typo Check
+    # only run on pull requests because of security reasons
+    # we shouldn't trust external actions for builds within the repository
+    if: ${{ github.event_name == 'pull_request' }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Check typos
+        uses: crate-ci/typos@v1.22.4
+        # To run the typo check locally, you can follow these steps:
+        # 1. Install typos locally using cargo:
+        #    cargo install typos-cli
+        # 2. Run the typo check with the following command:
+        #    typos
+        # FP is configured in the project root directory in the `.typos.toml` file.
+        # You can refer to the `.typos.toml` documentation here:
+        # https://github.com/crate-ci/typos/blob/master/docs/reference.md
diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml
new file mode 100644
index 00000000000..d20eba55b0d
--- /dev/null
+++ b/.github/workflows/e2e.yaml
@@ -0,0 +1,79 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: End to End Tests
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  compatibility:
+    strategy:
+      matrix:
+        jdk: [8, 11]
+        zk: [3.5.9, 3.6.3, 3.7.0, nightly]
+      fail-fast: false
+    timeout-minutes: 360
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Set up JDK ${{ matrix.jdk }}
+        uses: actions/setup-java@v5
+        with:
+          java-version: ${{ matrix.jdk }}
+          distribution: temurin
+          cache: 'maven'
+      - name: Show the first log message
+        run: git log -n1
+      - name: Install C Dependencies
+        run: |
+          sudo apt update
+          sudo apt install -y libcppunit-dev libsasl2-dev
+      - name: Build with Maven
+        run: mvn -B -V -e -ntp "-Dstyle.color=always" package -DskipTests
+        env:
+          MAVEN_OPTS: -Djansi.force=true
+      - name: Cache ZooKeeper ${{ matrix.zk }}
+        id: dist-cache
+        if: matrix.zk != 'nightly'
+        uses: actions/cache@v4
+        with:
+          key: apache-zookeeper-${{ matrix.zk }}-bin.tar.gz
+          path: apache-zookeeper-${{ matrix.zk }}-bin.tar.gz
+      - name: Download ZooKeeper ${{ matrix.zk }}
+        if: matrix.zk != 'nightly' && steps.dist-cache.outputs.cache-hit != 'true'
+        run: |
+          curl -O https://archive.apache.org/dist/zookeeper/zookeeper-${{ matrix.zk }}/apache-zookeeper-${{ matrix.zk }}-bin.tar.gz
+      - name: Extract ZooKeeper ${{ matrix.zk }}
+        if: matrix.zk != 'nightly'
+        run: tar -xzvf apache-zookeeper-${{ matrix.zk }}-bin.tar.gz
+      - name: Test ZooKeeper nightly server and ${{ matrix.zk }} client
+        if: matrix.zk != 'nightly'
+        run: tools/ci/test-connectivity.py --server . --client apache-zookeeper-${{ matrix.zk }}-bin
+        env:
+          ZOOCFG: zoo_sample.cfg
+      - name: Test ZooKeeper ${{ matrix.zk }} server and nightly client
+        if: matrix.zk != 'nightly'
+        run: tools/ci/test-connectivity.py --server apache-zookeeper-${{ matrix.zk }}-bin --client .
+        env:
+          ZOOCFG: zoo_sample.cfg
+      - name: Test ZooKeeper nightly server and client
+        if: matrix.zk == 'nightly'
+        run: tools/ci/test-connectivity.py --server . --client .
+        env:
+          ZOOCFG: zoo_sample.cfg
diff --git a/.github/workflows/manual.yaml b/.github/workflows/manual.yaml
new file mode 100644
index 00000000000..8b50b8be361
--- /dev/null
+++ b/.github/workflows/manual.yaml
@@ -0,0 +1,78 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# This workflow will build a Java project with Maven
+# See also:
+#   https://help.github.com/actions/language-and-framework-guides/building-and-testing-java-with-maven
+#   https://docs.github.com/en/actions/reference/events-that-trigger-workflows#manual-events
+
+name: Manual Build
+
+on:
+  workflow_dispatch:
+    inputs:
+      buildRef:
+        description: Ref to build (commit, branch, or refs/pull/1234/head or refs/pull/1234/merge)
+        required: true
+        default: refs/pull/1234/merge
+      mvnOpts:
+        description: Maven options
+        required: true
+        default: --fail-at-end
+      goals:
+        description: Maven goals
+        required: true
+        default: -Pfull-build apache-rat:check verify -DskipTests spotbugs:check checkstyle:check javadoc:jar
+jobs:
+  mvn:
+    name: mvn (triggered by ${{ github.event.sender.login }})
+    timeout-minutes: 360
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v6
+      with:
+        ref: ${{ github.event.inputs.buildRef }}
+    - name: Set up JDK 11
+      uses: actions/setup-java@v5
+      with:
+        java-version: 11
+        distribution: temurin
+        cache: 'maven'
+    - name: Show the first log message
+      run: git log -n1
+    - name: Install C Dependencies
+      run: |
+        sudo apt update
+        sudo apt install -y libcppunit-dev libsasl2-dev
+    - name: Build with Maven
+      run: mvn -B -V -e -ntp "-Dstyle.color=always" ${{ github.event.inputs.mvnOpts }} ${{ github.event.inputs.goals }}
+      env:
+        MAVEN_OPTS: -Djansi.force=true
+    - name: Upload unit test results
+      if: ${{ failure() }}
+      uses: actions/upload-artifact@v7
+      with:
+        name: surefire-reports
+        path: ./**/target/surefire-reports/
+        if-no-files-found: ignore
+    - name: Upload integration test results
+      if: ${{ failure() }}
+      uses: actions/upload-artifact@v7
+      with:
+        name: failsafe-reports
+        path: ./**/target/failsafe-reports/
+        if-no-files-found: ignore
diff --git a/.github/workflows/scripts.yaml b/.github/workflows/scripts.yaml
new file mode 100644
index 00000000000..98217b74700
--- /dev/null
+++ b/.github/workflows/scripts.yaml
@@ -0,0 +1,58 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+# This workflow enforces quality checks on bash scripts in the project
+
+name: ScriptQA
+
+on:
+  push:
+    branches: [ '*' ]
+  pull_request:
+    branches: [ '*' ]
+
+permissions:
+  contents: read
+
+jobs:
+  shfmt:
+    name: shfmt
+    timeout-minutes: 3
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v6
+    - name: Show the first log message
+      run: git log -n1
+    - name: Install shfmt
+      run: tools/ci/install-shfmt.sh
+    - name: Checking formatting of all scripts
+      run: tools/ci/run-shfmt.sh
+
+  shellcheck:
+    name: ShellCheck
+    timeout-minutes: 3
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v6
+    - name: Show the first log message
+      run: git log -n1
+    - name: Install shfmt
+      run: tools/ci/install-shfmt.sh
+    - name: Running shellcheck on all scripts
+      run: tools/ci/run-shellcheck.sh
diff --git a/.gitignore b/.gitignore
index 55937cec57e..5b7d5dcac48 100644
--- a/.gitignore
+++ b/.gitignore
@@ -69,9 +69,6 @@ tags
 obj
 zookeeper-server/src/main/resources/lib/ant-eclipse-*
 zookeeper-server/src/main/resources/lib/ivy-*
-zookeeper-server/src/main/java/org/apache/zookeeper/version/Info.java
-zookeeper-server/src/main/java/org/apache/zookeeper/version/VersionInfoMain.java
-zookeeper-server/src/test/resources/
 zookeeper-client/zookeeper-client-c/Makefile.in
 zookeeper-client/zookeeper-client-c/aclocal.m4
 zookeeper-client/zookeeper-client-c/autom4te.cache/
diff --git a/.travis.yml b/.travis.yml
deleted file mode 100644
index fe2e952a1d9..00000000000
--- a/.travis.yml
+++ /dev/null
@@ -1,35 +0,0 @@
-language: java
-sudo: false
-
-matrix:
-  include:
-    - os: linux
-      jdk: openjdk8
-    - os: linux
-      jdk: openjdk11
-    - os: linux
-      arch: s390x
-      jdk: openjdk11
-      addons:
-        apt:
-          update: true
-          packages:
-            - maven
-            - libcppunit-dev
-
-cache:
-  directories:
-  - "$HOME/.m2"
-
-addons:
-  apt:
-    packages:
-    - libcppunit-dev
-
-script: mvn clean apache-rat:check install -DskipTests spotbugs:check checkstyle:check -Pfull-build
-
-branches:
-  only:
-  - master
-  - branch-3.5
-  - branch-3.4
diff --git a/.typos.toml b/.typos.toml
new file mode 100644
index 00000000000..b3cd78c734f
--- /dev/null
+++ b/.typos.toml
@@ -0,0 +1,52 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+[default.extend-words]
+# abbr
+"aroun" = "aroun"
+"delet" = "delet"
+"dout" = "dout"
+"fied" = "fied"
+"fle" = "fle"
+"fo" = "fo"
+"hte" = "hte"
+"nd" = "nd"
+"nwe" = "nwe"
+"pn" = "pn"
+"strack" = "strack"
+"thr" = "thr"
+"ths" = "ths"
+"wew" = "wew"
+# keep for comptability
+"pathes" = "pathes"
+"shapshot" = "shapshot"
+# keyword fp
+"atend" = "atend"
+"chec" = "chec"
+"clos" = "clos"
+"erro" = "erro"
+"infor" = "infor"
+"locahost" = "locahost"
+"leafs" = "leafs"
+"sceen" = "sceen"
+
+[files]
+extend-exclude = [
+    "zookeeper-server/src/test/java/org/apache/zookeeper/common/CertificatesToPlayWith.java",
+]
diff --git a/Jenkinsfile b/Jenkinsfile
new file mode 100644
index 00000000000..40fcdd5bbad
--- /dev/null
+++ b/Jenkinsfile
@@ -0,0 +1,78 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+pipeline {
+    agent {
+        label 'Hadoop'
+    }
+
+    options {
+        disableConcurrentBuilds()
+        buildDiscarder(logRotator(daysToKeepStr: '14'))
+        timeout(time: 2, unit: 'HOURS')
+        timestamps()
+    }
+
+    triggers {
+        cron('@daily')
+    }
+
+    stages {
+        stage('Prepare') {
+            matrix {
+                agent any
+                axes {
+                    axis {
+                        name 'JAVA_VERSION'
+                        values 'jdk_1.8_latest', 'jdk_11_latest'
+                    }
+                }
+
+                tools {
+                    maven "maven_latest"
+                    jdk "${JAVA_VERSION}"
+                }
+
+                stages {
+                    stage('BuildAndTest') {
+                        steps {
+                            sh "git clean -fxd"
+                            sh "mvn verify spotbugs:check checkstyle:check -Pfull-build -Dsurefire-forkcount=4"
+                        }
+                        post {
+                            always {
+                               junit '**/target/surefire-reports/TEST-*.xml'
+                               archiveArtifacts '**/target/*.jar'
+                            }
+                            // Jenkins pipeline jobs fill slaves on PRs without this :(
+                            cleanup() {
+                                script {
+                                    sh label: 'Cleanup workspace', script: '''
+                                        # See HADOOP-13951
+                                        chmod -R u+rxw "${WORKSPACE}"
+                                        '''
+                                    deleteDir()
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
diff --git a/Jenkinsfile-PreCommit b/Jenkinsfile-PreCommit
new file mode 100644
index 00000000000..8390e05b929
--- /dev/null
+++ b/Jenkinsfile-PreCommit
@@ -0,0 +1,62 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+pipeline {
+    agent {
+        label 'Hadoop'
+    }
+
+    options {
+        disableConcurrentBuilds()
+        buildDiscarder(logRotator(daysToKeepStr: '14'))
+        timeout(time: 2, unit: 'HOURS')
+        timestamps()
+    }
+
+    tools {
+        maven "maven_latest"
+        jdk "jdk_1.8_latest"
+    }
+
+    stages {
+        stage('BuildAndTest') {
+            steps {
+                sh "git clean -fxd"
+                sh "mvn verify spotbugs:check checkstyle:check -Pfull-build -Dsurefire-forkcount=4"
+            }
+            post {
+                always {
+                   junit '**/target/surefire-reports/TEST-*.xml'
+                }
+            }
+        }
+    }
+
+    post {
+        // Jenkins pipeline jobs fill slaves on PRs without this :(
+        cleanup() {
+            script {
+                sh label: 'Cleanup workspace', script: '''
+                    # See HADOOP-13951
+                    chmod -R u+rxw "${WORKSPACE}"
+                    '''
+                deleteDir()
+            }
+        }
+    }
+}
diff --git a/Jenkinsfile-owasp b/Jenkinsfile-owasp
new file mode 100644
index 00000000000..2831dd4d6df
--- /dev/null
+++ b/Jenkinsfile-owasp
@@ -0,0 +1,61 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+pipeline {
+    agent {
+        label 'Hadoop'
+    }
+
+    options {
+        buildDiscarder(logRotator(daysToKeepStr: '14'))
+        timeout(time: 2, unit: 'HOURS')
+        timestamps()
+    }
+
+    tools {
+        maven "maven_latest"
+        jdk "jdk_11_latest"
+    }
+
+    stages {
+        stage('BuildAndTest') {
+            steps {
+                sh "git clean -fxd"
+                sh "mvn clean package -DskipTests dependency-check:check"
+            }
+            post {
+                always {
+                   archiveArtifacts '**/target/dependency-check-*'
+                }
+            }
+        }
+    }
+
+    post {
+        // Jenkins pipeline jobs fill slaves on PRs without this :(
+        cleanup() {
+            script {
+                sh label: 'Cleanup workspace', script: '''
+                    # See HADOOP-13951
+                    chmod -R u+rxw "${WORKSPACE}"
+                    '''
+                deleteDir()
+            }
+        }
+    }
+}
diff --git a/Jenkinsfile-s390x b/Jenkinsfile-s390x
new file mode 100644
index 00000000000..bd48a1c280a
--- /dev/null
+++ b/Jenkinsfile-s390x
@@ -0,0 +1,73 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+pipeline {
+    agent {
+        label 's390x'
+    }
+
+    options {
+        disableConcurrentBuilds()
+        buildDiscarder(logRotator(daysToKeepStr: '14'))
+        timeout(time: 2, unit: 'HOURS')
+        timestamps()
+    }
+
+    triggers {
+        cron('@daily')
+    }
+
+    stages {
+        stage('Prepare') {
+
+            agent {
+                label 's390x'
+            }
+
+            tools {
+                maven "maven_latest"
+                jdk "jdk_11_latest"
+            }
+
+            stages {
+                stage('BuildAndTest') {
+                    steps {
+                        sh "git clean -fxd"
+                        sh "mvn verify spotbugs:check checkstyle:check -Pfull-build -Dsurefire-forkcount=4"
+                    }
+                    post {
+                        always {
+                            junit '**/target/surefire-reports/TEST-*.xml'
+                            archiveArtifacts '**/target/*.jar'
+                        }
+                        // Jenkins pipeline jobs fill slaves on PRs without this :(
+                        cleanup() {
+                            script {
+                                sh label: 'Cleanup workspace', script: '''
+                                    # See HADOOP-13951
+                                    chmod -R u+rxw "${WORKSPACE}"
+                                    '''
+                                deleteDir()
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
diff --git a/NOTICE.txt b/NOTICE.txt
index 4c4f8b220fe..9b3afcb4705 100644
--- a/NOTICE.txt
+++ b/NOTICE.txt
@@ -1,5 +1,5 @@
 Apache ZooKeeper
-Copyright 2009-2020 The Apache Software Foundation
+Copyright 2009-2026 The Apache Software Foundation
 
 This product includes software developed at
 The Apache Software Foundation (http://www.apache.org/).
@@ -9,3 +9,17 @@ developed for Airlift (https://github.com/airlift/airlift),
 licensed under the Apache 2.0 license. The licensing terms
 for Airlift code can be found at:
 https://github.com/airlift/airlift/blob/master/LICENSE
+
+This project also includes some files with the following licenses.
+
+These BSD licensed files:
+  ./zookeeper-client/zookeeper-client-c/src/hashtable/hashtable.c
+  ./zookeeper-client/zookeeper-client-c/src/hashtable/hashtable.h
+  ./zookeeper-client/zookeeper-client-c/src/hashtable/hashtable_itr.c
+  ./zookeeper-client/zookeeper-client-c/src/hashtable/hashtable_itr.h
+  ./zookeeper-client/zookeeper-client-c/src/hashtable/hashtable_private.h
+  ./zookeeper-docs/src/main/resources/markdown/skin/prototype.js
+
+This Apache 2.0 licensed file:
+./zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/com/nitido/utils/toaster/Toaster.java
+
diff --git a/README.md b/README.md
index 0f9c4b2af13..cd9db2b460c 100644
--- a/README.md
+++ b/README.md
@@ -1,16 +1,20 @@
-# Apache ZooKeeper [![Build Status](https://travis-ci.org/apache/zookeeper.svg?branch=master)](https://travis-ci.org/apache/zookeeper) [![Maven Central](https://img.shields.io/maven-central/v/org.apache.zookeeper/zookeeper)](https://zookeeper.apache.org/releases.html) [![License](https://img.shields.io/github/license/apache/zookeeper)](https://github.com/apache/zookeeper/blob/master/LICENSE.txt)
-![alt text](https://zookeeper.apache.org/images/zookeeper_small.gif "ZooKeeper")
+# Apache ZooKeeper [![GitHub Actions CI][ciBadge]][ciLink] [![Travis CI][trBadge]][trLink] [![Maven Central][mcBadge]][mcLink] [![License][liBadge]][liLink]
+
+<p align="left">
+  <a href="https://zookeeper.apache.org/">
+    <img src="https://zookeeper.apache.org/images/zookeeper_small.gif"" alt="https://zookeeper.apache.org/"><br/>
+  </a>
+</p>
 
 For the latest information about Apache ZooKeeper, please visit our website at:
 
-   http://zookeeper.apache.org/
+   https://zookeeper.apache.org
 
 and our wiki, at:
 
    https://cwiki.apache.org/confluence/display/ZOOKEEPER
 
----------------------------
-Packaging/release artifacts
+## Packaging/release artifacts
 
 Either downloaded from https://zookeeper.apache.org/releases.html or
 found in zookeeper-assembly/target directory after building the project with maven.
@@ -33,7 +37,7 @@ As of version 3.5.5, the parent, zookeeper and zookeeper-jute artifacts
 are deployed to the central repository after the release
 is voted on and approved by the Apache ZooKeeper PMC:
 
-  https://repo1.maven.org/maven2/org/apache/zookeeper/zookeeper/
+  https://repo1.maven.org/maven2/org/apache/zookeeper/zookeeper
 
 ## Java 8
 
@@ -41,6 +45,14 @@ If you are going to compile with Java 1.8, you should use a
 recent release at u211 or above.
 
 # Contributing
-We always welcome new contributors to the project! See [How to Contribute](https://cwiki.apache.org/confluence/display/ZOOKEEPER/HowToContribute) for details on how to submit patch through pull request and our contribution workflow.
+We always welcome new contributors to the project! See [How to Contribute](https://cwiki.apache.org/confluence/display/ZOOKEEPER/HowToContribute) for details on how to submit patches as pull requests and other aspects of our contribution workflow.
 
 
+[ciBadge]: https://github.com/apache/zookeeper/workflows/CI/badge.svg
+[ciLink]: https://github.com/apache/zookeeper/actions
+[liBadge]: https://img.shields.io/github/license/apache/zookeeper?color=282661
+[liLink]: https://github.com/apache/zookeeper/blob/master/LICENSE.txt
+[mcBadge]: https://img.shields.io/maven-central/v/org.apache.zookeeper/zookeeper
+[mcLink]: https://zookeeper.apache.org/releases
+[trBadge]: https://travis-ci.org/apache/zookeeper.svg?branch=master
+[trLink]: https://travis-ci.org/apache/zookeeper
diff --git a/bin/zkCleanup.sh b/bin/zkCleanup.sh
index 45532410e96..2b8b87371cb 100755
--- a/bin/zkCleanup.sh
+++ b/bin/zkCleanup.sh
@@ -1,19 +1,22 @@
-#!/usr/bin/env bash
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
 
 #
 # This script cleans up old transaction logs and snapshots
@@ -27,27 +30,35 @@
 
 # use POSIX interface, symlink is followed automatically
 ZOOBIN="${BASH_SOURCE-$0}"
-ZOOBIN="$(dirname "${ZOOBIN}")"
-ZOOBINDIR="$(cd "${ZOOBIN}"; pwd)"
+ZOOBIN="$(dirname "$ZOOBIN")"
+ZOOBINDIR="$(cd "$ZOOBIN" && pwd)" || exit
 
-if [ -e "$ZOOBIN/../libexec/zkEnv.sh" ]; then
-  . "$ZOOBINDIR"/../libexec/zkEnv.sh
+if [[ -e "$ZOOBIN/../libexec/zkEnv.sh" ]]; then
+  # shellcheck source=bin/zkEnv.sh
+  . "$ZOOBINDIR"/../libexec/zkEnv.sh "$@"
 else
-  . "$ZOOBINDIR"/zkEnv.sh
+  # shellcheck source=bin/zkEnv.sh
+  . "$ZOOBINDIR"/zkEnv.sh "$@"
 fi
 
-ZOODATADIR="$(grep "^[[:space:]]*dataDir=" "$ZOOCFG" | sed -e 's/.*=//')"
-ZOODATALOGDIR="$(grep "^[[:space:]]*dataLogDir=" "$ZOOCFG" | sed -e 's/.*=//')"
+ZOODATADIR=""
+ZOODATALOGDIR=""
+
+# Only try to read config if ZOOCFG exists
+if [[ -f $ZOOCFG ]]; then
+  re='^[^=]*=[[:space:]]*(.*)[[:space:]]*$'
+  ZOODATADIR="$(grep "^[[:space:]]*dataDir=" "$ZOOCFG" 2>/dev/null)"
+  [[ $ZOODATADIR =~ $re ]] && ZOODATADIR="${BASH_REMATCH[1]}"
+  ZOODATALOGDIR="$(grep "^[[:space:]]*dataLogDir=" "$ZOOCFG" 2>/dev/null)"
+  [[ $ZOODATALOGDIR =~ $re ]] && ZOODATALOGDIR="${BASH_REMATCH[1]}"
+fi
 
 ZOO_LOG_FILE=zookeeper-$USER-cleanup-$HOSTNAME.log
 
-if [ "x$ZOODATALOGDIR" = "x" ]
-then
-"$JAVA" "-Dzookeeper.log.dir=${ZOO_LOG_DIR}" "-Dzookeeper.root.logger=${ZOO_LOG4J_PROP}" "-Dzookeeper.log.file=${ZOO_LOG_FILE}" \
-     -cp "$CLASSPATH" $JVMFLAGS \
-     org.apache.zookeeper.server.PurgeTxnLog "$ZOODATADIR" $*
-else
-"$JAVA" "-Dzookeeper.log.dir=${ZOO_LOG_DIR}" "-Dzookeeper.root.logger=${ZOO_LOG4J_PROP}" "-Dzookeeper.log.file=${ZOO_LOG_FILE}" \
-     -cp "$CLASSPATH" $JVMFLAGS \
-     org.apache.zookeeper.server.PurgeTxnLog "$ZOODATALOGDIR" "$ZOODATADIR" $*
-fi
+# shellcheck disable=SC2206
+flags=("-Dzookeeper.log.dir=$ZOO_LOG_DIR" "-Dzookeeper.log.file=$ZOO_LOG_FILE" $JVMFLAGS)
+
+directories=()
+[[ -n $ZOODATADIR ]] && directories=("$ZOODATADIR")
+[[ -n $ZOODATALOGDIR ]] && directories=("$ZOODATALOGDIR" "${directories[@]}")
+"$JAVA" "${flags[@]}" org.apache.zookeeper.server.PurgeTxnLog "${directories[@]}" "$@"
diff --git a/bin/zkCli.cmd b/bin/zkCli.cmd
index 807ffaa9e5c..7a4391dd9ff 100644
--- a/bin/zkCli.cmd
+++ b/bin/zkCli.cmd
@@ -20,7 +20,7 @@ call "%~dp0zkEnv.cmd"
 set ZOO_LOG_FILE=zookeeper-%USERNAME%-cli-%COMPUTERNAME%.log
 
 set ZOOMAIN=org.apache.zookeeper.ZooKeeperMain
-call %JAVA% "-Dzookeeper.log.dir=%ZOO_LOG_DIR%" "-Dzookeeper.root.logger=%ZOO_LOG4J_PROP%" "-Dzookeeper.log.file=%ZOO_LOG_FILE%" -cp "%CLASSPATH%" %ZOOMAIN% %*
+call %JAVA% "-Dzookeeper.log.dir=%ZOO_LOG_DIR%" "-Dzookeeper.log.file=%ZOO_LOG_FILE%" -cp "%CLASSPATH%" %ZOOMAIN% %*
 
 endlocal
 
diff --git a/bin/zkCli.sh b/bin/zkCli.sh
index ecf9a4525a0..7ae9637766b 100755
--- a/bin/zkCli.sh
+++ b/bin/zkCli.sh
@@ -1,19 +1,22 @@
-#!/usr/bin/env bash
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
 
 #
 # This script cleans up old transaction logs and snapshots
@@ -27,17 +30,23 @@
 
 # use POSIX interface, symlink is followed automatically
 ZOOBIN="${BASH_SOURCE-$0}"
-ZOOBIN="$(dirname "${ZOOBIN}")"
-ZOOBINDIR="$(cd "${ZOOBIN}"; pwd)"
+ZOOBIN="$(dirname "$ZOOBIN")"
+ZOOBINDIR="$(cd "$ZOOBIN" && pwd)"
 
-if [ -e "$ZOOBIN/../libexec/zkEnv.sh" ]; then
+if [[ -e "$ZOOBIN/../libexec/zkEnv.sh" ]]; then
+  # shellcheck source=bin/zkEnv.sh
   . "$ZOOBINDIR"/../libexec/zkEnv.sh
 else
+  # shellcheck source=bin/zkEnv.sh
   . "$ZOOBINDIR"/zkEnv.sh
 fi
 
 ZOO_LOG_FILE=zookeeper-$USER-cli-$HOSTNAME.log
 
-"$JAVA" "-Dzookeeper.log.dir=${ZOO_LOG_DIR}" "-Dzookeeper.root.logger=${ZOO_LOG4J_PROP}" "-Dzookeeper.log.file=${ZOO_LOG_FILE}" \
-     -cp "$CLASSPATH" $CLIENT_JVMFLAGS $JVMFLAGS \
-     org.apache.zookeeper.ZooKeeperMain "$@"
+# shellcheck disable=SC2206
+clientflags=($CLIENT_JVMFLAGS)
+# shellcheck disable=SC2206
+flags=($JVMFLAGS)
+"$JAVA" "-Dzookeeper.log.dir=$ZOO_LOG_DIR" "-Dzookeeper.log.file=$ZOO_LOG_FILE" \
+  "${clientflags[@]}" "${flags[@]}" \
+  org.apache.zookeeper.ZooKeeperMain "$@"
diff --git a/bin/zkEnv.cmd b/bin/zkEnv.cmd
index 68e231d7084..de9fc929b61 100644
--- a/bin/zkEnv.cmd
+++ b/bin/zkEnv.cmd
@@ -16,7 +16,6 @@ REM limitations under the License.
 
 set ZOOCFGDIR=%~dp0%..\conf
 set ZOO_LOG_DIR=%~dp0%..\logs
-set ZOO_LOG4J_PROP=INFO,CONSOLE
 
 REM for sanity sake assume Java 1.6
 REM see: http://java.sun.com/javase/6/docs/technotes/tools/windows/java.html
diff --git a/bin/zkEnv.sh b/bin/zkEnv.sh
index 8d93a50c7c0..40889874818 100755
--- a/bin/zkEnv.sh
+++ b/bin/zkEnv.sh
@@ -1,19 +1,22 @@
-#!/usr/bin/env bash
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
+#! /usr/bin/env bash
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
 
 # This script should be sourced into other zookeeper
 # scripts to setup the env variables
@@ -26,99 +29,88 @@
 # '--config' option in the command line.
 
 ZOOBINDIR="${ZOOBINDIR:-/usr/bin}"
-ZOOKEEPER_PREFIX="${ZOOBINDIR}/.."
+ZOOKEEPER_PREFIX="$ZOOBINDIR/.."
 
 #check to see if the conf dir is given as an optional argument
-if [ $# -gt 1 ]
-then
-    if [ "--config" = "$1" ]
-	  then
-	      shift
-	      confdir=$1
-	      shift
-	      ZOOCFGDIR=$confdir
-    fi
+if [[ $# -gt 1 ]]; then
+  if [[ "--config" == "$1" ]]; then
+    shift
+    ZOOCFGDIR=$1
+    shift
+  fi
 fi
 
-if [ "x$ZOOCFGDIR" = "x" ]
-then
-  if [ -e "${ZOOKEEPER_PREFIX}/conf" ]; then
+if [[ -z $ZOOCFGDIR ]]; then
+  if [[ -e "$ZOOKEEPER_PREFIX/conf" ]]; then
     ZOOCFGDIR="$ZOOBINDIR/../conf"
   else
     ZOOCFGDIR="$ZOOBINDIR/../etc/zookeeper"
   fi
 fi
 
-if [ -f "${ZOOCFGDIR}/zookeeper-env.sh" ]; then
-  . "${ZOOCFGDIR}/zookeeper-env.sh"
+if [[ -f "$ZOOCFGDIR/zookeeper-env.sh" ]]; then
+  # shellcheck source=bin/zkEnv.sh
+  . "$ZOOCFGDIR/zookeeper-env.sh"
 fi
 
-if [ "x$ZOOCFG" = "x" ]
-then
-    ZOOCFG="zoo.cfg"
-fi
+ZOOCFG=${ZOOCFG:-zoo.cfg}
 
 ZOOCFG="$ZOOCFGDIR/$ZOOCFG"
 
-if [ -f "$ZOOCFGDIR/java.env" ]
-then
-    . "$ZOOCFGDIR/java.env"
+if [[ -f "$ZOOCFGDIR/java.env" ]]; then
+  # shellcheck source=bin/zkEnv.sh
+  . "$ZOOCFGDIR/java.env"
 fi
 
-if [ "x${ZOO_LOG_DIR}" = "x" ]
-then
-    ZOO_LOG_DIR="$ZOOKEEPER_PREFIX/logs"
-fi
-
-if [ "x${ZOO_LOG4J_PROP}" = "x" ]
-then
-    ZOO_LOG4J_PROP="INFO,CONSOLE"
-fi
+ZOO_LOG_DIR=${ZOO_LOG_DIR:-$ZOOKEEPER_PREFIX/logs}
 
-if [[ -n "$JAVA_HOME" ]] && [[ -x "$JAVA_HOME/bin/java" ]];  then
-    JAVA="$JAVA_HOME/bin/java"
+if [[ -n $JAVA_HOME ]] && [[ -x "$JAVA_HOME/bin/java" ]]; then
+  JAVA="$JAVA_HOME/bin/java"
 elif type -p java; then
-    JAVA=java
+  # ignore unused; used this file is sourced
+  # shellcheck disable=SC2034
+  JAVA=java
 else
-    echo "Error: JAVA_HOME is not set and java could not be found in PATH." 1>&2
-    exit 1
+  echo "Error: JAVA_HOME is not set and java could not be found in PATH." 1>&2
+  exit 1
 fi
 
 #add the zoocfg dir to classpath
 CLASSPATH="$ZOOCFGDIR:$CLASSPATH"
 
-for i in "$ZOOBINDIR"/../zookeeper-server/src/main/resources/lib/*.jar
-do
-    CLASSPATH="$i:$CLASSPATH"
+for i in "$ZOOBINDIR"/../zookeeper-server/src/main/resources/lib/*.jar; do
+  CLASSPATH="$i:$CLASSPATH"
 done
 
 #make it work in the binary package
 #(use array for LIBPATH to account for spaces within wildcard expansion)
-if ls "${ZOOKEEPER_PREFIX}"/share/zookeeper/zookeeper-*.jar > /dev/null 2>&1; then 
-  LIBPATH=("${ZOOKEEPER_PREFIX}"/share/zookeeper/*.jar)
+if ls "$ZOOKEEPER_PREFIX"/share/zookeeper/zookeeper-*.jar &>/dev/null; then
+  LIBPATH=("$ZOOKEEPER_PREFIX"/share/zookeeper/*.jar)
 else
   #release tarball format
-  for i in "$ZOOBINDIR"/../zookeeper-*.jar
-  do
+  for i in "$ZOOBINDIR"/../zookeeper-*.jar; do
     CLASSPATH="$i:$CLASSPATH"
   done
-  LIBPATH=("${ZOOBINDIR}"/../lib/*.jar)
+  LIBPATH=("$ZOOBINDIR"/../lib/*.jar)
 fi
 
-for i in "${LIBPATH[@]}"
-do
-    CLASSPATH="$i:$CLASSPATH"
+for i in "${LIBPATH[@]}"; do
+  CLASSPATH="$i:$CLASSPATH"
 done
 
 #make it work for developers
-for d in "$ZOOBINDIR"/../build/lib/*.jar
-do
-   CLASSPATH="$d:$CLASSPATH"
+for d in "$ZOOBINDIR"/../build/lib/*.jar; do
+  CLASSPATH="$d:$CLASSPATH"
 done
 
-for d in "$ZOOBINDIR"/../zookeeper-server/target/lib/*.jar
-do
-   CLASSPATH="$d:$CLASSPATH"
+#make it work for developers
+for d in "$ZOOBINDIR"/../zookeeper-server/target/lib/*.jar; do
+  CLASSPATH="$d:$CLASSPATH"
+done
+
+#make it work for developers
+for d in "$ZOOBINDIR"/../zookeeper-metrics-providers/zookeeper-prometheus-metrics/target/lib/*.jar; do
+  CLASSPATH="$d:$CLASSPATH"
 done
 
 #make it work for developers
@@ -127,17 +119,20 @@ CLASSPATH="$ZOOBINDIR/../build/classes:$CLASSPATH"
 #make it work for developers
 CLASSPATH="$ZOOBINDIR/../zookeeper-server/target/classes:$CLASSPATH"
 
-case "`uname`" in
-    CYGWIN*|MINGW*) cygwin=true ;;
-    *) cygwin=false ;;
+#make it work for developers
+CLASSPATH="$ZOOBINDIR/../zookeeper-metrics-providers/zookeeper-prometheus-metrics/target/classes:$CLASSPATH"
+
+case "$(uname)" in
+  CYGWIN* | MINGW*) cygwin=true ;;
+  *) cygwin=false ;;
 esac
 
-if $cygwin
-then
-    CLASSPATH=`cygpath -wp "$CLASSPATH"`
+if $cygwin; then
+  CLASSPATH=$(cygpath -wp "$CLASSPATH")
 fi
 
 #echo "CLASSPATH=$CLASSPATH"
+export CLASSPATH
 
 # default heap for zookeeper server
 ZK_SERVER_HEAP="${ZK_SERVER_HEAP:-1000}"
diff --git a/bin/zkServer-initialize.sh b/bin/zkServer-initialize.sh
index 062e265915c..d41befcd470 100755
--- a/bin/zkServer-initialize.sh
+++ b/bin/zkServer-initialize.sh
@@ -1,19 +1,22 @@
-#!/usr/bin/env bash
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
 
 #
 # If this scripted is run out of /usr/bin or some other system bin directory
@@ -23,12 +26,14 @@
 
 # use POSIX interface, symlink is followed automatically
 ZOOBIN="${BASH_SOURCE-$0}"
-ZOOBIN="$(dirname "${ZOOBIN}")"
-ZOOBINDIR="$(cd "${ZOOBIN}"; pwd)"
+ZOOBIN="$(dirname "$ZOOBIN")"
+ZOOBINDIR="$(cd "$ZOOBIN" && pwd)"
 
-if [ -e "$ZOOBIN/../libexec/zkEnv.sh" ]; then
+if [[ -e "$ZOOBIN/../libexec/zkEnv.sh" ]]; then
+  # shellcheck source=bin/zkEnv.sh
   . "$ZOOBINDIR"/../libexec/zkEnv.sh
 else
+  # shellcheck source=bin/zkEnv.sh
   . "$ZOOBINDIR"/zkEnv.sh
 fi
 
@@ -47,94 +52,93 @@ usage() {
   exit 1
 }
 
-if [ $? != 0 ] ; then
-    usage
-    exit 1
-fi
-
 initialize() {
-    if [ ! -e "$ZOOCFG" ]; then
-        echo "Unable to find config file at $ZOOCFG"
-        exit 1
-    fi
-
-    ZOO_DATADIR="$(grep "^[[:space:]]*dataDir" "$ZOOCFG" | sed -e 's/.*=//')"
-    ZOO_DATALOGDIR="$(grep "^[[:space:]]*dataLogDir" "$ZOOCFG" | sed -e 's/.*=//')"
-
-    if [ -z "$ZOO_DATADIR" ]; then
-        echo "Unable to determine dataDir from $ZOOCFG"
-        exit 1
-    fi
-
-    if [ $FORCE ]; then
-        echo "Force enabled, data/txnlog directories will be re-initialized"
-    else
-        # we create if version-2 exists (ie real data), not the
-        # parent. See comments in following section for more insight
-        if [ -d "$ZOO_DATADIR/version-2" ]; then
-            echo "ZooKeeper data directory already exists at $ZOO_DATADIR (or use --force to force re-initialization)"
-            exit 1
-        fi
-
-        if [ -n "$ZOO_DATALOGDIR" ] && [ -d "$ZOO_DATALOGDIR/version-2" ]; then
-            echo "ZooKeeper txnlog directory already exists at $ZOO_DATALOGDIR (or use --force to force re-initialization)"
-            exit 1
-        fi
-    fi
+  if [[ ! -e $ZOOCFG ]]; then
+    echo "Unable to find config file at $ZOOCFG"
+    exit 1
+  fi
 
-    # remove the child files that we're (not) interested in, not the
-    # parent. this allows for parent to be installed separately, and
-    # permissions to be set based on overarching requirements. by
-    # default we'll use the permissions of the user running this
-    # script for the files contained by the parent. note also by using
-    # -p the parent(s) will be created if it doesn't already exist
-    rm -rf "$ZOO_DATADIR/myid" 2>/dev/null >/dev/null
-    rm -rf "$ZOO_DATADIR/version-2" 2>/dev/null >/dev/null
-    mkdir -p "$ZOO_DATADIR/version-2"
+  ZOO_DATADIR="$(grep "^[[:space:]]*dataDir" "$ZOOCFG" | sed -e 's/.*=//')"
+  ZOO_DATALOGDIR="$(grep "^[[:space:]]*dataLogDir" "$ZOOCFG" | sed -e 's/.*=//')"
 
-    if [ -n "$ZOO_DATALOGDIR" ]; then
-        rm -rf "$ZOO_DATALOGDIR/myid" 2>/dev/null >/dev/null
-        rm -rf "$ZOO_DATALOGDIR/version-2" 2>/dev/null >/dev/null
-        mkdir -p "$ZOO_DATALOGDIR/version-2"
+  if [[ -z $ZOO_DATADIR ]]; then
+    echo "Unable to determine dataDir from $ZOOCFG"
+    exit 1
+  fi
+
+  if [[ $FORCE -eq 1 ]]; then
+    echo "Force enabled, data/txnlog directories will be re-initialized"
+  else
+    # we create if version-2 exists (ie real data), not the
+    # parent. See comments in following section for more insight
+    if [[ -d "$ZOO_DATADIR/version-2" ]]; then
+      echo "ZooKeeper data directory already exists at $ZOO_DATADIR (or use --force to force re-initialization)"
+      exit 1
     fi
 
-    if [ $MYID ]; then
-        echo "Using myid of $MYID"
-        echo $MYID > "$ZOO_DATADIR/myid"
-    else
-        echo "No myid provided, be sure to specify it in $ZOO_DATADIR/myid if using non-standalone"
+    if [[ -n $ZOO_DATALOGDIR ]] && [[ -d "$ZOO_DATALOGDIR/version-2" ]]; then
+      echo "ZooKeeper txnlog directory already exists at $ZOO_DATALOGDIR (or use --force to force re-initialization)"
+      exit 1
     fi
-
-    touch "$ZOO_DATADIR/initialize"
+  fi
+
+  # remove the child files that we're (not) interested in, not the
+  # parent. this allows for parent to be installed separately, and
+  # permissions to be set based on overarching requirements. by
+  # default we'll use the permissions of the user running this
+  # script for the files contained by the parent. note also by using
+  # -p the parent(s) will be created if it doesn't already exist
+  rm -rf "$ZOO_DATADIR/myid" 2>/dev/null >/dev/null
+  rm -rf "$ZOO_DATADIR/version-2" 2>/dev/null >/dev/null
+  mkdir -p "$ZOO_DATADIR/version-2"
+
+  if [[ -n $ZOO_DATALOGDIR ]]; then
+    rm -rf "$ZOO_DATALOGDIR/myid" 2>/dev/null >/dev/null
+    rm -rf "$ZOO_DATALOGDIR/version-2" 2>/dev/null >/dev/null
+    mkdir -p "$ZOO_DATALOGDIR/version-2"
+  fi
+
+  if [[ -n $MYID ]]; then
+    echo "Using myid of $MYID"
+    echo "$MYID" >"$ZOO_DATADIR/myid"
+  else
+    echo "No myid provided, be sure to specify it in $ZOO_DATADIR/myid if using non-standalone"
+  fi
+
+  touch "$ZOO_DATADIR/initialize"
 }
 
-while [ ! -z "$1" ]; do
+while [[ -n $1 ]]; do
   case "$1" in
     --configfile)
-      ZOOCFG=$2; shift 2
+      ZOOCFG=$2
+      shift 2
       ;;
     --configfile=?*)
-      ZOOCFG=${1#*=}; shift 1
+      ZOOCFG=${1#*=}
+      shift 1
       ;;
     --myid)
-      MYID=$2; shift 2
+      MYID=$2
+      shift 2
       ;;
     --myid=?*)
-      MYID=${1#*=}; shift 1
+      MYID=${1#*=}
+      shift 1
       ;;
     --force)
-      FORCE=1; shift 1
+      FORCE=1
+      shift 1
       ;;
     -h)
       usage
-      ;; 
+      ;;
     --help)
       usage
-      ;; 
+      ;;
     *)
       echo "Unknown option: $1"
       usage
-      exit 1 
       ;;
   esac
 done
diff --git a/bin/zkServer.cmd b/bin/zkServer.cmd
index b03a44386e7..07ac3a30244 100644
--- a/bin/zkServer.cmd
+++ b/bin/zkServer.cmd
@@ -21,6 +21,6 @@ set ZOOMAIN=org.apache.zookeeper.server.quorum.QuorumPeerMain
 set ZOO_LOG_FILE=zookeeper-%USERNAME%-server-%COMPUTERNAME%.log
 
 echo on
-call %JAVA% "-Dzookeeper.log.dir=%ZOO_LOG_DIR%" "-Dzookeeper.root.logger=%ZOO_LOG4J_PROP%" "-Dzookeeper.log.file=%ZOO_LOG_FILE%" "-XX:+HeapDumpOnOutOfMemoryError" "-XX:OnOutOfMemoryError=cmd /c taskkill /pid %%%%p /t /f" -cp "%CLASSPATH%" %ZOOMAIN% "%ZOOCFG%" %*
+call %JAVA% "-Dzookeeper.log.dir=%ZOO_LOG_DIR%" "-Dzookeeper.log.file=%ZOO_LOG_FILE%" "-XX:+HeapDumpOnOutOfMemoryError" "-XX:OnOutOfMemoryError=cmd /c taskkill /pid %%%%p /t /f" -cp "%CLASSPATH%" %ZOOMAIN% "%ZOOCFG%" %*
 
 endlocal
diff --git a/bin/zkServer.sh b/bin/zkServer.sh
index 10ead606b2d..b2fd120544e 100755
--- a/bin/zkServer.sh
+++ b/bin/zkServer.sh
@@ -1,19 +1,22 @@
-#!/usr/bin/env bash
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
 
 #
 # If this scripted is run out of /usr/bin or some other system bin directory
@@ -21,15 +24,16 @@
 # relative to the canonical path of this script.
 #
 
-
 # use POSIX interface, symlink is followed automatically
 ZOOBIN="${BASH_SOURCE-$0}"
-ZOOBIN="$(dirname "${ZOOBIN}")"
-ZOOBINDIR="$(cd "${ZOOBIN}"; pwd)"
+ZOOBIN="$(dirname "$ZOOBIN")"
+ZOOBINDIR="$(cd "$ZOOBIN" && pwd)"
 
-if [ -e "$ZOOBIN/../libexec/zkEnv.sh" ]; then
+if [[ -e "$ZOOBIN/../libexec/zkEnv.sh" ]]; then
+  # shellcheck source=bin/zkEnv.sh
   . "$ZOOBINDIR"/../libexec/zkEnv.sh
 else
+  # shellcheck source=bin/zkEnv.sh
   . "$ZOOBINDIR"/zkEnv.sh
 fi
 
@@ -37,252 +41,272 @@ fi
 # up the JVM to accept JMX remote management:
 # http://java.sun.com/javase/6/docs/technotes/guides/management/agent.html
 # by default we allow local JMX connections
-if [ "x$JMXLOCALONLY" = "x" ]
-then
-    JMXLOCALONLY=false
+if [[ -z $JMXLOCALONLY ]]; then
+  JMXLOCALONLY=false
 fi
 
-if [ "x$JMXDISABLE" = "x" ] || [ "$JMXDISABLE" = 'false' ]
-then
+if [[ -z $JMXDISABLE ]] || [[ $JMXDISABLE == 'false' ]]; then
   echo "ZooKeeper JMX enabled by default" >&2
-  if [ "x$JMXPORT" = "x" ]
-  then
+  if [[ -z $JMXPORT ]]; then
     # for some reason these two options are necessary on jdk6 on Ubuntu
     #   accord to the docs they are not necessary, but otw jconsole cannot
     #   do a local attach
-    ZOOMAIN="-Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.local.only=$JMXLOCALONLY org.apache.zookeeper.server.quorum.QuorumPeerMain"
+    ZOOMAIN=("-Dcom.sun.management.jmxremote" "-Dcom.sun.management.jmxremote.local.only=$JMXLOCALONLY" "org.apache.zookeeper.server.quorum.QuorumPeerMain")
   else
-    if [ "x$JMXAUTH" = "x" ]
-    then
+    if [[ -z $JMXAUTH ]]; then
       JMXAUTH=false
     fi
-    if [ "x$JMXSSL" = "x" ]
-    then
+    if [[ -z $JMXSSL ]]; then
       JMXSSL=false
     fi
-    if [ "x$JMXLOG4J" = "x" ]
-    then
+    if [[ -z $JMXLOG4J ]]; then
       JMXLOG4J=true
     fi
     echo "ZooKeeper remote JMX Port set to $JMXPORT" >&2
     echo "ZooKeeper remote JMX authenticate set to $JMXAUTH" >&2
     echo "ZooKeeper remote JMX ssl set to $JMXSSL" >&2
     echo "ZooKeeper remote JMX log4j set to $JMXLOG4J" >&2
-    if [ "x$JMXHOSTNAME" = "x" ]
-    then
-      ZOOMAIN="-Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.port=$JMXPORT -Dcom.sun.management.jmxremote.authenticate=$JMXAUTH -Dcom.sun.management.jmxremote.ssl=$JMXSSL -Dzookeeper.jmx.log4j.disable=$JMXLOG4J org.apache.zookeeper.server.quorum.QuorumPeerMain"
+    if [[ -z $JMXHOSTNAME ]]; then
+      ZOOMAIN=("-Dcom.sun.management.jmxremote" "-Dcom.sun.management.jmxremote.port=$JMXPORT" "-Dcom.sun.management.jmxremote.authenticate=$JMXAUTH" "-Dcom.sun.management.jmxremote.ssl=$JMXSSL" "-Dzookeeper.jmx.log4j.disable=$JMXLOG4J" "org.apache.zookeeper.server.quorum.QuorumPeerMain")
     else
       echo "ZooKeeper remote JMX Hostname set to $JMXHOSTNAME" >&2
-      ZOOMAIN="-Dcom.sun.management.jmxremote -Djava.rmi.server.hostname=$JMXHOSTNAME -Dcom.sun.management.jmxremote.port=$JMXPORT -Dcom.sun.management.jmxremote.authenticate=$JMXAUTH -Dcom.sun.management.jmxremote.ssl=$JMXSSL -Dzookeeper.jmx.log4j.disable=$JMXLOG4J org.apache.zookeeper.server.quorum.QuorumPeerMain"
+      ZOOMAIN=("-Dcom.sun.management.jmxremote" "-Djava.rmi.server.hostname=$JMXHOSTNAME" "-Dcom.sun.management.jmxremote.port=$JMXPORT" "-Dcom.sun.management.jmxremote.authenticate=$JMXAUTH" "-Dcom.sun.management.jmxremote.ssl=$JMXSSL" "-Dzookeeper.jmx.log4j.disable=$JMXLOG4J" "org.apache.zookeeper.server.quorum.QuorumPeerMain")
     fi
   fi
 else
-    echo "JMX disabled by user request" >&2
-    ZOOMAIN="org.apache.zookeeper.server.quorum.QuorumPeerMain"
+  echo "JMX disabled by user request" >&2
+  ZOOMAIN=("org.apache.zookeeper.server.quorum.QuorumPeerMain")
 fi
 
-if [ "x$SERVER_JVMFLAGS" != "x" ]
-then
-    JVMFLAGS="$SERVER_JVMFLAGS $JVMFLAGS"
+if [[ -n $SERVER_JVMFLAGS ]]; then
+  JVMFLAGS="$SERVER_JVMFLAGS $JVMFLAGS"
 fi
+# shellcheck disable=SC2206
+flags=($JVMFLAGS)
+# shellcheck disable=SC2206
+clientflags=($CLIENT_JVMFLAGS)
 
-if [ "x$2" != "x" ]
-then
-    ZOOCFG="$ZOOCFGDIR/$2"
+if [[ -n $2 ]]; then
+  ZOOCFG="$ZOOCFGDIR/$2"
 fi
 
 # if we give a more complicated path to the config, don't screw around in $ZOOCFGDIR
-if [ "x$(dirname "$ZOOCFG")" != "x$ZOOCFGDIR" ]
-then
-    ZOOCFG="$2"
+if [[ "$(dirname "$ZOOCFG")" != "$ZOOCFGDIR" ]]; then
+  ZOOCFG="$2"
 fi
 
-if $cygwin
-then
-    ZOOCFG=`cygpath -wp "$ZOOCFG"`
-    # cygwin has a "kill" in the shell itself, gets confused
-    KILL=/bin/kill
+if $cygwin; then
+  ZOOCFG=$(cygpath -wp "$ZOOCFG")
+  # cygwin has a "kill" in the shell itself, gets confused
+  KILL='/bin/kill'
 else
-    KILL=kill
+  KILL='kill'
 fi
 
 echo "Using config: $ZOOCFG" >&2
 
 case "$OSTYPE" in
-*solaris*)
-  GREP=/usr/xpg4/bin/grep
-  ;;
-*)
-  GREP=grep
-  ;;
+  *solaris*)
+    GREP='/usr/xpg4/bin/grep'
+    ;;
+  *)
+    GREP='grep'
+    ;;
 esac
 ZOO_DATADIR="$($GREP "^[[:space:]]*dataDir" "$ZOOCFG" | sed -e 's/.*=//')"
-ZOO_DATADIR="$(echo -e "${ZOO_DATADIR}" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')"
+ZOO_DATADIR="$(echo -e "$ZOO_DATADIR" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')"
 ZOO_DATALOGDIR="$($GREP "^[[:space:]]*dataLogDir" "$ZOOCFG" | sed -e 's/.*=//')"
 
 # iff autocreate is turned off and the datadirs don't exist fail
 # immediately as we can't create the PID file, etc..., anyway.
-if [ -n "$ZOO_DATADIR_AUTOCREATE_DISABLE" ]; then
-    if [ ! -d "$ZOO_DATADIR/version-2" ]; then
-        echo "ZooKeeper data directory is missing at $ZOO_DATADIR fix the path or run initialize"
-        exit 1
-    fi
+if [[ -n $ZOO_DATADIR_AUTOCREATE_DISABLE ]]; then
+  if [[ ! -d "$ZOO_DATADIR/version-2" ]]; then
+    echo "ZooKeeper data directory is missing at $ZOO_DATADIR fix the path or run initialize"
+    exit 1
+  fi
 
-    if [ -n "$ZOO_DATALOGDIR" ] && [ ! -d "$ZOO_DATALOGDIR/version-2" ]; then
-        echo "ZooKeeper txnlog directory is missing at $ZOO_DATALOGDIR fix the path or run initialize"
-        exit 1
-    fi
-    ZOO_DATADIR_AUTOCREATE="-Dzookeeper.datadir.autocreate=false"
+  if [[ -n $ZOO_DATALOGDIR ]] && [[ ! -d "$ZOO_DATALOGDIR/version-2" ]]; then
+    echo "ZooKeeper txnlog directory is missing at $ZOO_DATALOGDIR fix the path or run initialize"
+    exit 1
+  fi
+  flags=("-Dzookeeper.datadir.autocreate=false" "${flags[@]}")
 fi
 
-if [ -z "$ZOOPIDFILE" ]; then
-    if [ ! -d "$ZOO_DATADIR" ]; then
-        mkdir -p "$ZOO_DATADIR"
-    fi
-    ZOOPIDFILE="$ZOO_DATADIR/zookeeper_server.pid"
+if [[ -z $ZOOPIDFILE ]]; then
+  if [[ ! -d $ZOO_DATADIR ]]; then
+    mkdir -p "$ZOO_DATADIR"
+  fi
+  ZOOPIDFILE="$ZOO_DATADIR/zookeeper_server.pid"
 else
-    # ensure it exists, otw stop will fail
-    mkdir -p "$(dirname "$ZOOPIDFILE")"
+  # ensure it exists, otw stop will fail
+  mkdir -p "$(dirname "$ZOOPIDFILE")"
 fi
 
-if [ ! -w "$ZOO_LOG_DIR" ] ; then
-mkdir -p "$ZOO_LOG_DIR"
+if [[ ! -w $ZOO_LOG_DIR ]]; then
+  mkdir -p "$ZOO_LOG_DIR"
 fi
 
-ZOO_LOG_FILE=zookeeper-$USER-server-$HOSTNAME.log
+ZOO_LOG_FILE=${ZOO_LOG_FILE:-zookeeper-$USER-server-$HOSTNAME.log}
 _ZOO_DAEMON_OUT="$ZOO_LOG_DIR/zookeeper-$USER-server-$HOSTNAME.out"
 
 case $1 in
-start)
-    echo  -n "Starting zookeeper ... "
-    if [ -f "$ZOOPIDFILE" ]; then
-      if kill -0 `cat "$ZOOPIDFILE"` > /dev/null 2>&1; then
-         echo $command already running as process `cat "$ZOOPIDFILE"`.
-         exit 1
+  start)
+    echo -n "Starting zookeeper ... "
+    if [[ -f $ZOOPIDFILE ]]; then
+      if kill -0 "$(cat "$ZOOPIDFILE")" &>/dev/null; then
+        echo "already running as process $(cat "$ZOOPIDFILE")."
+        exit 1
       fi
     fi
-    nohup "$JAVA" $ZOO_DATADIR_AUTOCREATE "-Dzookeeper.log.dir=${ZOO_LOG_DIR}" \
-    "-Dzookeeper.log.file=${ZOO_LOG_FILE}" "-Dzookeeper.root.logger=${ZOO_LOG4J_PROP}" \
-    -XX:+HeapDumpOnOutOfMemoryError -XX:OnOutOfMemoryError='kill -9 %p' \
-    -cp "$CLASSPATH" $JVMFLAGS $ZOOMAIN "$ZOOCFG" > "$_ZOO_DAEMON_OUT" 2>&1 < /dev/null &
-    if [ $? -eq 0 ]
-    then
-      case "$OSTYPE" in
+    nohup "$JAVA" "-Dzookeeper.log.dir=$ZOO_LOG_DIR" \
+      "-Dzookeeper.log.file=$ZOO_LOG_FILE" \
+      -XX:+HeapDumpOnOutOfMemoryError -XX:OnOutOfMemoryError='kill -9 %p' \
+      "${flags[@]}" "${ZOOMAIN[@]}" "$ZOOCFG" &>"$_ZOO_DAEMON_OUT" </dev/null &
+    case "$OSTYPE" in
       *solaris*)
-        /bin/echo "${!}\\c" > "$ZOOPIDFILE"
+        /bin/echo "${!}\\c" >"$ZOOPIDFILE"
+        ;;
+      aix*)
+        /bin/echo "$!\c" >"$ZOOPIDFILE"
         ;;
       *)
-        /bin/echo -n $! > "$ZOOPIDFILE"
+        echo -n $! >"$ZOOPIDFILE"
         ;;
-      esac
-      if [ $? -eq 0 ];
-      then
-        sleep 1
-        pid=$(cat "${ZOOPIDFILE}")
-        if ps -p "${pid}" > /dev/null 2>&1; then
-          echo STARTED
-        else
-          echo FAILED TO START
-          exit 1
-        fi
+    esac
+    # this checks the exit code of the echo statements to verify the PID was written
+    # shellcheck disable=SC2320,SC2181
+    if [[ $? -eq 0 ]]; then
+      sleep 1
+      pid=$(cat "$ZOOPIDFILE")
+      if ps -p "$pid" &>/dev/null; then
+        echo STARTED
       else
-        echo FAILED TO WRITE PID
+        echo FAILED TO START
         exit 1
       fi
     else
-      echo SERVER DID NOT START
+      echo FAILED TO WRITE PID
       exit 1
     fi
     ;;
-start-foreground)
+  start-foreground)
     ZOO_CMD=(exec "$JAVA")
-    if [ "${ZOO_NOEXEC}" != "" ]; then
+    if [[ -n $ZOO_NOEXEC ]]; then
       ZOO_CMD=("$JAVA")
     fi
-    "${ZOO_CMD[@]}" $ZOO_DATADIR_AUTOCREATE "-Dzookeeper.log.dir=${ZOO_LOG_DIR}" \
-    "-Dzookeeper.log.file=${ZOO_LOG_FILE}" "-Dzookeeper.root.logger=${ZOO_LOG4J_PROP}" \
-    -XX:+HeapDumpOnOutOfMemoryError -XX:OnOutOfMemoryError='kill -9 %p' \
-    -cp "$CLASSPATH" $JVMFLAGS $ZOOMAIN "$ZOOCFG"
+    "${ZOO_CMD[@]}" "-Dzookeeper.log.dir=$ZOO_LOG_DIR" \
+      "-Dzookeeper.log.file=$ZOO_LOG_FILE" \
+      -XX:+HeapDumpOnOutOfMemoryError -XX:OnOutOfMemoryError='kill -9 %p' \
+      "${flags[@]}" "${ZOOMAIN[@]}" "$ZOOCFG"
+    ;;
+  print-classpath)
+    echo "CLASSPATH=$CLASSPATH"
     ;;
-print-cmd)
-    echo "\"$JAVA\" $ZOO_DATADIR_AUTOCREATE -Dzookeeper.log.dir=\"${ZOO_LOG_DIR}\" \
-    -Dzookeeper.log.file=\"${ZOO_LOG_FILE}\" -Dzookeeper.root.logger=\"${ZOO_LOG4J_PROP}\" \
+  print-cmd)
+    echo "\"$JAVA\" -Dzookeeper.log.dir=\"$ZOO_LOG_DIR\" \
+    -Dzookeeper.log.file=\"$ZOO_LOG_FILE\" \
     -XX:+HeapDumpOnOutOfMemoryError -XX:OnOutOfMemoryError='kill -9 %p' \
-    -cp \"$CLASSPATH\" $JVMFLAGS $ZOOMAIN \"$ZOOCFG\" > \"$_ZOO_DAEMON_OUT\" 2>&1 < /dev/null"
+    $(for x in "${flags[@]}"; do echo "\"$x\""; done | paste -sd' ') \
+    $(for x in "${ZOOMAIN[@]}"; do echo "\"$x\""; done | paste -sd' ') \
+    \"$ZOOCFG\" &>\"$_ZOO_DAEMON_OUT\" </dev/null"
     ;;
-stop)
+  stop)
     echo -n "Stopping zookeeper ... "
-    if [ ! -f "$ZOOPIDFILE" ]
-    then
+    if [[ ! -f $ZOOPIDFILE ]]; then
       echo "no zookeeper to stop (could not find file $ZOOPIDFILE)"
     else
-      $KILL $(cat "$ZOOPIDFILE")
+      $KILL "$(cat "$ZOOPIDFILE")"
       rm "$ZOOPIDFILE"
       sleep 1
       echo STOPPED
     fi
     exit 0
     ;;
-version)
-    ZOOMAIN=org.apache.zookeeper.version.VersionInfoMain
-    $JAVA -cp "$CLASSPATH" $ZOOMAIN 2> /dev/null
+  version)
+    ZOOMAIN=("org.apache.zookeeper.version.VersionInfoMain")
+    $JAVA "${ZOOMAIN[@]}" 2>/dev/null
     ;;
-restart)
+  restart)
     shift
-    "$0" stop ${@}
+    "$0" stop "$@"
     sleep 3
-    "$0" start ${@}
+    "$0" start "$@"
     ;;
-status)
+  status)
     # -q is necessary on some versions of linux where nc returns too quickly, and no stat result is output
-    clientPortAddress=`$GREP "^[[:space:]]*clientPortAddress[^[:alpha:]]" "$ZOOCFG" | sed -e 's/.*=//'`
-    if ! [ $clientPortAddress ]
-    then
-	clientPortAddress="localhost"
+    isSSL="false"
+    clientPortAddress=$($GREP "^[[:space:]]*clientPortAddress[^[:alpha:]]" "$ZOOCFG" | sed -e 's/.*=//')
+    if [[ -z $clientPortAddress ]]; then
+      clientPortAddress="localhost"
     fi
-    clientPort=`$GREP "^[[:space:]]*clientPort[^[:alpha:]]" "$ZOOCFG" | sed -e 's/.*=//'`
-    if ! [[ "$clientPort"  =~ ^[0-9]+$ ]]
-    then
-       dataDir=`$GREP "^[[:space:]]*dataDir" "$ZOOCFG" | sed -e 's/.*=//'`
-       myid=`cat "$dataDir/myid"`
-       if ! [[ "$myid" =~ ^[0-9]+$ ]] ; then
-         echo "clientPort not found and myid could not be determined. Terminating."
-         exit 1
-       fi
-       clientPortAndAddress=`$GREP "^[[:space:]]*server.$myid=.*;.*" "$ZOOCFG" | sed -e 's/.*=//' | sed -e 's/.*;//'`
-       if [ ! "$clientPortAndAddress" ] ; then
-           echo "Client port not found in static config file. Looking in dynamic config file."
-           dynamicConfigFile=`$GREP "^[[:space:]]*dynamicConfigFile" "$ZOOCFG" | sed -e 's/.*=//'`
-           clientPortAndAddress=`$GREP "^[[:space:]]*server.$myid=.*;.*" "$dynamicConfigFile" | sed -e 's/.*=//' | sed -e 's/.*;//'`
-       fi
-       if [ ! "$clientPortAndAddress" ] ; then
-          echo "Client port not found. Terminating."
-          exit 1
-       fi
-       if [[ "$clientPortAndAddress" =~ ^.*:[0-9]+ ]] ; then
-          clientPortAddress=`echo "$clientPortAndAddress" | sed -e 's/:.*//'`
-       fi
-       clientPort=`echo "$clientPortAndAddress" | sed -e 's/.*://'`
-       if [ ! "$clientPort" ] ; then
-          echo "Client port not found. Terminating."
-          exit 1
-       fi
+    clientPort=$($GREP "^[[:space:]]*clientPort[^[:alpha:]]" "$ZOOCFG" | sed -e 's/.*=//')
+    if ! [[ $clientPort =~ ^[0-9]+$ ]]; then
+      dataDir=$($GREP "^[[:space:]]*dataDir" "$ZOOCFG" | sed -e 's/.*=//')
+      myid=$(cat "$dataDir/myid" 2>/dev/null)
+      if ! [[ $myid =~ ^[0-9]+$ ]]; then
+        echo "myid could not be determined, will not able to locate clientPort in the server configs."
+      else
+        clientPortAndAddress=$($GREP "^[[:space:]]*server.$myid=.*;.*" "$ZOOCFG" | sed -e 's/.*=//' | sed -e 's/.*;//')
+        if [[ -z $clientPortAndAddress ]]; then
+          echo "Client port not found in static config file. Looking in dynamic config file."
+          dynamicConfigFile=$($GREP "^[[:space:]]*dynamicConfigFile" "$ZOOCFG" | sed -e 's/.*=//')
+          clientPortAndAddress=$($GREP "^[[:space:]]*server.$myid=.*;.*" "$dynamicConfigFile" | sed -e 's/.*=//' | sed -e 's/.*;//')
+        fi
+        if [[ -z $clientPortAndAddress ]]; then
+          echo "Client port not found in the server configs"
+        else
+          # Extracts address and port from address:port, even if address contains optional square braces
+          # For example, this extracts the address 127::1 and the port 2181 from "[127::1]:2181"
+          if [[ $clientPortAndAddress =~ ^\[?([^\]]*)\]?:([0-9]+) ]]; then
+            clientPortAddress=${BASH_REMATCH[1]}
+            clientPort=${BASH_REMATCH[2]}
+          elif [[ $clientPortAndAddress =~ ^[0-9]+$ ]]; then
+            clientPort=$clientPortAndAddress
+          fi
+        fi
+      fi
     fi
-    echo "Client port found: $clientPort. Client address: $clientPortAddress."
-    STAT=`"$JAVA" "-Dzookeeper.log.dir=${ZOO_LOG_DIR}" "-Dzookeeper.root.logger=${ZOO_LOG4J_PROP}" "-Dzookeeper.log.file=${ZOO_LOG_FILE}" \
-             -cp "$CLASSPATH" $JVMFLAGS org.apache.zookeeper.client.FourLetterWordMain \
-             $clientPortAddress $clientPort srvr 2> /dev/null    \
-          | $GREP Mode`
-    if [ "x$STAT" = "x" ]
-    then
-        echo "Error contacting service. It is probably not running."
+    if [[ -z $clientPort ]]; then
+      echo "Client port not found. Looking for secureClientPort in the static config."
+      secureClientPort=$($GREP "^[[:space:]]*secureClientPort[^[:alpha:]]" "$ZOOCFG" | sed -e 's/.*=//')
+      if [[ -n $secureClientPort ]]; then
+        isSSL="true"
+        clientPort=$secureClientPort
+        clientPortAddress=$($GREP "^[[:space:]]*secureClientPortAddress[^[:alpha:]]" "$ZOOCFG" | sed -e 's/.*=//')
+        if [[ -z $clientPortAddress ]]; then
+          clientPortAddress="localhost"
+        fi
+      else
+        echo "Unable to find either secure or unsecure client port in any configs. Terminating."
         exit 1
+      fi
+    fi
+    echo "Client port found: $clientPort. Client address: $clientPortAddress. Client SSL: $isSSL."
+    STAT=$("$JAVA" "-Dzookeeper.log.dir=$ZOO_LOG_DIR" "-Dzookeeper.log.file=$ZOO_LOG_FILE" \
+      "${clientflags[@]}" "${flags[@]}" org.apache.zookeeper.client.FourLetterWordMain \
+      "$clientPortAddress" "$clientPort" srvr "$isSSL" 2>/dev/null |
+      $GREP Mode)
+    if [[ -z $STAT ]]; then
+      if [[ $isSSL == "true" ]]; then
+        echo " "
+        echo "Note: We used secureClientPort ($secureClientPort) to establish connection, but we failed. The 'status'"
+        echo "  command establishes a client connection to the server to execute diagnostic commands. Please make sure you"
+        echo "  provided all the Client SSL connection related parameters in the CLIENT_JVMFLAGS environment variable! E.g.:"
+        echo '  CLIENT_JVMFLAGS="-Dzookeeper.clientCnxnSocket=org.apache.zookeeper.ClientCnxnSocketNetty'
+        echo "  -Dzookeeper.ssl.trustStore.location=/tmp/clienttrust.jks -Dzookeeper.ssl.trustStore.password=password"
+        echo "  -Dzookeeper.ssl.keyStore.location=/tmp/client.jks -Dzookeeper.ssl.keyStore.password=password"
+        echo '  -Dzookeeper.client.secure=true" ./zkServer.sh status'
+        echo " "
+      fi
+      echo "Error contacting service. It is probably not running."
+      exit 1
     else
-        echo $STAT
-        exit 0
+      echo "$STAT"
+      exit 0
     fi
     ;;
-*)
+  *)
     echo "Usage: $0 [--config <conf-dir>] {start|start-foreground|stop|version|restart|status|print-cmd}" >&2
+    ;;
 
 esac
diff --git a/bin/zkSnapShotToolkit.sh b/bin/zkSnapShotToolkit.sh
index 1664d596f37..dd256c366f3 100755
--- a/bin/zkSnapShotToolkit.sh
+++ b/bin/zkSnapShotToolkit.sh
@@ -1,19 +1,22 @@
-#!/usr/bin/env bash
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
 
 #
 # If this scripted is run out of /usr/bin or some other system bin directory
@@ -23,16 +26,18 @@
 
 # use POSIX interface, symlink is followed automatically
 ZOOBIN="${BASH_SOURCE-$0}"
-ZOOBIN="$(dirname "${ZOOBIN}")"
-ZOOBINDIR="$(cd "${ZOOBIN}"; pwd)"
+ZOOBIN="$(dirname "$ZOOBIN")"
+ZOOBINDIR="$(cd "$ZOOBIN" && pwd)"
 
-if [ -e "$ZOOBIN/../libexec/zkEnv.sh" ]; then
+if [[ -e "$ZOOBIN/../libexec/zkEnv.sh" ]]; then
+  # shellcheck source=bin/zkEnv.sh
   . "$ZOOBINDIR"/../libexec/zkEnv.sh
 else
+  # shellcheck source=bin/zkEnv.sh
   . "$ZOOBINDIR"/zkEnv.sh
 fi
 
-"$JAVA" -cp "$CLASSPATH" $JVMFLAGS \
-     org.apache.zookeeper.server.SnapshotFormatter "$@"
-
-
+# shellcheck disable=SC2206
+flags=($JVMFLAGS)
+"$JAVA" "${flags[@]}" \
+  org.apache.zookeeper.server.SnapshotFormatter "$@"
diff --git a/bin/zkSnapshotComparer.sh b/bin/zkSnapshotComparer.sh
index b284c902d39..0167fdb116a 100755
--- a/bin/zkSnapshotComparer.sh
+++ b/bin/zkSnapshotComparer.sh
@@ -1,19 +1,22 @@
-#!/usr/bin/env bash
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
 
 #
 # If this scripted is run out of /usr/bin or some other system bin directory
@@ -23,14 +26,18 @@
 
 # use POSIX interface, symlink is followed automatically
 ZOOBIN="${BASH_SOURCE-$0}"
-ZOOBIN="$(dirname "${ZOOBIN}")"
-ZOOBINDIR="$(cd "${ZOOBIN}"; pwd)"
+ZOOBIN="$(dirname "$ZOOBIN")"
+ZOOBINDIR="$(cd "$ZOOBIN" && pwd)"
 
-if [ -e "$ZOOBIN/../libexec/zkEnv.sh" ]; then
+if [[ -e "$ZOOBIN/../libexec/zkEnv.sh" ]]; then
+  # shellcheck source=bin/zkEnv.sh
   . "$ZOOBINDIR"/../libexec/zkEnv.sh
 else
+  # shellcheck source=bin/zkEnv.sh
   . "$ZOOBINDIR"/zkEnv.sh
 fi
 
-"$JAVA" -cp "$CLASSPATH" $JVMFLAGS \
-     org.apache.zookeeper.server.SnapshotComparer "$@"
+# shellcheck disable=SC2206
+flags=($JVMFLAGS)
+"$JAVA" "${flags[@]}" \
+  org.apache.zookeeper.server.SnapshotComparer "$@"
diff --git a/bin/zkSnapshotRecursiveSummaryToolkit.cmd b/bin/zkSnapshotRecursiveSummaryToolkit.cmd
new file mode 100755
index 00000000000..ee893108e6b
--- /dev/null
+++ b/bin/zkSnapshotRecursiveSummaryToolkit.cmd
@@ -0,0 +1,24 @@
+@echo off
+REM Licensed to the Apache Software Foundation (ASF) under one or more
+REM contributor license agreements.  See the NOTICE file distributed with
+REM this work for additional information regarding copyright ownership.
+REM The ASF licenses this file to You under the Apache License, Version 2.0
+REM (the "License"); you may not use this file except in compliance with
+REM the License.  You may obtain a copy of the License at
+REM
+REM     http://www.apache.org/licenses/LICENSE-2.0
+REM
+REM Unless required by applicable law or agreed to in writing, software
+REM distributed under the License is distributed on an "AS IS" BASIS,
+REM WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+REM See the License for the specific language governing permissions and
+REM limitations under the License.
+
+setlocal
+call "%~dp0zkEnv.cmd"
+
+set ZOOMAIN=org.apache.zookeeper.server.SnapshotRecursiveSummary
+call %JAVA% -cp "%CLASSPATH%" %ZOOMAIN% %*
+
+endlocal
+
diff --git a/bin/zkSnapshotRecursiveSummaryToolkit.sh b/bin/zkSnapshotRecursiveSummaryToolkit.sh
new file mode 100755
index 00000000000..8b5ee45aab2
--- /dev/null
+++ b/bin/zkSnapshotRecursiveSummaryToolkit.sh
@@ -0,0 +1,43 @@
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+#
+# If this scripted is run out of /usr/bin or some other system bin directory
+# it should be linked to and not copied. Things like java jar files are found
+# relative to the canonical path of this script.
+#
+
+# use POSIX interface, symlink is followed automatically
+ZOOBIN="${BASH_SOURCE-$0}"
+ZOOBIN="$(dirname "$ZOOBIN")"
+ZOOBINDIR="$(cd "$ZOOBIN" && pwd)"
+
+if [[ -e "$ZOOBIN/../libexec/zkEnv.sh" ]]; then
+  # shellcheck source=bin/zkEnv.sh
+  . "$ZOOBINDIR"/../libexec/zkEnv.sh
+else
+  # shellcheck source=bin/zkEnv.sh
+  . "$ZOOBINDIR"/zkEnv.sh
+fi
+
+# shellcheck disable=SC2206
+flags=($JVMFLAGS)
+"$JAVA" "${flags[@]}" \
+  org.apache.zookeeper.server.SnapshotRecursiveSummary "$@"
diff --git a/bin/zkTxnLogToolkit.sh b/bin/zkTxnLogToolkit.sh
index 8beed20ddd7..0381ffa0227 100755
--- a/bin/zkTxnLogToolkit.sh
+++ b/bin/zkTxnLogToolkit.sh
@@ -1,19 +1,22 @@
-#!/usr/bin/env bash
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
 
 #
 # If this scripted is run out of /usr/bin or some other system bin directory
@@ -23,16 +26,18 @@
 
 # use POSIX interface, symlink is followed automatically
 ZOOBIN="${BASH_SOURCE-$0}"
-ZOOBIN="$(dirname "${ZOOBIN}")"
-ZOOBINDIR="$(cd "${ZOOBIN}"; pwd)"
+ZOOBIN="$(dirname "$ZOOBIN")"
+ZOOBINDIR="$(cd "$ZOOBIN" && pwd)"
 
-if [ -e "$ZOOBIN/../libexec/zkEnv.sh" ]; then
+if [[ -e "$ZOOBIN/../libexec/zkEnv.sh" ]]; then
+  # shellcheck source=bin/zkEnv.sh
   . "$ZOOBINDIR"/../libexec/zkEnv.sh
 else
+  # shellcheck source=bin/zkEnv.sh
   . "$ZOOBINDIR"/zkEnv.sh
 fi
 
-"$JAVA" -cp "$CLASSPATH" $JVMFLAGS \
-     org.apache.zookeeper.server.persistence.TxnLogToolkit "$@"
-
-
+# shellcheck disable=SC2206
+flags=($JVMFLAGS)
+"$JAVA" "${flags[@]}" \
+  org.apache.zookeeper.server.persistence.TxnLogToolkit "$@"
diff --git a/checkstyle-simple.xml b/checkstyle-simple.xml
index 204937026a8..004cd68e417 100644
--- a/checkstyle-simple.xml
+++ b/checkstyle-simple.xml
@@ -16,8 +16,8 @@
     limitations under the License.
 -->
 <!DOCTYPE module PUBLIC
-        "-//Puppy Crawl//DTD Check Configuration 1.3//EN"
-        "http://www.puppycrawl.com/dtds/configuration_1_3.dtd">
+        "-//Checkstyle//DTD Checkstyle Configuration 1.3//EN"
+        "https://checkstyle.org/dtds/configuration_1_3.dtd">
 
 <!-- This is a checkstyle configuration file. For descriptions of
 what the following rules do, please see the checkstyle configuration
diff --git a/checkstyle-strict.xml b/checkstyle-strict.xml
index f4fa57ea8d9..4f2d55b103f 100644
--- a/checkstyle-strict.xml
+++ b/checkstyle-strict.xml
@@ -16,12 +16,12 @@
     limitations under the License.
 -->
 <!DOCTYPE module PUBLIC
-        "-//Puppy Crawl//DTD Check Configuration 1.3//EN"
-        "http://www.puppycrawl.com/dtds/configuration_1_3.dtd">
+        "-//Checkstyle//DTD Checkstyle Configuration 1.3//EN"
+        "https://checkstyle.org/dtds/configuration_1_3.dtd">
 
 <!-- This is a checkstyle configuration file. For descriptions of
 what the following rules do, please see the checkstyle configuration
-page at http://checkstyle.sourceforge.net/config.html -->
+page at https://checkstyle.sourceforge.io/config.html -->
 
 <module name="Checker">
 
@@ -140,16 +140,12 @@ page at http://checkstyle.sourceforge.net/config.html -->
         -->
 
         <!-- Checks for Javadoc comments.                     -->
-        <!-- See http://checkstyle.sf.net/config_javadoc.html -->
+        <!-- See https://checkstyle.sourceforge.io/config_javadoc.html -->
         <module name="JavadocMethod">
             <property name="scope" value="protected"/>
             <property name="severity" value="error"/>
-            <property name="allowMissingJavadoc" value="true"/>
             <property name="allowMissingParamTags" value="true"/>
             <property name="allowMissingReturnTag" value="true"/>
-            <property name="allowMissingThrowsTags" value="true"/>
-            <property name="allowThrowsTagsForSubclasses" value="true"/>
-            <property name="allowUndeclaredRTE" value="true"/>
         </module>
 
         <!-- Check that paragraph tags are used correctly in Javadoc. -->
@@ -271,27 +267,6 @@ page at http://checkstyle.sourceforge.net/config.html -->
             <property name="severity" value="error"/>
         </module>
 
-        <!--
-
-        LENGTH and CODING CHECKS
-
-        -->
-
-        <module name="LineLength">
-            <!-- Checks if a line is too long. -->
-            <property name="max" value="120"/>
-            <property name="severity" value="error"/>
-
-            <!--
-              The default ignore pattern exempts the following elements:
-                - import statements
-                - long URLs inside comments
-            -->
-
-            <property name="ignorePattern"
-                      value="^(package .*;\s*)|(import .*;\s*)|( *\* .*https?://.*)$"/>
-        </module>
-
         <module name="LeftCurly">
             <!-- Checks for placement of the left curly brace ('{'). -->
             <property name="severity" value="error"/>
@@ -433,4 +408,25 @@ page at http://checkstyle.sourceforge.net/config.html -->
         </module>
 
     </module>
-</module>
\ No newline at end of file
+
+    <!--
+
+    LENGTH and CODING CHECKS
+
+    -->
+
+    <module name="LineLength">
+        <!-- Checks if a line is too long. -->
+        <property name="max" value="120"/>
+        <property name="severity" value="error"/>
+
+        <!--
+          The default ignore pattern exempts the following elements:
+            - import statements
+            - long URLs inside comments
+        -->
+
+        <property name="ignorePattern"
+                  value="^(package .*;\s*)|(import .*;\s*)|( *\* .*https?://.*)$"/>
+    </module>
+</module>
diff --git a/checkstyleSuppressions.xml b/checkstyleSuppressions.xml
index 53d92eb5bda..513de6b4d80 100644
--- a/checkstyleSuppressions.xml
+++ b/checkstyleSuppressions.xml
@@ -13,9 +13,8 @@
   limitations under the License. See accompanying LICENSE file.
 -->
 <!DOCTYPE suppressions PUBLIC
-        "-//Puppy Crawl//DTD Suppressions 1.1//EN"
-        "http://www.puppycrawl.com/dtds/suppressions_1_1.dtd">
-
+        "-//Checkstyle//DTD SuppressionFilter Configuration 1.0//EN"
+        "https://checkstyle.org/dtds/suppressions_1_0.dtd">
 <suppressions>
     <!-- suppress all checks in the generated directories -->
     <suppress checks=".*" files=".+[\\/]classes[\\/].+\.java" />
diff --git a/conf/log4j.properties b/conf/log4j.properties
deleted file mode 100644
index 9e12a38d333..00000000000
--- a/conf/log4j.properties
+++ /dev/null
@@ -1,82 +0,0 @@
-# Copyright 2012 The Apache Software Foundation
-# 
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Define some default values that can be overridden by system properties
-zookeeper.root.logger=INFO, CONSOLE
-
-zookeeper.console.threshold=INFO
-
-zookeeper.log.dir=.
-zookeeper.log.file=zookeeper.log
-zookeeper.log.threshold=INFO
-zookeeper.log.maxfilesize=256MB
-zookeeper.log.maxbackupindex=20
-
-zookeeper.tracelog.dir=${zookeeper.log.dir}
-zookeeper.tracelog.file=zookeeper_trace.log
-
-log4j.rootLogger=${zookeeper.root.logger}
-
-#
-# console
-# Add "console" to rootlogger above if you want to use this 
-#
-log4j.appender.CONSOLE=org.apache.log4j.ConsoleAppender
-log4j.appender.CONSOLE.Threshold=${zookeeper.console.threshold}
-log4j.appender.CONSOLE.layout=org.apache.log4j.PatternLayout
-log4j.appender.CONSOLE.layout.ConversionPattern=%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L] - %m%n
-
-#
-# Add ROLLINGFILE to rootLogger to get log file output
-#
-log4j.appender.ROLLINGFILE=org.apache.log4j.RollingFileAppender
-log4j.appender.ROLLINGFILE.Threshold=${zookeeper.log.threshold}
-log4j.appender.ROLLINGFILE.File=${zookeeper.log.dir}/${zookeeper.log.file}
-log4j.appender.ROLLINGFILE.MaxFileSize=${zookeeper.log.maxfilesize}
-log4j.appender.ROLLINGFILE.MaxBackupIndex=${zookeeper.log.maxbackupindex}
-log4j.appender.ROLLINGFILE.layout=org.apache.log4j.PatternLayout
-log4j.appender.ROLLINGFILE.layout.ConversionPattern=%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L] - %m%n
-
-#
-# Add TRACEFILE to rootLogger to get log file output
-#    Log TRACE level and above messages to a log file
-#
-log4j.appender.TRACEFILE=org.apache.log4j.FileAppender
-log4j.appender.TRACEFILE.Threshold=TRACE
-log4j.appender.TRACEFILE.File=${zookeeper.tracelog.dir}/${zookeeper.tracelog.file}
-
-log4j.appender.TRACEFILE.layout=org.apache.log4j.PatternLayout
-### Notice we are including log4j's NDC here (%x)
-log4j.appender.TRACEFILE.layout.ConversionPattern=%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L][%x] - %m%n
-#
-# zk audit logging
-#
-zookeeper.auditlog.file=zookeeper_audit.log
-zookeeper.auditlog.threshold=INFO
-audit.logger=INFO, RFAAUDIT
-log4j.logger.org.apache.zookeeper.audit.Log4jAuditLogger=${audit.logger}
-log4j.additivity.org.apache.zookeeper.audit.Log4jAuditLogger=false
-log4j.appender.RFAAUDIT=org.apache.log4j.RollingFileAppender
-log4j.appender.RFAAUDIT.File=${zookeeper.log.dir}/${zookeeper.auditlog.file}
-log4j.appender.RFAAUDIT.layout=org.apache.log4j.PatternLayout
-log4j.appender.RFAAUDIT.layout.ConversionPattern=%d{ISO8601} %p %c{2}: %m%n
-log4j.appender.RFAAUDIT.Threshold=${zookeeper.auditlog.threshold}
-
-# Max log file size of 10MB
-log4j.appender.RFAAUDIT.MaxFileSize=10MB
-log4j.appender.RFAAUDIT.MaxBackupIndex=10
diff --git a/conf/logback.xml b/conf/logback.xml
new file mode 100644
index 00000000000..84a53896954
--- /dev/null
+++ b/conf/logback.xml
@@ -0,0 +1,114 @@
+<!--
+ Copyright 2022 The Apache Software Foundation
+
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements.  See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership.  The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+ Define some default values that can be overridden by system properties
+-->
+<configuration>
+  <!-- Uncomment this if you would like to expose Logback JMX beans -->
+  <!--jmxConfigurator /-->
+
+  <property name="zookeeper.console.threshold" value="INFO" />
+
+  <property name="zookeeper.log.dir" value="." />
+  <property name="zookeeper.log.file" value="zookeeper.log" />
+  <property name="zookeeper.log.threshold" value="INFO" />
+  <property name="zookeeper.log.maxfilesize" value="256MB" />
+  <property name="zookeeper.log.maxbackupindex" value="20" />
+
+  <!--
+    console
+    Add "console" to root logger if you want to use this
+  -->
+  <appender name="CONSOLE" class="ch.qos.logback.core.ConsoleAppender">
+    <encoder>
+      <pattern>%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L] - %m%n</pattern>
+    </encoder>
+    <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
+      <level>${zookeeper.console.threshold}</level>
+    </filter>
+  </appender>
+
+  <!--
+    Add ROLLINGFILE to root logger to get log file output
+  -->
+  <!--appender name="ROLLINGFILE" class="ch.qos.logback.core.rolling.RollingFileAppender">
+    <File>${zookeeper.log.dir}/${zookeeper.log.file}</File>
+    <encoder>
+      <pattern>%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L] - %m%n</pattern>
+    </encoder>
+    <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
+      <level>${zookeeper.log.threshold}</level>
+    </filter>
+    <rollingPolicy class="ch.qos.logback.core.rolling.FixedWindowRollingPolicy">
+      <maxIndex>${zookeeper.log.maxbackupindex}</maxIndex>
+      <FileNamePattern>${zookeeper.log.dir}/${zookeeper.log.file}.%i</FileNamePattern>
+    </rollingPolicy>
+    <triggeringPolicy class="ch.qos.logback.core.rolling.SizeBasedTriggeringPolicy">
+      <MaxFileSize>${zookeeper.log.maxfilesize}</MaxFileSize>
+    </triggeringPolicy>
+  </appender-->
+
+  <!--
+    Add TRACEFILE to root logger to get log file output
+    Log TRACE level and above messages to a log file
+  -->
+  <!--property name="zookeeper.tracelog.dir" value="${zookeeper.log.dir}" />
+  <property name="zookeeper.tracelog.file" value="zookeeper_trace.log" />
+  <appender name="TRACEFILE" class="ch.qos.logback.core.FileAppender">
+    <File>${zookeeper.tracelog.dir}/${zookeeper.tracelog.file}</File>
+    <encoder>
+      <pattern>%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L] - %m%n</pattern>
+    </encoder>
+    <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
+      <level>TRACE</level>
+    </filter>
+  </appender-->
+
+  <!--
+    zk audit logging
+  -->
+  <!--property name="zookeeper.auditlog.file" value="zookeeper_audit.log" />
+  <property name="zookeeper.auditlog.threshold" value="INFO" />
+  <property name="audit.logger" value="INFO, RFAAUDIT" />
+
+  <appender name="RFAAUDIT" class="ch.qos.logback.core.rolling.RollingFileAppender">
+    <File>${zookeeper.log.dir}/${zookeeper.auditlog.file}</File>
+    <encoder>
+      <pattern>%d{ISO8601} %p %c{2}: %m%n</pattern>
+    </encoder>
+    <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
+      <level>${zookeeper.auditlog.threshold}</level>
+    </filter>
+    <rollingPolicy class="ch.qos.logback.core.rolling.FixedWindowRollingPolicy">
+      <maxIndex>10</maxIndex>
+      <FileNamePattern>${zookeeper.log.dir}/${zookeeper.auditlog.file}.%i</FileNamePattern>
+    </rollingPolicy>
+    <triggeringPolicy class="ch.qos.logback.core.rolling.SizeBasedTriggeringPolicy">
+      <MaxFileSize>10MB</MaxFileSize>
+    </triggeringPolicy>
+  </appender>
+
+  <logger name="org.apache.zookeeper.audit.Slf4jAuditLogger" additivity="false" level="${audit.logger}">
+    <appender-ref ref="RFAAUDIT" />
+  </logger-->
+
+  <root level="INFO">
+    <appender-ref ref="CONSOLE" />
+  </root>
+</configuration>
diff --git a/conf/zoo_sample.cfg b/conf/zoo_sample.cfg
index 24a97d720c8..d0db6e99a1d 100644
--- a/conf/zoo_sample.cfg
+++ b/conf/zoo_sample.cfg
@@ -19,7 +19,7 @@ clientPort=2181
 # Be sure to read the maintenance section of the 
 # administrator guide before turning on autopurge.
 #
-# http://zookeeper.apache.org/doc/current/zookeeperAdmin.html#sc_maintenance
+# https://zookeeper.apache.org/doc/current/zookeeperAdmin.html#sc_maintenance
 #
 # The number of snapshots to retain in dataDir
 #autopurge.snapRetainCount=3
@@ -31,6 +31,7 @@ clientPort=2181
 #
 # https://prometheus.io Metrics Exporter
 #metricsProvider.className=org.apache.zookeeper.metrics.prometheus.PrometheusMetricsProvider
+#metricsProvider.httpHost=0.0.0.0
 #metricsProvider.httpPort=7000
 #metricsProvider.exportJvmInfo=true
 
diff --git a/dev/docker/Dockerfile b/dev/docker/Dockerfile
index 8d148ee0bef..4d8a5d08dd1 100644
--- a/dev/docker/Dockerfile
+++ b/dev/docker/Dockerfile
@@ -17,7 +17,18 @@
 # under the License.
 #
 
-FROM maven:3.6.3-jdk-8
+FROM maven:3.8.4-jdk-11
 
 RUN apt-get update
-RUN apt-get install -y g++ cmake autoconf libcppunit-dev libtool openssl libssl-dev libsasl2-modules-gssapi-mit libsasl2-modules libsasl2-dev
+RUN apt-get install -y \
+  g++ \
+  cmake \
+  autoconf \
+  pkg-config \
+  libcppunit-dev \
+  libtool \
+  openssl \
+  libssl-dev \
+  libsasl2-modules-gssapi-mit \
+  libsasl2-modules \
+  libsasl2-dev
diff --git a/dev/docker/run.sh b/dev/docker/run.sh
index 901131046ff..10c40c5ff8e 100755
--- a/dev/docker/run.sh
+++ b/dev/docker/run.sh
@@ -1,52 +1,55 @@
-#!/bin/bash
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
 
 set -e -x -u
 
-SCRIPT_DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
+SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 
 export IMAGE_NAME="zookeeper/dev"
 
-pushd ${SCRIPT_DIR}
+pushd "$SCRIPT_DIR"
 
-docker build --rm=true -t ${IMAGE_NAME} .
+docker build --rm=true -t "$IMAGE_NAME" .
 
 popd
 
-if [ "$(uname -s)" == "Linux" ]; then
+if [[ "$(uname -s)" == "Linux" ]]; then
   USER_NAME=${SUDO_USER:=$USER}
-  USER_ID=$(id -u "${USER_NAME}")
-  GROUP_ID=$(id -g "${USER_NAME}")
+  USER_ID=$(id -u "$USER_NAME")
+  GROUP_ID=$(id -g "$USER_NAME")
   LOCAL_HOME=$(realpath ~)
 else # boot2docker uid and gid
   USER_NAME=$USER
   USER_ID=1000
   GROUP_ID=50
-  LOCAL_HOME="/Users/${USER_NAME}"
+  LOCAL_HOME="/Users/$USER_NAME"
 fi
 
-docker build -t "${IMAGE_NAME}-${USER_NAME}" - <<UserSpecificDocker
-FROM ${IMAGE_NAME}
-RUN groupadd --non-unique -g ${GROUP_ID} ${USER_NAME} && \
-  useradd -g ${GROUP_ID} -u ${USER_ID} -k /root -m ${USER_NAME}
-ENV  HOME /home/${USER_NAME}
+docker build -t "$IMAGE_NAME-$USER_NAME" - <<UserSpecificDocker
+FROM $IMAGE_NAME
+RUN groupadd --non-unique -g $GROUP_ID $USER_NAME && \
+  useradd -g $GROUP_ID -u $USER_ID -k /root -m $USER_NAME
+ENV  HOME /home/$USER_NAME
 UserSpecificDocker
 
-ZOOKEEPER_ROOT=${SCRIPT_DIR}/../..
+ZOOKEEPER_ROOT="$SCRIPT_DIR/../.."
 
 CMD="
 echo
@@ -57,16 +60,15 @@ echo
 bash
 "
 
-pushd ${ZOOKEEPER_ROOT}
+pushd "$ZOOKEEPER_ROOT"
 
 docker run -i -t \
   --rm=true \
-  -w ${ZOOKEEPER_ROOT} \
-  -u "${USER}" \
-  -v "$(realpath $ZOOKEEPER_ROOT):${ZOOKEEPER_ROOT}" \
-  -v "${LOCAL_HOME}:/home/${USER_NAME}" \
-  ${IMAGE_NAME}-${USER_NAME} \
-  bash -c "${CMD}"
+  -w "$ZOOKEEPER_ROOT" \
+  -u "$USER" \
+  -v "$(realpath "$ZOOKEEPER_ROOT"):$ZOOKEEPER_ROOT" \
+  -v "$LOCAL_HOME:/home/$USER_NAME" \
+  "$IMAGE_NAME-$USER_NAME" \
+  bash -c "$CMD"
 
 popd
-
diff --git a/owaspSuppressions.xml b/owaspSuppressions.xml
index ae94db494b9..2db9d7c1515 100644
--- a/owaspSuppressions.xml
+++ b/owaspSuppressions.xml
@@ -18,10 +18,31 @@
 -->
 
 <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.2.xsd">
+   <suppress>
+      <!--
+         We have updated jetty[1] to 9.4.57.v20241219[2] which includes a fix[3] for CVE-2024-6763[4].
+         But it is not listed as fixed version since 9.x is EOL[5]. So we still have to suppress this
+         to pass vulnerabilities check. Besides above, ZooKeeper does not use HttpURI[6] thus should
+         not be affected by this CVE anyway.
+
+         Refs:
+         [1]: https://github.com/apache/zookeeper/pull/2220
+         [2]: https://github.com/jetty/jetty.project/releases/tag/jetty-9.4.57.v20241219
+         [3]: https://github.com/jetty/jetty.project/pull/12532
+         [4]: https://github.com/advisories/GHSA-qh8g-58pp-2wxh
+         [5]: https://gitlab.eclipse.org/security/cve-assignement/-/issues/25#note_2968611
+         [6]: https://issues.apache.org/jira/browse/ZOOKEEPER-4876
+      -->
+      <cve>CVE-2024-6763</cve>
+   </suppress>
    <suppress>
       <!-- ZOOKEEPER-3217 -->
       <cve>CVE-2018-8088</cve>
    </suppress>
+   <suppress>
+      <!-- ZOOKEEPER-4660 -->
+      <cve>CVE-2021-37533</cve>
+   </suppress>
    <suppress>
       <!-- ZOOKEEPER-3262 -->
       <cve>CVE-2018-8012</cve>
@@ -34,16 +55,38 @@
       <!-- https://github.com/jeremylong/DependencyCheck/issues/1653
            False positive on Netty 4.x-->
       <cve>CVE-2018-12056</cve>
+      <!-- ZOOKEEPER-4755: looks like a real vulnerability in Netty,
+           but no report or patch has been published so far.  This has
+           to be monitored and will probably have to be remediated.
+
+           https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4586
+      -->
+      <cve>CVE-2023-4586</cve>
    </suppress>
    <suppress>
       <!-- Seems like false positive - we are not using Prometheus
-           2.x, rather the client which lastest is 0.6. at the time of
+           2.x, rather the client which latest is 0.6. at the time of
            this writing  -->
       <cve>CVE-2019-3826</cve>
    </suppress>
+
+ 
+   <suppress>
+      <!-- Seems like false positives about zookeeper-jute -->
+      <cve>CVE-2021-29425</cve>
+      <cve>CVE-2021-28164</cve>
+      <cve>CVE-2021-34429</cve>
+   </suppress>
+
    <suppress>
-      <!-- false positive for us, it is about log4j server in log4j-1.2.17.jar
-           ZOOKEEPER-3677 -->
-      <cve>CVE-2019-17571</cve>
+      <!-- ZOOKEEPER-4716: jackson related false positives -->
+
+      <!-- according to jackson community, this is not a security issue,
+           see: https://github.com/FasterXML/jackson-databind/issues/3972#issuecomment-1596193098 -->
+      <cve>CVE-2023-35116</cve>
+
+      <!-- the following CVE is not even jackson related, but a vulnerability
+           in json-java which we don't use in ZooKeeper -->
+      <cve>CVE-2022-45688</cve>
    </suppress>
 </suppressions>
diff --git a/pom.xml b/pom.xml
old mode 100755
new mode 100644
index 041b41571f8..2811e0dfa06
--- a/pom.xml
+++ b/pom.xml
@@ -30,8 +30,8 @@
   <groupId>org.apache.zookeeper</groupId>
   <artifactId>parent</artifactId>
   <packaging>pom</packaging>
-  <!-- to change version: mvn -\-batch-mode release:update-versions -DdevelopmentVersion=3.6.0-SNAPSHOT -->
-  <version>3.7.0-SNAPSHOT</version>
+  <!-- to change version: mvn -B release:update-versions -DdevelopmentVersion=3.6.0-SNAPSHOT -->
+  <version>3.10.0-SNAPSHOT</version>
   <name>Apache ZooKeeper</name>
   <description>
     ZooKeeper is a centralized service for maintaining configuration information, naming,
@@ -64,6 +64,7 @@
     <module>zookeeper-client</module>
     <module>zookeeper-recipes</module>
     <module>zookeeper-assembly</module>
+    <module>zookeeper-compatibility-tests</module>
   </modules>
 
   <scm>
@@ -78,7 +79,7 @@
   </issueManagement>
   <ciManagement>
     <system>jenkins</system>
-    <url>https://builds.apache.org/view/S-Z/view/ZooKeeper/</url>
+    <url>https://ci-hadoop.apache.org/view/ZooKeeper/</url>
   </ciManagement>
   <mailingLists>
     <mailingList>
@@ -117,7 +118,7 @@
   <developers>
     <developer>
       <id>tdunning</id>
-      <name>Ted Dunning	</name>
+      <name>Ted Dunning</name>
       <email>tdunning@apache.org</email>
       <timezone>-8</timezone>
     </developer>
@@ -252,6 +253,36 @@
         <email>eolivelli@apache.org</email>
         <timezone>+1</timezone>
     </developer>
+    <developer>
+      <id>nkalmar</id>
+      <name>Norbert Kalmar</name>
+      <email>nkalmar@apache.org</email>
+      <timezone>+1</timezone>
+    </developer>
+    <developer>
+      <id>enixon</id>
+      <name>Brian Nixon</name>
+      <email>enixon@apache.org</email>
+      <timezone>-8</timezone>
+    </developer>
+    <developer>
+      <id>symat</id>
+      <name>Mate Szalay-Beko</name>
+      <email>symat@apache.org</email>
+      <timezone>+1</timezone>
+    </developer>
+    <developer>
+      <id>ddiederen</id>
+      <name>Damien Diederen</name>
+      <email>ddiederen@apache.org</email>
+      <timezone>Europe/Berlin</timezone>
+    </developer>
+    <developer>
+      <id>maoling</id>
+      <name>Ling Mao</name>
+      <email>maoling@apache.org</email>
+      <timezone>+8</timezone>
+    </developer>
   </developers>
 
   <profiles>
@@ -259,13 +290,18 @@
       <id>full-build</id>
       <modules>
         <module>zookeeper-contrib</module>
+        <!-- zookeeper-it needed by fatjar contrib -->
+        <module>zookeeper-it</module>
       </modules>
     </profile>
     <profile>
-      <id>java-build</id>
-      <activation>
-        <activeByDefault>true</activeByDefault>
-      </activation>
+      <!-- fatjar only profile; zookeeper-contrib will activate the fatjar in its pom -->
+      <id>fatjar</id>
+      <modules>
+        <module>zookeeper-contrib</module>
+        <!-- zookeeper-it needed by fatjar contrib -->
+        <module>zookeeper-it</module>
+      </modules>
     </profile>
     <profile>
         <id>apache-release</id>
@@ -317,6 +353,88 @@
       <properties>
         <maven.compiler.release>8</maven.compiler.release>
       </properties>
+      <build>
+        <pluginManagement>
+          <plugins>
+            <plugin>
+              <groupId>org.eclipse.m2e</groupId>
+              <artifactId>lifecycle-mapping</artifactId>
+              <version>1.0.0</version>
+              <configuration>
+                <lifecycleMappingMetadata>
+                  <pluginExecutions>
+                    <pluginExecution>
+                      <pluginExecutionFilter>
+                        <groupId>org.codehaus.mojo</groupId>
+                        <artifactId>exec-maven-plugin</artifactId>
+                        <versionRange>[0,)</versionRange>
+                        <goals>
+                          <goal>exec</goal>
+                        </goals>
+                      </pluginExecutionFilter>
+                      <action>
+                        <ignore />
+                      </action>
+                    </pluginExecution>
+                    <pluginExecution>
+                      <pluginExecutionFilter>
+                        <groupId>org.apache.maven.plugins</groupId>
+                        <artifactId>maven-antrun-plugin</artifactId>
+                        <versionRange>[0,)</versionRange>
+                        <goals>
+                          <goal>run</goal>
+                        </goals>
+                      </pluginExecutionFilter>
+                      <action>
+                        <ignore />
+                      </action>
+                    </pluginExecution>
+                    <pluginExecution>
+                      <pluginExecutionFilter>
+                        <groupId>com.ruleoftech</groupId>
+                        <artifactId>markdown-page-generator-plugin</artifactId>
+                        <versionRange>[0,)</versionRange>
+                        <goals>
+                          <goal>generate</goal>
+                        </goals>
+                      </pluginExecutionFilter>
+                      <action>
+                        <ignore />
+                      </action>
+                    </pluginExecution>
+                    <pluginExecution>
+                      <pluginExecutionFilter>
+                        <groupId>org.codehaus.mojo</groupId>
+                        <artifactId>javacc-maven-plugin</artifactId>
+                        <versionRange>[0,)</versionRange>
+                        <goals>
+                          <goal>javacc</goal>
+                        </goals>
+                      </pluginExecutionFilter>
+                      <action>
+                        <ignore />
+                      </action>
+                    </pluginExecution>
+                    <pluginExecution>
+                      <pluginExecutionFilter>
+                        <groupId>com.github.koraktor</groupId>
+                        <artifactId>mavanagaiata</artifactId>
+                        <versionRange>[0,)</versionRange>
+                        <goals>
+                          <goal>commit</goal>
+                        </goals>
+                      </pluginExecutionFilter>
+                      <action>
+                        <ignore />
+                      </action>
+                    </pluginExecution>
+                  </pluginExecutions>
+                </lifecycleMappingMetadata>
+              </configuration>
+            </plugin>
+          </plugins>
+        </pluginManagement>
+      </build>
     </profile>
     <profile>
       <id>jdk-release-flag</id>
@@ -327,38 +445,137 @@
         <maven.compiler.release>8</maven.compiler.release>
       </properties>
     </profile>
+    <profile>
+      <id>clover</id>
+      <activation>
+        <activeByDefault>false</activeByDefault>
+        <property>
+          <name>clover</name>
+        </property>
+      </activation>
+      <properties>
+        <cloverDatabase>${project.build.directory}/clover/zookeeper-coverage.db</cloverDatabase>
+      </properties>
+      <build>
+        <plugins>
+          <plugin>
+            <groupId>org.openclover</groupId>
+            <artifactId>clover-maven-plugin</artifactId>
+            <configuration>
+              <includesAllSourceRoots>false</includesAllSourceRoots>
+              <includesTestSourceRoots>true</includesTestSourceRoots>
+              <cloverDatabase>${cloverDatabase}</cloverDatabase>
+              <targetPercentage>50%</targetPercentage>
+              <outputDirectory>${project.build.directory}/clover</outputDirectory>
+              <alwaysReport>true</alwaysReport>
+              <generateHistorical>false</generateHistorical>
+              <cloverDatabase>${project.build.directory}/clover/zookeeper-coverage.db</cloverDatabase>
+              <cloverMergeDatabase>${project.build.directory}/clover/zookeeper-coverage.db</cloverMergeDatabase>
+              <outputDirectory>${project.build.directory}/clover</outputDirectory>
+              <generateHtml>true</generateHtml>
+              <generateXml>true</generateXml>
+              <includesAllSourceRoots>false</includesAllSourceRoots>
+              <includesTestSourceRoots>true</includesTestSourceRoots>
+              <includes>
+                <include>org/apache/zookeeper/**/*</include>
+              </includes>
+              <excludes>
+                <exclude>org/apache/zookeeper/version/**/*</exclude>
+                  <exclude>**/ReadOnlyModeTest.java</exclude>
+                  <exclude>**/KeeperStateTest.java</exclude>
+              </excludes>
+            </configuration>
+            <executions>
+              <execution>
+                <id>clover-setup</id>
+                <phase>process-sources</phase>
+                <goals>
+                  <goal>setup</goal>
+                </goals>
+              </execution>
+              <execution>
+                <id>clover</id>
+                <phase>test</phase>
+                <goals>
+                  <goal>clover</goal>
+                </goals>
+              </execution>
+            </executions>
+          </plugin>
+        </plugins>
+      </build>
+    </profile>
+    <profile>
+      <id>sonar</id>
+      <properties>
+        <sonar.php.coverage.reportPaths>${project.build.directory}/clover/clover.xml</sonar.php.coverage.reportPaths>
+      </properties>
+      <build>
+        <plugins>
+          <plugin>
+            <groupId>org.sonarsource.scanner.maven</groupId>
+            <artifactId>sonar-maven-plugin</artifactId>
+          </plugin>
+        </plugins>
+        <pluginManagement>
+          <plugins>
+            <plugin>
+              <groupId>org.sonarsource.scanner.maven</groupId>
+              <artifactId>sonar-maven-plugin</artifactId>
+              <version>${sonar-maven-plugin.version}</version>
+              <configuration>
+                <sonar.dynamicAnalysis>reuseReports</sonar.dynamicAnalysis>
+                <sonar.core.codeCoveragePlugin>clover</sonar.core.codeCoveragePlugin>
+                <sonar.clover.reportPath>${project.build.directory}/clover/clover.xml</sonar.clover.reportPath>
+                <sonar.surefire.reportsPath>target/surefire-reports</sonar.surefire.reportsPath>
+                <sonar.core.codeCoveragePlugin>clover</sonar.core.codeCoveragePlugin>
+                <sonar.clover.version>${clover-maven-plugin.version}</sonar.clover.version>
+              </configuration>
+            </plugin>
+          </plugins>
+        </pluginManagement>
+      </build>
+    </profile>
   </profiles>
 
   <properties>
     <!-- maven properties -->
     <maven.compiler.source>1.8</maven.compiler.source>
     <maven.compiler.target>1.8</maven.compiler.target>
+    <project.build.outputTimestamp>1691130453</project.build.outputTimestamp>
     <dependency.locations.enabled>false</dependency.locations.enabled>
+    <surefire.version>2.22.1</surefire.version>
 
     <surefire-forkcount>8</surefire-forkcount>
+    <redirectTestOutputToFile>true</redirectTestOutputToFile>
 
     <!-- dependency versions -->
-    <slf4j.version>1.7.25</slf4j.version>
-    <audience-annotations.version>0.5.0</audience-annotations.version>
+    <slf4j.version>2.0.13</slf4j.version>
+    <logback-version>1.3.15</logback-version>
+    <audience-annotations.version>0.12.0</audience-annotations.version>
     <jmockit.version>1.48</jmockit.version>
-    <junit.version>4.12</junit.version>
-    <log4j.version>1.2.17</log4j.version>
-    <mockito.version>2.27.0</mockito.version>
-    <hamcrest.version>1.3</hamcrest.version>
-    <commons-cli.version>1.2</commons-cli.version>
-    <netty.version>4.1.45.Final</netty.version>
-    <jetty.version>9.4.24.v20191120</jetty.version>
-    <jackson.version>2.10.3</jackson.version>
-    <json.version>1.1.1</json.version>
-    <jline.version>2.11</jline.version>
-    <snappy.version>1.1.7</snappy.version>
+    <junit.version>5.6.2</junit.version>
+    <junit-platform.version>1.6.2</junit-platform.version>
+    <mockito.version>4.9.0</mockito.version>
+    <hamcrest.version>2.2</hamcrest.version>
+    <commons-cli.version>1.5.0</commons-cli.version>
+    <netty.version>4.1.130.Final</netty.version>
+    <jetty.version>9.4.58.v20250814</jetty.version>
+    <jackson.version>2.18.1</jackson.version>
+    <jline.version>3.25.1</jline.version>
+    <snappy.version>1.1.10.5</snappy.version>
     <kerby.version>2.0.0</kerby.version>
-    <bouncycastle.version>1.60</bouncycastle.version>
-    <commons-collections.version>3.2.2</commons-collections.version>
-    <commons-lang.version>2.6</commons-lang.version>
-    <dropwizard.version>3.2.5</dropwizard.version>
-    <spotbugsannotations.version>3.1.9</spotbugsannotations.version>
-    <checkstyle.version>8.17</checkstyle.version>
+    <bouncycastle.version>1.78</bouncycastle.version>
+    <commons-collections.version>4.4</commons-collections.version>
+    <dropwizard.version>4.1.12.1</dropwizard.version>
+    <spotbugsannotations.version>4.0.2</spotbugsannotations.version>
+    <checkstyle.version>8.39</checkstyle.version>
+    <enforcer.version>3.0.0-M3</enforcer.version>
+    <commons-io.version>2.17.0</commons-io.version>
+    <burningwave.mockdns.version>0.25.4</burningwave.mockdns.version>
+    <dnsjava.version>3.5.1</dnsjava.version>
+    <clover-maven-plugin.version>4.4.1</clover-maven-plugin.version>
+    <sonar-maven-plugin.version>3.7.0.1746</sonar-maven-plugin.version>
 
     <!-- parameters to pass to C client build -->
     <c-client-openssl>yes</c-client-openssl>
@@ -370,19 +587,14 @@
     <dependencies>
       <dependency>
         <groupId>org.hamcrest</groupId>
-        <artifactId>hamcrest-all</artifactId>
+        <artifactId>hamcrest-library</artifactId>
         <version>${hamcrest.version}</version>
       </dependency>
       <dependency>
-        <groupId>commons-collections</groupId>
-        <artifactId>commons-collections</artifactId>
+        <groupId>org.apache.commons</groupId>
+        <artifactId>commons-collections4</artifactId>
         <version>${commons-collections.version}</version>
       </dependency>
-      <dependency>
-        <groupId>commons-lang</groupId>
-        <artifactId>commons-lang</artifactId>
-        <version>${commons-lang.version}</version>
-      </dependency>
       <dependency>
         <groupId>org.apache.yetus</groupId>
         <artifactId>audience-annotations</artifactId>
@@ -432,12 +644,12 @@
       </dependency>
       <dependency>
         <groupId>org.bouncycastle</groupId>
-        <artifactId>bcprov-jdk15on</artifactId>
+        <artifactId>bcprov-jdk18on</artifactId>
         <version>${bouncycastle.version}</version>
       </dependency>
       <dependency>
         <groupId>org.bouncycastle</groupId>
-        <artifactId>bcpkix-jdk15on</artifactId>
+        <artifactId>bcpkix-jdk18on</artifactId>
         <version>${bouncycastle.version}</version>
       </dependency>
       <dependency>
@@ -446,20 +658,14 @@
         <version>${slf4j.version}</version>
       </dependency>
       <dependency>
-        <groupId>org.slf4j</groupId>
-        <artifactId>slf4j-log4j12</artifactId>
-        <version>${slf4j.version}</version>
-        <exclusions>
-          <exclusion>
-            <groupId>*</groupId>
-            <artifactId>*</artifactId>
-          </exclusion>
-        </exclusions>
+        <groupId>ch.qos.logback</groupId>
+        <artifactId>logback-core</artifactId>
+        <version>${logback-version}</version>
       </dependency>
       <dependency>
-        <groupId>log4j</groupId>
-        <artifactId>log4j</artifactId>
-        <version>${log4j.version}</version>
+        <groupId>ch.qos.logback</groupId>
+        <artifactId>logback-classic</artifactId>
+        <version>${logback-version}</version>
       </dependency>
       <dependency>
         <groupId>org.jmockit</groupId>
@@ -467,8 +673,30 @@
         <version>${jmockit.version}</version>
       </dependency>
       <dependency>
-        <groupId>junit</groupId>
-        <artifactId>junit</artifactId>
+        <groupId>org.junit.jupiter</groupId>
+        <artifactId>junit-jupiter-api</artifactId>
+        <version>${junit.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.junit.jupiter</groupId>
+        <artifactId>junit-jupiter-engine</artifactId>
+        <version>${junit.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.junit.jupiter</groupId>
+        <artifactId>junit-jupiter-params</artifactId>
+        <version>${junit.version}</version>
+        <scope>test</scope>
+      </dependency>
+      <dependency>
+        <groupId>org.junit.platform</groupId>
+        <artifactId>junit-platform-runner</artifactId>
+        <version>${junit-platform.version}</version>
+        <scope>test</scope>
+      </dependency>
+      <dependency>
+        <groupId>org.junit.vintage</groupId>
+        <artifactId>junit-vintage-engine</artifactId>
         <version>${junit.version}</version>
       </dependency>
       <dependency>
@@ -477,14 +705,17 @@
         <version>${mockito.version}</version>
       </dependency>
       <dependency>
-        <groupId>io.netty</groupId>
-        <artifactId>netty-handler</artifactId>
-        <version>${netty.version}</version>
+        <groupId>org.mockito</groupId>
+        <artifactId>mockito-inline</artifactId>
+        <version>${mockito.version}</version>
+        <scope>test</scope>
       </dependency>
       <dependency>
         <groupId>io.netty</groupId>
-        <artifactId>netty-transport-native-epoll</artifactId>
+        <artifactId>netty-bom</artifactId>
         <version>${netty.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
       </dependency>
       <dependency>
         <groupId>org.eclipse.jetty</groupId>
@@ -496,6 +727,11 @@
         <artifactId>jetty-servlet</artifactId>
         <version>${jetty.version}</version>
       </dependency>
+      <dependency>
+        <groupId>org.eclipse.jetty</groupId>
+        <artifactId>jetty-client</artifactId>
+        <version>${jetty.version}</version>
+      </dependency>
       <dependency>
         <groupId>io.dropwizard.metrics</groupId>
         <artifactId>metrics-core</artifactId>
@@ -513,18 +749,7 @@
         <version>${jackson.version}</version>
       </dependency>
       <dependency>
-        <groupId>com.googlecode.json-simple</groupId>
-        <artifactId>json-simple</artifactId>
-        <version>${json.version}</version>
-        <exclusions>
-          <exclusion>
-              <groupId>junit</groupId>
-              <artifactId>junit</artifactId>
-          </exclusion>
-        </exclusions>
-      </dependency>
-      <dependency>
-        <groupId>jline</groupId>
+        <groupId>org.jline</groupId>
         <artifactId>jline</artifactId>
         <version>${jline.version}</version>
       </dependency>
@@ -540,6 +765,21 @@
         <artifactId>snappy-java</artifactId>
         <version>${snappy.version}</version>
       </dependency>
+      <dependency>
+        <groupId>commons-io</groupId>
+        <artifactId>commons-io</artifactId>
+        <version>${commons-io.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.burningwave</groupId>
+        <artifactId>tools</artifactId>
+        <version>${burningwave.mockdns.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>dnsjava</groupId>
+        <artifactId>dnsjava</artifactId>
+        <version>${dnsjava.version}</version>
+      </dependency>
     </dependencies>
   </dependencyManagement>
 
@@ -549,7 +789,6 @@
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-compiler-plugin</artifactId>
-          <version>3.8.1</version>
           <configuration>
              <showWarnings>true</showWarnings>
              <compilerArgs>
@@ -566,7 +805,6 @@
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-jar-plugin</artifactId>
-          <version>3.1.0</version>
           <configuration>
             <archive>
               <manifestEntries>
@@ -578,25 +816,24 @@
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-source-plugin</artifactId>
-          <version>3.0.1</version>
         </plugin>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-javadoc-plugin</artifactId>
-          <version>3.0.1</version>
+          <version>3.1.1</version>
           <configuration>
+            <quiet>true</quiet>
             <doclint>none</doclint>
           </configuration>
         </plugin>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-assembly-plugin</artifactId>
-          <version>3.1.0</version>
+          <version>3.6.0</version>
         </plugin>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-release-plugin</artifactId>
-          <version>2.5.3</version>
         </plugin>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
@@ -606,17 +843,18 @@
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-surefire-plugin</artifactId>
-          <version>2.22.1</version>
+          <configuration>
+              <trimStackTrace>false</trimStackTrace>
+              <redirectTestOutputToFile>${redirectTestOutputToFile}</redirectTestOutputToFile>
+          </configuration>
         </plugin>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-antrun-plugin</artifactId>
-          <version>1.8</version>
         </plugin>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-dependency-plugin</artifactId>
-          <version>3.1.1</version>
         </plugin>
         <plugin>
           <groupId>org.codehaus.mojo</groupId>
@@ -644,12 +882,12 @@
         <plugin>
           <groupId>org.openclover</groupId>
           <artifactId>clover-maven-plugin</artifactId>
-          <version>4.3.1</version>
+          <version>${clover-maven-plugin.version}</version>
         </plugin>
         <plugin>
           <groupId>com.github.spotbugs</groupId>
           <artifactId>spotbugs-maven-plugin</artifactId>
-          <version>3.1.9</version>
+          <version>4.0.0</version>
           <configuration>
             <excludeFilterFile>excludeFindBugsFilter.xml</excludeFilterFile>
           </configuration>
@@ -657,12 +895,12 @@
         <plugin>
           <groupId>org.owasp</groupId>
           <artifactId>dependency-check-maven</artifactId>
-          <version>5.3.0</version>
+          <version>12.1.6</version>
         </plugin>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-checkstyle-plugin</artifactId>
-          <version>3.1.0</version>
+          <version>3.1.1</version>
           <dependencies>
             <dependency>
               <groupId>com.puppycrawl.tools</groupId>
@@ -680,15 +918,6 @@
             <includeTestResources>false</includeTestResources>
             <includeTestSourceDirectory>true</includeTestSourceDirectory>
           </configuration>
-          <executions>
-            <execution>
-              <id>checkstyle</id>
-              <phase>validate</phase>
-              <goals>
-                <goal>check</goal>
-              </goals>
-            </execution>
-          </executions>
         </plugin>
         <!-- we don't need this plugin-->
         <plugin>
@@ -700,6 +929,16 @@
             </execution>
           </executions>
         </plugin>
+        <plugin>
+          <groupId>org.apache.felix</groupId>
+          <artifactId>maven-bundle-plugin</artifactId>
+          <version>5.1.9</version>
+        </plugin>
+        <plugin>
+          <groupId>org.cyclonedx</groupId>
+          <artifactId>cyclonedx-maven-plugin</artifactId>
+          <version>2.7.9</version>
+       </plugin>
       </plugins>
     </pluginManagement>
 
@@ -717,34 +956,12 @@
           </execution>
         </executions>
       </plugin>
-      <plugin>
-        <groupId>org.openclover</groupId>
-        <artifactId>clover-maven-plugin</artifactId>
-        <configuration>
-          <generateHtml>true</generateHtml>
-          <generateXml>true</generateXml>
-          <includes>
-            <include>org/apache/zookeeper/**/*</include>
-          </includes>
-          <excludes>
-            <exclude>org/apache/zookeeper/version/**/*</exclude>
-          </excludes>
-        </configuration>
-        <executions>
-          <execution>
-            <phase>pre-site</phase>
-            <goals>
-              <goal>instrument</goal>
-              <goal>aggregate</goal>
-            </goals>
-          </execution>
-        </executions>
-      </plugin>
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-antrun-plugin</artifactId>
         <executions>
           <execution>
+            <id>set-hostname-property</id>
             <phase>validate</phase>
             <goals>
               <goal>run</goal>
@@ -852,9 +1069,9 @@
       <plugin>
         <groupId>org.apache.rat</groupId>
         <artifactId>apache-rat-plugin</artifactId>
+        <version>0.15</version>
         <configuration>
           <excludes>
-            <exclude>**/log4j.properties</exclude>
             <exclude>**/README.md</exclude>
             <exclude>**/findbugsExcludeFile.xml</exclude>
             <exclude>**/checkstyle-noframes-sorted.xsl</exclude>
@@ -868,24 +1085,24 @@
             <exclude>src/main/resources/markdown/skin/*</exclude>
             <exclude>src/main/resources/markdown/html/*</exclude>
             <exclude>src/main/resources/markdown/images/*</exclude>
+            <exclude>**/src/test/resources/embedded/*.conf</exclude>
             <!-- contrib -->
-            <exclude>zookeeper-contrib-monitoring/JMX-RESOURCES</exclude>
-            <exclude>zookeeper-contrib-fatjar/src/main/resources/mainClasses</exclude>
-            <exclude>zookeeper-contrib-zkperl/Changes</exclude>
-            <exclude>zookeeper-contrib-zkperl/MANIFEST</exclude>
-            <exclude>zookeeper-contrib-zkpython/src/test/zoo.cfg</exclude>
-            <exclude>zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/*</exclude>
-            <exclude>src/main/resources/webapp/org/apache/zookeeper/graph/resources/*</exclude>
-            <exclude>src/main/java/com/nitido/utils/toaster/Toaster.java</exclude>
-            <exclude>TODO</exclude>
+            <exclude>**/JMX-RESOURCES</exclude>
+            <exclude>**/src/main/resources/mainClasses</exclude>
+            <exclude>**/Changes</exclude>
+            <exclude>**/MANIFEST</exclude>
+            <exclude>**/src/test/zoo.cfg</exclude>
+            <exclude>**/src/main/resources/webapp/org/apache/zookeeper/graph/resources/*</exclude>
+            <exclude>**/src/main/java/com/nitido/utils/toaster/Toaster.java</exclude>
+            <exclude>**/TODO</exclude>
             <!-- c client -->
             <exclude>**/acinclude.m4</exclude>
             <exclude>**/aminclude.am</exclude>
-            <exclude>src/hashtable/*</exclude>
-            <exclude>include/winconfig.h</exclude>
-            <exclude>tests/wrappers.opt</exclude>
-            <exclude>tests/zoo.cfg</exclude>
-            <exclude>tests/wrappers-mt.opt</exclude>
+            <exclude>**/src/hashtable/*</exclude>
+            <exclude>**/include/winconfig.h</exclude>
+            <exclude>**/tests/wrappers.opt</exclude>
+            <exclude>**/tests/zoo.cfg</exclude>
+            <exclude>**/tests/wrappers-mt.opt</exclude>
             <exclude>**/c-doc.Doxyfile</exclude>
           </excludes>
           <consoleOutput>true</consoleOutput>
@@ -897,8 +1114,12 @@
           <inherited>false</inherited>
           <configuration>
             <!-- update the version inside the C sources -->
-            <preparationGoals>clean install -DskipTests antrun:run@replace-cclient-files-during-release scm:add@add-cclient-files-during-release scm:checkin@commit-cclient-files-during-release</preparationGoals>
-            <completionGoals>clean install -DskipTests antrun:run@replace-cclient-files-during-release scm:add@add-cclient-files-during-release scm:checkin@commit-cclient-files-during-release</completionGoals>
+            <preparationGoals>clean verify -DskipTests antrun:run@replace-cclient-files-during-release scm:add@add-cclient-files-during-release scm:checkin@commit-cclient-files-during-release</preparationGoals>
+            <completionGoals>clean verify -DskipTests antrun:run@replace-cclient-files-during-release scm:add@add-cclient-files-during-release scm:checkin@commit-cclient-files-during-release</completionGoals>
+            <pushChanges>false</pushChanges>
+            <localCheckout>true</localCheckout>
+            <autoVersionSubmodules>true</autoVersionSubmodules>
+            <tagNameFormat>release-@{project.version}</tagNameFormat>
           </configuration>
         </plugin>
         <plugin>
@@ -931,6 +1152,76 @@
             </execution>
         </executions>
       </plugin>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-enforcer-plugin</artifactId>
+        <version>${enforcer.version}</version>
+        <executions>
+          <execution>
+            <id>banned-commons-lang</id>
+            <goals>
+              <goal>enforce</goal>
+            </goals>
+            <configuration>
+              <rules>
+                <bannedDependencies>
+                  <excludes>
+                    <exclude>commons-lang:commons-lang</exclude>
+                  </excludes>
+                  <searchTransitive>false</searchTransitive>
+                  <message>We don't use commons-lang anymore, so do not depend on it directly.</message>
+                </bannedDependencies>
+              </rules>
+            </configuration>
+          </execution>
+          <execution>
+            <id>banned-commons-lang3</id>
+            <goals>
+              <goal>enforce</goal>
+            </goals>
+            <configuration>
+              <rules>
+                <bannedDependencies>
+                  <excludes>
+                    <exclude>org.apache.commons:commons-lang3</exclude>
+                  </excludes>
+                  <searchTransitive>false</searchTransitive>
+                  <message>We don't use commons-lang3, so do not depend on it directly.</message>
+                </bannedDependencies>
+              </rules>
+            </configuration>
+          </execution>
+          <execution>
+            <id>banned-json-simple</id>
+            <goals>
+              <goal>enforce</goal>
+            </goals>
+            <configuration>
+              <rules>
+                <bannedDependencies>
+                  <excludes>
+                    <exclude>com.googlecode.json-simple:json-simple</exclude>
+                  </excludes>
+                  <searchTransitive>false</searchTransitive>
+                  <message>We don't use json-simple anymore, so do not depend on it directly.</message>
+                </bannedDependencies>
+              </rules>
+            </configuration>
+          </execution>
+        </executions>
+      </plugin>
+      <plugin>
+        <groupId>org.cyclonedx</groupId>
+        <artifactId>cyclonedx-maven-plugin</artifactId>
+        <executions>
+          <execution>
+            <goals>
+              <goal>makeBom</goal>
+            </goals>
+            <phase>package</phase>
+          </execution>
+        </executions>
+      </plugin>
     </plugins>
     <resources>
       <resource>
diff --git a/tools/ci/install-shfmt.sh b/tools/ci/install-shfmt.sh
new file mode 100755
index 00000000000..fd73efc3c6c
--- /dev/null
+++ b/tools/ci/install-shfmt.sh
@@ -0,0 +1,29 @@
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+# Install shfmt tool to search for and optionally format bash scripts
+# This is useful for other CI tools to run ShellCheck and shfmt to format
+
+set -e
+set -x
+
+shfmt_version=3.4.3
+sudo wget "https://github.com/mvdan/sh/releases/download/v${shfmt_version}/shfmt_v${shfmt_version}_linux_amd64" -O /usr/local/bin/shfmt &&
+  sudo chmod +x /usr/local/bin/shfmt
diff --git a/tools/ci/run-shellcheck.sh b/tools/ci/run-shellcheck.sh
new file mode 100755
index 00000000000..5d6ca75d2d7
--- /dev/null
+++ b/tools/ci/run-shellcheck.sh
@@ -0,0 +1,28 @@
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+# Run ShellCheck on all bash scripts
+
+set -e
+
+mapfile -t filestocheck < <(shfmt -f .)
+
+set -x
+shellcheck -P SCRIPTDIR -x "${filestocheck[@]}"
diff --git a/tools/ci/run-shfmt.sh b/tools/ci/run-shfmt.sh
new file mode 100755
index 00000000000..233df9aff49
--- /dev/null
+++ b/tools/ci/run-shfmt.sh
@@ -0,0 +1,26 @@
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+# Check formatting of all bash scripts
+
+set -e
+set -x
+
+shfmt -ln bash -l -d -i 2 -ci -s .
diff --git a/tools/ci/test-connectivity.py b/tools/ci/test-connectivity.py
new file mode 100755
index 00000000000..2ad837571c0
--- /dev/null
+++ b/tools/ci/test-connectivity.py
@@ -0,0 +1,48 @@
+#!/usr/bin/env python3
+
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import argparse
+import subprocess
+
+from pathlib import Path
+
+class Server():
+    def __init__(self, binpath):
+        self.binpath = binpath
+    def __enter__(self):
+        subprocess.run([f'{self.binpath}', 'start'], check=True)
+        return self
+    def __exit__(self, type, value, traceback):
+        subprocess.run([f'{self.binpath}', 'stop'], check=True)
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--server', help="basepath to zk server", required=True)
+    parser.add_argument('--client', help="basepath to zk client", required=True)
+
+    args = parser.parse_args()
+    
+    server_basepath = Path(args.server).absolute()
+    server_binpath = server_basepath / "bin" / "zkServer.sh"
+    assert server_binpath.exists(), f"server binpath not exist: {server_binpath}"
+    client_basepath = Path(args.client).absolute()
+    client_binpath = client_basepath / "bin" / "zkCli.sh"
+    assert client_binpath.exists(), f"client binpath not exist: {client_binpath}"
+
+    with Server(server_binpath):
+        subprocess.run([f'{client_binpath}', 'sync', '/'], check=True)
diff --git a/tools/sonar/code-coverage.sh b/tools/sonar/code-coverage.sh
new file mode 100755
index 00000000000..4dfe4eea11a
--- /dev/null
+++ b/tools/sonar/code-coverage.sh
@@ -0,0 +1,73 @@
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+usage() {
+  echo
+  echo "options:"
+  echo "-h     Display help"
+  echo "-u     SonarQube Host URL"
+  echo "-l     SonarQube Login Credentials"
+  echo "-k     SonarQube Project Key"
+  echo "-n     SonarQube Project Name"
+  echo
+  echo "Important:"
+  echo "    The required parameters for publishing the coverage results to SonarQube:"
+  echo "      - Host URL"
+  echo "      - Login Credentials"
+  echo "      - Project Key"
+  echo
+}
+
+execute() {
+  SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
+  MAIN_POM="$SCRIPT_DIR/../../pom.xml"
+
+  mvn -B -e -Pclover -f "$MAIN_POM" clean install -DskipTests -DskipShade
+
+  mvn -B -e -Pclover -f "$MAIN_POM" test -Dparallel-tests -DtestsThreadCount=8 -Dscale
+
+  mvn -B -e -Pclover -f "$MAIN_POM" clover:aggregate clover:clover
+
+  # If the required parameters are given, the code coverage results are uploaded to the SonarQube Server
+  if [[ -n $SONAR_LOGIN ]] && [[ -n $SONAR_PROJECT_KEY ]] && [[ -n $SONAR_URL ]]; then
+    mvn -B -e -Pclover -f "$MAIN_POM" sonar:sonar -Dsonar.clover.reportPath=./target/clover/clover.xml \
+      -Dsonar.host.url="$SONAR_URL" -Dsonar.login="$SONAR_LOGIN" -Dsonar.projectKey="$SONAR_PROJECT_KEY" -Dsonar.projectName="$SONAR_PROJECT_NAME"
+  fi
+}
+
+while getopts ":u:l:k:n:h" option; do
+  case $option in
+    u) SONAR_URL=${OPTARG:-} ;;
+    l) SONAR_LOGIN=${OPTARG:-} ;;
+    k) SONAR_PROJECT_KEY=${OPTARG:-} ;;
+    n) SONAR_PROJECT_NAME=${OPTARG:-} ;;
+    h) # Display usage
+      usage
+      exit
+      ;;
+    \?) # Invalid option
+      echo "Error: Invalid option"
+      exit
+      ;;
+  esac
+done
+
+# Start code analysis
+execute
diff --git a/zk-merge-pr.py b/zk-merge-pr.py
old mode 100644
new mode 100755
index 5768a94d74f..100244bfc16
--- a/zk-merge-pr.py
+++ b/zk-merge-pr.py
@@ -32,8 +32,9 @@
 import re
 import subprocess
 import sys
-import urllib2
+import urllib.request, urllib.error, urllib.parse
 import getpass
+import requests
 
 try:
     import jira.client
@@ -53,6 +54,11 @@
 JIRA_USERNAME = os.environ.get("JIRA_USERNAME", "")
 # ASF JIRA password
 JIRA_PASSWORD = os.environ.get("JIRA_PASSWORD", "")
+# ASF JIRA access token
+# If it is configured, username and password are dismissed
+# Go to https://issues.apache.org/jira/secure/ViewProfile.jspa -> Personal Access Tokens for
+# your own token management.
+JIRA_ACCESS_TOKEN = os.environ.get("JIRA_ACCESS_TOKEN")
 # OAuth key used for issuing requests against the GitHub API. If this is not defined, then requests
 # will be unauthenticated. You should only need to configure this if you find yourself regularly
 # exceeding your IP's unauthenticated request rate limit. You can create an OAuth key at
@@ -75,154 +81,148 @@
 
 def get_json(url):
     try:
-        request = urllib2.Request(url)
+        request = urllib.request.Request(url)
         if GITHUB_OAUTH_KEY:
             request.add_header('Authorization', 'token %s' % GITHUB_OAUTH_KEY)
-        return json.load(urllib2.urlopen(request))
-    except urllib2.HTTPError as e:
+        return json.load(urllib.request.urlopen(request))
+    except urllib.error.HTTPError as e:
         if "X-RateLimit-Remaining" in e.headers and e.headers["X-RateLimit-Remaining"] == '0':
-            print "Exceeded the GitHub API rate limit; see the instructions in " + \
+            print("Exceeded the GitHub API rate limit; see the instructions in " + \
                   "zk-merge-pr.py to configure an OAuth token for making authenticated " + \
-                  "GitHub requests."
+                  "GitHub requests.")
         else:
-            print "Unable to fetch URL, exiting: %s" % url
+            print("Unable to fetch URL, exiting: %s" % url)
         sys.exit(-1)
 
 
 def fail(msg):
-    print msg
+    print(msg)
     clean_up()
     sys.exit(-1)
 
 
 def run_cmd(cmd):
-    print cmd
+    print(cmd)
     if isinstance(cmd, list):
-        return subprocess.check_output(cmd)
+        return subprocess.check_output(cmd, encoding='utf8')
     else:
-        return subprocess.check_output(cmd.split(" "))
+        return subprocess.check_output(cmd.split(" "), encoding='utf8')
 
 
 def continue_maybe(prompt):
-    result = raw_input("\n%s (y/n): " % prompt)
+    result = input("\n%s (y/n): " % prompt)
     if result.lower().strip() != "y":
         fail("Okay, exiting")
 
 def clean_up():
     if original_head != get_current_branch():
-        print "Restoring head pointer to %s" % original_head
+        print("Restoring head pointer to %s" % original_head)
         run_cmd("git checkout %s" % original_head)
 
     branches = run_cmd("git branch").replace(" ", "").split("\n")
 
-    for branch in filter(lambda x: x.startswith(TEMP_BRANCH_PREFIX), branches):
-        print "Deleting local branch %s" % branch
+    for branch in [x for x in branches if x.startswith(TEMP_BRANCH_PREFIX)]:
+        print("Deleting local branch %s" % branch)
         run_cmd("git branch -D %s" % branch)
 
 def get_current_branch():
     return run_cmd("git rev-parse --abbrev-ref HEAD").replace("\n", "")
 
 # merge the requested PR and return the merge hash
-def merge_pr(pr_num, target_ref, title, body, pr_repo_desc):
-    pr_branch_name = "%s_MERGE_PR_%s" % (TEMP_BRANCH_PREFIX, pr_num)
-    target_branch_name = "%s_MERGE_PR_%s_%s" % (TEMP_BRANCH_PREFIX, pr_num, target_ref.upper())
-    run_cmd("git fetch %s pull/%s/head:%s" % (PR_REMOTE_NAME, pr_num, pr_branch_name))
-    run_cmd("git fetch %s %s:%s" % (PUSH_REMOTE_NAME, target_ref, target_branch_name))
-    run_cmd("git checkout %s" % target_branch_name)
-
-    had_conflicts = False
-    try:
-        run_cmd(['git', 'merge', pr_branch_name, '--squash'])
-    except Exception as e:
-        msg = "Error merging: %s\nWould you like to manually fix-up this merge?" % e
-        continue_maybe(msg)
-        msg = "Okay, please fix any conflicts and 'git add' conflicting files... Finished?"
-        continue_maybe(msg)
-        had_conflicts = True
-
-    commit_authors = run_cmd(['git', 'log', 'HEAD..%s' % pr_branch_name,
-                             '--pretty=format:%an <%ae>']).split("\n")
-    distinct_authors = sorted(set(commit_authors),
-                              key=lambda x: commit_authors.count(x), reverse=True)
-    primary_author = raw_input(
-        "Enter primary author in the format of \"name <email>\" [%s]: " %
-        distinct_authors[0])
-    if primary_author == "":
-        primary_author = distinct_authors[0]
-
-    reviewers = raw_input(
-        "Enter reviewers in the format of \"name1 <email1>, name2 <email2>\": ").strip()
-
-    commits = run_cmd(['git', 'log', 'HEAD..%s' % pr_branch_name,
-                      '--pretty=format:%h [%an] %s']).split("\n")
-
-    if len(commits) > 1:
-        result = raw_input("List pull request commits in squashed commit message? (y/n): ")
-        if result.lower().strip() == "y":
-          should_list_commits = True
-        else:
-          should_list_commits = False
+def merge_pr(pr_num, title, pr_repo_desc):
+
+    merge_message = []
+    result = input("Would you like to squash the commit messages? (y/n): ")
+    if result.lower().strip() == "y":
+        # Retrieve the commits separately.
+        json_commits = get_json(f"https://api.github.com/repos/{PUSH_REMOTE_NAME}/{PROJECT_NAME}/pulls/{pr_num}/commits")
+        if json_commits and isinstance(json_commits, list):
+            for commit in json_commits:
+                commit_message = commit['commit']['message']
+                # Remove empty lines and lines containing "Change-Id:"
+                filtered_lines = [line for line in commit_message.split('\n') if 'Change-Id:' not in line and line.strip()]
+                modified_commit_message = '\n'.join(filtered_lines)
+                if modified_commit_message.strip() != title.strip():
+                    merge_message += [modified_commit_message]
+
+    # Check for disapproval reviews.
+    json_reviewers = get_json(f"https://api.github.com/repos/{PUSH_REMOTE_NAME}/{PROJECT_NAME}/pulls/{pr_num}/reviews")
+    disapproval_reviews = [review['user']['login'] for review in json_reviewers if review['state'] == 'CHANGES_REQUESTED']
+    if disapproval_reviews:
+        continue_maybe("Warning: There are requested changes. Proceed with merging pull request #%s?" % pr_num)
+    # Verify if there are no approved reviews.
+    approved_reviewers = [review['user']['login'] for review in json_reviewers if review['state'] == 'APPROVED']
+    if not approved_reviewers:
+        continue_maybe("Warning: Pull Request does not have an approved review. Proceed with merging pull request #%s?" % pr_num)
     else:
-        should_list_commits = False
-
-    merge_message_flags = []
-
-    merge_message_flags += ["-m", title]
-    if body is not None:
-        # We remove @ symbols from the body to avoid triggering e-mails
-        # to people every time someone creates a public fork of the project.
-        merge_message_flags += ["-m", body.replace("@", "")]
-
-    authors = "\n".join(["Author: %s" % a for a in distinct_authors])
-
-    merge_message_flags += ["-m", authors]
-
-    if (reviewers != ""):
-        merge_message_flags += ["-m", "Reviewers: %s" % reviewers]
-
-    if had_conflicts:
-        committer_name = run_cmd("git config --get user.name").strip()
-        committer_email = run_cmd("git config --get user.email").strip()
-        message = "This patch had conflicts when merged, resolved by\nCommitter: %s <%s>" % (
-            committer_name, committer_email)
-        merge_message_flags += ["-m", message]
-
-    # The string "Closes #%s" string is required for GitHub to correctly close the PR
+        reviewers_string = ', '.join(approved_reviewers)
+        merge_message += [f"Reviewers: {reviewers_string}"]
+    # Check the author and the closing line.
+    json_pr = get_json(f"https://api.github.com/repos/{PUSH_REMOTE_NAME}/{PROJECT_NAME}/pulls/{pr_num}")
+    primary_author = json_pr["user"]["login"]
+    if primary_author != "":
+        merge_message += [f"Author: {primary_author}"]
     close_line = "Closes #%s from %s" % (pr_num, pr_repo_desc)
-    if should_list_commits:
-        close_line += " and squashes the following commits:"
-    merge_message_flags += ["-m", close_line]
-
-    if should_list_commits:
-        merge_message_flags += ["-m", "\n".join(commits)]
-
-    run_cmd(['git', 'commit', '--author="%s"' % primary_author] + merge_message_flags)
-
-    continue_maybe("Merge complete (local ref %s). Push to %s?" % (
-        target_branch_name, PUSH_REMOTE_NAME))
-
-    try:
-        run_cmd('git push %s %s:%s' % (PUSH_REMOTE_NAME, target_branch_name, target_ref))
-    except Exception as e:
-        clean_up()
-        fail("Exception while pushing: %s" % e)
-
-    merge_hash = run_cmd("git rev-parse %s" % target_branch_name)[:8]
-    clean_up()
-    print("Pull request #%s merged!" % pr_num)
-    print("Merge hash: %s" % merge_hash)
-    return merge_hash
-
+    merge_message += [close_line]
+    merged_string = '\n'.join(merge_message)
+
+    # Get the latest commit SHA.
+    latest_commit_sha = json_pr["head"]["sha"]
+    json_status = get_json(f"https://api.github.com/repos/{PUSH_REMOTE_NAME}/{PROJECT_NAME}/commits/{latest_commit_sha}/check-runs")
+    # Check if all checks have passed on GitHub.
+    all_checks_passed = all(status["conclusion"] == "success" for status in json_status["check_runs"])
+    if all_checks_passed:
+        print("All checks have passed on the github.")
+    else:
+        any_in_progress = any(run["status"] == "in_progress" for run in json_status["check_runs"])
+        if any_in_progress:
+            continue_maybe("Warning: There are pending checks. Would you like to continue the merge?")
+        else:
+            continue_maybe("Warning: Not all checks have passed on GitHub. Would you like to continue the merge?")
+
+    headers = {
+        "Authorization": f"token {GITHUB_OAUTH_KEY}",
+        "Accept": "application/vnd.github.v3+json"
+    }
+    data = {
+        "commit_title": title,
+        "commit_message": merged_string,
+        "merge_method": "squash"
+    }
+
+    response = requests.put(f"https://api.github.com/repos/{PUSH_REMOTE_NAME}/{PROJECT_NAME}/pulls/{pr_num}/merge", headers=headers, json=data)
+
+    if response.status_code == 200:
+        merge_response_json = response.json()
+        merge_commit_sha = merge_response_json.get("sha")
+        print(f"Pull request #{pr_num} merged. Sha: #{merge_commit_sha}")
+        return merge_commit_sha
+    else:
+        print(f"Failed to merge pull request #{pr_num}. Status code: {response.status_code}")
+        print(response.text)
+        exit()
 
 def cherry_pick(pr_num, merge_hash, default_branch):
-    pick_ref = raw_input("Enter a branch name [%s]: " % default_branch)
+    pick_ref = input("Enter a branch name [%s]: " % default_branch)
     if pick_ref == "":
         pick_ref = default_branch
 
     pick_branch_name = "%s_PICK_PR_%s_%s" % (TEMP_BRANCH_PREFIX, pr_num, pick_ref.upper())
 
-    run_cmd("git fetch %s %s:%s" % (PUSH_REMOTE_NAME, pick_ref, pick_branch_name))
-    run_cmd("git checkout %s" % pick_branch_name)
+    run_cmd("git fetch %s" % PR_REMOTE_NAME)
+    run_cmd("git checkout -b %s %s/%s" % (pick_branch_name, PUSH_REMOTE_NAME, pick_ref))
+
+    current_attempt = 0
+    max_attempts = 6
+    # Check if the merge hash exists
+    while not run_cmd("git rev-parse --verify %s" % merge_hash):
+        if current_attempt >= max_attempts:
+            print("Error: The commit hash does not exist in the local repository.")
+            exit()
+        current_attempt += 1
+        print("Waiting for the merge hash to become available...(10 sec)")
+        time.sleep(10)
+        run_cmd("git fetch %s" % PR_REMOTE_NAME)
 
     try:
         run_cmd("git cherry-pick -sx %s" % merge_hash)
@@ -244,21 +244,21 @@ def cherry_pick(pr_num, merge_hash, default_branch):
     pick_hash = run_cmd("git rev-parse %s" % pick_branch_name)[:8]
     clean_up()
 
-    print("Pull request #%s picked into %s!" % (pr_num, pick_ref))
-    print("Pick hash: %s" % pick_hash)
+    print(("Pull request #%s picked into %s!" % (pr_num, pick_ref)))
+    print(("Pick hash: %s" % pick_hash))
     return pick_ref
 
 
 def fix_version_from_branch(branch, versions):
     # Note: Assumes this is a sorted (newest->oldest) list of un-released versions
     if branch == DEV_BRANCH_NAME:
-        versions = filter(lambda x: x == DEFAULT_FIX_VERSION, versions)
+        versions = [x for x in versions if x == DEFAULT_FIX_VERSION]
         if len(versions) > 0:
             return versions[0]
         else:
             return None
     else:
-        versions = filter(lambda x: x.startswith(branch), versions)
+        versions = [x for x in versions if x.startswith(branch)]
         if len(versions) > 0:
             return versions[-1]
         else:
@@ -266,10 +266,14 @@ def fix_version_from_branch(branch, versions):
 
 
 def resolve_jira_issue(merge_branches, comment, default_jira_id=""):
-    asf_jira = jira.client.JIRA({'server': JIRA_API_BASE},
-                                basic_auth=(JIRA_USERNAME, JIRA_PASSWORD))
+    jira_server = {"server": JIRA_API_BASE}
 
-    jira_id = raw_input("Enter a JIRA id [%s]: " % default_jira_id)
+    if JIRA_ACCESS_TOKEN is not None:
+        asf_jira = jira.client.JIRA(jira_server, token_auth=JIRA_ACCESS_TOKEN)
+    else:
+        asf_jira = jira.client.JIRA(jira_server, basic_auth=(JIRA_USERNAME, JIRA_PASSWORD))
+
+    jira_id = input("Enter a JIRA id [%s]: " % default_jira_id)
     if jira_id == "":
         jira_id = default_jira_id
 
@@ -288,40 +292,40 @@ def resolve_jira_issue(merge_branches, comment, default_jira_id=""):
 
     if cur_status == "Resolved" or cur_status == "Closed":
         fail("JIRA issue %s already has status '%s'" % (jira_id, cur_status))
-    print ("=== JIRA %s ===" % jira_id)
-    print ("summary\t\t%s\nassignee\t%s\nstatus\t\t%s\nurl\t\t%s/%s\n" % (
-        cur_summary, cur_assignee, cur_status, JIRA_BASE, jira_id))
+    print(("=== JIRA %s ===" % jira_id))
+    print(("summary\t\t%s\nassignee\t%s\nstatus\t\t%s\nurl\t\t%s/%s\n" % (
+        cur_summary, cur_assignee, cur_status, JIRA_BASE, jira_id)))
 
     versions = asf_jira.project_versions(CAPITALIZED_PROJECT_NAME)
     versions = sorted(versions, key=lambda x: x.name, reverse=True)
-    versions = filter(lambda x: x.raw['released'] is False, versions)
+    versions = [x for x in versions if x.raw['released'] is False]
 
-    version_names = map(lambda x: x.name, versions)
-    default_fix_versions = map(lambda x: fix_version_from_branch(x, version_names), merge_branches)
-    default_fix_versions = filter(lambda x: x != None, default_fix_versions)
+    version_names = [x.name for x in versions]
+    default_fix_versions = [fix_version_from_branch(x, version_names) for x in merge_branches]
+    default_fix_versions = [x for x in default_fix_versions if x != None]
     default_fix_versions = ",".join(default_fix_versions)
 
-    fix_versions = raw_input("Enter comma-separated fix version(s) [%s]: " % default_fix_versions)
+    fix_versions = input("Enter comma-separated fix version(s) [%s]: " % default_fix_versions)
     if fix_versions == "":
         fix_versions = default_fix_versions
     fix_versions = fix_versions.replace(" ", "").split(",")
 
     def get_version_json(version_str):
-        return filter(lambda v: v.name == version_str, versions)[0].raw
+        return [v for v in versions if v.name == version_str][0].raw
 
-    jira_fix_versions = map(lambda v: get_version_json(v), fix_versions)
+    jira_fix_versions = [get_version_json(v) for v in fix_versions]
 
-    resolve = filter(lambda a: a['name'] == "Resolve Issue", asf_jira.transitions(jira_id))[0]
-    resolution = filter(lambda r: r.raw['name'] == "Fixed", asf_jira.resolutions())[0]
+    resolve = [a for a in asf_jira.transitions(jira_id) if a['name'] == "Resolve Issue"][0]
+    resolution = [r for r in asf_jira.resolutions() if r.raw['name'] == "Fixed"][0]
     asf_jira.transition_issue(
         jira_id, resolve["id"], fixVersions = jira_fix_versions,
         comment = comment, resolution = {'id': resolution.raw['id']})
 
-    print "Successfully resolved %s with fixVersions=%s!" % (jira_id, fix_versions)
+    print("Successfully resolved %s with fixVersions=%s!" % (jira_id, fix_versions))
 
 
 def resolve_jira_issues(title, merge_branches, comment):
-    jira_ids = re.findall("%s-[0-9]{4,5}" % CAPITALIZED_PROJECT_NAME, title)
+    jira_ids = re.findall("%s-[0-9]+" % CAPITALIZED_PROJECT_NAME, title)
 
     if len(jira_ids) == 0:
         resolve_jira_issue(merge_branches, comment)
@@ -401,7 +405,7 @@ def check_git_remote():
 
     # check if all remote endpoints' URLs point to project git repo
     name = PROJECT_NAME + ".git"
-    for url in repos.values():
+    for url in list(repos.values()):
         if not url.endswith(name):
             fail("Error: not a %s git repo or at least one remote is invalid" % PROJECT_NAME)
 
@@ -417,15 +421,15 @@ def check_jira_env():
     global JIRA_PASSWORD
 
     if JIRA_IMPORTED:
-
-       if JIRA_USERNAME.strip() != "" and JIRA_PASSWORD.strip() == "":
-           inform_pwd = raw_input("JIRA_USERNAME set but JIRA_PASSWORD is not. Want to inform it? ")
-           if inform_pwd.strip() == "y":
-               JIRA_PASSWORD = getpass.getpass('JIRA PASSWORD: ')
-
-       if JIRA_USERNAME.strip() == "" or JIRA_PASSWORD.strip() == "":
-           msg ="JIRA_USERNAME and/or JIRA_PASSWORD are not set. Want to continue? "
-           continue_maybe(msg)
+        if JIRA_ACCESS_TOKEN is None:
+            if JIRA_USERNAME.strip() != "" and JIRA_PASSWORD.strip() == "":
+                inform_pwd = input("JIRA_USERNAME set but JIRA_PASSWORD is not. Want to inform it? ")
+                if inform_pwd.strip() == "y":
+                    JIRA_PASSWORD = getpass.getpass('JIRA PASSWORD: ')
+
+            if JIRA_USERNAME.strip() == "" or JIRA_PASSWORD.strip() == "":
+                msg ="Neither JIRA_ACCESS_TOKEN nor JIRA_USERNAME and/or JIRA_PASSWORD are set. Want to continue? "
+                continue_maybe(msg)
     else:
         msg = "JIRA lib not installed. Want to continue? "
         continue_maybe(msg)
@@ -440,89 +444,92 @@ def main():
     check_git_remote()
 
     branches = get_json("%s/branches" % GITHUB_API_BASE)
-    branch_names = filter(lambda x: x.startswith(RELEASE_BRANCH_PREFIX), [x['name'] for x in branches])
+    branch_names = [x for x in [x['name'] for x in branches] if x.startswith(RELEASE_BRANCH_PREFIX)]
     # Assumes branch names can be sorted lexicographically
     latest_branch = sorted(branch_names, reverse=True)[0]
 
-    pr_num = raw_input("Which pull request would you like to merge? (e.g. 34): ")
+    pr_num = input("Which pull request would you like to merge? (e.g. 34): ")
     pr = get_json("%s/pulls/%s" % (GITHUB_API_BASE, pr_num))
-    pr_events = get_json("%s/issues/%s/events" % (GITHUB_API_BASE, pr_num))
+
+    # Check if the pull request has already been closed or merged.
+    pull_request_state = pr.get("state", "")
+    if pull_request_state == "closed":
+        merge_hash = pr.get("merge_commit_sha", "")
+        merged = pr.get("merged")
+        # Verify if the pull request has been merged by the GitHub API.
+        if merged is True:
+            print(f"Pull request #{pr['number']} has already been merged, assuming you want to backport")
+            cherry_pick(pr_num, merge_hash, latest_branch)
+            sys.exit(0)
+        # Some merged pull requests may not appear as merged in the GitHub API,
+        # for example, those closed by an older version of this script.
+        else:
+            pr_events = get_json("%s/issues/%s/events" % (GITHUB_API_BASE, pr_num))
+            for event in pr_events:
+                if event.get("event") == "closed":
+                    commit_id = event.get("commit_id")
+                    if commit_id is not None:
+                        print(f"Pull request #{pr['number']} has already been merged, assuming you want to backport")
+                        cherry_pick(pr_num, merge_hash, latest_branch)
+                        sys.exit(0)
+                    else:
+                        print(f"Pull request #{pr['number']} has already been closed, but not merged, exiting.")
+                        exit()
+
+    if not bool(pr["mergeable"]):
+        print(f"Pull request %s is not mergeable in its current form.\n" % pr_num)
+        exit()
 
     url = pr["url"]
 
     pr_title = pr["title"]
-    commit_title = raw_input("Commit title [%s]: " % pr_title.encode("utf-8")).decode("utf-8")
+    commit_title = input("Commit title [%s]: " % pr_title)
     if commit_title == "":
         commit_title = pr_title
 
     # Decide whether to use the modified title or not
     modified_title = standardize_jira_ref(commit_title)
     if modified_title != commit_title:
-        print "I've re-written the title as follows to match the standard format:"
-        print "Original: %s" % commit_title
-        print "Modified: %s" % modified_title
-        result = raw_input("Would you like to use the modified title? (y/n): ")
+        print("I've re-written the title as follows to match the standard format:")
+        print("Original: %s" % commit_title)
+        print("Modified: %s" % modified_title)
+        result = input("Would you like to use the modified title? (y/n): ")
         if result.lower().strip() == "y":
             commit_title = modified_title
-            print "Using modified title:"
+            print("Using modified title:")
         else:
-            print "Using original title:"
-        print commit_title
+            print("Using original title:")
+        print(commit_title)
 
-    body = pr["body"]
     target_ref = pr["base"]["ref"]
     user_login = pr["user"]["login"]
     base_ref = pr["head"]["ref"]
     pr_repo_desc = "%s/%s" % (user_login, base_ref)
 
-    # Merged pull requests don't appear as merged in the GitHub API;
-    # Instead, they're closed by asfgit.
-    merge_commits = \
-        [e for e in pr_events if e["actor"]["login"] == "asfgit" and e["event"] == "closed"]
-
-    if merge_commits:
-        merge_hash = merge_commits[0]["commit_id"]
-        message = get_json("%s/commits/%s" % (GITHUB_API_BASE, merge_hash))["commit"]["message"]
-
-        print "Pull request %s has already been merged, assuming you want to backport" % pr_num
-        commit_is_downloaded = run_cmd(['git', 'rev-parse', '--quiet', '--verify',
-                                    "%s^{commit}" % merge_hash]).strip() != ""
-        if not commit_is_downloaded:
-            fail("Couldn't find any merge commit for #%s, you may need to update HEAD." % pr_num)
-
-        print "Found commit %s:\n%s" % (merge_hash, message)
-        cherry_pick(pr_num, merge_hash, latest_branch)
-        sys.exit(0)
-
-    if not bool(pr["mergeable"]):
-        msg = "Pull request %s is not mergeable in its current form.\n" % pr_num + \
-            "Continue? (experts only!)"
-        continue_maybe(msg)
-
-    print ("\n=== Pull Request #%s ===" % pr_num)
-    print ("PR title\t%s\nCommit title\t%s\nSource\t\t%s\nTarget\t\t%s\nURL\t\t%s" % (
-        pr_title, commit_title, pr_repo_desc, target_ref, url))
+    print(("\n=== Pull Request #%s ===" % pr_num))
+    print(("PR title\t%s\nCommit title\t%s\nSource\t\t%s\nTarget\t\t%s\nURL\t\t%s" % (
+        pr_title, commit_title, pr_repo_desc, target_ref, url)))
     continue_maybe("Proceed with merging pull request #%s?" % pr_num)
 
     merged_refs = [target_ref]
 
-    merge_hash = merge_pr(pr_num, target_ref, commit_title, body, pr_repo_desc)
+    merge_hash = merge_pr(pr_num, commit_title, pr_repo_desc)
 
     pick_prompt = "Would you like to pick %s into another branch?" % merge_hash
-    while raw_input("\n%s (y/n): " % pick_prompt).lower().strip() == "y":
+    while input("\n%s (y/n): " % pick_prompt).lower().strip() == "y":
         merged_refs = merged_refs + [cherry_pick(pr_num, merge_hash, latest_branch)]
 
     if JIRA_IMPORTED:
-        if JIRA_USERNAME and JIRA_PASSWORD:
+        if (JIRA_ACCESS_TOKEN is not None) or (JIRA_USERNAME and JIRA_PASSWORD):
             continue_maybe("Would you like to update an associated JIRA?")
             jira_comment = "Issue resolved by pull request %s\n[%s/%s]" % (pr_num, GITHUB_BASE, pr_num)
             resolve_jira_issues(commit_title, merged_refs, jira_comment)
         else:
-            print "JIRA_USERNAME and JIRA_PASSWORD not set"
-            print "Exiting without trying to close the associated JIRA."
+            print("Neither JIRA_ACCESS_TOKEN nor JIRA_USERNAME and/or JIRA_PASSWORD are set.")
+            print("Exiting without trying to close the associated JIRA.")
     else:
-        print "Could not find jira-python library. Run 'sudo pip install jira' to install."
-        print "Exiting without trying to close the associated JIRA."
+        print("Could not find jira-python library. Run 'sudo pip install jira' to install.")
+        print("Exiting without trying to close the associated JIRA.")
 
 if __name__ == "__main__":
     import doctest
diff --git a/zookeeper-assembly/pom.xml b/zookeeper-assembly/pom.xml
old mode 100755
new mode 100644
index c2b97c0e6a3..317233d6f3b
--- a/zookeeper-assembly/pom.xml
+++ b/zookeeper-assembly/pom.xml
@@ -23,8 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
-    <relativePath>..</relativePath>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-assembly</artifactId>
@@ -53,6 +52,7 @@
       <groupId>org.apache.zookeeper</groupId>
       <artifactId>zookeeper-docs</artifactId>
       <version>${project.version}</version>
+      <type>pom</type>
     </dependency>
     <dependency>
       <groupId>org.apache.zookeeper</groupId>
@@ -100,12 +100,12 @@
       <artifactId>jackson-databind</artifactId>
     </dependency>
     <dependency>
-      <groupId>com.googlecode.json-simple</groupId>
-      <artifactId>json-simple</artifactId>
+      <groupId>org.jline</groupId>
+      <artifactId>jline</artifactId>
     </dependency>
     <dependency>
-      <groupId>jline</groupId>
-      <artifactId>jline</artifactId>
+      <groupId>ch.qos.logback</groupId>
+      <artifactId>logback-classic</artifactId>
     </dependency>
     <dependency>
        <groupId>io.dropwizard.metrics</groupId>
diff --git a/zookeeper-assembly/src/main/assembly/lib-package.xml b/zookeeper-assembly/src/main/assembly/lib-package.xml
index 81194f9e64d..40336cee8fd 100644
--- a/zookeeper-assembly/src/main/assembly/lib-package.xml
+++ b/zookeeper-assembly/src/main/assembly/lib-package.xml
@@ -54,7 +54,7 @@
       <includes>
         <include>LICENSE</include>
       </includes>
-      <outputDirectory>/</outputDirectory>
+      <outputDirectory>.</outputDirectory>
       <fileMode>${rw.file.permission}</fileMode>
       <directoryMode>${rwx.file.permission}</directoryMode>
     </fileSet>
diff --git a/zookeeper-client/pom.xml b/zookeeper-client/pom.xml
old mode 100755
new mode 100644
index 307d60583fe..16f6419f6d2
--- a/zookeeper-client/pom.xml
+++ b/zookeeper-client/pom.xml
@@ -23,8 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
-    <relativePath>..</relativePath>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-client</artifactId>
@@ -39,10 +38,6 @@
         <module>zookeeper-client-c</module>
       </modules>
     </profile>
-    <profile>
-      <id>java-build</id>
-      <modules />
-    </profile>
   </profiles>
   <build>
     <plugins>
@@ -55,4 +50,4 @@
       </plugin>
     </plugins>
   </build>
-</project>
\ No newline at end of file
+</project>
diff --git a/zookeeper-client/zookeeper-client-c/CMakeLists.txt b/zookeeper-client/zookeeper-client-c/CMakeLists.txt
index 8400c1094c7..da1351e20f5 100644
--- a/zookeeper-client/zookeeper-client-c/CMakeLists.txt
+++ b/zookeeper-client/zookeeper-client-c/CMakeLists.txt
@@ -16,7 +16,7 @@
 
 cmake_minimum_required(VERSION 3.5)
 
-project(zookeeper VERSION 3.7.0)
+project(zookeeper VERSION 3.10.0)
 set(email user@zookeeper.apache.org)
 set(description "zookeeper C client")
 
@@ -249,6 +249,7 @@ set(test_sources
   tests/ThreadingUtil.cc
   tests/TestZookeeperInit.cc
   tests/TestZookeeperClose.cc
+  tests/TestSASLAuth.cc
   tests/TestReconfig.cc
   tests/TestReconfigServer.cc
   tests/TestClientRetry.cc
diff --git a/zookeeper-client/zookeeper-client-c/ChangeLog b/zookeeper-client/zookeeper-client-c/ChangeLog
index c85a6c0ad86..040e1d32a44 100644
--- a/zookeeper-client/zookeeper-client-c/ChangeLog
+++ b/zookeeper-client/zookeeper-client-c/ChangeLog
@@ -1,13 +1,13 @@
 Release 2.1.1
 2008-04-30 Andrew Kornev <akornev@users.sourceforge.net>
 
-    * changed the distributino package name to "c-client-src"
+    * changed the distributions package name to "c-client-src"
     
 Release 2.1.0
 2008-04-30 Andrew Kornev <akornev@users.sourceforge.net>
 
     * added the client latency diagnostics; the client prints a warning when the
-      reponse latency exceeds 20ms
+      response latency exceeds 20ms
 
     * modified logging format to report the znode path for which the zookeeper 
       operation is called
@@ -31,12 +31,12 @@ Release 1.1.3
     * get_xid() is not thread-safe (xid initialization race condition 
       in the multi-threaded mode).
     
-    * the I/O thread doesn’t automatically terminate on AUTH_FAILURE and 
+    * the I/O thread doesn't automatically terminate on AUTH_FAILURE and
       SESSION_EXPIRED events.
       
     * all session events should be processed on the completion thread. 
     
-    * PING operation doesn’t atomically enqueue the completion and 
+    * PING operation doesn't atomically enqueue the completion and
       send buffers like other operations do.
       
     * corrected zookeeper_init() doxygen docs.
diff --git a/zookeeper-client/zookeeper-client-c/LICENSE b/zookeeper-client/zookeeper-client-c/LICENSE
index 7df01ad5534..c3e546da36c 100644
--- a/zookeeper-client/zookeeper-client-c/LICENSE
+++ b/zookeeper-client/zookeeper-client-c/LICENSE
@@ -285,7 +285,7 @@
  * The implementation was written so as to conform with Netscapes SSL.
  *
  * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
+ * the following conditions are adhered to.  The following conditions
  * apply to all code found in this distribution, be it the RC4, RSA,
  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  * included with this distribution is covered by the same copyright terms
@@ -310,7 +310,7 @@
  *    must display the following acknowledgement:
  *    "This product includes cryptographic software written by
  *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
+ *    The word 'cryptographic' can be left out if the routines from the library
  *    being used are not cryptographic related :-).
  * 4. If you include any Windows specific code (or a derivative thereof) from
  *    the apps directory (application code) you must include an acknowledgement:
@@ -328,7 +328,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * The licence and distribution terms for any publically available version or
+ * The licence and distribution terms for any publicly available version or
  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  * copied and put under another distribution licence
  * [including the GNU Public Licence.]
diff --git a/zookeeper-client/zookeeper-client-c/Makefile.am b/zookeeper-client/zookeeper-client-c/Makefile.am
index 9c794a5ef09..e42a3539b8a 100644
--- a/zookeeper-client/zookeeper-client-c/Makefile.am
+++ b/zookeeper-client/zookeeper-client-c/Makefile.am
@@ -60,7 +60,7 @@ libzookeeper_st_la_LDFLAGS = $(LIB_LDFLAGS) -export-symbols-regex $(EXPORT_SYMBO
 if WANT_SYNCAPI
 noinst_LTLIBRARIES += libzkmt.la
 libzkmt_la_SOURCES =$(COMMON_SRC) src/mt_adaptor.c
-libzkmt_la_CFLAGS = -DTHREADED
+libzkmt_la_CFLAGS = $(AM_CFLAGS) -DTHREADED
 libzkmt_la_LIBADD = -lm $(CLOCK_GETTIME_LIBS)
 
 lib_LTLIBRARIES += libzookeeper_mt.la
@@ -80,11 +80,11 @@ bin_PROGRAMS += cli_mt load_gen
 
 cli_mt_SOURCES = src/cli.c
 cli_mt_LDADD = libzookeeper_mt.la $(SASL_LIB_LDFLAGS)
-cli_mt_CFLAGS = -DTHREADED
+cli_mt_CFLAGS = $(AM_CFLAGS) -DTHREADED
 
 load_gen_SOURCES = src/load_gen.c
 load_gen_LDADD = libzookeeper_mt.la
-load_gen_CFLAGS = -DTHREADED
+load_gen_CFLAGS = $(AM_CFLAGS) -DTHREADED
 
 endif
 
@@ -134,14 +134,14 @@ TESTS_ENVIRONMENT = ZKROOT=${srcdir}/../.. \
                     CLASSPATH=$$CLASSPATH:$$CLOVER_HOME/lib/clover*.jar
 nodist_zktest_st_SOURCES = $(TEST_SOURCES)
 zktest_st_LDADD = libzkst.la libhashtable.la $(CPPUNIT_LIBS) $(OPENSSL_LIB_LDFLAGS) $(SASL_LIB_LDFLAGS) -ldl
-zktest_st_CXXFLAGS = -DUSE_STATIC_LIB $(CPPUNIT_CFLAGS) $(USEIPV6) $(SOLARIS_CPPFLAGS)
+zktest_st_CXXFLAGS = $(AM_CXXFLAGS) -DUSE_STATIC_LIB $(CPPUNIT_CFLAGS) $(SOLARIS_CPPFLAGS)
 zktest_st_LDFLAGS = -shared $(SYMBOL_WRAPPERS) $(SOLARIS_LIB_LDFLAGS)
 
 if WANT_SYNCAPI
   check_PROGRAMS += zktest-mt
   nodist_zktest_mt_SOURCES = $(TEST_SOURCES) tests/PthreadMocks.cc
   zktest_mt_LDADD = libzkmt.la libhashtable.la -lpthread $(CPPUNIT_LIBS) $(OPENSSL_LIB_LDFLAGS) $(SASL_LIB_LDFLAGS) -ldl
-  zktest_mt_CXXFLAGS = -DUSE_STATIC_LIB -DTHREADED $(CPPUNIT_CFLAGS) $(USEIPV6)
+  zktest_mt_CXXFLAGS = $(AM_CXXFLAGS) -DUSE_STATIC_LIB -DTHREADED $(CPPUNIT_CFLAGS) $(USEIPV6)
 if SOLARIS
   SHELL_SYMBOL_WRAPPERS_MT = cat ${srcdir}/tests/wrappers-mt.opt
   SYMBOL_WRAPPERS_MT=$(SYMBOL_WRAPPERS) $(SHELL_SYMBOL_WRAPPERS_MT:sh)
diff --git a/zookeeper-client/zookeeper-client-c/README b/zookeeper-client/zookeeper-client-c/README
index ade5ad98fa1..24869756b63 100644
--- a/zookeeper-client/zookeeper-client-c/README
+++ b/zookeeper-client/zookeeper-client-c/README
@@ -34,70 +34,8 @@ Sync and Async API.
 
 INSTALLATION
 
-If you're building the client from a source checkout you need to
-follow the steps outlined below. If you're building from a release
-tar downloaded from Apache please skip to step 2.
-
-1) do a "ant compile_jute" from the zookeeper top level directory (.../trunk).
-   This will create a directory named "generated" under zookeeper-client/zookeeper-client-c.
-   Skip to step 3.
-2) unzip/untar the source tarball and cd to the zookeeper-x.x.x/zookeeper-client/zookeeper-client-c directory
-3) change directory to zookeeper-client/zookeeper-client-c and do a "autoreconf -if" to bootstrap
-   autoconf, automake and libtool. Please make sure you have autoconf
-   version 2.59 or greater installed. If cppunit is installed in a non-standard
-   directory, you need to specify where to find cppunit.m4. For example, if
-   cppunit is installed under /usr/local, run:
-   
-       ACLOCAL="aclocal -I /usr/local/share/aclocal" autoreconf -if
-
-4) do a "./configure [OPTIONS]" to generate the makefile. See INSTALL
-   for general information about running configure. Additionally, the
-   configure supports the following options:
-   --enable-debug     enables optimization and enables debug info compiler
-                      options, disabled by default
-   --without-syncapi  disables Sync API support; zookeeper_mt library won't
-                      be built, enabled by default
-   --disable-static   do not build static libraries, enabled by default
-   --disable-shared   do not build shared libraries, enabled by default
-   --without-cppunit  do not build the test library, enabled by default.
-
-5) do a "make" or "make install" to build the libraries and install them. 
-   Alternatively, you can also build and run a unit test suite (and
-   you probably should).  Please make sure you have cppunit-1.10.x or
-   higher installed before you execute step 4.  Once ./configure has
-   finished, do a "make check". It will build the libraries, build
-   the tests and run them.
-6) to generate doxygen documentation do a "make doxygen-doc". All
-   documentations will be placed to a new subfolder named docs. By
-   default only HTML documentation is generated.  For information on
-   other document formats please use "./configure --help"
-
-Alternatively you can use the CMake build system. On Windows, this is required.
-Follow steps 1 and 2 above, and then continue here.
-
-1) do a "cmake [OPTIONS]" to generate the makefile or msbuild files (the correct
-   build system will be generated based on your platform). Some options from above
-   are supported:
-   -DCMAKE_BUILD_TYPE  Debug by default, Release enables optimzation etc.
-   -DWANT_SYNCAPI      ON by default, OFF disables the Sync API support
-   -DWANT_CPPUNIT      ON except on Windows, OFF disables the tests
-   -DWITH_OPENSSL      ON by default, OFF disables the SSL support. You can also
-                       specify a custom path by -DWITH_OPENSSL=/path/to/openssl/
-   -DWITH_CYRUS_SASL   ON by default, OFF disables SASL support. You can also
-                       specify a custom path by -DWITH_CYRUS_SASL=/path/to/cyrus-sasl/
-   -DBUILD_SHARED_LIBS not yet supported, only static libraries are built
-   other CMake options see "cmake --help" for generic options, such as generator
-
-2) do a "cmake --build ." to build the default targets. Alternatively you can
-   invoke "make" or "msbuild" manually. If the tests were enabled, use "ctest -V"
-   to run them.
-
-Current limitations of the CMake build system include lack of Solaris support,
-no shared library option, no explicitly exported symbols (all are exported by
-default), no versions on the libraries, and no documentation generation.
-Features of CMake include a single, easily consumed cross-platform build system
-to generate the ZooKeeper C Client libraries for any project, with little to no
-configuration.
+Please refer to the "Installation" item under "C Binding" section in file
+".../trunk/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md"
 
 EXAMPLE/SAMPLE C CLIENT SHELL
 
diff --git a/zookeeper-client/zookeeper-client-c/acinclude.m4 b/zookeeper-client/zookeeper-client-c/acinclude.m4
index 9734f215649..55061709180 100644
--- a/zookeeper-client/zookeeper-client-c/acinclude.m4
+++ b/zookeeper-client/zookeeper-client-c/acinclude.m4
@@ -10,7 +10,7 @@
 # DX_???_FEATURE(ON|OFF) - control the default setting of a Doxygen feature.
 # Supported features are 'DOXYGEN' itself, 'DOT' for generating graphics,
 # 'HTML' for plain HTML, 'CHM' for compressed HTML help (for MS users), 'CHI'
-# for generating a seperate .chi file by the .chm file, and 'MAN', 'RTF',
+# for generating a separate .chi file by the .chm file, and 'MAN', 'RTF',
 # 'XML', 'PDF' and 'PS' for the appropriate output formats. The environment
 # variable DOXYGEN_PAPER_SIZE may be specified to override the default 'a4wide'
 # paper size.
@@ -239,8 +239,8 @@ DX_ARG_ABLE(chm, [generate doxygen compressed HTML help documentation],
              DX_ENV_APPEND(GENERATE_HTMLHELP, YES)],
             [DX_ENV_APPEND(GENERATE_HTMLHELP, NO)])
 
-# Seperate CHI file generation.
-DX_ARG_ABLE(chi, [generate doxygen seperate compressed HTML help index file],
+# Separate CHI file generation.
+DX_ARG_ABLE(chi, [generate doxygen separate compressed HTML help index file],
             [DX_CHECK_DEPEND(chm, 1)],
             [DX_CLEAR_DEPEND(chm, 1)],
             [],
diff --git a/zookeeper-client/zookeeper-client-c/configure.ac b/zookeeper-client/zookeeper-client-c/configure.ac
index 8e24d651c1b..0de8427e5bb 100644
--- a/zookeeper-client/zookeeper-client-c/configure.ac
+++ b/zookeeper-client/zookeeper-client-c/configure.ac
@@ -3,7 +3,7 @@
 
 AC_PREREQ(2.59)
 
-AC_INIT([zookeeper C client],3.7.0,[user@zookeeper.apache.org],[zookeeper])
+AC_INIT([zookeeper C client],3.10.0,[user@zookeeper.apache.org],[zookeeper])
 AC_CONFIG_SRCDIR([src/zookeeper.c])
 
 # Save initial CFLAGS and CXXFLAGS values before AC_PROG_CC and AC_PROG_CXX
diff --git a/zookeeper-client/zookeeper-client-c/include/zookeeper.h b/zookeeper-client/zookeeper-client-c/include/zookeeper.h
index 243fac28430..ead328a94a0 100644
--- a/zookeeper-client/zookeeper-client-c/include/zookeeper.h
+++ b/zookeeper-client/zookeeper-client-c/include/zookeeper.h
@@ -108,7 +108,7 @@ enum ZOO_ERRORS {
   ZBADARGUMENTS = -8, /*!< Invalid arguments */
   ZINVALIDSTATE = -9, /*!< Invliad zhandle state */
   ZNEWCONFIGNOQUORUM = -13, /*!< No quorum of new config is connected and
-                                 up-to-date with the leader of last commmitted
+                                 up-to-date with the leader of last committed
                                  config - try invoking reconfiguration after new
                                  servers are connected and synced */
   ZRECONFIGINPROGRESS = -14, /*!< Reconfiguration requested while another
@@ -140,7 +140,10 @@ enum ZOO_ERRORS {
   ZEPHEMERALONLOCALSESSION = -120, /*!< Attempt to create ephemeral node on a local session */
   ZNOWATCHER = -121, /*!< The watcher couldn't be found */
   ZRECONFIGDISABLED = -123, /*!< Attempts to perform a reconfiguration operation when reconfiguration feature is disabled */
-  ZSESSIONCLOSEDREQUIRESASLAUTH = -124 /*!< The session has been closed by server because server requires client to do SASL authentication, but client is not configured with SASL authentication or configuted with SASL but failed (i.e. wrong credential used.). */
+  ZSESSIONCLOSEDREQUIRESASLAUTH = -124, /*!< The session has been closed by server because server requires client to do authentication via configured authentication scheme at server, but client is not configured with required authentication scheme or configured but failed (i.e. wrong credential used.). */
+  ZTHROTTLEDOP = -127 /*!< Operation was throttled and not executed at all. please, retry! */
+
+  /* when adding/changing values here also update zerror(int) to return correct error message */
 };
 
 #ifdef __cplusplus
@@ -534,6 +537,38 @@ ZOOAPI zhandle_t *zookeeper_init(const char *host, watcher_fn fn,
   int recv_timeout, const clientid_t *clientid, void *context, int flags);
 
 #ifdef HAVE_OPENSSL_H
+/**
+ * \brief create a handle to communicate with zookeeper using SSL.
+ *
+ * This method creates a new handle and a zookeeper session that corresponds
+ * to that handle. Session establishment is asynchronous, meaning that the
+ * session should not be considered established until (and unless) an
+ * event of state ZOO_CONNECTED_STATE is received.
+ * \param host comma separated host:port pairs, each corresponding to a zk
+ *   server. e.g. "127.0.0.1:3000,127.0.0.1:3001,127.0.0.1:3002"
+ * \param cert SSL certificate string. Two formats are supported: server CA
+ *   only e.g. "/path/to/server_ca.cer" and server CA with client certificate e.g.
+ *   "/path/to/server_ca.cer,/path/to/client_cert.pem,/path/to/client_cert.key,client_cert_password".
+ * \param fn the global watcher callback function. When notifications are
+ *   triggered this function will be invoked.
+ * \param recv_timeout the timeout for the zookeeper session.
+ * \param clientid the id of a previously established session that this
+ *   client will be reconnecting to. Pass 0 if not reconnecting to a previous
+ *   session. Clients can access the session id of an established, valid,
+ *   connection by calling \ref zoo_client_id. If the session corresponding to
+ *   the specified clientid has expired, or if the clientid is invalid for
+ *   any reason, the returned zhandle_t will be invalid -- the zhandle_t
+ *   state will indicate the reason for failure (typically
+ *   ZOO_EXPIRED_SESSION_STATE).
+ * \param context the handback object that will be associated with this instance
+ *   of zhandle_t. Application can access it (for example, in the watcher
+ *   callback) using \ref zoo_get_context. The object is not used by zookeeper
+ *   internally and can be null.
+ * \param flags reserved for future use. Should be set to zero.
+ * \return a pointer to the opaque zhandle structure. If it fails to create
+ * a new zhandle the function returns NULL and the errno variable
+ * indicates the reason.
+ */
 ZOOAPI zhandle_t *zookeeper_init_ssl(const char *host, const char *cert, watcher_fn fn,
   int recv_timeout, const clientid_t *clientid, void *context, int flags);
 #endif
@@ -664,8 +699,85 @@ ZOOAPI zhandle_t *zookeeper_init_sasl(const char *host, watcher_fn fn,
 ZOOAPI sasl_callback_t *zoo_sasl_make_basic_callbacks(const char *user,
   const char *realm, const char* password_file);
 
+/**
+ * \brief signature of the callback function for SASL password.
+ *
+ * This callback is defined by user to decrypt the content of password file with
+ * context into the actual password.
+ *
+ * \param content the string read from the password file.
+ * \param content_len the size of the content in bytes.
+ * \param context the handback object that will be associated with the password
+ *   file. The object is not used by zookeeper internally and can be null.
+ * \param buf the buffer where the resulting actual password is saved.
+ * \param buf_len the size of buf in bytes, which is also the max allowed
+ *   password length.
+ * \param passwd_len as an output parameter of the callback function, passwd_len
+ *   points to the actual length of the password stored in buf. Its size must not
+ *   exceed buf_len; otherwise, SASL_BUFOVER will be returned.
+ * \return SASL_OK, or the possible errors defined by the SASL library.
+ */
+typedef int (*zoo_sasl_password_callback_t)(const char *content, size_t content_len,
+        void *context, char *buf, size_t buf_len, size_t *passwd_len);
+
+/**
+ * \brief zoo_sasl_password structure.
+ *
+ * This structure holds the parameters for getting the actual SASL password. The
+ * user-defined callback is a processor that decrypts the content of password_file
+ * with context as a handback object helping the decryption into the actual password
+ * as is described above for zoo_sasl_password_callback_t.
+ *
+ * All of password_file, context and callback are allowed to be null; however, once
+ * callback is defined, password_file should not be null since the content processed
+ * by callback is from password_file. If callback is null and password_file is given,
+ * the first line of the file is just the actual password. While both password_file
+ * and callback are null, the password would be read from terminal with prompt.
+ *
+ * zoo_sasl_password is defined by user and used to generate the actual password in
+ * response to \c SASL_CB_PASS.
+ */
+typedef struct zoo_sasl_password {
+  const char *password_file;                /*!< The path of the password file */
+  void *context;                            /*!< The handback object used by callback */
+  zoo_sasl_password_callback_t callback;    /*!< Callback over the content of password file */
+} zoo_sasl_password_t;
+
+/**
+ * \brief allocates and initializes a basic array of Cyrus SASL callbacks.
+ *
+ * This helper function is similar to zoo_sasl_make_basic_callbacks, except that
+ * the actual password is generated by zoo_sasl_password object rather than just
+ * read from the password file.
+ *
+ * \param user the "canned" response to \c SASL_CB_USER and \c SASL_CB_AUTHNAME,
+ *   or NULL for none.
+ * \param realm the "canned" response to \c SASL_CB_GETREALM, or NULL for none.
+ * \param password the object defined by user to specify how the actual password
+ *   is generated in response to \c SASL_CB_PASS, should never be NULL (otherwise
+ *   the behaviour is undefined), see struct zoo_sasl_password for details.
+ * \return the freshly-malloc()ed callbacks array, or NULL if allocation
+ *   failed. Deallocate with free(), but only after the corresponding
+ *   ZooKeeper handle is closed.
+ */
+ZOOAPI sasl_callback_t *zoo_sasl_make_password_callbacks(const char *user,
+  const char *realm, zoo_sasl_password_t *password);
+
 #endif /* HAVE_CYRUS_SASL_H */
 
+
+/**
+ * \brief return ZOO_VERSION from loaded library as a string.
+ *
+ * This method allows a calling program to determine at runtime whether the
+ * version of the dynamically loaded zookeeper library (a.k.a. zoo_version_str())
+ * is same as the version of the library the calling program was compiled against
+ * (a.k.a. ZOO_VERSION).
+ *
+ * \return a string in shape "MAJOR.MINOR.PATCH", say "3.10.0"
+ */
+ZOOAPI const char* zoo_version_str();
+
 /**
  * \brief update the list of servers this client will connect to.
  *
@@ -694,10 +806,36 @@ ZOOAPI sasl_callback_t *zoo_sasl_make_basic_callbacks(const char *user,
  * \return ZOK on success or one of the following errcodes on failure:
  * ZBADARGUMENTS - invalid input parameters
  * ZINVALIDSTATE - zhandle state is either ZOO_SESSION_EXPIRED_STATE or ZOO_AUTH_FAILED_STATE
- * ZSYSTEMERROR -- a system (OS) error occured; it's worth checking errno to get details
+ * ZSYSTEMERROR -- a system (OS) error occurred; it's worth checking errno to get details
  */
 ZOOAPI int zoo_set_servers(zhandle_t *zh, const char *hosts);
 
+/**
+ * \brief sets a minimum delay to observe between "routine" host name
+ * resolutions.
+ *
+ * The client performs regular resolutions of the list of servers
+ * passed to \ref zookeeper_init or set with \ref zoo_set_servers in
+ * order to detect changes at the DNS level.
+ *
+ * By default, it does so every time it checks for socket readiness.
+ * This results in low latency in the detection of changes, but can
+ * lead to heavy DNS traffic when the local cache is not effective.
+ *
+ * This method allows an application to influence the rate of polling.
+ * When delay_ms is set to a value greater than zero, the client skips
+ * most "routine" resolutions which would have happened in a window of
+ * that many milliseconds since the last successful one.
+ *
+ * Setting delay_ms to 0 disables this logic, reverting to the default
+ * behavior.  Setting it to -1 disables network resolutions during
+ * normal operation (but not, e.g., on connection loss).
+ *
+ * \param delay_ms 0, -1, or the window size in milliseconds
+ * \return ZOK on success or ZBADARGUMENTS for invalid input parameters
+ */
+ZOOAPI int zoo_set_servers_resolution_delay(zhandle_t *zh, int delay_ms);
+
 /**
  * \brief cycle to the next server on the next connection attempt.
  *
@@ -1750,7 +1888,7 @@ typedef enum {
  * \param wtype the watcher type to be removed
  * \param watcher the watcher to be removed, if null all watches for that
  * path (and watcher type) will be removed
- * \param watcherCtx the contex associated with the watcher to be removed
+ * \param watcherCtx the context associated with the watcher to be removed
  * \param local whether the watches will be removed locally even if there is
  * no server connection
  * \return the return code for the function call.
@@ -1760,7 +1898,7 @@ typedef enum {
  * or ZOO_AUTH_FAILED_STATE
  * ZBADARGUMENTS - invalid input parameters
  * ZMARSHALLINGERROR - failed to marshall a request; possibly, out of memory
- * ZSYSTEMERROR - a system error occured
+ * ZSYSTEMERROR - a system error occurred
  */
 ZOOAPI int zoo_aremove_watches(zhandle_t *zh, const char *path,
         ZooWatcherType wtype, watcher_fn watcher, void *watcherCtx, int local,
@@ -1781,7 +1919,7 @@ ZOOAPI int zoo_aremove_watches(zhandle_t *zh, const char *path,
  * or ZOO_AUTH_FAILED_STATE
  * ZBADARGUMENTS - invalid input parameters
  * ZMARSHALLINGERROR - failed to marshall a request; possibly, out of memory
- * ZSYSTEMERROR - a system error occured
+ * ZSYSTEMERROR - a system error occurred
  */
 ZOOAPI int zoo_remove_all_watches(zhandle_t *zh, const char *path,
         ZooWatcherType wtype, int local);
@@ -1801,7 +1939,7 @@ ZOOAPI int zoo_remove_all_watches(zhandle_t *zh, const char *path,
  * or ZOO_AUTH_FAILED_STATE
  * ZBADARGUMENTS - invalid input parameters
  * ZMARSHALLINGERROR - failed to marshall a request; possibly, out of memory
- * ZSYSTEMERROR - a system error occured
+ * ZSYSTEMERROR - a system error occurred
 */
 ZOOAPI int zoo_aremove_all_watches(zhandle_t *zh, const char *path,
         ZooWatcherType wtype, int local, void_completion_t *completion,
@@ -2405,7 +2543,7 @@ ZOOAPI int zoo_multi(zhandle_t *zh, int count, const zoo_op_t *ops, zoo_op_resul
  * \param wtype the watcher type to be removed
  * \param watcher the watcher to be removed, if null all watches for that
  * path (and watcher type) will be removed
- * \param watcherCtx the contex associated with the watcher to be removed
+ * \param watcherCtx the context associated with the watcher to be removed
  * \param local whether the watches will be removed locally even if there is
  * no server connection
  * \return the return code for the function call.
@@ -2415,7 +2553,7 @@ ZOOAPI int zoo_multi(zhandle_t *zh, int count, const zoo_op_t *ops, zoo_op_resul
  * or ZOO_AUTH_FAILED_STATE
  * ZBADARGUMENTS - invalid input parameters
  * ZMARSHALLINGERROR - failed to marshall a request; possibly, out of memory
- * ZSYSTEMERROR - a system error occured
+ * ZSYSTEMERROR - a system error occurred
  */
 ZOOAPI int zoo_remove_watches(zhandle_t *zh, const char *path,
         ZooWatcherType wtype, watcher_fn watcher, void *watcherCtx, int local);
diff --git a/zookeeper-client/zookeeper-client-c/include/zookeeper_version.h b/zookeeper-client/zookeeper-client-c/include/zookeeper_version.h
index 9fa2bae3d2f..639eaf5fe28 100644
--- a/zookeeper-client/zookeeper-client-c/include/zookeeper_version.h
+++ b/zookeeper-client/zookeeper-client-c/include/zookeeper_version.h
@@ -22,7 +22,7 @@
 extern "C" {
 #endif
 
-#define ZOO_VERSION "3.7.0"
+#define ZOO_VERSION "3.10.0"
 
 #ifdef __cplusplus
 }
diff --git a/zookeeper-client/zookeeper-client-c/pom.xml b/zookeeper-client/zookeeper-client-c/pom.xml
old mode 100755
new mode 100644
index e8ea1aa7a97..91e45cff3e8
--- a/zookeeper-client/zookeeper-client-c/pom.xml
+++ b/zookeeper-client/zookeeper-client-c/pom.xml
@@ -23,32 +23,17 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-client</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
-    <relativePath>..</relativePath>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-client-c</artifactId>
-  <packaging>jar</packaging>
+  <packaging>pom</packaging>
   <name>Apache ZooKeeper - Client - C</name>
   <description>ZooKeeper c client</description>
 
-  <profiles>
-    <profile>
-      <id>c-test-coverage</id>
-      <properties>
-        <c-test-coverage-arg>--enable-gcov</c-test-coverage-arg>
-      </properties>
-    </profile>
-    <profile>
-      <id>no-c-test-coverage</id>
-      <activation>
-        <activeByDefault>true</activeByDefault>
-      </activation>
-      <properties>
-        <c-test-coverage-arg> </c-test-coverage-arg>
-      </properties>
-    </profile>
-  </profiles>
+  <properties>
+    <c-test-coverage-arg> </c-test-coverage-arg>
+  </properties>
 
   <build>
     <plugins>
@@ -104,9 +89,9 @@
             <id>generate-sources</id>
             <phase>generate-sources</phase>
             <configuration>
-              <tasks>
+              <target>
                 <mkdir dir="target/c" />
-              </tasks>
+              </target>
             </configuration>
             <goals>
               <goal>run</goal>
@@ -116,7 +101,7 @@
             <id>build-c-client</id>
             <phase>compile</phase>
             <configuration>
-              <tasks>
+              <target>
                 <exec dir="${basedir}/target/c" executable="make" failonerror="true">
                   <env key="LD_LIBRARY_PATH" value="${env.LD_LIBRARY_PATH};/usr/lib" />
                   <env key="PATH" path="${env.PATH};${basedir};" />
@@ -125,28 +110,7 @@
                   <env key="base_dir" value="${basedir}/../.." />
                   <arg line="clean install" />
                 </exec>
-              </tasks>
-            </configuration>
-            <goals>
-              <goal>run</goal>
-            </goals>
-          </execution>
-          <execution>
-            <id>test-cppunit</id>
-            <phase>test</phase>
-            <configuration>
-              <!-- do not run cpp tests if tests are globally skipped -->
-              <skip>${skipTests}</skip>
-              <tasks>
-                <exec dir="${basedir}/target/c" executable="make" failonerror="true">
-                  <env key="LD_LIBRARY_PATH" value="${env.LD_LIBRARY_PATH};/usr/lib" />
-                  <env key="PATH" path="${env.PATH};${basedir};" />
-                  <env key="CALLER" value="ANT" />
-                  <env key="CLOVER_HOME" value="${basedir}/../../zookeeper-server/target" />
-                  <env key="base_dir" value="${basedir}/../.." />
-                  <arg line="check" />
-                </exec>
-              </tasks>
+              </target>
             </configuration>
             <goals>
               <goal>run</goal>
@@ -160,7 +124,7 @@
             </goals>
             <configuration>
                <target>
-                  <replaceregexp file="include/zookeeper_version.h" match="project.*" replace="project(zookeeper VERSION ${project.version})" byline="true" />
+                  <replaceregexp file="include/zookeeper_version.h" match="\#define ZOO_VERSION.*" replace="#define ZOO_VERSION &quot;${project.version}&quot;" byline="true" />
                   <replace file="include/zookeeper_version.h" value="">
                       <replaceToken>-SNAPSHOT</replaceToken>
                   </replace>
@@ -179,5 +143,54 @@
       </plugin>
     </plugins>
   </build>
+  <profiles>
+    <profile>
+      <id>c-test-coverage</id>
+      <properties>
+        <c-test-coverage-arg>--enable-gcov</c-test-coverage-arg>
+      </properties>
+    </profile>
+    <profile>
+      <!-- can be skipped by deactivating the profile with -P!cppunit (may need to escape or quote exclamation on command-line) -->
+      <id>cppunit</id>
+      <activation>
+        <property>
+          <!-- can also be skipped by -DskipCppUnit or with -DskipTests (see below) -->
+          <name>!skipCppUnit</name>
+        </property>
+      </activation>
+      <build>
+        <plugins>
+          <plugin>
+            <groupId>org.apache.maven.plugins</groupId>
+            <artifactId>maven-antrun-plugin</artifactId>
+            <executions>
+              <execution>
+                <id>test-cppunit</id>
+                <phase>test</phase>
+                <configuration>
+                  <!-- do not run cpp tests if tests are globally skipped -->
+                  <skip>${skipTests}</skip>
+                  <target>
+                    <exec dir="${basedir}/target/c" executable="make" failonerror="true">
+                      <env key="LD_LIBRARY_PATH" value="${env.LD_LIBRARY_PATH};/usr/lib" />
+                      <env key="PATH" path="${env.PATH};${basedir};" />
+                      <env key="CALLER" value="ANT" />
+                      <env key="CLOVER_HOME" value="${basedir}/../../zookeeper-server/target" />
+                      <env key="base_dir" value="${basedir}/../.." />
+                      <arg line="check" />
+                    </exec>
+                  </target>
+                </configuration>
+                <goals>
+                  <goal>run</goal>
+                </goals>
+              </execution>
+            </executions>
+          </plugin>
+        </plugins>
+      </build>
+    </profile>
+  </profiles>
 
 </project>
diff --git a/zookeeper-client/zookeeper-client-c/src/addrvec.c b/zookeeper-client/zookeeper-client-c/src/addrvec.c
index fdfb68d34fd..b7f244e7afb 100644
--- a/zookeeper-client/zookeeper-client-c/src/addrvec.c
+++ b/zookeeper-client/zookeeper-client-c/src/addrvec.c
@@ -126,8 +126,26 @@ int addrvec_contains(const addrvec_t *avec, const struct sockaddr_storage *addr)
 
     for (i = 0; i < avec->count; i++)
     {
-        if(memcmp(&avec->data[i], addr, INET_ADDRSTRLEN) == 0)
-            return 1;
+        if (avec->data[i].ss_family != addr->ss_family)
+            continue;
+        switch (addr->ss_family) {
+        case AF_INET:
+            if (memcmp(&((struct sockaddr_in*)&avec->data[i])->sin_addr,
+                       &((struct sockaddr_in*)addr)->sin_addr,
+                       sizeof(struct in_addr)) == 0)
+                return 1;
+            break;
+#ifdef AF_INET6
+        case AF_INET6:
+            if (memcmp(&((struct sockaddr_in6*)&avec->data[i])->sin6_addr,
+                       &((struct sockaddr_in6*)addr)->sin6_addr,
+                       sizeof(struct in6_addr)) == 0)
+                return 1;
+            break;
+#endif
+        default:
+            break;
+        }
     }
 
     return 0;
diff --git a/zookeeper-client/zookeeper-client-c/src/addrvec.h b/zookeeper-client/zookeeper-client-c/src/addrvec.h
index a12642908bb..2a9a8ad9117 100644
--- a/zookeeper-client/zookeeper-client-c/src/addrvec.h
+++ b/zookeeper-client/zookeeper-client-c/src/addrvec.h
@@ -74,7 +74,7 @@ int addrvec_grow(addrvec_t *avec, uint32_t grow_amount);
 int addrvec_grow_default(addrvec_t *avec);
 
 /**
- * Check if an addrvec contains the specificed sockaddr_storage value.
+ * Check if an addrvec contains the specified sockaddr_storage value.
  * \returns 1 if it contains the value and 0 otherwise.
  */
 int addrvec_contains(const addrvec_t *avec, const struct sockaddr_storage *addr);
diff --git a/zookeeper-client/zookeeper-client-c/src/cli.c b/zookeeper-client/zookeeper-client-c/src/cli.c
index 1864e564571..c34be8d5961 100644
--- a/zookeeper-client/zookeeper-client-c/src/cli.c
+++ b/zookeeper-client/zookeeper-client-c/src/cli.c
@@ -924,7 +924,7 @@ int main(int argc, char **argv) {
     if (clientIdFile) {
         fh = fopen(clientIdFile, "r");
         if (fh) {
-            if (fread(&myid, sizeof(myid), 1, fh) != sizeof(myid)) {
+            if (fread(&myid, sizeof(myid), 1, fh) != 1) {
                 memset(&myid, 0, sizeof(myid));
             }
             fclose(fh);
@@ -948,6 +948,17 @@ int main(int argc, char **argv) {
     zoo_deterministic_conn_order(1); // enable deterministic order
 
 #ifdef HAVE_CYRUS_SASL_H
+    /*
+     * We need to disable the deprecation warnings as Apple has
+     * decided to deprecate all of CyrusSASL's functions with OS 10.11
+     * (see MESOS-3030, ZOOKEEPER-4201). We are using GCC pragmas also
+     * for covering clang.
+     */
+#ifdef __APPLE__
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+#endif
+
     if (mechlist) {
         zoo_sasl_params_t sasl_params = { 0 };
         int sr;
@@ -977,6 +988,11 @@ int main(int argc, char **argv) {
             return errno;
         }
     }
+
+#ifdef __APPLE__
+#pragma GCC diagnostic pop
+#endif
+
 #endif /* HAVE_CYRUS_SASL_H */
 
     if (!zh) {
diff --git a/zookeeper-client/zookeeper-client-c/src/hashtable/hashtable.c b/zookeeper-client/zookeeper-client-c/src/hashtable/hashtable.c
index caa5f6ccc03..bc94a59599b 100644
--- a/zookeeper-client/zookeeper-client-c/src/hashtable/hashtable.c
+++ b/zookeeper-client/zookeeper-client-c/src/hashtable/hashtable.c
@@ -70,7 +70,7 @@ hash(struct hashtable *h, void *k)
 static int
 hashtable_expand(struct hashtable *h)
 {
-    /* Double the size of the table to accomodate more entries */
+    /* Double the size of the table to accommodate more entries */
     struct entry **newtable;
     struct entry *e;
     struct entry **pE;
diff --git a/zookeeper-client/zookeeper-client-c/src/load_gen.c b/zookeeper-client/zookeeper-client-c/src/load_gen.c
index 886fe1b3e3c..f25edcbe928 100644
--- a/zookeeper-client/zookeeper-client-c/src/load_gen.c
+++ b/zookeeper-client/zookeeper-client-c/src/load_gen.c
@@ -27,8 +27,6 @@
 
 static zhandle_t *zh;
 
-static int shutdownThisThing=0;
-
 // *****************************************************************************
 //
 static pthread_cond_t cond=PTHREAD_COND_INITIALIZER;
diff --git a/zookeeper-client/zookeeper-client-c/src/mt_adaptor.c b/zookeeper-client/zookeeper-client-c/src/mt_adaptor.c
index 38cced425ba..174701c7358 100644
--- a/zookeeper-client/zookeeper-client-c/src/mt_adaptor.c
+++ b/zookeeper-client/zookeeper-client-c/src/mt_adaptor.c
@@ -121,7 +121,7 @@ int handle_error(zhandle_t* zh, SOCKET sock, char* message)
        return -1;
 }
 
-//--create socket pair for interupting selects.
+//--create socket pair for interrupting selects.
 int create_socket_pair(zhandle_t* zh, SOCKET fds[2]) 
 { 
     struct sockaddr_in inaddr; 
@@ -256,12 +256,13 @@ int adaptor_init(zhandle_t *zh)
     pthread_mutex_init(&zh->to_process.lock,0);
     pthread_mutex_init(&adaptor_threads->zh_lock,0);
     pthread_mutex_init(&adaptor_threads->reconfig_lock,0);
-    // to_send must be recursive mutex    
+    pthread_mutex_init(&adaptor_threads->watchers_lock,0);
+    // to_send must be recursive mutex
     pthread_mutexattr_init(&recursive_mx_attr);
     pthread_mutexattr_settype(&recursive_mx_attr, PTHREAD_MUTEX_RECURSIVE);
     pthread_mutex_init(&zh->to_send.lock,&recursive_mx_attr);
     pthread_mutexattr_destroy(&recursive_mx_attr);
-    
+
     pthread_mutex_init(&zh->sent_requests.lock,0);
     pthread_cond_init(&zh->sent_requests.cond,0);
     pthread_mutex_init(&zh->completions_to_process.lock,0);
@@ -358,6 +359,7 @@ unsigned __stdcall do_io( void * v)
 void *do_io(void *v)
 #endif
 {
+    log_callback_fn log_fn;
     zhandle_t *zh = (zhandle_t*)v;
 #ifndef WIN32
     struct pollfd fds[2];
@@ -369,13 +371,14 @@ void *do_io(void *v)
     fds[0].fd=adaptor_threads->self_pipe[0];
     fds[0].events=POLLIN;
     while(!zh->close_requested) {
-        zh->io_count++;
         struct timeval tv;
         int fd;
         int interest;
         int timeout;
         int maxfd=1;
 
+        zh->io_count++;
+
         zookeeper_interest(zh, &fd, &interest, &tv);
         if (fd != -1) {
             fds[1].fd=fd;
@@ -454,8 +457,9 @@ void *do_io(void *v)
         if(is_unrecoverable(zh))
             break;
     }
-    api_epilog(zh, 0);    
-    LOG_DEBUG(LOGCALLBACK(zh), "IO thread terminated");
+    log_fn = LOGCALLBACK(zh);
+    api_epilog(zh, 0);
+    LOG_DEBUG(log_fn, "IO thread terminated");
     return 0;
 }
 
@@ -466,6 +470,7 @@ void *do_completion(void *v)
 #endif
 {
     zhandle_t *zh = v;
+    log_callback_fn fn;
     api_prolog(zh);
     notify_thread_ready(zh);
     LOG_DEBUG(LOGCALLBACK(zh), "started completion thread");
@@ -477,8 +482,9 @@ void *do_completion(void *v)
         pthread_mutex_unlock(&zh->completions_to_process.lock);
         process_completions(zh);
     }
-    api_epilog(zh, 0);    
-    LOG_DEBUG(LOGCALLBACK(zh), "completion thread terminated");
+    fn = LOGCALLBACK(zh);
+    api_epilog(zh, 0);
+    LOG_DEBUG(fn, "completion thread terminated");
     return 0;
 }
 
@@ -530,6 +536,25 @@ int unlock_reconfig(struct _zhandle *zh)
     }
 }
 
+int lock_watchers(struct _zhandle *zh)
+{
+    struct adaptor_threads *adaptor = zh->adaptor_priv;
+    if (adaptor) {
+        return pthread_mutex_lock(&adaptor->watchers_lock);
+    } else {
+        return 0;
+    }
+}
+int unlock_watchers(struct _zhandle *zh)
+{
+    struct adaptor_threads *adaptor = zh->adaptor_priv;
+    if (adaptor) {
+        return pthread_mutex_unlock(&adaptor->watchers_lock);
+    } else {
+        return 0;
+    }
+}
+
 int enter_critical(zhandle_t* zh)
 {
     struct adaptor_threads *adaptor = zh->adaptor_priv;
diff --git a/zookeeper-client/zookeeper-client-c/src/recordio.c b/zookeeper-client/zookeeper-client-c/src/recordio.c
index 77fae28785f..52036f94e7a 100644
--- a/zookeeper-client/zookeeper-client-c/src/recordio.c
+++ b/zookeeper-client/zookeeper-client-c/src/recordio.c
@@ -145,7 +145,7 @@ int oa_serialize_buffer(struct oarchive *oa, const char *name,
         return rc;
     // this means a buffer of NUll 
     // with size of -1. This is 
-    // waht we use in java serialization for NULL
+    // what we use in java serialization for NULL
     if (b->len == -1) {
       return rc;
     }
diff --git a/zookeeper-client/zookeeper-client-c/src/st_adaptor.c b/zookeeper-client/zookeeper-client-c/src/st_adaptor.c
index ddc2582db34..07540b76ac1 100644
--- a/zookeeper-client/zookeeper-client-c/src/st_adaptor.c
+++ b/zookeeper-client/zookeeper-client-c/src/st_adaptor.c
@@ -94,6 +94,16 @@ int unlock_reconfig(struct _zhandle *zh)
     return 0;
 }
 
+int lock_watchers(struct _zhandle *zh)
+{
+    return 0;
+}
+
+int unlock_watchers(struct _zhandle *zh)
+{
+    return 0;
+}
+
 int enter_critical(zhandle_t* zh)
 {
     return 0;
diff --git a/zookeeper-client/zookeeper-client-c/src/winport.c b/zookeeper-client/zookeeper-client-c/src/winport.c
index d40614c9131..8d8698ee6c5 100644
--- a/zookeeper-client/zookeeper-client-c/src/winport.c
+++ b/zookeeper-client/zookeeper-client-c/src/winport.c
@@ -83,7 +83,7 @@ int pthread_detach(pthread_t _thread)
 }
 
 void pthread_mutexattr_init(pthread_mutexattr_t* ignore){}
-void pthread_mutexattr_settype(pthread_mutexattr_t* ingore_attr, int ignore){}
+void pthread_mutexattr_settype(pthread_mutexattr_t* ignore_attr, int ignore){}
 void pthread_mutexattr_destroy(pthread_mutexattr_t* ignore_attr){}
        
 int 
diff --git a/zookeeper-client/zookeeper-client-c/src/winport.h b/zookeeper-client/zookeeper-client-c/src/winport.h
index d216f7fd30d..e8f10ba046b 100644
--- a/zookeeper-client/zookeeper-client-c/src/winport.h
+++ b/zookeeper-client/zookeeper-client-c/src/winport.h
@@ -80,7 +80,7 @@ int pthread_join(pthread_t _thread, void** ignore);
 int pthread_detach(pthread_t _thread);
 
 void pthread_mutexattr_init(pthread_mutexattr_t* ignore);
-void pthread_mutexattr_settype(pthread_mutexattr_t* ingore_attr, int ignore);
+void pthread_mutexattr_settype(pthread_mutexattr_t* ignore_attr, int ignore);
 void pthread_mutexattr_destroy(pthread_mutexattr_t* ignore_attr);
 
 
diff --git a/zookeeper-client/zookeeper-client-c/src/zk_adaptor.h b/zookeeper-client/zookeeper-client-c/src/zk_adaptor.h
index 57696d4b203..77d70f3bb6d 100644
--- a/zookeeper-client/zookeeper-client-c/src/zk_adaptor.h
+++ b/zookeeper-client/zookeeper-client-c/src/zk_adaptor.h
@@ -167,6 +167,7 @@ struct adaptor_threads {
      pthread_mutex_t lock;          // ... and a lock
      pthread_mutex_t zh_lock;       // critical section lock
      pthread_mutex_t reconfig_lock; // lock for reconfiguring cluster's ensemble
+     pthread_mutex_t watchers_lock; // lock for watcher operations
 #ifdef WIN32
      SOCKET self_pipe[2];
 #else
@@ -200,6 +201,9 @@ struct _zhandle {
     addrvec_t addrs_old;                // old list of addresses that we are no longer connected to
     addrvec_t addrs_new;                // new list of addresses to connect to if we're reconfiguring
 
+    struct timeval last_resolve;        // time of last hostname resolution
+    int resolve_delay_ms;               // see zoo_set_servers_resolution_delay
+
     int reconfig;                       // Are we in the process of reconfiguring cluster's ensemble
     double pOld, pNew;                  // Probability for selecting between 'addrs_old' and 'addrs_new'
     int delay;
@@ -297,6 +301,10 @@ int zoo_unlock_auth(zhandle_t *zh);
 int lock_reconfig(struct _zhandle *zh);
 int unlock_reconfig(struct _zhandle *zh);
 
+// watchers hashtable lock
+int lock_watchers(struct _zhandle *zh);
+int unlock_watchers(struct _zhandle *zh);
+
 // critical section guards
 int enter_critical(zhandle_t* zh);
 int leave_critical(zhandle_t* zh);
diff --git a/zookeeper-client/zookeeper-client-c/src/zk_log.c b/zookeeper-client/zookeeper-client-c/src/zk_log.c
index 436485e97c4..79ebd61f18e 100644
--- a/zookeeper-client/zookeeper-client-c/src/zk_log.c
+++ b/zookeeper-client/zookeeper-client-c/src/zk_log.c
@@ -110,7 +110,7 @@ static const char* time_now(char* now_str){
     now = tv.tv_sec;
     localtime_r(&now, &lt);
 
-    // clone the format used by log4j ISO8601DateFormat
+    // clone the format used by logback ISO8601DateFormat
     // specifically: "yyyy-MM-dd HH:mm:ss,SSS"
 
     len = strftime(now_str, TIME_NOW_BUF_SIZE,
diff --git a/zookeeper-client/zookeeper-client-c/src/zk_sasl.c b/zookeeper-client/zookeeper-client-c/src/zk_sasl.c
index e0ccfb31004..c741a88943a 100644
--- a/zookeeper-client/zookeeper-client-c/src/zk_sasl.c
+++ b/zookeeper-client/zookeeper-client-c/src/zk_sasl.c
@@ -47,6 +47,17 @@
 #include "zk_adaptor.h"
 #include "zookeeper_log.h"
 
+/*
+ * We need to disable the deprecation warnings as Apple has decided to
+ * deprecate all of CyrusSASL's functions with OS 10.11 (see
+ * MESOS-3030, ZOOKEEPER-4201). We are using GCC pragmas also for
+ * covering clang.
+ */
+#ifdef __APPLE__
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+#endif
+
 /*
  * Store a duplicate of src, or NULL, into *target.  Returns
  * ZSYSTEMERROR if no memory could be allocated, ZOK otherwise.
@@ -93,6 +104,7 @@ zoo_sasl_client_t *zoo_sasl_client_create(zoo_sasl_params_t *sasl_params)
 
     if (rc != ZOK) {
         zoo_sasl_client_destroy(sc);
+        free(sc);
         return NULL;
     }
 
@@ -431,6 +443,8 @@ getpassphrase(const char *prompt) {
 
 struct zsasl_secret_ctx {
     const char *password_file;
+    void *context;
+    zoo_sasl_password_callback_t callback;
     sasl_secret_t *secret;
 };
 
@@ -440,53 +454,111 @@ struct zsasl_secret_ctx {
 static int _zsasl_getsecret(sasl_conn_t *conn, void *context, int id,
                             sasl_secret_t **psecret)
 {
+    /* Max allowed length of a password */
+    const size_t MAX_PASSWORD_LEN = 1023; 
     struct zsasl_secret_ctx *secret_ctx = (struct zsasl_secret_ctx *)context;
-    char buf[1024];
-    char *password;
-    size_t len;
+    /* The extra 1 byte is reserved for storing the null terminator. */
+    char buf[MAX_PASSWORD_LEN + 1]; 
+    char *password = NULL;
+    size_t len = 0;
+    int res = 0;
+    /* The extra 1 byte is reserved for storing the null terminator. */
+    char new_passwd[MAX_PASSWORD_LEN + 1];
+    char *p = NULL;
     sasl_secret_t *x;
 
     /* paranoia check */
-    if (!conn || !psecret || id != SASL_CB_PASS)
+    if (!conn || !psecret || id != SASL_CB_PASS) {
         return SASL_BADPARAM;
+    }
 
     if (secret_ctx->password_file) {
-        char *p;
         FILE *fh = fopen(secret_ctx->password_file, "rt");
-        if (!fh)
+        if (!fh) {
             return SASL_FAIL;
+        }
 
-        if (!fgets(buf, sizeof(buf), fh)) {
+        /*
+         * The file's content may be the encrypted password with binary characters,
+         * thus use fread().
+         */
+        len = fread(buf, sizeof(buf[0]), MAX_PASSWORD_LEN, fh);
+        if (ferror(fh)) {
             fclose(fh);
+            fh = NULL;
+
             return SASL_FAIL;
         }
 
         fclose(fh);
+        fh = NULL;
+
+        /*
+         * Write the null terminator immediately after the last character of the
+         * content since it would be used as a null-terminated string once it is
+         * the actual password.
+         */
+        buf[len] = '\0';
+        password = buf;
+    }
 
-        p = strrchr(buf, '\n');
-        if (p)
-            *p = '\0';
+    if (secret_ctx->callback) {
+        if (!password) {
+            /*
+             * The callback takes effect only when password_file is provided.
+             */
+            return SASL_BADPARAM;
+        }
 
-        password = buf;
+        res = secret_ctx->callback(password, len, secret_ctx->context,
+            new_passwd, MAX_PASSWORD_LEN, &len);
+        if (res != SASL_OK) {
+            return res;
+        }
+
+        if (len > MAX_PASSWORD_LEN) {
+            return SASL_BUFOVER;
+        }
+
+        /* 
+         * Append the null terminator  to the end of the password obtained from
+         * the callback function.
+         */
+        new_passwd[len] = '\0';
+        password = new_passwd;
+    } else if (secret_ctx->password_file) {
+        /*
+         * The file's content is the actual password, which must consist only of
+         * text characters (i.e., without null terminator). The first line would
+         * be read as the password once there are multiple lines in the file.
+         */
+        p = strchr(password, '\n');
+        if (p) {
+            *p = '\0';
+        }
     } else {
         password = getpassphrase("Password: ");
-
-        if (!password)
+        if (!password) {
             return SASL_FAIL;
+        }
     }
 
+    /*
+     * Any password, regardless of its source, is always null-terminated.
+     */
     len = strlen(password);
 
     x = secret_ctx->secret = (sasl_secret_t *)realloc(
         secret_ctx->secret, sizeof(sasl_secret_t) + len);
-
     if (!x) {
         memset(password, 0, len);
         return SASL_NOMEM;
     }
 
     x->len = len;
-    strcpy((char *) x->data, password);
+
+    /* The extra 1 byte is the null terminator. */
+    memcpy(x->data, password, len + 1);
     memset(password, 0, len);
 
     *psecret = x;
@@ -495,9 +567,9 @@ static int _zsasl_getsecret(sasl_conn_t *conn, void *context, int id,
 
 typedef int (* sasl_callback_fn_t)(void);
 
-sasl_callback_t *zoo_sasl_make_basic_callbacks(const char *user,
-                                               const char *realm,
-                                               const char* password_file)
+sasl_callback_t *zoo_sasl_make_password_callbacks(const char *user,
+                                                  const char *realm,
+                                                  zoo_sasl_password_t *password)
 {
     struct zsasl_secret_ctx *secret_ctx;
     const char *user_ctx = NULL;
@@ -510,7 +582,9 @@ sasl_callback_t *zoo_sasl_make_basic_callbacks(const char *user,
 
     rc = rc < 0 ? rc : _zsasl_strdup(&user_ctx, user);
     rc = rc < 0 ? rc : _zsasl_strdup(&realm_ctx, realm);
-    rc = rc < 0 ? rc : _zsasl_strdup(&secret_ctx->password_file, password_file);
+    rc = rc < 0 ? rc : _zsasl_strdup(&secret_ctx->password_file, password->password_file);
+    secret_ctx->context = password->context;
+    secret_ctx->callback = password->callback;
 
     {
         sasl_callback_t callbacks[] = {
@@ -539,3 +613,15 @@ sasl_callback_t *zoo_sasl_make_basic_callbacks(const char *user,
         return xcallbacks;
     }
 }
+
+sasl_callback_t *zoo_sasl_make_basic_callbacks(const char *user,
+                                               const char *realm,
+                                               const char* password_file)
+{
+    zoo_sasl_password_t password = {password_file, NULL, NULL};
+    return zoo_sasl_make_password_callbacks(user, realm, &password);
+}
+
+#ifdef __APPLE__
+#pragma GCC diagnostic pop
+#endif
diff --git a/zookeeper-client/zookeeper-client-c/src/zookeeper.c b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
index 0c143e7bbe2..cdd9d74a537 100644
--- a/zookeeper-client/zookeeper-client-c/src/zookeeper.c
+++ b/zookeeper-client/zookeeper-client-c/src/zookeeper.c
@@ -244,6 +244,8 @@ typedef struct _completion_list {
 } completion_list_t;
 
 const char*err2string(int err);
+static inline int calculate_interval(const struct timeval *start,
+        const struct timeval *end);
 static int queue_session_event(zhandle_t *zh, int state);
 static const char* format_endpoint_info(const struct sockaddr_storage* ep);
 
@@ -277,7 +279,7 @@ static void queue_completion_nolock(completion_head_t *list, completion_list_t *
         int add_to_front);
 static void queue_completion(completion_head_t *list, completion_list_t *c,
         int add_to_front);
-static int handle_socket_error_msg(zhandle_t *zh, int line, int rc,
+static int handle_socket_error_msg(zhandle_t *zh, int line, const char *func, int rc,
     const char* format,...);
 static void cleanup_bufs(zhandle_t *zh,int callCompletion,int rc);
 
@@ -330,6 +332,18 @@ static void zookeeper_set_sock_noblock(zhandle_t *, socket_t);
 static void zookeeper_set_sock_timeout(zhandle_t *, socket_t, int);
 static socket_t zookeeper_connect(zhandle_t *, struct sockaddr_storage *, socket_t);
 
+/*
+ * return 1 if zh has a SASL client configured, 0 otherwise.
+ */
+static int has_sasl_client(zhandle_t* zh)
+{
+#ifdef HAVE_CYRUS_SASL_H
+    return zh->sasl_client != NULL;
+#else /* !HAVE_CYRUS_SASL_H */
+    return 0;
+#endif /* HAVE_CYRUS_SASL_H */
+}
+
 /*
  * return 1 if zh has a SASL client performing authentication, 0 otherwise.
  */
@@ -342,6 +356,39 @@ static int is_sasl_auth_in_progress(zhandle_t* zh)
 #endif /* HAVE_CYRUS_SASL_H */
 }
 
+/*
+ * Extract the type field (ZOO_*_OP) of a serialized RequestHeader.
+ *
+ * (This is not the most efficient way of fetching 4 bytes, but it is
+ * currently only used during SASL negotiation.)
+ *
+ * \param buffer the buffer to extract the request type from.  Must
+ *   start with a serialized RequestHeader;
+ * \param len the buffer length.  Must be positive.
+ * \param out_type out parameter; pointer to the location where the
+ *   extracted type is to be stored.  Cannot be NULL.
+ * \return ZOK on success, or < 0 if something went wrong
+ */
+static int extract_request_type(char *buffer, int len, int32_t *out_type)
+{
+    struct iarchive *ia;
+    struct RequestHeader h;
+    int rc;
+
+    ia = create_buffer_iarchive(buffer, len);
+    rc = ia ? ZOK : ZSYSTEMERROR;
+    rc = rc < 0 ? rc : deserialize_RequestHeader(ia, "header", &h);
+    deallocate_RequestHeader(&h);
+    if (ia) {
+        close_buffer_iarchive(&ia);
+    }
+
+    *out_type = h.type;
+
+    return rc;
+}
+
+#ifndef THREADED
 /*
  * abort due to the use of a sync api in a singlethreaded environment
  */
@@ -350,6 +397,7 @@ static void abort_singlethreaded(zhandle_t *zh)
     LOG_ERROR(LOGCALLBACK(zh), "Sync completion used without threads");
     abort();
 }
+#endif  /* THREADED */
 
 static ssize_t zookeeper_send(zsock_t *fd, const void* buf, size_t len)
 {
@@ -658,6 +706,7 @@ static void destroy(zhandle_t *zh)
 #ifdef HAVE_CYRUS_SASL_H
     if (zh->sasl_client) {
         zoo_sasl_client_destroy(zh->sasl_client);
+        free(zh->sasl_client);
         zh->sasl_client = NULL;
     }
 #endif /* HAVE_CYRUS_SASL_H */
@@ -681,7 +730,7 @@ static void setup_random()
             /* Assert we either read something or we were interrupted due to a
              * signal (errno == EINTR) in which case we need to retry.
              */
-            int rc = read(fd, &seed + seed_len, sizeof(seed) - seed_len);
+            int rc = read(fd, (char *)&seed + seed_len, sizeof(seed) - seed_len);
             assert(rc > 0 || errno == EINTR);
             if (rc > 0) {
                 seed_len += rc;
@@ -982,10 +1031,14 @@ static int resolve_hosts(const zhandle_t *zh, const char *hosts_in, addrvec_t *a
  *
  * See zoo_cycle_next_server for the selection logic.
  *
+ * \param ref_time an optional "reference time," used to determine if
+ * resolution can be skipped in accordance to the delay set by \ref
+ * zoo_set_servers_resolution_delay.  Passing NULL prevents skipping.
+ *
  * See {@link https://issues.apache.org/jira/browse/ZOOKEEPER-1355} for the
  * protocol and its evaluation,
  */
-int update_addrs(zhandle_t *zh)
+int update_addrs(zhandle_t *zh, const struct timeval *ref_time)
 {
     int rc = ZOK;
     char *hosts = NULL;
@@ -1006,26 +1059,54 @@ int update_addrs(zhandle_t *zh)
         return ZSYSTEMERROR;
     }
 
-    // NOTE: guard access to {hostname, addr_cur, addrs, addrs_old, addrs_new}
+    // NOTE: guard access to {hostname, addr_cur, addrs, addrs_old, addrs_new, last_resolve, resolve_delay_ms}
     lock_reconfig(zh);
 
+    // Check if we are due for a host name resolution.  (See
+    // zoo_set_servers_resolution_delay.  The answer is always "yes"
+    // if no reference is provided or the file descriptor is invalid.)
+    if (ref_time && zh->fd->sock != -1) {
+        int do_resolve;
+
+        if (zh->resolve_delay_ms <= 0) {
+            // -1 disables, 0 means unconditional.  Fail safe.
+            do_resolve = zh->resolve_delay_ms != -1;
+        } else {
+            int elapsed_ms = calculate_interval(&zh->last_resolve, ref_time);
+            // Include < 0 in case of overflow, or if we are not
+            // backed by a monotonic clock.
+            do_resolve = elapsed_ms > zh->resolve_delay_ms || elapsed_ms < 0;
+        }
+
+        if (!do_resolve) {
+            goto finish;
+        }
+    }
+
     // Copy zh->hostname for local use
     hosts = strdup(zh->hostname);
     if (hosts == NULL) {
         rc = ZSYSTEMERROR;
-        goto fail;
+        goto finish;
     }
 
     rc = resolve_hosts(zh, hosts, &resolved);
     if (rc != ZOK)
     {
-        goto fail;
+        goto finish;
+    }
+
+    // Unconditionally note last resolution time.
+    if (ref_time) {
+        zh->last_resolve = *ref_time;
+    } else {
+        get_system_time(&zh->last_resolve);
     }
 
     // If the addrvec list is identical to last time we ran don't do anything
     if (addrvec_eq(&zh->addrs, &resolved))
     {
-        goto fail;
+        goto finish;
     }
 
     // Is the server we're connected to in the new resolved list?
@@ -1045,14 +1126,14 @@ int update_addrs(zhandle_t *zh)
             rc = addrvec_append(&zh->addrs_old, resolved_address);
             if (rc != ZOK)
             {
-                goto fail;
+                goto finish;
             }
         }
         else {
             rc = addrvec_append(&zh->addrs_new, resolved_address);
             if (rc != ZOK)
             {
-                goto fail;
+                goto finish;
             }
         }
     }
@@ -1105,13 +1186,13 @@ int update_addrs(zhandle_t *zh)
         zh->state = ZOO_NOTCONNECTED_STATE;
     }
 
-fail:
+finish:
 
     unlock_reconfig(zh);
 
     // If we short-circuited out and never assigned resolved to zh->addrs then we
     // need to free resolved to avoid a memleak.
-    if (zh->addrs.data != resolved.data)
+    if (resolved.data && zh->addrs.data != resolved.data)
     {
         addrvec_free(&resolved);
     }
@@ -1214,6 +1295,14 @@ static void log_env(zhandle_t *zh) {
 #endif
 }
 
+/**
+ * Return string of "MAJOR.MINOR.PATCH"
+ */
+const char *zoo_version_str()
+{
+    return ZOO_VERSION;
+}
+
 /**
  * Create a zookeeper handle associated with the given host and port.
  */
@@ -1308,7 +1397,7 @@ static zhandle_t *zookeeper_init_internal(const char *host, watcher_fn watcher,
     if (zh->hostname == 0) {
         goto abort;
     }
-    if(update_addrs(zh) != 0) {
+    if(update_addrs(zh, NULL) != 0) {
         goto abort;
     }
 
@@ -1373,7 +1462,7 @@ zhandle_t *zookeeper_init_ssl(const char *host, const char *cert, watcher_fn wat
 {
     zcert_t zcert;
     zcert.certstr = strdup(cert);
-    zcert.ca = strtok(strdup(cert), ",");
+    zcert.ca = strtok(zcert.certstr, ",");
     zcert.cert = strtok(NULL, ",");
     zcert.key = strtok(NULL, ",");
     zcert.passwd = strtok(NULL, ",");       
@@ -1402,7 +1491,7 @@ int zoo_set_servers(zhandle_t *zh, const char *hosts)
         return ZBADARGUMENTS;
     }
 
-    // NOTE: guard access to {hostname, addr_cur, addrs, addrs_old, addrs_new}
+    // NOTE: guard access to {hostname, addr_cur, addrs, addrs_old, addrs_new, last_resolve, resolve_delay_ms}
     lock_reconfig(zh);
 
     // Reset hostname to new set of hosts to connect to
@@ -1414,7 +1503,27 @@ int zoo_set_servers(zhandle_t *zh, const char *hosts)
 
     unlock_reconfig(zh);
 
-    return update_addrs(zh);
+    return update_addrs(zh, NULL);
+}
+
+/*
+ * Sets a minimum delay to observe between "routine" host name
+ * resolutions.  See prototype for full documentation.
+ */
+int zoo_set_servers_resolution_delay(zhandle_t *zh, int delay_ms) {
+    if (delay_ms < -1) {
+        LOG_ERROR(LOGCALLBACK(zh), "Resolution delay cannot be %d", delay_ms);
+        return ZBADARGUMENTS;
+    }
+
+    // NOTE: guard access to {hostname, addr_cur, addrs, addrs_old, addrs_new, last_resolve, resolve_delay_ms}
+    lock_reconfig(zh);
+
+    zh->resolve_delay_ms = delay_ms;
+
+    unlock_reconfig(zh);
+
+    return ZOK;
 }
 
 /**
@@ -1470,7 +1579,7 @@ static int get_next_server_in_reconfig(zhandle_t *zh)
 /**
  * Cycle through our server list to the correct 'next' server. The 'next' server
  * to connect to depends upon whether we're in a 'reconfig' mode or not. Reconfig
- * mode means we've upated the server list and are now trying to find a server
+ * mode means we've updated the server list and are now trying to find a server
  * to connect to. Once we get connected, we are no longer in the reconfig mode.
  * Similarly, if we try to connect to all the servers in the new configuration
  * and failed, reconfig mode is set to false.
@@ -1479,7 +1588,7 @@ static int get_next_server_in_reconfig(zhandle_t *zh)
  */
 void zoo_cycle_next_server(zhandle_t *zh)
 {
-    // NOTE: guard access to {hostname, addr_cur, addrs, addrs_old, addrs_new}
+    // NOTE: guard access to {hostname, addr_cur, addrs, addrs_old, addrs_new, last_resolve, resolve_delay_ms}
     lock_reconfig(zh);
 
     memset(&zh->addr_cur, 0, sizeof(zh->addr_cur));
@@ -1511,7 +1620,7 @@ const char* zoo_get_current_server(zhandle_t* zh)
 {
     const char *endpoint_info = NULL;
 
-    // NOTE: guard access to {hostname, addr_cur, addrs, addrs_old, addrs_new}
+    // NOTE: guard access to {hostname, addr_cur, addrs, addrs_old, addrs_new, last_resolve, resolve_delay_ms}
     // Need the lock here as it is changed in update_addrs()
     lock_reconfig(zh);
 
@@ -1521,7 +1630,7 @@ const char* zoo_get_current_server(zhandle_t* zh)
 }
 
 /**
- * deallocated the free_path only its beeen allocated
+ * deallocated the free_path only its been allocated
  * and not equal to path
  */
 void free_duplicate_path(const char *free_path, const char* path) {
@@ -1765,7 +1874,24 @@ static int recv_buffer(zhandle_t *zh, buffer_list_t *buff)
         /* dirty hack to make new client work against old server
          * old server sends 40 bytes to finish connection handshake,
          * while we're expecting 41 (1 byte for read-only mode data) */
-        if (buff == &zh->primer_buffer && rc == buff->len - 1) ++rc;
+        if (rc > 0 && buff == &zh->primer_buffer) {
+            /* primer_buffer's curr_offset starts at 4 (see prime_connection) */
+            int avail = buff->curr_offset - sizeof(buff->len) + rc;
+
+            /* exactly 40 bytes (out of 41 expected) collected? */
+            if (avail == buff->len - 1) {
+                int32_t reply_len;
+
+                /* extract length of ConnectResponse (+ 1-byte flag?) */
+                memcpy(&reply_len, buff->buffer, sizeof(reply_len));
+                reply_len = ntohl(reply_len);
+
+                /* if 1-byte flag was not sent, fake it (value 0) */
+                if ((int)(reply_len + sizeof(reply_len)) == buff->len - 1) {
+                    ++rc;
+                }
+            }
+        }
 
         switch(rc) {
         case 0:
@@ -1838,23 +1964,23 @@ void free_completions(zhandle_t *zh,int callCompletion,int reason)
             }
         }
     }
-    if (zoo_lock_auth(zh) == 0) {
-        a_list.completion = NULL;
-        a_list.next = NULL;
 
-        get_auth_completions(&zh->auth_h, &a_list);
-        zoo_unlock_auth(zh);
+    zoo_lock_auth(zh);
+    a_list.completion = NULL;
+    a_list.next = NULL;
+    get_auth_completions(&zh->auth_h, &a_list);
+    zoo_unlock_auth(zh);
 
-        a_tmp = &a_list;
-        // chain call user's completion function
-        while (a_tmp->completion != NULL) {
-            auth_completion = a_tmp->completion;
-            auth_completion(reason, a_tmp->auth_data);
-            a_tmp = a_tmp->next;
-            if (a_tmp == NULL)
-                break;
-        }
+    a_tmp = &a_list;
+    // chain call user's completion function
+    while (a_tmp->completion != NULL) {
+        auth_completion = a_tmp->completion;
+        auth_completion(reason, a_tmp->auth_data);
+        a_tmp = a_tmp->next;
+        if (a_tmp == NULL)
+            break;
     }
+
     free_auth_completion(&a_list);
 }
 
@@ -1911,7 +2037,7 @@ static void handle_error(zhandle_t *zh,int rc)
     addrvec_next(&zh->addrs, &zh->addr_cur);
 }
 
-static int handle_socket_error_msg(zhandle_t *zh, int line, int rc,
+static int handle_socket_error_msg(zhandle_t *zh, int line, const char *func, int rc,
         const char* format, ...)
 {
     if(logLevel>=ZOO_LOG_LEVEL_ERROR){
@@ -1919,7 +2045,7 @@ static int handle_socket_error_msg(zhandle_t *zh, int line, int rc,
         char buf[1024];
         va_start(va,format);
         vsnprintf(buf, sizeof(buf)-1,format,va);
-        log_message(LOGCALLBACK(zh), ZOO_LOG_LEVEL_ERROR,line,__func__,
+        log_message(LOGCALLBACK(zh), ZOO_LOG_LEVEL_ERROR, line, func,
             "Socket %s zk retcode=%d, errno=%d(%s): %s",
             zoo_get_current_server(zh),rc,errno,strerror(errno),buf);
         va_end(va);
@@ -2043,9 +2169,11 @@ static int send_set_watches(zhandle_t *zh)
     int rc;
 
     req.relativeZxid = zh->last_zxid;
+    lock_watchers(zh);
     req.dataWatches.data = collect_keys(zh->active_node_watchers, (int*)&req.dataWatches.count);
     req.existWatches.data = collect_keys(zh->active_exist_watchers, (int*)&req.existWatches.count);
     req.childWatches.data = collect_keys(zh->active_child_watchers, (int*)&req.childWatches.count);
+    unlock_watchers(zh);
 
     // return if there are no pending watches
     if (!req.dataWatches.count && !req.existWatches.count &&
@@ -2163,7 +2291,7 @@ static int prime_connection(zhandle_t *zh)
     serialize_prime_connect(&req, buffer_req);
     rc=rc<0 ? rc : zookeeper_send(zh->fd, buffer_req, len);
     if (rc<0) {
-        return handle_socket_error_msg(zh, __LINE__, ZCONNECTIONLOSS,
+        return handle_socket_error_msg(zh, __LINE__, __func__, ZCONNECTIONLOSS,
                 "failed to send a handshake packet: %s", strerror(errno));
     }
     zh->state = ZOO_ASSOCIATING_STATE;
@@ -2413,7 +2541,7 @@ int zookeeper_interest(zhandle_t *zh, socket_t *fd, int *interest,
     }
     api_prolog(zh);
 
-    rc = update_addrs(zh);
+    rc = update_addrs(zh, &now);
     if (rc != ZOK) {
         return api_epilog(zh, rc);
     }
@@ -2438,8 +2566,9 @@ int zookeeper_interest(zhandle_t *zh, socket_t *fd, int *interest,
             *tv = get_timeval(zh->recv_timeout/60);
             zh->delay = 0;
 
-            LOG_WARN(LOGCALLBACK(zh), "Delaying connection after exhaustively trying all servers [%s]",
-                     zh->hostname);
+            lock_reconfig(zh);
+            LOG_WARN(LOGCALLBACK(zh), "Delaying connection after exhaustively trying all servers [%s]", zh->hostname);
+            unlock_reconfig(zh);
         } else {
             if (addr_rw_server) {
                 zh->addr_cur = *addr_rw_server;
@@ -2452,6 +2581,7 @@ int zookeeper_interest(zhandle_t *zh, socket_t *fd, int *interest,
             if (zh->fd->sock < 0) {
               rc = handle_socket_error_msg(zh,
                                            __LINE__,
+                                           __func__,
                                            ZSYSTEMERROR,
                                            "socket() call failed");
               return api_epilog(zh, rc);
@@ -2475,6 +2605,7 @@ int zookeeper_interest(zhandle_t *zh, socket_t *fd, int *interest,
                 } else {
                     rc = handle_socket_error_msg(zh,
                                                  __LINE__,
+                                                 __func__,
                                                  ZCONNECTIONLOSS,
                                                  "connect() call failed");
                     return api_epilog(zh, rc);
@@ -2523,7 +2654,7 @@ int zookeeper_interest(zhandle_t *zh, socket_t *fd, int *interest,
             *interest=0;
             *tv = get_timeval(0);
             return api_epilog(zh,handle_socket_error_msg(zh,
-                    __LINE__,ZOPERATIONTIMEOUT,
+                    __LINE__, __func__, ZOPERATIONTIMEOUT,
                     "connection to %s timed out (exceeded timeout by %dms)",
                     format_endpoint_info(&zh->addr_cur),
                     -recv_to));
@@ -2629,11 +2760,6 @@ static int init_ssl_for_socket(zsock_t *fd, zhandle_t *zh, int fail_on_error) {
         OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS | OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
         method = TLS_client_method();
 #endif
-        if (FIPS_mode() == 0) {
-            LOG_INFO(LOGCALLBACK(zh), "FIPS mode is OFF ");
-        } else {
-            LOG_INFO(LOGCALLBACK(zh), "FIPS mode is ON ");
-        }
         fd->ssl_ctx = SSL_CTX_new(method);
         ctx = &fd->ssl_ctx;
 
@@ -2651,27 +2777,30 @@ static int init_ssl_for_socket(zsock_t *fd, zhandle_t *zh, int fail_on_error) {
             errno = EINVAL;
             return ZBADARGUMENTS;
         }
-        /*CLIENT CA FILE (With Certificate Chain)*/
-        if (SSL_CTX_use_certificate_chain_file(*ctx, fd->cert->cert) != 1) {
-            SSL_CTX_free(*ctx);
-            LOG_ERROR(LOGCALLBACK(zh), "Failed to load client certificate chain from %s", fd->cert->cert);
-            errno = EINVAL;
-            return ZBADARGUMENTS;
-        }
-        /*CLIENT PRIVATE KEY*/
-        SSL_CTX_set_default_passwd_cb_userdata(*ctx, fd->cert->passwd);
-        if (SSL_CTX_use_PrivateKey_file(*ctx, fd->cert->key, SSL_FILETYPE_PEM) != 1) {
-            SSL_CTX_free(*ctx);
-            LOG_ERROR(LOGCALLBACK(zh), "Failed to load client private key from %s", fd->cert->key);
-            errno = EINVAL;
-            return ZBADARGUMENTS;
-        }
-        /*CHECK*/
-        if (SSL_CTX_check_private_key(*ctx) != 1) {
-            SSL_CTX_free(*ctx);
-            LOG_ERROR(LOGCALLBACK(zh), "SSL_CTX_check_private_key failed");
-            errno = EINVAL;
-            return ZBADARGUMENTS;
+        if (fd->cert->cert != NULL && fd->cert->passwd != NULL && fd->cert->key != NULL)
+        {
+            /*CLIENT CA FILE (With Certificate Chain)*/
+            if (SSL_CTX_use_certificate_chain_file(*ctx, fd->cert->cert) != 1) {
+                SSL_CTX_free(*ctx);
+                LOG_ERROR(LOGCALLBACK(zh), "Failed to load client certificate chain from %s", fd->cert->cert);
+                errno = EINVAL;
+                return ZBADARGUMENTS;
+            }
+            /*CLIENT PRIVATE KEY*/
+            SSL_CTX_set_default_passwd_cb_userdata(*ctx, fd->cert->passwd);
+            if (SSL_CTX_use_PrivateKey_file(*ctx, fd->cert->key, SSL_FILETYPE_PEM) != 1) {
+                SSL_CTX_free(*ctx);
+                LOG_ERROR(LOGCALLBACK(zh), "Failed to load client private key from %s", fd->cert->key);
+                errno = EINVAL;
+                return ZBADARGUMENTS;
+            }
+            /*CHECK*/
+            if (SSL_CTX_check_private_key(*ctx) != 1) {
+                SSL_CTX_free(*ctx);
+                LOG_ERROR(LOGCALLBACK(zh), "SSL_CTX_check_private_key failed");
+                errno = EINVAL;
+                return ZBADARGUMENTS;
+            }
         }
         /*MULTIPLE HANDSHAKE*/
         SSL_CTX_set_mode(*ctx, SSL_MODE_AUTO_RETRY);
@@ -2679,7 +2808,7 @@ static int init_ssl_for_socket(zsock_t *fd, zhandle_t *zh, int fail_on_error) {
         fd->ssl_sock = SSL_new(*ctx);
         if (fd->ssl_sock == NULL) {
             if (fail_on_error) {
-                return handle_socket_error_msg(zh,__LINE__,ZSSLCONNECTIONERROR, "error creating ssl context");
+                return handle_socket_error_msg(zh, __LINE__, __func__, ZSSLCONNECTIONERROR, "error creating ssl context");
             } else {
                 LOG_ERROR(LOGCALLBACK(zh), "error creating ssl context");
                 return ZSSLCONNECTIONERROR;
@@ -2710,7 +2839,7 @@ static int init_ssl_for_socket(zsock_t *fd, zhandle_t *zh, int fail_on_error) {
                 FD_CLR(sock, &s_rfds);
             } else {
                 if (fail_on_error) {
-                    return handle_socket_error_msg(zh,__LINE__,ZSSLCONNECTIONERROR, "error in ssl connect");
+                    return handle_socket_error_msg(zh, __LINE__, __func__, ZSSLCONNECTIONERROR, "error in ssl connect");
                 } else {
                     LOG_ERROR(LOGCALLBACK(zh), "error in ssl connect");
                     return ZSSLCONNECTIONERROR;
@@ -2719,7 +2848,7 @@ static int init_ssl_for_socket(zsock_t *fd, zhandle_t *zh, int fail_on_error) {
             rc = select(sock + 1, &s_rfds, &s_wfds, NULL, &tv);
             if (rc == -1) {
                 if (fail_on_error) {
-                    return handle_socket_error_msg(zh,__LINE__,ZSSLCONNECTIONERROR, "error in ssl connect (after select)");
+                    return handle_socket_error_msg(zh, __LINE__, __func__, ZSSLCONNECTIONERROR, "error in ssl connect (after select)");
                 } else {
                     LOG_ERROR(LOGCALLBACK(zh), "error in ssl connect (after select)");
                     return ZSSLCONNECTIONERROR;
@@ -2754,6 +2883,11 @@ static void finalize_session_establishment(zhandle_t *zh) {
     LOG_DEBUG(LOGCALLBACK(zh), "Calling a watcher for a ZOO_SESSION_EVENT and the state=ZOO_CONNECTED_STATE");
     zh->input_buffer = 0; // just in case the watcher calls zookeeper_process() again
     PROCESS_SESSION_EVENT(zh, zh->state);
+
+    if (has_sasl_client(zh)) {
+        /* some packets might have been delayed during SASL negotiation. */
+        adaptor_send_queue(zh, 0);
+    }
 }
 
 #ifdef HAVE_CYRUS_SASL_H
@@ -2800,8 +2934,10 @@ static int process_sasl_response(zhandle_t *zh, char *buffer, int len)
     struct SetSASLResponse res;
     int rc;
 
+    memset(&res, 0, sizeof(res));
     rc = ia ? ZOK : ZSYSTEMERROR;
     rc = rc < 0 ? rc : deserialize_ReplyHeader(ia, "hdr", &hdr);
+    rc = rc < 0 ? rc : hdr.err;
     rc = rc < 0 ? rc : deserialize_SetSASLResponse(ia, "reply", &res);
     rc = rc < 0 ? rc : zoo_sasl_client_step(zh, res.token.buff, res.token.len);
     deallocate_SetSASLResponse(&res);
@@ -2833,7 +2969,7 @@ static int check_events(zhandle_t *zh, int events)
         if (rc < 0 || error) {
             if (rc == 0)
                 errno = error;
-            return handle_socket_error_msg(zh, __LINE__,ZCONNECTIONLOSS,
+            return handle_socket_error_msg(zh, __LINE__, __func__, ZCONNECTIONLOSS,
                 "server refused to accept the client");
         }
         // We do SSL_connect() here
@@ -2853,7 +2989,7 @@ static int check_events(zhandle_t *zh, int events)
         if (rc < 0 || error) {
             if (rc == 0)
                 errno = error;
-            return handle_socket_error_msg(zh, __LINE__,ZCONNECTIONLOSS,
+            return handle_socket_error_msg(zh, __LINE__, __func__, ZCONNECTIONLOSS,
                 "server refused to accept the client");
         }
 
@@ -2868,7 +3004,7 @@ static int check_events(zhandle_t *zh, int events)
         /* make the flush call non-blocking by specifying a 0 timeout */
         int rc=flush_send_queue(zh,0);
         if (rc < 0)
-            return handle_socket_error_msg(zh,__LINE__,ZCONNECTIONLOSS,
+            return handle_socket_error_msg(zh, __LINE__, __func__, ZCONNECTIONLOSS,
                 "failed while flushing send queue");
     }
     if (events&ZOOKEEPER_READ) {
@@ -2879,7 +3015,7 @@ static int check_events(zhandle_t *zh, int events)
 
         rc = recv_buffer(zh, zh->input_buffer);
         if (rc < 0) {
-            return handle_socket_error_msg(zh, __LINE__,ZCONNECTIONLOSS,
+            return handle_socket_error_msg(zh, __LINE__, __func__, ZCONNECTIONLOSS,
                 "failed while receiving a server response");
         }
         if (rc > 0) {
@@ -2891,6 +3027,7 @@ static int check_events(zhandle_t *zh, int events)
                 } else {
                     rc = process_sasl_response(zh, zh->input_buffer->buffer, zh->input_buffer->curr_offset);
                     free_buffer(zh->input_buffer);
+                    zh->input_buffer = 0;
                     if (rc < 0) {
                         zoo_sasl_mark_failed(zh);
                         return rc;
@@ -2915,7 +3052,7 @@ static int check_events(zhandle_t *zh, int events)
                 if (oldid != 0 && oldid != newid) {
                     zh->state = ZOO_EXPIRED_SESSION_STATE;
                     errno = ESTALE;
-                    return handle_socket_error_msg(zh,__LINE__,ZSESSIONEXPIRED,
+                    return handle_socket_error_msg(zh, __LINE__, __func__, ZSESSIONEXPIRED,
                             "sessionId=%#llx has expired.",oldid);
                 } else {
                     zh->recv_timeout = zh->primer_storage.timeOut;
@@ -2999,7 +3136,9 @@ static int queue_session_event(zhandle_t *zh, int state)
     }
     /* We queued the buffer, so don't free it */
     close_buffer_oarchive(&oa, 0);
+    lock_watchers(zh);
     cptr->c.watcher_result = collectWatchers(zh, ZOO_SESSION_EVENT, "");
+    unlock_watchers(zh);
     queue_completion(&zh->completions_to_process, cptr, 0);
     if (process_async(zh->outstanding_sync)) {
         process_completions(zh);
@@ -3011,10 +3150,9 @@ static int queue_session_event(zhandle_t *zh, int state)
 }
 //#endif
 
-completion_list_t *dequeue_completion(completion_head_t *list)
-{
+completion_list_t *dequeue_completion_nolock(completion_head_t *list) {
+
     completion_list_t *cptr;
-    lock_completion_list(list);
     cptr = list->head;
     if (cptr) {
         list->head = cptr->next;
@@ -3023,6 +3161,14 @@ completion_list_t *dequeue_completion(completion_head_t *list)
             list->last = 0;
         }
     }
+    return cptr;
+}
+
+completion_list_t *dequeue_completion(completion_head_t *list)
+{
+    completion_list_t *cptr;
+    lock_completion_list(list);
+    cptr = dequeue_completion_nolock(list);
     unlock_completion_list(list);
     return cptr;
 }
@@ -3031,7 +3177,7 @@ completion_list_t *dequeue_completion(completion_head_t *list)
 static void cleanup_failed_multi(zhandle_t *zh, int xid, int rc, completion_list_t *cptr) {
     completion_list_t *entry;
     completion_head_t *clist = &cptr->c.clist;
-    while ((entry = dequeue_completion(clist)) != NULL) {
+    while ((entry = dequeue_completion_nolock(clist)) != NULL) {
         // Fake failed response for all sub-requests
         deserialize_response(zh, entry->c.type, xid, 1, rc, entry, NULL);
         destroy_completion_entry(entry);
@@ -3046,7 +3192,7 @@ static int deserialize_multi(zhandle_t *zh, int xid, completion_list_t *cptr, st
     assert(clist);
     deserialize_MultiHeader(ia, "multiheader", &mhdr);
     while (!mhdr.done) {
-        completion_list_t *entry = dequeue_completion(clist);
+        completion_list_t *entry = dequeue_completion_nolock(clist);
         assert(entry);
 
         if (mhdr.type == -1) {
@@ -3305,7 +3451,9 @@ int zookeeper_process(zhandle_t *zh, int events)
             /* We are doing a notification, so there is no pending request */
             c = create_completion_entry(zh, WATCHER_EVENT_XID,-1,0,0,0,0);
             c->buffer = bptr;
+            lock_watchers(zh);
             c->c.watcher_result = collectWatchers(zh, type, path);
+            unlock_watchers(zh);
 
             // We cannot free until now, otherwise path will become invalid
             deallocate_WatcherEvent(&evt);
@@ -3351,7 +3499,7 @@ int zookeeper_process(zhandle_t *zh, int events)
                 // signaled and deallocated) and disconnect from the server
                 queue_completion(&zh->sent_requests,cptr,1);
                 return api_epilog(zh,
-                                  handle_socket_error_msg(zh, __LINE__,ZRUNTIMEINCONSISTENCY,
+                                  handle_socket_error_msg(zh, __LINE__, __func__, ZRUNTIMEINCONSISTENCY,
                                   "unexpected server response: expected %#x, but received %#x",
                                   hdr.xid,cptr->xid));
             }
@@ -3360,8 +3508,10 @@ int zookeeper_process(zhandle_t *zh, int events)
                 // Update last_zxid only when it is a request response
                 zh->last_zxid = hdr.zxid;
             }
+            lock_watchers(zh);
             activateWatcher(zh, cptr->watcher, rc);
             deactivateWatcher(zh, cptr->watcher_deregistration, rc);
+            unlock_watchers(zh);
 
             if (cptr->c.void_result != SYNCHRONOUS_MARKER) {
                 LOG_DEBUG(LOGCALLBACK(zh), "Queueing asynchronous response");
@@ -3492,6 +3642,7 @@ static completion_list_t* do_create_completion_entry(zhandle_t *zh, int xid,
         break;
     case COMPLETION_STRING_STAT:
         c->c.string_stat_result = (string_stat_completion_t)dc;
+        break;
     case COMPLETION_ACLLIST:
         c->c.acl_result = (acl_completion_t)dc;
         break;
@@ -3699,7 +3850,7 @@ int zookeeper_close(zhandle_t *zh)
          * completions from calling zookeeper_close before we have
          * completed the adaptor_finish call below. */
 
-    /* Signal any syncronous completions before joining the threads */
+    /* Signal any synchronous completions before joining the threads */
         enter_critical(zh);
         free_completions(zh,1,ZCLOSING);
         leave_critical(zh);
@@ -3830,6 +3981,19 @@ static int Request_path_watch_init(zhandle_t *zh, int mode,
 /*---------------------------------------------------------------------------*
  * ASYNC API
  *---------------------------------------------------------------------------*/
+
+/* make an attempt to send queued requests immediately without blocking */
+static int nonblocking_send(zhandle_t *zh, int rc)
+{
+    if (adaptor_send_queue(zh, 0) < 0) {
+        if (zh->fd->sock != -1) {
+            close_zsock(zh->fd);
+            zh->state = ZOO_NOTCONNECTED_STATE;
+        }
+    }
+    return (rc < 0) ? ZMARSHALLINGERROR : ZOK;
+}
+
 int zoo_aget(zhandle_t *zh, const char *path, int watch, data_completion_t dc,
         const void *data)
 {
@@ -3869,9 +4033,8 @@ int zoo_awget(zhandle_t *zh, const char *path,
 
     LOG_DEBUG(LOGCALLBACK(zh), "Sending request xid=%#x for path [%s] to %s",h.xid,path,
             zoo_get_current_server(zh));
-    /* make a best (non-blocking) effort to send the requests asap */
-    adaptor_send_queue(zh, 0);
-    return (rc < 0)?ZMARSHALLINGERROR:ZOK;
+
+    return nonblocking_send(zh, rc);
 }
 
 int zoo_agetconfig(zhandle_t *zh, int watch, data_completion_t dc,
@@ -3913,9 +4076,8 @@ int zoo_awgetconfig(zhandle_t *zh, watcher_fn watcher, void* watcherCtx,
 
     LOG_DEBUG(LOGCALLBACK(zh), "Sending request xid=%#x for path [%s] to %s",h.xid,path,
                zoo_get_current_server(zh));
-    /* make a best (non-blocking) effort to send the requests asap */
-    adaptor_send_queue(zh, 0);
-    return (rc < 0)?ZMARSHALLINGERROR:ZOK;
+
+    return nonblocking_send(zh, rc);
 }
 
 int zoo_areconfig(zhandle_t *zh, const char *joining, const char *leaving,
@@ -3949,10 +4111,8 @@ int zoo_areconfig(zhandle_t *zh, const char *joining, const char *leaving,
     close_buffer_oarchive(&oa, 0);
 
     LOG_DEBUG(LOGCALLBACK(zh), "Sending Reconfig request xid=%#x to %s",h.xid, zoo_get_current_server(zh));
-    /* make a best (non-blocking) effort to send the requests asap */
-    adaptor_send_queue(zh, 0);
 
-    return (rc < 0)?ZMARSHALLINGERROR:ZOK;
+    return nonblocking_send(zh, rc);
 }
 
 static int SetDataRequest_init(zhandle_t *zh, struct SetDataRequest *req,
@@ -3995,9 +4155,8 @@ int zoo_aset(zhandle_t *zh, const char *path, const char *buffer, int buflen,
 
     LOG_DEBUG(LOGCALLBACK(zh), "Sending request xid=%#x for path [%s] to %s",h.xid,path,
             zoo_get_current_server(zh));
-    /* make a best (non-blocking) effort to send the requests asap */
-    adaptor_send_queue(zh, 0);
-    return (rc < 0)?ZMARSHALLINGERROR:ZOK;
+
+    return nonblocking_send(zh, rc);
 }
 
 static int CreateRequest_init(zhandle_t *zh, struct CreateRequest *req,
@@ -4122,9 +4281,8 @@ int zoo_acreate_ttl(zhandle_t *zh, const char *path, const char *value,
 
     LOG_DEBUG(LOGCALLBACK(zh), "Sending request xid=%#x for path [%s] to %s",h.xid,path,
             zoo_get_current_server(zh));
-    /* make a best (non-blocking) effort to send the requests asap */
-    adaptor_send_queue(zh, 0);
-    return (rc < 0)?ZMARSHALLINGERROR:ZOK;
+
+    return nonblocking_send(zh, rc);
 }
 
 int zoo_acreate2(zhandle_t *zh, const char *path, const char *value,
@@ -4189,9 +4347,8 @@ int zoo_acreate2_ttl(zhandle_t *zh, const char *path, const char *value,
 
     LOG_DEBUG(LOGCALLBACK(zh), "Sending request xid=%#x for path [%s] to %s",h.xid,path,
             zoo_get_current_server(zh));
-    /* make a best (non-blocking) effort to send the requests asap */
-    adaptor_send_queue(zh, 0);
-    return (rc < 0)?ZMARSHALLINGERROR:ZOK;
+
+    return nonblocking_send(zh, rc);
 }
 
 int DeleteRequest_init(zhandle_t *zh, struct DeleteRequest *req,
@@ -4229,9 +4386,8 @@ int zoo_adelete(zhandle_t *zh, const char *path, int version,
 
     LOG_DEBUG(LOGCALLBACK(zh), "Sending request xid=%#x for path [%s] to %s",h.xid,path,
             zoo_get_current_server(zh));
-    /* make a best (non-blocking) effort to send the requests asap */
-    adaptor_send_queue(zh, 0);
-    return (rc < 0)?ZMARSHALLINGERROR:ZOK;
+
+    return nonblocking_send(zh, rc);
 }
 
 int zoo_aexists(zhandle_t *zh, const char *path, int watch,
@@ -4268,9 +4424,8 @@ int zoo_awexists(zhandle_t *zh, const char *path,
 
     LOG_DEBUG(LOGCALLBACK(zh), "Sending request xid=%#x for path [%s] to %s",h.xid,path,
             zoo_get_current_server(zh));
-    /* make a best (non-blocking) effort to send the requests asap */
-    adaptor_send_queue(zh, 0);
-    return (rc < 0)?ZMARSHALLINGERROR:ZOK;
+
+    return nonblocking_send(zh, rc);
 }
 
 static int zoo_awget_children_(zhandle_t *zh, const char *path,
@@ -4301,9 +4456,8 @@ static int zoo_awget_children_(zhandle_t *zh, const char *path,
 
     LOG_DEBUG(LOGCALLBACK(zh), "Sending request xid=%#x for path [%s] to %s",h.xid,path,
             zoo_get_current_server(zh));
-    /* make a best (non-blocking) effort to send the requests asap */
-    adaptor_send_queue(zh, 0);
-    return (rc < 0)?ZMARSHALLINGERROR:ZOK;
+
+    return nonblocking_send(zh, rc);
 }
 
 int zoo_aget_children(zhandle_t *zh, const char *path, int watch,
@@ -4349,9 +4503,8 @@ static int zoo_awget_children2_(zhandle_t *zh, const char *path,
 
     LOG_DEBUG(LOGCALLBACK(zh), "Sending request xid=%#x for path [%s] to %s",h.xid,path,
             zoo_get_current_server(zh));
-    /* make a best (non-blocking) effort to send the requests asap */
-    adaptor_send_queue(zh, 0);
-    return (rc < 0)?ZMARSHALLINGERROR:ZOK;
+
+    return nonblocking_send(zh, rc);
 }
 
 int zoo_aget_children2(zhandle_t *zh, const char *path, int watch,
@@ -4392,9 +4545,8 @@ int zoo_async(zhandle_t *zh, const char *path,
 
     LOG_DEBUG(LOGCALLBACK(zh), "Sending request xid=%#x for path [%s] to %s",h.xid,path,
             zoo_get_current_server(zh));
-    /* make a best (non-blocking) effort to send the requests asap */
-    adaptor_send_queue(zh, 0);
-    return (rc < 0)?ZMARSHALLINGERROR:ZOK;
+
+    return nonblocking_send(zh, rc);
 }
 
 
@@ -4422,9 +4574,8 @@ int zoo_aget_acl(zhandle_t *zh, const char *path, acl_completion_t completion,
 
     LOG_DEBUG(LOGCALLBACK(zh), "Sending request xid=%#x for path [%s] to %s",h.xid,path,
             zoo_get_current_server(zh));
-    /* make a best (non-blocking) effort to send the requests asap */
-    adaptor_send_queue(zh, 0);
-    return (rc < 0)?ZMARSHALLINGERROR:ZOK;
+
+    return nonblocking_send(zh, rc);
 }
 
 int zoo_aset_acl(zhandle_t *zh, const char *path, int version,
@@ -4453,9 +4604,8 @@ int zoo_aset_acl(zhandle_t *zh, const char *path, int version,
 
     LOG_DEBUG(LOGCALLBACK(zh), "Sending request xid=%#x for path [%s] to %s",h.xid,path,
             zoo_get_current_server(zh));
-    /* make a best (non-blocking) effort to send the requests asap */
-    adaptor_send_queue(zh, 0);
-    return (rc < 0)?ZMARSHALLINGERROR:ZOK;
+
+    return nonblocking_send(zh, rc);
 }
 
 /* Completions for multi-op results */
@@ -4597,7 +4747,7 @@ int zoo_amulti(zhandle_t *zh, int count, const zoo_op_t *ops,
                 return ZUNIMPLEMENTED;
         }
 
-        queue_completion(&clist, entry, 0);
+        queue_completion_nolock(&clist, entry, 0);
     }
 
     rc = rc < 0 ? rc : serialize_MultiHeader(oa, "multiheader", &mh);
@@ -4614,10 +4764,8 @@ int zoo_amulti(zhandle_t *zh, int count, const zoo_op_t *ops,
 
     LOG_DEBUG(LOGCALLBACK(zh), "Sending multi request xid=%#x with %d subrequests to %s",
             h.xid, index, zoo_get_current_server(zh));
-    /* make a best (non-blocking) effort to send the requests asap */
-    adaptor_send_queue(zh, 0);
 
-    return (rc < 0) ? ZMARSHALLINGERROR : ZOK;
+    return nonblocking_send(zh, rc);
 }
 
 typedef union WatchesRequest WatchesRequest;
@@ -4652,19 +4800,23 @@ static int aremove_watches(
         goto done;
     }
 
+    lock_watchers(zh);
     if (!pathHasWatcher(zh, server_path, wtype, watcher, watcherCtx)) {
         rc = ZNOWATCHER;
+        unlock_watchers(zh);
         goto done;
     }
 
     if (local) {
         removeWatchers(zh, server_path, wtype, watcher, watcherCtx);
+        unlock_watchers(zh);
 #ifdef THREADED
         notify_sync_completion((struct sync_completion *)data);
 #endif
         rc = ZOK;
         goto done;
     }
+    unlock_watchers(zh);
 
     oa = create_buffer_oarchive();
     rc = serialize_RequestHeader(oa, "header", &h);
@@ -4696,7 +4848,6 @@ static int aremove_watches(
         zh, h.xid, COMPLETION_VOID, completion, data, 0, wdo, 0);
     rc = rc < 0 ? rc : queue_buffer_bytes(&zh->to_send, get_buffer(oa),
             get_buffer_len(oa));
-    rc = rc < 0 ? ZMARSHALLINGERROR : ZOK;
     leave_critical(zh);
 
     /* We queued the buffer, so don't free it */
@@ -4705,7 +4856,7 @@ static int aremove_watches(
     LOG_DEBUG(LOGCALLBACK(zh), "Sending request xid=%#x for path [%s] to %s",
               h.xid, path, zoo_get_current_server(zh));
 
-    adaptor_send_queue(zh, 0);
+    rc = nonblocking_send(zh, rc);
 
 done:
     free_duplicate_path(server_path, path);
@@ -4787,6 +4938,20 @@ int flush_send_queue(zhandle_t*zh, int timeout)
     // successful
     lock_buffer_list(&zh->to_send);
     while (zh->to_send.head != 0 && (is_connected(zh) || is_sasl_auth_in_progress(zh))) {
+        if (is_sasl_auth_in_progress(zh)) {
+            // We don't let non-SASL packets escape as long as
+            // negotiation is not complete.  (SASL packets are always
+            // pushed to the front of the queue.)
+            buffer_list_t *buff = zh->to_send.head;
+            int32_t type;
+
+            rc = extract_request_type(buff->buffer, buff->len, &type);
+
+            if (rc < 0 || type != ZOO_SASL_OP) {
+                break;
+            }
+        }
+
         if(timeout!=0){
 #ifndef _WIN32
             struct pollfd fds;
@@ -4863,7 +5028,7 @@ const char* zerror(int c)
     case ZINVALIDSTATE:
       return "invalid zhandle state";
     case ZNEWCONFIGNOQUORUM:
-      return "no quorum of new config is connected and up-to-date with the leader of last commmitted config - try invoking reconfiguration after new servers are connected and synced";
+      return "no quorum of new config is connected and up-to-date with the leader of last committed config - try invoking reconfiguration after new servers are connected and synced";
     case ZRECONFIGINPROGRESS:
       return "Another reconfiguration is in progress -- concurrent reconfigs not supported (yet)";
     case ZAPIERROR:
@@ -4902,6 +5067,10 @@ const char* zerror(int c)
       return "the watcher couldn't be found";
     case ZRECONFIGDISABLED:
       return "attempts to perform a reconfiguration operation when reconfiguration feature is disable";
+    case ZSESSIONCLOSEDREQUIRESASLAUTH:
+      return "session closed by server because client is required to do SASL authentication";
+    case ZTHROTTLEDOP:
+      return "Operation was throttled due to high load";
     }
     if (c > 0) {
       return strerror(c);
@@ -4948,19 +5117,29 @@ int zoo_add_auth(zhandle_t *zh,const char* scheme,const char* cert,
     add_last_auth(&zh->auth_h, authinfo);
     zoo_unlock_auth(zh);
 
-    if (is_connected(zh) || zh->state == ZOO_ASSOCIATING_STATE)
+    if (is_connected(zh) ||
+        // When associating, only send info packets if no SASL
+        // negotiation is planned.  (Such packets would be queued in
+        // front of SASL packets, which is forbidden, and SASL
+        // completion is followed by a 'send_auth_info' anyway.)
+        (zh->state == ZOO_ASSOCIATING_STATE && !has_sasl_client(zh))) {
         return send_last_auth_info(zh);
+    }
 
     return ZOK;
 }
 
 static const char* format_endpoint_info(const struct sockaddr_storage* ep)
 {
-    static char buf[134] = { 0 };
+#if defined(_MSC_VER)
+    static __declspec(thread) char buf[134] = { 0 };
+#else
+    static __thread char buf[134] = { 0 };
+#endif
     char addrstr[INET6_ADDRSTRLEN] = { 0 };
     const char *fmtstring;
     void *inaddr;
-    char is_inet6 = 0;  // poor man's boolean
+    char is_inet6 = 0; // poor man's boolean
 #ifdef _WIN32
     char * addrstring;
 #endif
diff --git a/zookeeper-client/zookeeper-client-c/ssl/gencerts.sh b/zookeeper-client/zookeeper-client-c/ssl/gencerts.sh
index f32cf5895bd..cbe8199ea59 100755
--- a/zookeeper-client/zookeeper-client-c/ssl/gencerts.sh
+++ b/zookeeper-client/zookeeper-client-c/ssl/gencerts.sh
@@ -1,19 +1,22 @@
-#!/usr/bin/env bash
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
+#! /usr/bin/env bash
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
 
 #
 # This script cleans up old transaction logs and snapshots
@@ -25,12 +28,11 @@
 # relative to the canonical path of this script.
 #
 
-
 # determining the domain name in the certificates:
 # - use the first commandline argument, if present
 # - if not, then use the fully qualified domain name
 # - if `hostname` command fails, fall back to zookeeper.apache.org
-FQDN=`hostname -f`
+FQDN=$(hostname -f)
 FQDN=${1:-$FQDN}
 FQDN=${FQDN:-"zookeeper.apache.org"}
 
@@ -39,7 +41,7 @@ openssl genrsa -out rootkey.pem 2048
 
 #Generate the root Cert
 openssl req -x509 -new -key rootkey.pem -out root.crt -config <(
-cat <<-EOF
+  cat <<-EOF
 [ req ]
 default_bits = 2048
 prompt = no
@@ -61,7 +63,7 @@ openssl genrsa -out clientkey.pem 2048
 
 #Generate Client Cert
 openssl req -new -key clientkey.pem -out client.csr -config <(
-cat <<-EOF
+  cat <<-EOF
 [ req ]
 default_bits = 2048
 prompt = no
@@ -92,7 +94,7 @@ openssl genrsa -out serverkey.pem 2048
 
 #Generate Server Cert
 openssl req -new -key serverkey.pem -out server.csr -config <(
-cat <<-EOF
+  cat <<-EOF
 [ req ]
 default_bits = 2048
 prompt = no
@@ -116,7 +118,6 @@ openssl pkcs12 -export -in server.crt -inkey serverkey.pem -out server.pkcs12 -p
 # Import Keystore in JKS
 keytool -importkeystore -srckeystore server.pkcs12 -destkeystore server.jks -srcstoretype pkcs12 -srcstorepass password -deststorepass password
 
-
 keytool -importcert -keystore server.jks -file root.crt -storepass password -noprompt
 
 keytool -importcert -alias ca -file root.crt -keystore clienttrust.jks -storepass password -noprompt
diff --git a/zookeeper-client/zookeeper-client-c/tests/LibCMocks.cc b/zookeeper-client/zookeeper-client-c/tests/LibCMocks.cc
index 870a554ca3b..8a46ee54dcc 100644
--- a/zookeeper-client/zookeeper-client-c/tests/LibCMocks.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/LibCMocks.cc
@@ -259,7 +259,12 @@ int setsockopt(int s,int level,int optname,const void *optval,socklen_t optlen){
     return Mock_socket::mock_->callSet(s,level,optname,optval,optlen);      
 }
 int connect(int s,const struct sockaddr *addr,socklen_t len){
+#ifdef AF_UNIX
+    /* don't mock UNIX domain sockets */
+    if (!Mock_socket::mock_ || addr->sa_family == AF_UNIX)
+#else
     if (!Mock_socket::mock_)
+#endif
         return LIBC_SYMBOLS.connect(s,addr,len);
     return Mock_socket::mock_->callConnect(s,addr,len);
 }
diff --git a/zookeeper-client/zookeeper-client-c/tests/LibCSymTable.h b/zookeeper-client/zookeeper-client-c/tests/LibCSymTable.h
index 1b6f9db996d..08028abca8c 100644
--- a/zookeeper-client/zookeeper-client-c/tests/LibCSymTable.h
+++ b/zookeeper-client/zookeeper-client-c/tests/LibCSymTable.h
@@ -26,6 +26,7 @@
 #include <dlfcn.h>
 #include <cassert>
 #include <poll.h>
+#include <time.h>
 #include <unistd.h> // needed for _POSIX_MONOTONIC_CLOCK
 
 #ifdef THREADED
diff --git a/zookeeper-client/zookeeper-client-c/tests/TestClient.cc b/zookeeper-client/zookeeper-client-c/tests/TestClient.cc
index a7d055fbe47..83a7203d7b8 100644
--- a/zookeeper-client/zookeeper-client-c/tests/TestClient.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/TestClient.cc
@@ -212,6 +212,10 @@ class Zookeeper_simpleSystem : public CPPUNIT_NS::TestFixture
 #endif
 #ifdef HAVE_OPENSSL_H
     CPPUNIT_TEST(testSSL);
+    CPPUNIT_TEST(testSSLNoClientCert);
+
+    // Order after above two tests as it changes ssl.clientAuth
+    CPPUNIT_TEST(testSSLServerOnly);
 #endif
     CPPUNIT_TEST(testCreate);
     CPPUNIT_TEST(testCreateContainer);
@@ -227,6 +231,7 @@ class Zookeeper_simpleSystem : public CPPUNIT_NS::TestFixture
     CPPUNIT_TEST(testWatcherAutoResetWithLocal);
     CPPUNIT_TEST(testGetChildren2);
     CPPUNIT_TEST(testLastZxid);
+    CPPUNIT_TEST(testServersResolutionDelay);
     CPPUNIT_TEST(testRemoveWatchers);
 #endif
     CPPUNIT_TEST_SUITE_END();
@@ -313,6 +318,12 @@ class Zookeeper_simpleSystem : public CPPUNIT_NS::TestFixture
         CPPUNIT_ASSERT(system(cmd) == 0);
     }
 
+    void startServer(const char *envs) {
+        char cmd[1024];
+        sprintf(cmd, "%s %s start %s", envs, ZKSERVER_CMD, getHostPorts());
+        CPPUNIT_ASSERT(system(cmd) == 0);
+    }
+
     void stopServer() {
         char cmd[1024];
         sprintf(cmd, "%s stop %s", ZKSERVER_CMD, getHostPorts());
@@ -325,9 +336,10 @@ class Zookeeper_simpleSystem : public CPPUNIT_NS::TestFixture
     
     /** have a callback in the default watcher **/
     static void default_zoo_watcher(zhandle_t *zzh, int type, int state, const char *path, void *context){
-        int zrc = 0;
+        int zrc;
         struct String_vector str_vec = {0, NULL};
         zrc = zoo_wget_children(zzh, "/mytest", default_zoo_watcher, NULL, &str_vec);
+        CPPUNIT_ASSERT(zrc == ZOK || zrc == ZCLOSING);
     }
 
     /** ZOOKEEPER-1057 This checks that the client connects to the second server when the first is not reachable **/
@@ -353,24 +365,28 @@ class Zookeeper_simpleSystem : public CPPUNIT_NS::TestFixture
 
     /** this checks for a deadlock in calling zookeeper_close and calls from a default watcher that might get triggered just when zookeeper_close() is in progress **/
     void testHangingClient() {
-        int zrc = 0;
+        int zrc;
         char buff[10] = "testall";
         char path[512];
-        watchctx_t *ctx;
+        watchctx_t *ctx = NULL;
         struct String_vector str_vec = {0, NULL};
         zhandle_t *zh = zookeeper_init(hostPorts, NULL, 10000, 0, ctx, 0);
         sleep(1);
         zrc = zoo_create(zh, "/mytest", buff, 10, &ZOO_OPEN_ACL_UNSAFE, 0, path, 512);
+        CPPUNIT_ASSERT_EQUAL((int)ZOK, zrc);
         zrc = zoo_wget_children(zh, "/mytest", default_zoo_watcher, NULL, &str_vec);
+        CPPUNIT_ASSERT_EQUAL((int)ZOK, zrc);
         zrc = zoo_create(zh, "/mytest/test1", buff, 10, &ZOO_OPEN_ACL_UNSAFE, 0, path, 512);
+        CPPUNIT_ASSERT_EQUAL((int)ZOK, zrc);
         zrc = zoo_wget_children(zh, "/mytest", default_zoo_watcher, NULL, &str_vec);
+        CPPUNIT_ASSERT_EQUAL((int)ZOK, zrc);
         zrc = zoo_delete(zh, "/mytest/test1", -1);
+        CPPUNIT_ASSERT_EQUAL((int)ZOK, zrc);
         zookeeper_close(zh);
     }
 
     void testBadDescriptor() {
-        int zrc = 0;
-        watchctx_t *ctx;
+        watchctx_t *ctx = NULL;
         zhandle_t *zh = zookeeper_init(hostPorts, NULL, 10000, 0, ctx, 0);
         sleep(1);
         zh->io_count = 0;
@@ -381,7 +397,78 @@ class Zookeeper_simpleSystem : public CPPUNIT_NS::TestFixture
         CPPUNIT_ASSERT(zh->io_count < 2);
         zookeeper_close(zh);
     }
-    
+
+    /* Checks the zoo_set_servers_resolution_delay default and operation */
+    void testServersResolutionDelay() {
+        watchctx_t ctx;
+        zhandle_t *zk = createClient(&ctx);
+        int rc;
+        struct timeval tv;
+        struct Stat stat;
+
+        CPPUNIT_ASSERT(zk);
+        CPPUNIT_ASSERT(zk->resolve_delay_ms == 0);
+
+        // a) Default/0 case: resolve at each request.
+
+        tv = zk->last_resolve;
+        usleep(10000); // 10ms
+
+        rc = zoo_exists(zk, "/", 0, &stat);
+        CPPUNIT_ASSERT_EQUAL((int)ZOK, rc);
+
+        // Must have changed because of the request.
+        CPPUNIT_ASSERT(zk->last_resolve.tv_sec != tv.tv_sec ||
+                       zk->last_resolve.tv_usec != tv.tv_usec);
+
+        // b) Disabled/-1 case: never perform "routine" resolutions.
+
+        rc = zoo_set_servers_resolution_delay(zk, -1); // Disabled
+        CPPUNIT_ASSERT_EQUAL((int)ZOK, rc);
+
+        tv = zk->last_resolve;
+        usleep(10000); // 10ms
+
+        rc = zoo_exists(zk, "/", 0, &stat);
+        CPPUNIT_ASSERT_EQUAL((int)ZOK, rc);
+
+        // Must not have changed as auto-resolution is disabled.
+        CPPUNIT_ASSERT(zk->last_resolve.tv_sec == tv.tv_sec &&
+                       zk->last_resolve.tv_usec == tv.tv_usec);
+
+        // c) Invalid delay is rejected.
+
+        rc = zoo_set_servers_resolution_delay(zk, -1000); // Bad
+        CPPUNIT_ASSERT_EQUAL((int)ZBADARGUMENTS, rc);
+
+        // d) Valid delay, no resolution within window.
+
+        rc = zoo_set_servers_resolution_delay(zk, 500); // 0.5s
+        CPPUNIT_ASSERT_EQUAL((int)ZOK, rc);
+
+        tv = zk->last_resolve;
+        usleep(10000); // 10ms
+
+        rc = zoo_exists(zk, "/", 0, &stat);
+        CPPUNIT_ASSERT_EQUAL((int)ZOK, rc);
+
+        // Must not have changed because the request (hopefully!)
+        // executed in less than 0.5s.
+        CPPUNIT_ASSERT(zk->last_resolve.tv_sec == tv.tv_sec &&
+                       zk->last_resolve.tv_usec == tv.tv_usec);
+
+        // e) Valid delay, at least one resolution after delay.
+
+        usleep(500 * 1000); // 0.5s
+
+        rc = zoo_exists(zk, "/", 0, &stat);
+        CPPUNIT_ASSERT_EQUAL((int)ZOK, rc);
+
+        // Must have changed because we waited 0.5s between the
+        // capture and the last request.
+        CPPUNIT_ASSERT(zk->last_resolve.tv_sec != tv.tv_sec ||
+                       zk->last_resolve.tv_usec != tv.tv_usec);
+    }
 
     void testPing()
     {
@@ -802,15 +889,28 @@ class Zookeeper_simpleSystem : public CPPUNIT_NS::TestFixture
     }
 
 #ifdef HAVE_OPENSSL_H
-    void testSSL() {
+    int checkSSL(const char *path, const char *certs) {
         watchctx_t ctx;
         zoo_set_debug_level(ZOO_LOG_LEVEL_DEBUG);
-        zhandle_t *zk = createSSLClient("127.0.0.1:22281", "/tmp/certs/server.crt,/tmp/certs/client.crt,/tmp/certs/clientkey.pem,password", &ctx);
+        zhandle_t *zk = createSSLClient("127.0.0.1:22281", certs, &ctx);
         CPPUNIT_ASSERT(zk);
         int rc = 0;
-        rc = zoo_create(zk, "/ssl", NULL, -1,
-                        &ZOO_OPEN_ACL_UNSAFE, 0, 0, 0);
-        CPPUNIT_ASSERT_EQUAL((int) ZOK, rc);
+        return zoo_create(zk, path, NULL, -1, &ZOO_OPEN_ACL_UNSAFE, 0, 0, 0);
+    }
+
+    void testSSL() {
+        CPPUNIT_ASSERT_EQUAL((int) ZOK, checkSSL("/ssl", "/tmp/certs/server.crt,/tmp/certs/client.crt,/tmp/certs/clientkey.pem,password"));
+    }
+
+    void testSSLNoClientCert() {
+        CPPUNIT_ASSERT(ZOK != checkSSL("/ssl-no-client-cert", "/tmp/certs/server.crt"));
+    }
+
+    void testSSLServerOnly() {
+        stopServer();
+        startServer("CLIENT_AUTH=none");
+
+        CPPUNIT_ASSERT_EQUAL((int) ZOK, checkSSL("/ssl-server-only", "/tmp/certs/server.crt"));
     }
 #endif
 
@@ -928,7 +1028,7 @@ class Zookeeper_simpleSystem : public CPPUNIT_NS::TestFixture
     void testChroot() {
         // the c client async callbacks do
         // not callback with the path, so
-        // we dont need to test taht for now
+        // we dont need to test that for now
         // we should fix that though soon!
         watchctx_t ctx, ctx_ch;
         zhandle_t *zk, *zk_ch;
@@ -1039,8 +1139,8 @@ class Zookeeper_simpleSystem : public CPPUNIT_NS::TestFixture
         CPPUNIT_ASSERT_EQUAL(zoo_get_log_callback(zk), &logMessageHandler);
 
         // Log 10 messages and ensure all go to callback
-        int expected = 10;
-        for (int i = 0; i < expected; i++)
+        const std::size_t expected = 10;
+        for (std::size_t i = 0; i < expected; i++)
         {
             LOG_INFO(LOGCALLBACK(zk), "%s #%d", __FUNCTION__, i);
         }
@@ -1057,12 +1157,12 @@ class Zookeeper_simpleSystem : public CPPUNIT_NS::TestFixture
 
         // All the connection messages should have gone to the callback -- don't
         // want this to be a maintenance issue so we're not asserting exact count
-        int numBefore = logMessages.size();
+        std::size_t numBefore = logMessages.size();
         CPPUNIT_ASSERT(numBefore != 0);
 
         // Log 10 messages and ensure all go to callback
-        int expected = 10;
-        for (int i = 0; i < expected; i++)
+        const std::size_t expected = 10;
+        for (std::size_t i = 0; i < expected; i++)
         {
             LOG_INFO(LOGCALLBACK(zk), "%s #%d", __FUNCTION__, i);
         }
diff --git a/zookeeper-client/zookeeper-client-c/tests/TestMulti.cc b/zookeeper-client/zookeeper-client-c/tests/TestMulti.cc
index 226e4708202..6dfeb96e0c0 100644
--- a/zookeeper-client/zookeeper-client-c/tests/TestMulti.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/TestMulti.cc
@@ -486,8 +486,6 @@ class Zookeeper_multi : public CPPUNIT_NS::TestFixture
         watchctx_t ctx;
         zhandle_t *zk = createClient(&ctx);
         int sz = 512;
-        char buf[sz];
-        int blen;
         char p1[sz];
         p1[0] = '\0';
         struct Stat stat;
@@ -573,7 +571,6 @@ class Zookeeper_multi : public CPPUNIT_NS::TestFixture
         int sz = 512;
         char p1[sz];
         p1[0] = '\0';
-        struct Stat s1;
 
         rc = zoo_create(zk, "/multi0", "", 0, &ZOO_OPEN_ACL_UNSAFE, 0, p1, sz);
         CPPUNIT_ASSERT_EQUAL((int)ZOK, rc);
diff --git a/zookeeper-client/zookeeper-client-c/tests/TestOperations.cc b/zookeeper-client/zookeeper-client-c/tests/TestOperations.cc
index ed8e9f460ac..534c7599c1f 100644
--- a/zookeeper-client/zookeeper-client-c/tests/TestOperations.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/TestOperations.cc
@@ -36,6 +36,10 @@ class Zookeeper_operations : public CPPUNIT_NS::TestFixture
     CPPUNIT_TEST(testCloseWhileInProgressFromCompletion);
     CPPUNIT_TEST(testCloseWhileMultiInProgressFromMain);
     CPPUNIT_TEST(testCloseWhileMultiInProgressFromCompletion);
+    CPPUNIT_TEST(testConnectResponseFull);
+    CPPUNIT_TEST(testConnectResponseNoReadOnlyFlag);
+    CPPUNIT_TEST(testConnectResponseSplitAtReadOnlyFlag);
+    CPPUNIT_TEST(testConnectResponseNoReadOnlyFlagSplit);
 #else    
     CPPUNIT_TEST(testAsyncWatcher1);
     CPPUNIT_TEST(testAsyncGetOperation);
@@ -126,7 +130,7 @@ class Zookeeper_operations : public CPPUNIT_NS::TestFixture
         zh=zookeeper_init("localhost:2121",watcher,10000,TEST_CLIENT_ID,0,0);
         CPPUNIT_ASSERT(zh!=0);
         // simulate connected state
-        forceConnected(zh);
+        forceConnected(zh, &timeMock.tv);
         
         int fd=0;
         int interest=0;
@@ -169,7 +173,7 @@ class Zookeeper_operations : public CPPUNIT_NS::TestFixture
         zh=zookeeper_init("localhost:2121",watcher,10000,TEST_CLIENT_ID,0,0);
         CPPUNIT_ASSERT(zh!=0);
         // simulate connected state
-        forceConnected(zh);
+        forceConnected(zh, &timeMock.tv);
         
         int fd=0;
         int interest=0;
@@ -212,7 +216,7 @@ class Zookeeper_operations : public CPPUNIT_NS::TestFixture
         zh=zookeeper_init("localhost:2121",watcher,10000,TEST_CLIENT_ID,0,0);
         CPPUNIT_ASSERT(zh!=0);
         // simulate connected state
-        forceConnected(zh);
+        forceConnected(zh, &timeMock.tv);
         
         int fd=0;
         int interest=0;
@@ -263,7 +267,7 @@ class Zookeeper_operations : public CPPUNIT_NS::TestFixture
         zh=zookeeper_init("localhost:1234",watcher,TIMEOUT*1000,TEST_CLIENT_ID,0,0);
         CPPUNIT_ASSERT(zh!=0);
         // simulate connected state
-        forceConnected(zh);
+        forceConnected(zh, &timeMock.tv);
         
         int fd=0;
         int interest=0;
@@ -340,7 +344,7 @@ class Zookeeper_operations : public CPPUNIT_NS::TestFixture
         zh=zookeeper_init("localhost:1234",watcher,TIMEOUT*1000,TEST_CLIENT_ID,0,0);
         CPPUNIT_ASSERT(zh!=0);
         // simulate connected state
-        forceConnected(zh);
+        forceConnected(zh, &timeMock.tv);
 
         int fd=0;
         int interest=0;
@@ -375,7 +379,7 @@ class Zookeeper_operations : public CPPUNIT_NS::TestFixture
         zh=zookeeper_init("localhost:1234",watcher,TIMEOUT*1000,TEST_CLIENT_ID,0,0);
         CPPUNIT_ASSERT(zh!=0);
         // simulate connected state
-        forceConnected(zh);
+        forceConnected(zh, &timeMock.tv);
         
         int fd=0;
         int interest=0;
@@ -422,7 +426,7 @@ class Zookeeper_operations : public CPPUNIT_NS::TestFixture
         zh=zookeeper_init("localhost:1234",watcher,TIMEOUT*1000,TEST_CLIENT_ID,0,0);
         CPPUNIT_ASSERT(zh!=0);
         // simulate connected state
-        forceConnected(zh);
+        forceConnected(zh, &now.tv);
         
         // queue up a request; keep it pending (as if the server is busy or has died)
         AsyncGetOperationCompletion res1;
@@ -477,7 +481,7 @@ class Zookeeper_operations : public CPPUNIT_NS::TestFixture
 
         zh=zookeeper_init("localhost:2121",watcher,10000,TEST_CLIENT_ID,0,0);
         CPPUNIT_ASSERT(zh!=0);
-        forceConnected(zh);
+        forceConnected(zh, &timeMock.tv);
         zhandle_t* savezh=zh;
 
         // issue a request
@@ -516,7 +520,7 @@ class Zookeeper_operations : public CPPUNIT_NS::TestFixture
 
         zh=zookeeper_init("localhost:2121",watcher,10000,TEST_CLIENT_ID,0,0);
         CPPUNIT_ASSERT(zh!=0);
-        forceConnected(zh);
+        forceConnected(zh, &timeMock.tv);
         zhandle_t* savezh=zh;
 
         // will handle completion on request #1 and issue request #2 from it
@@ -578,7 +582,7 @@ class Zookeeper_operations : public CPPUNIT_NS::TestFixture
         CPPUNIT_ASSERT_EQUAL((int)ZCLOSING,res2.rc_);
     }
 
-    // ZOOKEEPER-2891: Invalid processing of zookeeper_close for mutli-request
+    // ZOOKEEPER-2891: Invalid processing of zookeeper_close for multi-request
     // while there is a multi request waiting for being processed
     // call zookeeper_close() from the main event loop
     // assert the completion callback is called with status ZCLOSING
@@ -590,7 +594,7 @@ class Zookeeper_operations : public CPPUNIT_NS::TestFixture
 
         zh=zookeeper_init("localhost:2121",watcher,10000,TEST_CLIENT_ID,0,0);
         CPPUNIT_ASSERT(zh!=0);
-        forceConnected(zh);
+        forceConnected(zh, &timeMock.tv);
         zhandle_t* savezh=zh;
 
         // issue a multi request
@@ -622,7 +626,7 @@ class Zookeeper_operations : public CPPUNIT_NS::TestFixture
         CPPUNIT_ASSERT_EQUAL((int)ZCLOSING,res1.rc_);
     }
 
-    // ZOOKEEPER-2891: Invalid processing of zookeeper_close for mutli-request
+    // ZOOKEEPER-2891: Invalid processing of zookeeper_close for multi-request
     // send some request #1 (not a multi request)
     // then, while there is a multi request #2 waiting for being processed
     // call zookeeper_close() from the completion callback of request #1
@@ -635,7 +639,7 @@ class Zookeeper_operations : public CPPUNIT_NS::TestFixture
 
         zh=zookeeper_init("localhost:2121",watcher,10000,TEST_CLIENT_ID,0,0);
         CPPUNIT_ASSERT(zh!=0);
-        forceConnected(zh);
+        forceConnected(zh, &timeMock.tv);
         zhandle_t* savezh=zh;
 
         // these shall persist during the test
@@ -710,6 +714,126 @@ class Zookeeper_operations : public CPPUNIT_NS::TestFixture
         CPPUNIT_ASSERT_EQUAL((int)ZCLOSING,res2.rc_);
     }
 
+    void testConnectResponseFull()
+    {
+        CloseFinally guard(&zh);
+        Mock_socket socketMock;
+        HandshakeResponse hsResponse;
+        std::string hsResponseData = hsResponse.toString();
+
+        CPPUNIT_ASSERT_EQUAL(hsResponseData.length(), static_cast<size_t>(41));
+
+        zh = zookeeper_init("localhost:2121", watcher, 10000, NULL, NULL, 0);
+        CPPUNIT_ASSERT(zh!=0);
+
+        int rc, fd, interest;
+        timeval tv;
+
+        rc = zookeeper_interest(zh, &fd, &interest, &tv);
+        CPPUNIT_ASSERT_EQUAL(static_cast<int>(ZOK), rc);
+
+        socketMock.recvReturnBuffer = hsResponseData;
+        rc = zookeeper_process(zh, interest);
+        CPPUNIT_ASSERT_EQUAL(static_cast<int>(ZOK), rc);
+
+        CPPUNIT_ASSERT_EQUAL(ZOO_CONNECTED_STATE, static_cast<int>(zh->state));
+    }
+
+    void testConnectResponseNoReadOnlyFlag()
+    {
+        CloseFinally guard(&zh);
+        Mock_socket socketMock;
+        HandshakeResponse hsResponse;
+
+        hsResponse.omitReadOnly = true;
+
+        std::string hsResponseData = hsResponse.toString();
+
+        CPPUNIT_ASSERT_EQUAL(hsResponseData.length(), static_cast<size_t>(40));
+
+        zh = zookeeper_init("localhost:2121", watcher, 10000, NULL, NULL, 0);
+        CPPUNIT_ASSERT(zh!=0);
+
+        int rc, fd, interest;
+        timeval tv;
+
+        rc = zookeeper_interest(zh, &fd, &interest, &tv);
+        CPPUNIT_ASSERT_EQUAL(static_cast<int>(ZOK), rc);
+
+        socketMock.recvReturnBuffer = hsResponseData;
+        rc = zookeeper_process(zh, interest);
+        CPPUNIT_ASSERT_EQUAL(static_cast<int>(ZOK), rc);
+
+        CPPUNIT_ASSERT_EQUAL(ZOO_CONNECTED_STATE, static_cast<int>(zh->state));
+    }
+
+    void testConnectResponseSplitAtReadOnlyFlag()
+    {
+        CloseFinally guard(&zh);
+        Mock_socket socketMock;
+        HandshakeResponse hsResponse;
+        std::string hsResponseData = hsResponse.toString();
+
+        CPPUNIT_ASSERT_EQUAL(hsResponseData.length(), static_cast<size_t>(41));
+
+        zh = zookeeper_init("localhost:2121", watcher, 10000, NULL, NULL, 0);
+        CPPUNIT_ASSERT(zh!=0);
+
+        int rc, fd, interest;
+        timeval tv;
+
+        rc = zookeeper_interest(zh, &fd, &interest, &tv);
+        CPPUNIT_ASSERT_EQUAL(static_cast<int>(ZOK), rc);
+
+        socketMock.recvReturnBuffer = hsResponseData.substr(0, 40);
+        rc = zookeeper_process(zh, interest);
+        // Response not complete.
+        CPPUNIT_ASSERT_EQUAL(static_cast<int>(ZNOTHING), rc);
+
+        CPPUNIT_ASSERT_EQUAL(ZOO_ASSOCIATING_STATE, static_cast<int>(zh->state));
+
+        socketMock.recvReturnBuffer = hsResponseData.substr(40);
+        rc = zookeeper_process(zh, interest);
+        CPPUNIT_ASSERT_EQUAL(static_cast<int>(ZOK), rc);
+
+        CPPUNIT_ASSERT_EQUAL(ZOO_CONNECTED_STATE, static_cast<int>(zh->state));
+    }
+
+    void testConnectResponseNoReadOnlyFlagSplit()
+    {
+        CloseFinally guard(&zh);
+        Mock_socket socketMock;
+        HandshakeResponse hsResponse;
+
+        hsResponse.omitReadOnly = true;
+
+        std::string hsResponseData = hsResponse.toString();
+
+        CPPUNIT_ASSERT_EQUAL(hsResponseData.length(), static_cast<size_t>(40));
+
+        zh = zookeeper_init("localhost:2121", watcher, 10000, NULL, NULL, 0);
+        CPPUNIT_ASSERT(zh!=0);
+
+        int rc, fd, interest;
+        timeval tv;
+
+        rc = zookeeper_interest(zh, &fd, &interest, &tv);
+        CPPUNIT_ASSERT_EQUAL(static_cast<int>(ZOK), rc);
+
+        socketMock.recvReturnBuffer = hsResponseData.substr(0, 20);
+        rc = zookeeper_process(zh, interest);
+        // Response not complete.
+        CPPUNIT_ASSERT_EQUAL(static_cast<int>(ZNOTHING), rc);
+
+        CPPUNIT_ASSERT_EQUAL(ZOO_ASSOCIATING_STATE, static_cast<int>(zh->state));
+
+        socketMock.recvReturnBuffer = hsResponseData.substr(20);
+        rc = zookeeper_process(zh, interest);
+        CPPUNIT_ASSERT_EQUAL(static_cast<int>(ZOK), rc);
+
+        CPPUNIT_ASSERT_EQUAL(ZOO_CONNECTED_STATE, static_cast<int>(zh->state));
+    }
+
 #else   
     class TestGetDataJob: public TestJob{
     public:
diff --git a/zookeeper-client/zookeeper-client-c/tests/TestReadOnlyClient.cc b/zookeeper-client/zookeeper-client-c/tests/TestReadOnlyClient.cc
index 0d4d579f444..e864ef266ca 100644
--- a/zookeeper-client/zookeeper-client-c/tests/TestReadOnlyClient.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/TestReadOnlyClient.cc
@@ -71,6 +71,24 @@ class Zookeeper_readOnly : public CPPUNIT_NS::TestFixture {
     void setUp() {
         zoo_set_log_stream(logfile);
         zoo_set_debug_level(ZOO_LOG_LEVEL_DEBUG);
+        stopServer();
+    }
+
+    void tearDown()
+    {
+        startServer();
+    }
+
+    void startServer() {
+        char cmd[1024];
+        sprintf(cmd, "%s start %s", ZKSERVER_CMD, "127.0.0.1:22181");
+        CPPUNIT_ASSERT(system(cmd) == 0);
+    }
+
+    void stopServer() {
+        char cmd[1024];
+        sprintf(cmd, "%s stop %s", ZKSERVER_CMD, "127.0.0.1:22181");
+        CPPUNIT_ASSERT(system(cmd) == 0);
     }
 
     void startReadOnly() {
diff --git a/zookeeper-client/zookeeper-client-c/tests/TestReconfig.cc b/zookeeper-client/zookeeper-client-c/tests/TestReconfig.cc
index 317ffcddfed..5ae9606b5f5 100644
--- a/zookeeper-client/zookeeper-client-c/tests/TestReconfig.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/TestReconfig.cc
@@ -26,6 +26,10 @@
 #include <exception>
 #include <stdlib.h>
 
+extern "C" {
+#include <src/addrvec.h>
+}
+
 #include "Util.h"
 #include "LibCMocks.h"
 #include "ZKMocks.h"
@@ -218,6 +222,10 @@ class Zookeeper_reconfig : public CPPUNIT_NS::TestFixture
     CPPUNIT_TEST(testcycleNextServer);
     CPPUNIT_TEST(testMigrateOrNot);
     CPPUNIT_TEST(testMigrationCycle);
+    CPPUNIT_TEST(testAddrVecContainsIPv4);
+#ifdef AF_INET6
+    CPPUNIT_TEST(testAddrVecContainsIPv6);
+#endif
 
     // In threaded mode each 'create' is a thread -- it's not practical to create
     // 10,000 threads to test load balancing. The load balancing code can easily
@@ -491,7 +499,7 @@ class Zookeeper_reconfig : public CPPUNIT_NS::TestFixture
             found = seen.find(next.str());
             CPPUNIT_ASSERT_MESSAGE(next.str() + " in seen list",
                                    found == string::npos);
-            seen += found + ", ";
+            seen += next.str() + ", ";
         }
 
         // Now it should start connecting to the old servers
@@ -508,7 +516,7 @@ class Zookeeper_reconfig : public CPPUNIT_NS::TestFixture
             // Assert not in seen list then append
             found = seen.find(next.str());
             CPPUNIT_ASSERT(found == string::npos);
-            seen += found + ", ";
+            seen += next.str() + ", ";
         }
 
         // NOW it goes back to normal as we've tried all the new and old
@@ -609,6 +617,81 @@ class Zookeeper_reconfig : public CPPUNIT_NS::TestFixture
         numServers = 9;
         updateAllClientsAndServers(numServers);
     }
+
+    /**
+     * This tests that client can detect server's ipv4 address change.
+     *
+     * (1) We generate some address and put in addr, which saddr point to
+     * (2) Add all addresses that differ by one bit from the source
+     * (3) Add same address, but set ipv6 protocol
+     * (4) Ensure, that our address is not equal to any of generated,
+     *     and that it equals to itself
+     */
+    void testAddrVecContainsIPv4() {
+        addrvec_t vec;
+        addrvec_init(&vec);
+
+        sockaddr_storage addr;
+        sockaddr_in* saddr = (sockaddr_in*)&addr;
+        saddr->sin_family = AF_INET;
+        saddr->sin_port = htons((u_short)1234);
+        saddr->sin_addr.s_addr = INADDR_ANY;
+
+        CPPUNIT_ASSERT(sizeof(saddr->sin_addr.s_addr) == 4);
+
+        for (int i = 0; i < 32; i++) {
+            saddr->sin_addr.s_addr ^= (1 << i);
+            addrvec_append(&vec, &addr);
+            saddr->sin_addr.s_addr ^= (1 << i);
+        }
+
+        saddr->sin_family = AF_INET6;
+        addrvec_append(&vec, &addr);
+        saddr->sin_family = AF_INET;
+
+        CPPUNIT_ASSERT(!addrvec_contains(&vec, &addr));
+        addrvec_append(&vec, &addr);
+        CPPUNIT_ASSERT(addrvec_contains(&vec, &addr));
+        addrvec_free(&vec);
+    }
+
+    /**
+     * This tests that client can detect server's ipv6 address change.
+     *
+     * Same logic as in previous testAddrVecContainsIPv4 method,
+     * but we keep in mind, that ipv6 is 128-bit long.
+     */
+#ifdef AF_INET6
+    void testAddrVecContainsIPv6() {
+        addrvec_t vec;
+        addrvec_init(&vec);
+
+        sockaddr_storage addr;
+        sockaddr_in6* saddr = (sockaddr_in6*)&addr;
+        saddr->sin6_family = AF_INET6;
+        saddr->sin6_port = htons((u_short)1234);
+        saddr->sin6_addr = in6addr_any;
+
+        CPPUNIT_ASSERT(sizeof(saddr->sin6_addr.s6_addr) == 16);
+
+        for (int i = 0; i < 16; i++) {
+            for (int j = 0; j < 8; j++) {
+                saddr->sin6_addr.s6_addr[i] ^= (1 << j);
+                addrvec_append(&vec, &addr);
+                saddr->sin6_addr.s6_addr[i] ^= (1 << j);
+            }
+        }
+
+        saddr->sin6_family = AF_INET;
+        addrvec_append(&vec, &addr);
+        saddr->sin6_family = AF_INET6;
+
+        CPPUNIT_ASSERT(!addrvec_contains(&vec, &addr));
+        addrvec_append(&vec, &addr);
+        CPPUNIT_ASSERT(addrvec_contains(&vec, &addr));
+        addrvec_free(&vec);
+    }
+#endif
 };
 
 CPPUNIT_TEST_SUITE_REGISTRATION(Zookeeper_reconfig);
diff --git a/zookeeper-client/zookeeper-client-c/tests/TestReconfigServer.cc b/zookeeper-client/zookeeper-client-c/tests/TestReconfigServer.cc
index c15774e9e30..54810b60c29 100644
--- a/zookeeper-client/zookeeper-client-c/tests/TestReconfigServer.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/TestReconfigServer.cc
@@ -49,12 +49,12 @@ class TestReconfigServer : public CPPUNIT_NS::TestFixture {
     static const uint32_t NUM_SERVERS;
     FILE* logfile_;
     std::vector<ZooKeeperQuorumServer*> cluster_;
-    int32_t getLeader();
-    std::vector<int32_t> getFollowers();
+    std::size_t getLeader();
+    std::vector<std::size_t> getFollowers();
     void parseConfig(char* buf, int len, std::vector<std::string>& servers,
                      std::string& version);
     bool waitForConnected(zhandle_t* zh, uint32_t timeout_sec);
-    zhandle_t* connectFollowers(std::vector<int32_t> &followers);
+    zhandle_t* connectFollowers(std::vector<std::size_t> &followers);
 };
 
 const uint32_t TestReconfigServer::NUM_SERVERS = 3;
@@ -84,15 +84,15 @@ setUp() {
 
 void TestReconfigServer::
 tearDown() {
-    for (int i = 0; i < cluster_.size(); i++) {
+    for (std::size_t i = 0; i < cluster_.size(); i++) {
         delete cluster_[i];
     }
     cluster_.clear();
 }
 
-int32_t TestReconfigServer::
+std::size_t TestReconfigServer::
 getLeader() {
-    for (int32_t i = 0; i < cluster_.size(); i++) {
+    for (std::size_t i = 0; i < cluster_.size(); i++) {
         if (cluster_[i]->isLeader()) {
             return i;
         }
@@ -100,10 +100,10 @@ getLeader() {
     return -1;
 }
 
-std::vector<int32_t> TestReconfigServer::
+std::vector<std::size_t> TestReconfigServer::
 getFollowers() {
-    std::vector<int32_t> followers;
-    for (int32_t i = 0; i < cluster_.size(); i++) {
+    std::vector<std::size_t> followers;
+    for (std::size_t i = 0; i < cluster_.size(); i++) {
         if (cluster_[i]->isFollower()) {
             followers.push_back(i);
         }
@@ -154,7 +154,7 @@ testRemoveFollower() {
     char buf[len];
 
     // get config from leader.
-    int32_t leader = getLeader();
+    std::size_t leader = getLeader();
     CPPUNIT_ASSERT(leader >= 0);
     std::string host = cluster_[leader]->getHostPort();
     zhandle_t* zk = zookeeper_init(host.c_str(), NULL, 10000, NULL, NULL, 0);
@@ -167,13 +167,13 @@ testRemoveFollower() {
     // of the first NEWLEADER message, used as the initial version
     CPPUNIT_ASSERT_EQUAL(std::string("100000000"), version);
     CPPUNIT_ASSERT_EQUAL(NUM_SERVERS, (uint32_t)(servers.size()));
-    for (int i = 0; i < cluster_.size(); i++) {
+    for (std::size_t i = 0; i < cluster_.size(); i++) {
         CPPUNIT_ASSERT(std::find(servers.begin(), servers.end(),
                        cluster_[i]->getServerString()) != servers.end());
     }
 
     // remove a follower.
-    std::vector<int32_t> followers = getFollowers();
+    std::vector<std::size_t> followers = getFollowers();
     len = 1024;
     CPPUNIT_ASSERT_EQUAL(NUM_SERVERS - 1,
                          (uint32_t)(followers.size()));
@@ -185,7 +185,7 @@ testRemoveFollower() {
     parseConfig(buf, len, servers, version);
     CPPUNIT_ASSERT_EQUAL(std::string("100000002"), version);
     CPPUNIT_ASSERT_EQUAL(NUM_SERVERS - 1, (uint32_t)(servers.size()));
-    for (int i = 0; i < cluster_.size(); i++) {
+    for (std::size_t i = 0; i < cluster_.size(); i++) {
         if (i == followers[0]) {
             continue;
         }
@@ -201,7 +201,7 @@ testRemoveFollower() {
     CPPUNIT_ASSERT_EQUAL((int)ZOK, rc);
     parseConfig(buf, len, servers, version);
     CPPUNIT_ASSERT_EQUAL(NUM_SERVERS, (uint32_t)(servers.size()));
-    for (int i = 0; i < cluster_.size(); i++) {
+    for (std::size_t i = 0; i < cluster_.size(); i++) {
         CPPUNIT_ASSERT(std::find(servers.begin(), servers.end(),
                        cluster_[i]->getServerString()) != servers.end());
     }
@@ -222,7 +222,7 @@ testNonIncremental() {
     char buf[len];
 
     // get config from leader.
-    int32_t leader = getLeader();
+    std::size_t leader = getLeader();
     CPPUNIT_ASSERT(leader >= 0);
     std::string host = cluster_[leader]->getHostPort();
     zhandle_t* zk = zookeeper_init(host.c_str(), NULL, 10000, NULL, NULL, 0);
@@ -236,18 +236,18 @@ testNonIncremental() {
     // of the first NEWLEADER message, used as the initial version
     CPPUNIT_ASSERT_EQUAL(std::string("100000000"), version);
     CPPUNIT_ASSERT_EQUAL(NUM_SERVERS, (uint32_t)(servers.size()));
-    for (int i = 0; i < cluster_.size(); i++) {
+    for (std::size_t i = 0; i < cluster_.size(); i++) {
         CPPUNIT_ASSERT(std::find(servers.begin(), servers.end(),
                        cluster_[i]->getServerString()) != servers.end());
     }
 
     // remove a follower.
-    std::vector<int32_t> followers = getFollowers();
+    std::vector<std::size_t> followers = getFollowers();
     len = 1024;
     CPPUNIT_ASSERT_EQUAL(NUM_SERVERS - 1,
                          (uint32_t)(followers.size()));
     std::stringstream ss;
-    for (int i = 1; i < followers.size(); i++) {
+    for (std::size_t i = 1; i < followers.size(); i++) {
       ss << cluster_[followers[i]]->getServerString() << ",";
     }
     ss << cluster_[leader]->getServerString();
@@ -258,7 +258,7 @@ testNonIncremental() {
     parseConfig(buf, len, servers, version);
     CPPUNIT_ASSERT_EQUAL(std::string("100000002"), version);
     CPPUNIT_ASSERT_EQUAL(NUM_SERVERS - 1, (uint32_t)(servers.size()));
-    for (int i = 0; i < cluster_.size(); i++) {
+    for (std::size_t i = 0; i < cluster_.size(); i++) {
         if (i == followers[0]) {
             continue;
         }
@@ -269,7 +269,7 @@ testNonIncremental() {
     // add the follower back.
     len = 1024;
     ss.str("");
-    for (int i = 0; i < cluster_.size(); i++) {
+    for (std::size_t i = 0; i < cluster_.size(); i++) {
       ss << cluster_[i]->getServerString() << ",";
     }
     rc = zoo_reconfig(zk, NULL, NULL, ss.str().c_str(), -1, buf, &len,
@@ -277,7 +277,7 @@ testNonIncremental() {
     CPPUNIT_ASSERT_EQUAL((int)ZOK, rc);
     parseConfig(buf, len, servers, version);
     CPPUNIT_ASSERT_EQUAL(NUM_SERVERS, (uint32_t)(servers.size()));
-    for (int i = 0; i < cluster_.size(); i++) {
+    for (std::size_t i = 0; i < cluster_.size(); i++) {
         CPPUNIT_ASSERT(std::find(servers.begin(), servers.end(),
                        cluster_[i]->getServerString()) != servers.end());
     }
@@ -285,12 +285,12 @@ testNonIncremental() {
 }
 
 zhandle_t* TestReconfigServer::
-connectFollowers(std::vector<int32_t> &followers) {
+connectFollowers(std::vector<std::size_t> &followers) {
     std::stringstream ss;
-    int32_t leader = getLeader();
+    std::size_t leader = getLeader();
     CPPUNIT_ASSERT(leader >= 0);
     CPPUNIT_ASSERT_EQUAL(NUM_SERVERS - 1, (uint32_t)(followers.size()));
-    for (int i = 0; i < followers.size(); i++) {
+    for (std::size_t i = 0; i < followers.size(); i++) {
         ss << cluster_[followers[i]]->getHostPort() << ",";
     }
     ss << cluster_[leader]->getHostPort();
@@ -321,7 +321,7 @@ testRemoveConnectedFollower() {
 
     // connect to a follower.
     std::stringstream ss;
-    std::vector<int32_t> followers = getFollowers();
+    std::vector<std::size_t> followers = getFollowers();
     zhandle_t* zk = connectFollowers(followers);
     CPPUNIT_ASSERT_EQUAL((int)ZOK, zoo_add_auth(zk, "digest", "super:test", 10, NULL,(void*)ZOK));
 
@@ -333,7 +333,7 @@ testRemoveConnectedFollower() {
     CPPUNIT_ASSERT_EQUAL((int)ZOK, zoo_getconfig(zk, 0, buf, &len, &stat));
     parseConfig(buf, len, servers, version);
     CPPUNIT_ASSERT_EQUAL(NUM_SERVERS - 1, (uint32_t)(servers.size()));
-    for (int i = 0; i < cluster_.size(); i++) {
+    for (std::size_t i = 0; i < cluster_.size(); i++) {
         if (i == followers[0]) {
             continue;
         }
@@ -356,7 +356,7 @@ testReconfigFailureWithoutAuth() {
 
     // connect to a follower.
     std::stringstream ss;
-    std::vector<int32_t> followers = getFollowers();
+    std::vector<std::size_t> followers = getFollowers();
     zhandle_t* zk = connectFollowers(followers);
 
     // remove the follower.
@@ -374,7 +374,7 @@ testReconfigFailureWithoutAuth() {
     CPPUNIT_ASSERT_EQUAL((int)ZOK, zoo_getconfig(zk, 0, buf, &len, &stat));
     parseConfig(buf, len, servers, version);
     CPPUNIT_ASSERT_EQUAL(NUM_SERVERS - 1, (uint32_t)(servers.size()));
-    for (int i = 0; i < cluster_.size(); i++) {
+    for (std::size_t i = 0; i < cluster_.size(); i++) {
         if (i == followers[0]) {
             continue;
         }
@@ -400,7 +400,7 @@ testReconfigFailureWithoutServerSuperuserPasswordConfigured() {
 
     // connect to a follower.
     std::stringstream ss;
-    std::vector<int32_t> followers = getFollowers();
+    std::vector<std::size_t> followers = getFollowers();
     zhandle_t* zk = connectFollowers(followers);
 
     // remove the follower.
diff --git a/zookeeper-client/zookeeper-client-c/tests/TestSASLAuth.cc b/zookeeper-client/zookeeper-client-c/tests/TestSASLAuth.cc
index 080649d97f3..fcac2be1393 100644
--- a/zookeeper-client/zookeeper-client-c/tests/TestSASLAuth.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/TestSASLAuth.cc
@@ -34,10 +34,15 @@ class Zookeeper_SASLAuth : public CPPUNIT_NS::TestFixture {
     CPPUNIT_TEST(testServerRequireClientSASL);
 #ifdef HAVE_CYRUS_SASL_H
     CPPUNIT_TEST(testClientSASL);
+    CPPUNIT_TEST(testClientSASLWithPasswordFileNewline);
+    CPPUNIT_TEST(testClientSASLWithPasswordFileFirstLine);
+    CPPUNIT_TEST(testClientSASLWithPasswordEncryptedText);
+    CPPUNIT_TEST(testClientSASLWithPasswordEncryptedBinary);
 #ifdef ZOO_IPV6_ENABLED
     CPPUNIT_TEST(testClientSASLOverIPv6);
 #endif/* ZOO_IPV6_ENABLED */
     CPPUNIT_TEST(testClientSASLReadOnly);
+    CPPUNIT_TEST(testClientSASLPacketOrder);
 #endif /* HAVE_CYRUS_SASL_H */
     CPPUNIT_TEST_SUITE_END();
     FILE *logfile;
@@ -129,7 +134,18 @@ class Zookeeper_SASLAuth : public CPPUNIT_NS::TestFixture {
     }
 
 #ifdef HAVE_CYRUS_SASL_H
-    void testClientSASLHelper(const char *hostPorts, const char *path) {
+
+    // We need to disable the deprecation warnings as Apple has
+    // decided to deprecate all of CyrusSASL's functions with OS 10.11
+    // (see MESOS-3030, ZOOKEEPER-4201). We are using GCC pragmas also
+    // for covering clang.
+#ifdef __APPLE__
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+#endif
+
+    void testClientSASLHelper(const char *hostPorts, const char *path,
+                              const sasl_callback_t *callbacks) {
         startServer();
 
         // Initialize Cyrus SASL.
@@ -141,8 +157,7 @@ class Zookeeper_SASLAuth : public CPPUNIT_NS::TestFixture {
         sasl_params.service = "zookeeper";
         sasl_params.host = "zk-sasl-md5";
         sasl_params.mechlist = "DIGEST-MD5";
-        sasl_params.callbacks = zoo_sasl_make_basic_callbacks(
-            "myuser", NULL, "Zookeeper_SASLAuth.password");
+        sasl_params.callbacks = callbacks;
 
         // Connect.
         watchctx_t ctx;
@@ -177,10 +192,115 @@ class Zookeeper_SASLAuth : public CPPUNIT_NS::TestFixture {
         stopServer();
     }
 
+    void testClientSASLHelper(const char *hostPorts, const char *path,
+                              const char *password_file) {
+        const sasl_callback_t *callbacks = zoo_sasl_make_basic_callbacks(
+            "myuser", NULL, password_file);
+        testClientSASLHelper(hostPorts, path, callbacks);
+    }
+
+    void testClientSASLHelper(const char *hostPorts, const char *path) {
+        testClientSASLHelper(hostPorts, path, "Zookeeper_SASLAuth.password");
+    }
+
+    void testClientSASLHelper(const char *hostPorts, const char *path,
+                              zoo_sasl_password_t *password) {
+        const sasl_callback_t *callbacks = zoo_sasl_make_password_callbacks(
+            "myuser", NULL, password);
+        testClientSASLHelper(hostPorts, path, callbacks);
+    }
+
     void testClientSASL() {
         testClientSASLHelper(hostPorts, "/clientSASL");
     }
 
+    void testClientSASL(const char *password_file, const char *content, size_t content_len,
+                        const char *path, zoo_sasl_password_callback_t callback) {
+        // Create password file for client.
+        FILE *passf = fopen(password_file, "wt");
+        CPPUNIT_ASSERT(passf);
+
+        // Write the specified content into the file.
+        size_t len = fwrite(content, sizeof(content[0]), content_len, passf);
+        CPPUNIT_ASSERT_EQUAL(len, content_len);
+        CPPUNIT_ASSERT_EQUAL(fclose(passf), 0);
+        passf = NULL;
+
+        zoo_sasl_password_t passwd = {password_file, this, callback};
+        testClientSASLHelper(hostPorts, path, &passwd);
+    }
+
+    void testClientSASLWithPasswordFileNewline() {
+        // Insert a newline immediately after the correct password.
+        const char content[] = "mypassword\nabc";
+        testClientSASL("Zookeeper_SASLAuth.password.newline",
+                       content,
+                       sizeof(content) - 1,
+                       "/clientSASLWithPasswordFileNewline",
+                       NULL);
+    }
+
+    void testClientSASLWithPasswordFileFirstLine() {
+        // Insert multiple newlines and check if only the first line is accepted as the
+        // actual password.
+        const char content[] = "mypassword\nabc\nxyz";
+        testClientSASL("Zookeeper_SASLAuth.password.firstline",
+                       content,
+                       sizeof(content) - 1,
+                       "/clientSASLWithPasswordFileFirstLine",
+                       NULL);
+    }
+
+    int decryptPassword(const char *content, size_t content_len,
+                        char incr, char *buf, size_t buf_len,
+                        size_t *passwd_len) {
+        CPPUNIT_ASSERT(content_len <= buf_len);
+
+        // A simple decryption that only increases each character by a fixed value.
+        for (size_t i = 0; i < content_len; ++i) {
+            buf[i] = content[i] + incr;
+        }
+        *passwd_len = content_len;
+
+        // Since null terminator has not been appended to buf, use memcmp.  
+        CPPUNIT_ASSERT_EQUAL(memcmp(buf, "mypassword", *passwd_len), 0);
+        return SASL_OK;
+    }
+
+    static int textPasswordCallback(const char *content, size_t content_len,
+                                    void *context, char *buf, size_t buf_len,
+                                    size_t *passwd_len) {
+        Zookeeper_SASLAuth *auth = static_cast<Zookeeper_SASLAuth *>(context);
+        return auth->decryptPassword(content, content_len, 1, buf, buf_len, passwd_len);
+    }
+
+    void testClientSASLWithPasswordEncryptedText() {
+        // Encrypt "mypassword" by subtracting 1 from each character in it as plain text.
+        const char content[] = {0x6C, 0x78, 0x6F, 0x60, 0x72, 0x72, 0x76, 0x6E, 0x71, 0x63};
+        testClientSASL("Zookeeper_SASLAuth.password.encrypted.text",
+                       content,
+                       sizeof(content),
+                       "/clientSASLWithPasswordEncryptedText",
+                       textPasswordCallback);
+    }
+
+    static int binaryPasswordCallback(const char *content, size_t content_len,
+                                      void *context, char *buf, size_t buf_len,
+                                      size_t *passwd_len) {
+        Zookeeper_SASLAuth *auth = static_cast<Zookeeper_SASLAuth *>(context);
+        return auth->decryptPassword(content, content_len, 'a', buf, buf_len, passwd_len);
+    }
+
+    void testClientSASLWithPasswordEncryptedBinary() {
+        // Encrypt "mypassword" by subtracting 'a' from each character in it as binary format.
+        const char content[] = {0x0C, 0x18, 0x0F, 0x00, 0x12, 0x12, 0x16, 0x0E, 0x11, 0x03};
+        testClientSASL("Zookeeper_SASLAuth.password.encrypted.binary",
+                       content,
+                       sizeof(content),
+                       "/clientSASLWithPasswordEncryptedBinary",
+                       binaryPasswordCallback);
+    }
+
     void testClientSASLOverIPv6() {
         const char *ipAndPort = "::1:22181";
 
@@ -227,6 +347,42 @@ class Zookeeper_SASLAuth : public CPPUNIT_NS::TestFixture {
         stopServer();
     }
 
+    void testClientSASLPacketOrder() {
+        startServer();
+
+        // Initialize Cyrus SASL.
+        CPPUNIT_ASSERT_EQUAL(sasl_client_init(NULL), SASL_OK);
+
+        // Initialize SASL parameters.
+        zoo_sasl_params_t sasl_params = { 0 };
+
+        sasl_params.service = "zookeeper";
+        sasl_params.host = "zk-sasl-md5";
+        sasl_params.mechlist = "DIGEST-MD5";
+        sasl_params.callbacks = zoo_sasl_make_basic_callbacks(
+            "myuser", NULL, "Zookeeper_SASLAuth.password");
+
+        // Connect.
+        watchctx_t ctx;
+        int rc = 0;
+        zhandle_t *zk = zookeeper_init_sasl(hostPorts, watcher, 10000, NULL,
+            &ctx, /*flags*/0, /*log_callback*/NULL, &sasl_params);
+        ctx.zh = zk;
+        CPPUNIT_ASSERT(zk);
+
+        // No wait: try and queue a packet before SASL auth is complete.
+        char buf[1024];
+        int len = sizeof(buf);
+        rc = zoo_get(zk, "/", 0, buf, &len, 0);
+        CPPUNIT_ASSERT_EQUAL((int)ZOK, rc);
+
+        stopServer();
+    }
+
+#ifdef __APPLE__
+#pragma GCC diagnostic pop
+#endif
+
 #endif /* HAVE_CYRUS_SASL_H */
 };
 
diff --git a/zookeeper-client/zookeeper-client-c/tests/TestWatchers.cc b/zookeeper-client/zookeeper-client-c/tests/TestWatchers.cc
index 0a269341c57..7947d6f1396 100644
--- a/zookeeper-client/zookeeper-client-c/tests/TestWatchers.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/TestWatchers.cc
@@ -456,7 +456,7 @@ class Zookeeper_watchers : public CPPUNIT_NS::TestFixture
         zh=zookeeper_init("localhost:2121",activeWatcher,10000,TEST_CLIENT_ID,
                 &watcher,0);
         CPPUNIT_ASSERT(zh!=0);
-        // wait till watcher proccessing has completed (the connection 
+        // wait till watcher processing has completed (the connection
         // established event)
         CPPUNIT_ASSERT(ensureCondition(
                 deliveryTracker.isWatcherProcessingCompleted(),1000)<1000);
diff --git a/zookeeper-client/zookeeper-client-c/tests/TestZookeeperInit.cc b/zookeeper-client/zookeeper-client-c/tests/TestZookeeperInit.cc
index 61da41dd547..d5fc12c5ded 100644
--- a/zookeeper-client/zookeeper-client-c/tests/TestZookeeperInit.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/TestZookeeperInit.cc
@@ -36,6 +36,7 @@ using namespace std;
 class Zookeeper_init : public CPPUNIT_NS::TestFixture
 {
     CPPUNIT_TEST_SUITE(Zookeeper_init);
+    CPPUNIT_TEST(testVersion);
     CPPUNIT_TEST(testBasic);
     CPPUNIT_TEST(testAddressResolution);
     CPPUNIT_TEST(testMultipleAddressResolution);
@@ -90,6 +91,11 @@ class Zookeeper_init : public CPPUNIT_NS::TestFixture
 #endif
     }
 
+    void testVersion()
+    {
+        CPPUNIT_ASSERT_EQUAL(string(ZOO_VERSION), string(zoo_version_str()));
+    }
+
     void testBasic()
     {
         const string EXPECTED_HOST("127.0.0.1:2121");
diff --git a/zookeeper-client/zookeeper-client-c/tests/ThreadingUtil.h b/zookeeper-client/zookeeper-client-c/tests/ThreadingUtil.h
index 9165412bc8b..45791fd2f59 100644
--- a/zookeeper-client/zookeeper-client-c/tests/ThreadingUtil.h
+++ b/zookeeper-client/zookeeper-client-c/tests/ThreadingUtil.h
@@ -38,7 +38,7 @@ class AtomicInt{
 public:
     explicit AtomicInt(int32_t init=0):v_(init){}
     AtomicInt(const AtomicInt& other):v_(other){}
-    // assigment
+    // assignment
     AtomicInt& operator=(const AtomicInt& lhs){
         atomic_fetch_store(&v_,lhs);
         return *this;
diff --git a/zookeeper-client/zookeeper-client-c/tests/Util.cc b/zookeeper-client/zookeeper-client-c/tests/Util.cc
index 2b9da84eb57..7b49ecac549 100644
--- a/zookeeper-client/zookeeper-client-c/tests/Util.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/Util.cc
@@ -16,6 +16,8 @@
  * limitations under the License.
  */
 
+#include <time.h>
+
 #include "Util.h"
 #include "string.h"
 
diff --git a/zookeeper-client/zookeeper-client-c/tests/ZKMocks.cc b/zookeeper-client/zookeeper-client-c/tests/ZKMocks.cc
index d26c295f24d..674945e043c 100644
--- a/zookeeper-client/zookeeper-client-c/tests/ZKMocks.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/ZKMocks.cc
@@ -344,9 +344,11 @@ string HandshakeResponse::toString() const {
     tmp=htonl(passwd_len);
     buf.append((char*)&tmp,sizeof(tmp));
     buf.append(passwd,sizeof(passwd));
-    buf.append(&readOnly,sizeof(readOnly));
+    if (!omitReadOnly) {
+        buf.append(&readOnly,sizeof(readOnly));
+    }
     // finally set the buffer length
-    tmp=htonl(buf.size()+sizeof(tmp));
+    tmp=htonl(buf.size());
     buf.insert(0,(char*)&tmp, sizeof(tmp));
     return buf;
 }
@@ -523,7 +525,7 @@ void ZookeeperServer::notifyBufferSent(const std::string& buffer){
     addRecvResponse(e);
 }
 
-void forceConnected(zhandle_t* zh){
+void forceConnected(zhandle_t* zh, const struct timeval *last_recv_send){
     // simulate connected state
     zh->state=ZOO_CONNECTED_STATE;
 
@@ -534,8 +536,13 @@ void forceConnected(zhandle_t* zh){
     zh->addrs.next++;
 
     zh->input_buffer=0;
-    gettimeofday(&zh->last_recv,0);
-    gettimeofday(&zh->last_send,0);
+    if (last_recv_send) {
+        zh->last_recv = *last_recv_send;
+        zh->last_send = *last_recv_send;
+    } else {
+        gettimeofday(&zh->last_recv,0);
+        gettimeofday(&zh->last_send,0);
+    }
 }
 
 void terminateZookeeperThreads(zhandle_t* zh){
diff --git a/zookeeper-client/zookeeper-client-c/tests/ZKMocks.h b/zookeeper-client/zookeeper-client-c/tests/ZKMocks.h
index 2717ded3087..d53a41628e7 100644
--- a/zookeeper-client/zookeeper-client-c/tests/ZKMocks.h
+++ b/zookeeper-client/zookeeper-client-c/tests/ZKMocks.h
@@ -30,7 +30,7 @@
 // sets internal zhandle_t members to certain values to simulate the client 
 // connected state. This function should only be used with the single-threaded
 // Async API tests!
-void forceConnected(zhandle_t* zh); 
+void forceConnected(zhandle_t* zh, const struct timeval *last_recv_send = NULL);
 
 /**
  * Gracefully terminates zookeeper I/O and completion threads. 
@@ -305,7 +305,7 @@ class HandshakeResponse: public Response
 public:
     HandshakeResponse(int64_t sessId=1):
         protocolVersion(1),timeOut(10000),sessionId(sessId),
-        passwd_len(sizeof(passwd)),readOnly(0)
+        passwd_len(sizeof(passwd)),readOnly(0),omitReadOnly(false)
     {
         memcpy(passwd,"1234567890123456",sizeof(passwd));
     }
@@ -315,6 +315,7 @@ class HandshakeResponse: public Response
     int32_t passwd_len;
     char passwd[16];
     char readOnly;
+    bool omitReadOnly;
     virtual std::string toString() const ;
 };
 
@@ -442,7 +443,7 @@ class ZookeeperServer: public Mock_socket
     void returnSessionExpired(){ sessionExpired=true; }
     
     // this is a one shot trigger that gets reset back to false
-    // next recv call will return 0 length, thus simulating a connecton loss
+    // next recv call will return 0 length, thus simulating a connection loss
     volatile bool connectionLost;
     void setConnectionLost() {connectionLost=true;}
     
diff --git a/zookeeper-client/zookeeper-client-c/tests/ZooKeeperQuorumServer.cc b/zookeeper-client/zookeeper-client-c/tests/ZooKeeperQuorumServer.cc
index db79919c3c7..73548685712 100644
--- a/zookeeper-client/zookeeper-client-c/tests/ZooKeeperQuorumServer.cc
+++ b/zookeeper-client/zookeeper-client-c/tests/ZooKeeperQuorumServer.cc
@@ -197,6 +197,7 @@ getCluster(uint32_t numServers) {
         }
     }
     assert(!"The cluster didn't start for 10 seconds");
+    return {};
 }
 
 std::vector<ZooKeeperQuorumServer*> ZooKeeperQuorumServer::
diff --git a/zookeeper-client/zookeeper-client-c/tests/zkServer.sh b/zookeeper-client/zookeeper-client-c/tests/zkServer.sh
index 99b716a2111..244eefc9b0c 100755
--- a/zookeeper-client/zookeeper-client-c/tests/zkServer.sh
+++ b/zookeeper-client/zookeeper-client-c/tests/zkServer.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#! /usr/bin/env bash
 #
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements.  See the NOTICE file
@@ -8,13 +8,15 @@
 # "License"); you may not use this file except in compliance
 # with the License.  You may obtain a copy of the License at
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
 
 # This is the port where zookeeper server runs on.
 ZOOPORT=${ZOOPORT:-"22181"}
@@ -22,238 +24,207 @@ ZOOPORT=${ZOOPORT:-"22181"}
 # Some tests are setting the maxClientConnections. When it is not set, we fallback to default 100
 ZKMAXCNXNS=${ZKMAXCNXNS:-"100"}
 
+CLIENT_AUTH=${CLIENT_AUTH:-"need"}
+
 EXTRA_JVM_ARGS=${EXTRA_JVM_ARGS:-""}
 
-if [ "x$1" == "x" ]
-then
-    echo "USAGE: $0 startClean|start|startCleanReadOnly|startRequireSASLAuth [jaasConf] [readOnly]|stop"
-    exit 2
+if [[ -z $1 ]]; then
+  echo "USAGE: $0 startClean|start|startCleanReadOnly|startRequireSASLAuth [jaasConf] [readOnly]|stop"
+  exit 2
 fi
 
-
-
-
 # =====
 # ===== cleanup old executions
 # =====
 
-case "`uname`" in
-    CYGWIN*) cygwin=true ;;
-    *) cygwin=false ;;
+case "$(uname)" in
+  CYGWIN* | MINGW*) cygwin=true ;;
+  *) cygwin=false ;;
 esac
 
-
-if $cygwin
-then
-    # cygwin has a "kill" in the shell itself, gets confused
-    KILL=/bin/kill
+if $cygwin; then
+  # cygwin has a "kill" in the shell itself, gets confused
+  KILL='/bin/kill'
 else
-    KILL=kill
+  KILL='kill'
 fi
 
 # Make sure nothing is left over from before
-if [ -r "/tmp/zk.pid" ]
-then
-pid=`cat /tmp/zk.pid`
-$KILL -9 $pid
-rm -f /tmp/zk.pid
+if [[ -r "/tmp/zk.pid" ]]; then
+  pid=$(cat /tmp/zk.pid)
+  $KILL -9 "$pid"
+  rm -f /tmp/zk.pid
 fi
 
-if [ -r "${base_dir}/build/tmp/zk.pid" ]
-then
-pid=`cat "${base_dir}/build/tmp/zk.pid"`
-$KILL -9 $pid
-rm -f "${base_dir}/build/tmp/zk.pid"
+if [[ -r "$base_dir/build/tmp/zk.pid" ]]; then
+  pid=$(cat "$base_dir/build/tmp/zk.pid")
+  $KILL -9 "$pid"
+  rm -f "$base_dir/build/tmp/zk.pid"
 fi
 
 # [ZOOKEEPER-820] If lsof command is present, look for a process listening
-# on ZOOPORT and kill it. 
-which lsof &> /dev/null
-if [ $? -eq 0  ]
-then
-    pid=`lsof -i :$ZOOPORT | grep LISTEN | awk '{print $2}'`
-    if [ -n "$pid" ]
-    then
-        $KILL -9 $pid
-    fi
+# on ZOOPORT and kill it.
+if which lsof &>/dev/null; then
+  pid=$(lsof -i ":$ZOOPORT" | grep LISTEN | awk '{print $2}')
+  if [[ -n $pid ]]; then
+    $KILL -9 "$pid"
+  fi
 fi
 
-
-
 # =====
 # ===== build classpath
 # =====
 
-if [ "x${base_dir}" == "x" ]
-then
-zk_base="../../../"
+if [[ -z $base_dir ]]; then
+  zk_base="../../../"
 else
-zk_base="${base_dir}"
+  zk_base="$base_dir"
 fi
 
-CLASSPATH="$CLASSPATH:${zk_base}/build/classes"
-CLASSPATH="$CLASSPATH:${zk_base}/conf"
-CLASSPATH="$CLASSPATH:${zk_base}/zookeeper-server/target/classes"
+CLASSPATH="$CLASSPATH:$zk_base/build/classes"
+CLASSPATH="$CLASSPATH:$zk_base/conf"
+CLASSPATH="$CLASSPATH:$zk_base/zookeeper-server/target/classes"
 
-for i in "${zk_base}"/build/lib/*.jar
-do
-    CLASSPATH="$CLASSPATH:$i"
+for i in "$zk_base"/build/lib/*.jar; do
+  CLASSPATH="$CLASSPATH:$i"
 done
 
-for d in "${zk_base}"/zookeeper-server/target/lib/*.jar
-do
-    CLASSPATH="$d:$CLASSPATH"
+for d in "$zk_base"/zookeeper-server/target/lib/*.jar; do
+  CLASSPATH="$d:$CLASSPATH"
 done
 
-for i in "${zk_base}"/zookeeper-server/src/main/resource/lib/*.jar
-do
-    CLASSPATH="$CLASSPATH:$i"
+for i in "$zk_base"/zookeeper-server/src/main/resource/lib/*.jar; do
+  CLASSPATH="$CLASSPATH:$i"
 done
 
-CLASSPATH="$CLASSPATH:${CLOVER_HOME}/lib/clover*.jar"
+CLASSPATH="$CLASSPATH:$CLOVER_HOME/lib/clover*.jar"
 
-if $cygwin
-then
-    CLASSPATH=`cygpath -wp "$CLASSPATH"`
+if $cygwin; then
+  CLASSPATH=$(cygpath -wp "$CLASSPATH")
 fi
-
-
+export CLASSPATH
 
 # =====
 # ===== initialize JVM arguments
 # =====
 
 read_only=
-PROPERTIES="$EXTRA_JVM_ARGS -Dzookeeper.extendedTypesEnabled=true -Dznode.container.checkIntervalMs=100"
-if [ "x$1" == "xstartRequireSASLAuth" ]
-then
-    PROPERTIES="-Dzookeeper.sessionRequireClientSASLAuth=true $PROPERTIES"
-    if [ "x$2" != "x" ]
-    then
-        PROPERTIES="$PROPERTIES -Dzookeeper.authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider"
-        PROPERTIES="$PROPERTIES -Djava.security.auth.login.config=$2"
-    fi
-    if [ "x$3" != "x" ]
-    then
-        PROPERTIES="-Dreadonlymode.enabled=true $PROPERTIES"
-        read_only=true
-    fi
-fi
-if [ "x$1" == "xstartCleanReadOnly" ]
-then
-    PROPERTIES="-Dreadonlymode.enabled=true $PROPERTIES"
+# shellcheck disable=SC2206
+PROPERTIES=($EXTRA_JVM_ARGS "-Dzookeeper.extendedTypesEnabled=true" "-Dznode.container.checkIntervalMs=100")
+if [[ $1 == "startRequireSASLAuth" ]]; then
+  PROPERTIES=("-Dzookeeper.sessionRequireClientSASLAuth=true" "${PROPERTIES[@]}"
+    "-Dzookeeper.authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider"
+    "-Dzookeeper.fips-mode=false")
+  if [[ -n $2 ]]; then
+    PROPERTIES=("${PROPERTIES[@]}" "-Djava.security.auth.login.config=$2")
+  fi
+  if [[ -n $3 ]]; then
+    PROPERTIES=("-Dreadonlymode.enabled=true" "${PROPERTIES[@]}")
     read_only=true
+  fi
+fi
+if [[ $1 == "startCleanReadOnly" ]]; then
+  PROPERTIES=("-Dreadonlymode.enabled=true" "${PROPERTIES[@]}")
+  read_only=true
 fi
-
-
 
 # =====
 # ===== initialize data and test directories
 # =====
 
-if [ "x${base_dir}" == "x" ]
-then
-    tmp_dir="/tmp"
-    tests_dir="tests"
+if [[ -z $base_dir ]]; then
+  tmp_dir="/tmp"
+  tests_dir="tests"
 else
-    tmp_dir="${base_dir}/build/tmp"
-    tests_dir=${base_dir}/zookeeper-client/zookeeper-client-c/tests
+  tmp_dir="$base_dir/build/tmp"
+  tests_dir=$base_dir/zookeeper-client/zookeeper-client-c/tests
 fi
 
-
-
-
 # =====
 # ===== start the ZooKeeper server
 # =====
 
 case $1 in
-start|startClean|startRequireSASLAuth|startCleanReadOnly)
+  start | startClean | startRequireSASLAuth | startCleanReadOnly)
 
-    if [ "x$1" == "xstartClean" ] || [ "x$1" == "xstartCleanReadOnly" ]
-    then
-        rm -rf "${tmp_dir}/zkdata"
+    if [[ $1 == "startClean" ]] || [[ $1 == "startCleanReadOnly" ]]; then
+      rm -rf "$tmp_dir/zkdata"
     fi
-    mkdir -p "${tmp_dir}/zkdata"
-
+    mkdir -p "$tmp_dir/zkdata"
 
     # ===== initialize certificates
     certs_dir="/tmp/certs"
-    rm -rf "${certs_dir}"
-    mkdir -p "${certs_dir}"
-    cp ${tests_dir}/../ssl/gencerts.sh "${certs_dir}/"  > /dev/null
-    cd ${certs_dir} > /dev/null
-    ./gencerts.sh > ./gencerts.stdout 2> ./gencerts.stderr
-    cd - > /dev/null
-
+    rm -rf "$certs_dir"
+    mkdir -p "$certs_dir"
+    cp "$tests_dir"/../ssl/gencerts.sh "$certs_dir/" >/dev/null
+    (
+      cd "$certs_dir" >/dev/null &&
+        # GitHub is providing us hostnames with more than 64 characters now.
+        # And there are no cppunit tests do hostname verification currently,
+        # so we could set CN to arbitrary hostname for now.
+        ./gencerts.sh tests.zookeeper.apache.org >./gencerts.stdout 2>./gencerts.stderr
+    )
 
     # ===== prepare the configs
-    sed "s#TMPDIR#${tmp_dir}#g;s#CERTDIR#${certs_dir}#g;s#MAXCLIENTCONNECTIONS#${ZKMAXCNXNS}#g;s#CLIENTPORT#${ZOOPORT}#g" ${tests_dir}/zoo.cfg > "${tmp_dir}/zoo.cfg"
-    if [ "x$read_only" != "x" ]
-    then
-        # we can put the new server to read-only mode by starting only a single instance of a three node server
-        echo "server.1=localhost:22881:33881" >> ${tmp_dir}/zoo.cfg
-        echo "server.2=localhost:22882:33882" >> ${tmp_dir}/zoo.cfg
-        echo "server.3=localhost:22883:33883" >> ${tmp_dir}/zoo.cfg
-        echo "1" > ${tmp_dir}/zkdata/myid
-        main_class="org.apache.zookeeper.server.quorum.QuorumPeerMain"
+    sed "s#TMPDIR#$tmp_dir#g;s#CERTDIR#$certs_dir#g;s#MAXCLIENTCONNECTIONS#$ZKMAXCNXNS#g;s#CLIENTPORT#$ZOOPORT#g;s#CLIENT_AUTH#$CLIENT_AUTH#g" "$tests_dir/zoo.cfg" >"$tmp_dir/zoo.cfg"
+    if [[ -n $read_only ]]; then
+      # we can put the new server to read-only mode by starting only a single instance of a three node server
+      {
+        echo "server.1=localhost:22881:33881"
+        echo "server.2=localhost:22882:33882"
+        echo "server.3=localhost:22883:33883"
+      } >>"$tmp_dir/zoo.cfg"
+      echo "1" >"$tmp_dir/zkdata/myid"
+      main_class="org.apache.zookeeper.server.quorum.QuorumPeerMain"
     else
-        main_class="org.apache.zookeeper.server.ZooKeeperServerMain"
+      main_class="org.apache.zookeeper.server.ZooKeeperServerMain"
     fi
 
-
     # ===== start the server
-    java -cp "$CLASSPATH" $PROPERTIES ${main_class} ${tmp_dir}/zoo.cfg &> "${tmp_dir}/zk.log" &
+    java "${PROPERTIES[@]}" "$main_class" "$tmp_dir/zoo.cfg" &>"$tmp_dir/zk.log" &
     pid=$!
-    echo -n $! > /tmp/zk.pid
-
+    echo -n $! >/tmp/zk.pid
 
     # ===== wait for the server to start
-    if [ "x$1" == "xstartRequireSASLAuth" ] || [ "x$1" == "xstartCleanReadOnly" ]
-    then
-       # ===== in these cases we can not connect simply with the java client, so we are just waiting...
-       sleep 4
-       success=true
+    if [[ $1 == "startRequireSASLAuth" ]] || [[ $1 == "startCleanReadOnly" ]]; then
+      # ===== in these cases we can not connect simply with the java client, so we are just waiting...
+      sleep 4
+      success=true
     else
-        # ===== wait max 120 seconds for server to be ready to server clients (this handles testing on slow hosts)
-        success=false
-        for i in {1..120}
-        do
-            if ps -p $pid > /dev/null
-            then
-                java -cp "$CLASSPATH" $PROPERTIES org.apache.zookeeper.ZooKeeperMain -server localhost:$ZOOPORT ls / > /dev/null 2>&1
-                if [ $? -ne 0  ]
-                then
-                    # server not up yet - wait
-                    sleep 1
-                else
-                    # server is up and serving client connections
-                    success=true
-                    break
-                fi
-            else
-                # server died - exit now
-                echo -n " ZooKeeper server process failed"
-                break
-            fi
-        done
+      # ===== wait max 120 seconds for server to be ready to server clients (this handles testing on slow hosts)
+      success=false
+      for i in {1..120}; do
+        if ps -p $pid >/dev/null; then
+          if ! java "${PROPERTIES[@]}" org.apache.zookeeper.ZooKeeperMain -server "localhost:$ZOOPORT" ls / &>/dev/null; then
+            # server not up yet - wait
+            sleep 1
+          else
+            # server is up and serving client connections
+            success=true
+            break
+          fi
+        else
+          # server died - exit now
+          echo -n " ZooKeeper server process failed"
+          break
+        fi
+      done
     fi
 
-    if $success
-    then
-        ## in case for debug, but generally don't use as it messes up the
-        ## console test output
-        echo -n " ZooKeeper server started"
+    if $success; then
+      ## in case for debug, but generally don't use as it messes up the
+      ## console test output
+      echo -n " ZooKeeper server started"
     else
-        echo -n " ZooKeeper server NOT started"
+      echo -n " ZooKeeper server NOT started"
     fi
 
     ;;
-stop)
+  stop)
     # Already killed above
     ;;
-*)
-    echo "Unknown command " + $1
+  *)
+    echo "Unknown command $1"
     exit 2
+    ;;
 esac
-
diff --git a/zookeeper-client/zookeeper-client-c/tests/zoo.cfg b/zookeeper-client/zookeeper-client-c/tests/zoo.cfg
index b8e0b2a661f..5e3df626436 100644
--- a/zookeeper-client/zookeeper-client-c/tests/zoo.cfg
+++ b/zookeeper-client/zookeeper-client-c/tests/zoo.cfg
@@ -3,10 +3,12 @@ initLimit=10
 syncLimit=5
 dataDir=TMPDIR/zkdata
 maxClientCnxns=MAXCLIENTCONNECTIONS
+localSessionsEnabled=true
 
 clientPort=CLIENTPORT
 secureClientPort=22281
 serverCnxnFactory=org.apache.zookeeper.server.NettyServerCnxnFactory
+ssl.clientAuth=CLIENT_AUTH
 ssl.keyStore.location=CERTDIR/server.jks
 ssl.keyStore.password=password
 ssl.trustStore.location=CERTDIR/servertrust.jks
diff --git a/zookeeper-compatibility-tests/pom.xml b/zookeeper-compatibility-tests/pom.xml
new file mode 100644
index 00000000000..2d85a16ad7d
--- /dev/null
+++ b/zookeeper-compatibility-tests/pom.xml
@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <parent>
+        <groupId>org.apache.zookeeper</groupId>
+        <artifactId>parent</artifactId>
+        <version>3.10.0-SNAPSHOT</version>
+    </parent>
+    <packaging>pom</packaging>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>zookeeper-compatibility-tests</artifactId>
+
+    <modules>
+        <module>zookeeper-compatibility-tests-curator</module>
+    </modules>
+
+    <name>Apache ZooKeeper - Compatibility Tests</name>
+    <description>Module for various compatibility tests</description>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-install-plugin</artifactId>
+                <configuration>
+                    <skip>true</skip>
+                </configuration>
+            </plugin>
+
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-deploy-plugin</artifactId>
+                <configuration>
+                    <skip>true</skip>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+</project>
diff --git a/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml b/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml
new file mode 100644
index 00000000000..44aa201a7e8
--- /dev/null
+++ b/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/pom.xml
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <parent>
+        <groupId>org.apache.zookeeper</groupId>
+        <artifactId>zookeeper-compatibility-tests</artifactId>
+        <version>3.10.0-SNAPSHOT</version>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>zookeeper-compatibility-tests-curator</artifactId>
+
+    <name>Apache ZooKeeper - Compatibility Tests - Curator</name>
+    <description>Module for Apache Curator compatibility tests</description>
+
+    <properties>
+        <apache-curator-version>5.0.0</apache-curator-version>
+    </properties>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.apache.zookeeper</groupId>
+            <artifactId>zookeeper</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+
+        <dependency>
+            <groupId>org.apache.curator</groupId>
+            <artifactId>curator-recipes</artifactId>
+            <version>${apache-curator-version}</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.apache.zookeeper</groupId>
+                    <artifactId>zookeeper</artifactId>
+                </exclusion>
+            </exclusions>
+            <scope>test</scope>
+        </dependency>
+
+        <dependency>
+            <groupId>org.apache.curator</groupId>
+            <artifactId>curator-test</artifactId>
+            <version>${apache-curator-version}</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.apache.zookeeper</groupId>
+                    <artifactId>zookeeper</artifactId>
+                </exclusion>
+            </exclusions>
+            <scope>test</scope>
+        </dependency>
+
+        <dependency>
+            <groupId>org.junit.jupiter</groupId>
+            <artifactId>junit-jupiter-engine</artifactId>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+</project>
\ No newline at end of file
diff --git a/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/src/test/java/org/apache/zookeeper/compatibility/TestApacheCuratorCompatibility.java b/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/src/test/java/org/apache/zookeeper/compatibility/TestApacheCuratorCompatibility.java
new file mode 100644
index 00000000000..d8111281b8f
--- /dev/null
+++ b/zookeeper-compatibility-tests/zookeeper-compatibility-tests-curator/src/test/java/org/apache/zookeeper/compatibility/TestApacheCuratorCompatibility.java
@@ -0,0 +1,90 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.compatibility;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import java.util.concurrent.BlockingQueue;
+import java.util.concurrent.LinkedBlockingQueue;
+import java.util.concurrent.TimeUnit;
+import org.apache.curator.framework.CuratorFramework;
+import org.apache.curator.framework.CuratorFrameworkFactory;
+import org.apache.curator.framework.recipes.cache.CuratorCache;
+import org.apache.curator.retry.RetryOneTime;
+import org.apache.curator.test.TestingCluster;
+import org.apache.curator.test.TestingServer;
+import org.junit.jupiter.api.Test;
+
+/**
+ * Make sure minimal Apache Curator APIs work correctly. As it's a widely used ZooKeeper
+ * client library we should not break it.
+ */
+public class TestApacheCuratorCompatibility {
+    private static final int TIMEOUT_MS = 5000;
+
+    @Test
+    public void testBasicUsageOfApisAndRecipes() throws Exception {
+        try (TestingServer server = new TestingServer()) {
+            doTest(server.getConnectString());
+        }
+    }
+
+    @Test
+    public void testBasicUsageOfApisAndRecipesInCluster() throws Exception {
+        try (TestingCluster cluster = new TestingCluster(3)) {
+            cluster.start();
+            doTest(cluster.getConnectString());
+        }
+    }
+
+    private void doTest(String connectionString) throws Exception {
+        RetryOneTime retryPolicy = new RetryOneTime(1);
+        try (CuratorFramework client = CuratorFrameworkFactory.newClient(connectionString, retryPolicy)) {
+            try (CuratorCache cache = CuratorCache.build(client, "/base/path")) {
+                client.start();
+                cache.start();
+
+                BlockingQueue<String> paths = new LinkedBlockingQueue<>();
+                cache.listenable().addListener((dummy1, dummy2, data) -> paths.add(data.getPath()));
+
+                client.create().creatingParentsIfNeeded().forPath("/base/path/1");
+                client.create().creatingParentsIfNeeded().forPath("/base/path/2");
+                client.create().creatingParentsIfNeeded().forPath("/base/path/1/a");
+                client.create().creatingParentsIfNeeded().forPath("/base/path/2/a");
+
+                assertEquals("/base/path", poll(paths));
+                assertEquals("/base/path/1", poll(paths));
+                assertEquals("/base/path/2", poll(paths));
+                assertEquals("/base/path/1/a", poll(paths));
+                assertEquals("/base/path/2/a", poll(paths));
+            }
+        }
+    }
+
+    private static String poll(BlockingQueue<String> queue) {
+        try {
+            String value = queue.poll(TIMEOUT_MS, TimeUnit.MILLISECONDS);
+            assertNotNull(value, "Event poll timed out");
+            return value;
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+            throw new RuntimeException(e);
+        }
+    }
+}
diff --git a/zookeeper-contrib/pom.xml b/zookeeper-contrib/pom.xml
old mode 100755
new mode 100644
index edc3cb351fd..66d76ebba65
--- a/zookeeper-contrib/pom.xml
+++ b/zookeeper-contrib/pom.xml
@@ -24,7 +24,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-contrib</artifactId>
@@ -34,24 +34,30 @@
     Contrib projects to Apache ZooKeeper
   </description>
 
-  <modules>
-    <module>zookeeper-contrib-loggraph</module>
-    <module>zookeeper-contrib-rest</module>
-    <module>zookeeper-contrib-zooinspector</module>
-  </modules>
+  <properties>
+    <spotbugs.skip>true</spotbugs.skip>
+  </properties>
+
+  <profiles>
+    <profile>
+      <id>full-build</id>
+      <modules>
+        <module>zookeeper-contrib-fatjar</module>
+        <module>zookeeper-contrib-rest</module>
+        <module>zookeeper-contrib-zooinspector</module>
+      </modules>
+    </profile>
+    <profile>
+      <id>fatjar</id>
+      <modules>
+        <module>zookeeper-contrib-fatjar</module>
+      </modules>
+    </profile>
+  </profiles>
 
   <build>
     <pluginManagement>
       <plugins>
-        <plugin>
-          <groupId>com.github.spotbugs</groupId>
-          <artifactId>spotbugs-maven-plugin</artifactId>
-          <version>3.1.9</version>
-          <configuration>
-            <!-- No spotbugs for contrib modules -->
-            <skip>true</skip>
-          </configuration>
-        </plugin>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-compiler-plugin</artifactId>
@@ -66,33 +72,9 @@
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-checkstyle-plugin</artifactId>
-          <version>3.1.0</version>
-          <dependencies>
-            <dependency>
-              <groupId>com.puppycrawl.tools</groupId>
-              <artifactId>checkstyle</artifactId>
-              <version>${checkstyle.version}</version>
-            </dependency>
-          </dependencies>
           <configuration>
             <configLocation>checkstyle-simple.xml</configLocation>
-            <suppressionsLocation>checkstyleSuppressions.xml</suppressionsLocation>
-            <encoding>UTF-8</encoding>
-            <consoleOutput>true</consoleOutput>
-            <failOnViolation>true</failOnViolation>
-            <includeResources>false</includeResources>
-            <includeTestSourceDirectory>true</includeTestSourceDirectory>
-            <includeTestResources>false</includeTestResources>
           </configuration>
-          <executions>
-            <execution>
-              <id>checkstyle</id>
-              <phase>validate</phase>
-              <goals>
-                <goal>check</goal>
-              </goals>
-            </execution>
-          </executions>
         </plugin>
       </plugins>
     </pluginManagement>
diff --git a/zookeeper-contrib/zookeeper-contrib-fatjar/README.md b/zookeeper-contrib/zookeeper-contrib-fatjar/README.md
new file mode 100644
index 00000000000..baf2f95f91f
--- /dev/null
+++ b/zookeeper-contrib/zookeeper-contrib-fatjar/README.md
@@ -0,0 +1,21 @@
+ZooKeeper Fatjar
+================
+
+This package contains build to create a fat zookeeper jar. Fatjar can be used to run:
+- zookeeper server
+- zookeeper client
+- distributed load generator for testing (generateLoad)
+- container that will instantiate classes as directed by an instance manager (ic)
+- system test (systest)
+- jmh micro benchmarks (jmh)
+
+
+Use following command to build fatjar
+```
+mvn clean install -P fatjar -DskipTests
+```
+
+To run the fatjar use:
+```
+java -jar zoookeeper-<version>-fatjar.jar
+```
diff --git a/zookeeper-contrib/zookeeper-contrib-fatjar/README.txt b/zookeeper-contrib/zookeeper-contrib-fatjar/README.txt
deleted file mode 100644
index f8027ae8c9e..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-fatjar/README.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-This package contains build to create a fat zookeeper jar. You need to run ant to create the fat jar.
-To run the fatjar you can use. java -jar zoookeeper-*fatjar.jar 
diff --git a/zookeeper-contrib/zookeeper-contrib-fatjar/build.xml b/zookeeper-contrib/zookeeper-contrib-fatjar/build.xml
deleted file mode 100644
index 3a1dd958e4e..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-fatjar/build.xml
+++ /dev/null
@@ -1,74 +0,0 @@
-<?xml version="1.0"?>
-
-<!--
-   Licensed to the Apache Software Foundation (ASF) under one or more
-   contributor license agreements.  See the NOTICE file distributed with
-   this work for additional information regarding copyright ownership.
-   The ASF licenses this file to You under the Apache License, Version 2.0
-   (the "License"); you may not use this file except in compliance with
-   the License.  You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
--->
-
-<project name="fatjar" default="jar">
-  <import file="../build-contrib.xml"/>
-
-  <target name="setjarname">
-    <property name="jarname"
-              value="${build.dir}/zookeeper-${version}-${name}.jar"/>
-  </target>
-
-  <!-- Override jar target to specify main class -->
-  <target name="jar" depends="checkMainCompiled, setjarname, compile">
-    <echo message="contrib: ${name}"/>
-    <jar jarfile="${jarname}">
-      <manifest>
-        <attribute name="Main-Class" value="org.apache.zookeeper.util.FatJarMain" />
-        <attribute name="Built-By" value="${user.name}"/>
-        <attribute name="Built-At" value="${build.time}"/>
-        <attribute name="Built-On" value="${host.name}" />
-        <attribute name="Implementation-Title" value="org.apache.zookeeper"/>
-        <attribute name="Implementation-Version" value="${revision}"/>
-        <attribute name="Implementation-Vendor" value="The Apache Software Foundation"/>
-      </manifest>
-      <fileset file="${basedir}/src/main/resources/mainClasses" />
-      <fileset dir="${build.classes}"/>
-      <fileset dir="${build.test}"/>
-      <fileset file="${zk.root}/LICENSE.txt" />
-      <fileset file="${zk.root}/conf/log4j.properties" />
-      <fileset dir="${zk.root}/build/classes" excludes="**/.generated"/>
-      <fileset dir="${zk.root}/build/test/classes"/>
-      <zipgroupfileset dir="${zk.root}/build/lib" includes="*.jar" />
-      <zipgroupfileset dir="${zk.root}/build/test/lib" includes="*.jar" />
-      <zipgroupfileset dir="${zk.root}/zookeeper-server/src/main/resources/lib" includes="*.jar" />
-    </jar>
-  </target>
-
-  <target name="package" depends="jar, zookeeperbuildcontrib.package"
-          unless="skip.contrib">
-
-    <copy file="${basedir}/build.xml" todir="${dist.dir}/zookeeper-contrib/zookeeper-contrib-${name}"/>
-
-    <mkdir dir="${dist.dir}/zookeeper-contrib/zookeeper-contrib-${name}/conf"/>
-    <copy todir="${dist.dir}/zookeeper-contrib/zookeeper-contrib-${name}/conf">
-      <fileset dir="${basedir}/src/main/resources"/>
-    </copy>
-
-    <mkdir dir="${dist.dir}/zookeeper-contrib/zookeeper-contrib-${name}/src"/>
-    <copy todir="${dist.dir}/zookeeper-contrib/zookeeper-contrib-${name}/src">
-      <fileset dir="${basedir}/src"/>
-    </copy>
-  </target>
-
-	<target name="test">
-		<echo message="No test target defined for this package" />
-	</target>
-</project>
-
diff --git a/zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml b/zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml
new file mode 100644
index 00000000000..3cf8a30b607
--- /dev/null
+++ b/zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml
@@ -0,0 +1,141 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+  <!--
+  /**
+   * Licensed to the Apache Software Foundation (ASF) under one
+   * or more contributor license agreements.  See the NOTICE file
+   * distributed with this work for additional information
+   * regarding copyright ownership.  The ASF licenses this file
+   * to you under the Apache License, Version 2.0 (the
+   * "License"); you may not use this file except in compliance
+   * with the License.  You may obtain a copy of the License at
+   *
+   *     http://www.apache.org/licenses/LICENSE-2.0
+   *
+   * Unless required by applicable law or agreed to in writing, software
+   * distributed under the License is distributed on an "AS IS" BASIS,
+   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   * See the License for the specific language governing permissions and
+   * limitations under the License.
+   */
+  -->
+  <modelVersion>4.0.0</modelVersion>
+  <parent>
+    <groupId>org.apache.zookeeper</groupId>
+    <artifactId>zookeeper-contrib</artifactId>
+    <version>3.10.0-SNAPSHOT</version>
+  </parent>
+
+  <groupId>org.apache.zookeeper</groupId>
+  <artifactId>zookeeper-contrib-fatjar</artifactId>
+  <packaging>jar</packaging>
+  <name>Apache ZooKeeper - Contrib - Fatjar</name>
+
+  <properties>
+    <maven.javadoc.skip>true</maven.javadoc.skip>
+    <maven.source.skip>true</maven.source.skip>
+  </properties>
+
+  <dependencies>
+    <dependency>
+      <groupId>org.apache.zookeeper</groupId>
+      <artifactId>zookeeper-jute</artifactId>
+      <version>${project.version}</version>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.zookeeper</groupId>
+      <artifactId>zookeeper</artifactId>
+      <version>${project.version}</version>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.zookeeper</groupId>
+      <artifactId>zookeeper</artifactId>
+      <version>${project.version}</version>
+      <type>test-jar</type>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.zookeeper</groupId>
+      <artifactId>zookeeper-it</artifactId>
+      <version>${project.version}</version>
+    </dependency>
+    <dependency>
+      <groupId>org.slf4j</groupId>
+      <artifactId>slf4j-api</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>commons-cli</groupId>
+      <artifactId>commons-cli</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>org.eclipse.jetty</groupId>
+      <artifactId>jetty-server</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>org.eclipse.jetty</groupId>
+      <artifactId>jetty-servlet</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>com.fasterxml.jackson.core</groupId>
+      <artifactId>jackson-databind</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>org.jline</groupId>
+      <artifactId>jline</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>io.dropwizard.metrics</groupId>
+      <artifactId>metrics-core</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>org.xerial.snappy</groupId>
+      <artifactId>snappy-java</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>ch.qos.logback</groupId>
+      <artifactId>logback-core</artifactId>
+    </dependency>
+  </dependencies>
+
+  <build>
+    <resources>
+      <resource>
+        <directory>${project.basedir}/src/main/resources</directory>
+      </resource>
+      <resource>
+        <directory>${project.basedir}/../../conf</directory>
+        <includes>
+          <include>logback.xml</include>
+        </includes>
+      </resource>
+    </resources>
+    <plugins>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-assembly-plugin</artifactId>
+        <configuration>
+          <descriptorRefs>
+            <descriptorRef>jar-with-dependencies</descriptorRef>
+          </descriptorRefs>
+          <archive>
+            <manifest>
+              <mainClass>org.apache.zookeeper.util.FatJarMain</mainClass>
+            </manifest>
+          </archive>
+          <finalName>zookeeper-${project.version}-fatjar</finalName>
+          <appendAssemblyId>false</appendAssemblyId>
+          <attach>false</attach>
+        </configuration>
+        <executions>
+          <execution>
+          <id>make-assembly</id>
+          <phase>package</phase>
+          <goals>
+            <goal>single</goal>
+          </goals>
+        </execution>
+      </executions>
+      </plugin>
+    </plugins>
+  </build>
+
+</project>
diff --git a/zookeeper-contrib/zookeeper-contrib-fatjar/src/main/resources/mainClasses b/zookeeper-contrib/zookeeper-contrib-fatjar/src/main/resources/mainClasses
index ba29e891973..c7b27a1325b 100644
--- a/zookeeper-contrib/zookeeper-contrib-fatjar/src/main/resources/mainClasses
+++ b/zookeeper-contrib/zookeeper-contrib-fatjar/src/main/resources/mainClasses
@@ -4,8 +4,6 @@ client:org.apache.zookeeper.ZooKeeperMain:Client shell to ZooKeeper
 server:org.apache.zookeeper.server.quorum.QuorumPeerMain:Start ZooKeeper server
 ::Test Commands
 generateLoad:org.apache.zookeeper.test.system.GenerateLoad:A distributed load generator for testing
-quorumBench:org.apache.zookeeper.server.QuorumBenchmark:A benchmark of just the quorum protocol
-abBench:org.apache.zookeeper.server.quorum.AtomicBroadcastBenchmark:A benchmark of just the atomic broadcast
 ic:org.apache.zookeeper.test.system.InstanceContainer:A container that will instantiate classes as directed by an instance manager
 systest:org.apache.zookeeper.test.system.BaseSysTest:Start system test
 jmh:org.apache.zookeeper.BenchMain:Run jmh micro benchmarks
diff --git a/zookeeper-contrib/zookeeper-contrib-huebrowser/zkui/src/zkui/templates/view.mako b/zookeeper-contrib/zookeeper-contrib-huebrowser/zkui/src/zkui/templates/view.mako
index e046afc4fe5..9dd7fe7a2fe 100644
--- a/zookeeper-contrib/zookeeper-contrib-huebrowser/zkui/src/zkui/templates/view.mako
+++ b/zookeeper-contrib/zookeeper-contrib-huebrowser/zkui/src/zkui/templates/view.mako
@@ -96,7 +96,7 @@ ${shared.info_button(url('zkui.views.tree', id=cluster['id'], path='/'), 'View Z
     ${show_stats(leader)}
     
     <tr><td>Followers</td>
-      <td>${leader.get('zk_followers', '')}</td>
+      <td>${leader.get('zk_learners', '')}</td>
     </tr>
 
     <tr><td>Synced Followers</td>
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/README.txt b/zookeeper-contrib/zookeeper-contrib-loggraph/README.txt
deleted file mode 100644
index 8ccaa1ca5b0..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/README.txt
+++ /dev/null
@@ -1,70 +0,0 @@
-LogGraph README
-
-1 - About
-LogGraph is an application for viewing and filtering zookeeper logs. It can handle transaction logs and message logs. 
-
-2 - Compiling
-
-Run "ant jar" in src/contrib/loggraph/. This will download all dependencies and compile all the loggraph code.
-
-Once compilation has finished, you can run it the the loggraph.sh script in zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources.
-This will start and embedded web server on your machine.
-Navigate to http://localhost:8182/graph/main.html
-
-3 - Usage
-LogGraph presents the user with 4 views, 
- 
-  a) Simple log view
-     This view simply displays the log text. This isn't very useful without filters (see "Filtering the logs").
-
-  b) Server view
-     The server view shows the interactions between the different servers in an ensemble. The X axis represents time. 
-        * Exceptions show up as red dots. Hovering your mouse over them will give you more details of the exception
-	* The colour of the line represents the election state of the server. 
-	   - orange means LOOKING for leader
-	   - dark green means the server is the leader
-	   - light green means the server is following a leader
-	   - yellow means there isn't enough information to determine the state of the server. 
-	* The gray arrows denote election messages between servers. Pink dashed arrows are messages that were sent but never delivered.
-
-  c) Session view
-     The session view shows the lifetime of sessions on a server. Use the time filter to narrow down the view. Any more than about 2000 events will take a long time to view in your browser. 
-     The X axis represents time. Each line is a session. The black dots represent events on the session. You can click on the black dots for more details of the event.
-
-  d) Stats view
-     There is currently only one statistics view, Transactions/minute. Suggestions for other statistic views are very welcome.
-
-4 - Filtering the logs
-The logs can be filtered in 2 ways, by time and by content. 
-
-To filter by time simply move the slider to the desired start time. The time window specifies how many milliseconds after and including the start time will be displayed.
-
-Content filtering uses a adhoc filtering language, using prefix notation. The language looks somewhat similar to lisp. A statement in the language takes the form (op arg arg ....). A statement resolves to a boolean value. Statements can be nested. 
-
-4.1 - Filter arguments
-An argument can be a number, a string or a symbol. A number is any argument which starts with -, + or 0 to 9. If the number starts with 0x it is interpretted as hexidecimal. Otherwise it is interpretted as decimal. If the argument begins with a double-quote, (") it is interpretted as a string. Anything else is interpretted as a symbol.
-
-4.2 - Filter symbols
-The possible filter symbols are: 
-
-client-id : number, the session id of the client who initiated a transaction.
-cxid : number, the cxid of a transaction
-zxid : number, the zxid of a transaction
-operation : string, the operation being performed, for example "setData", "createSession", "closeSession", "error", "create"
-
-4.3 - Filter operations
-The possible filter operations are:
-
-or : logical or, takes 1 or more arguments which must be other statements.
-and : logical and, takes 1 or more arguments which must be other statements.
-not : logical not, takes 1 argument which must be another statement.
-xor : exclusive or, takes 1 or more arguments which must be other statements.
-= : equals, takes 1 or more arguments, which must all be equal to each other to return true.
-> : greater than, takes 1 or more arguments, to return true the 1st argument must be greater than the 2nd argument which must be greater than the 3rd argument and so on... 
-< : less than, takes 1 or more arguments, to return true the 1st argument must be less than the 2nd argument which must be less than the 3rd argument and so on... 
-
-4.3 - Filter examples
-Give me all the setData operations with session id 0xdeadbeef or 0xcafeb33r but not with zxid 0x12341234 ->
-
-(and (= operation "setData") (or (= client-id 0xdeadbeef) (= client-id 0xcafeb33r)) (not (= zxid 0x12341234)))
-
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/build.xml b/zookeeper-contrib/zookeeper-contrib-loggraph/build.xml
deleted file mode 100644
index 07809ff7e93..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/build.xml
+++ /dev/null
@@ -1,70 +0,0 @@
-<?xml version="1.0"?>
-
-<!--
-   Licensed to the Apache Software Foundation (ASF) under one or more
-   contributor license agreements.  See the NOTICE file distributed with
-   this work for additional information regarding copyright ownership.
-   The ASF licenses this file to You under the Apache License, Version 2.0
-   (the "License"); you may not use this file except in compliance with
-   the License.  You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
--->
-
-<project name="loggraph" default="jar">
-
-  <import file="../build-contrib.xml"/>
-  
-  <target name="init" depends="check-contrib,zookeeperbuildcontrib.init" unless="skip.contrib">
-    <echo message="contrib: ${name}"/>
-    <mkdir dir="${build.dir}"/>
-    <antcall target="init-contrib"/>
-  </target>
-
-  <target name="compile" depends="init,ivy-retrieve,zookeeperbuildcontrib.compile" unless="skip.contrib">
-  </target>
-
-  <target name="setjarname">
-    <property name="jarname" value="${build.dir}/zookeeper-${version}-${name}.jar"/>
-  </target>
-
-  <target name="jar" depends="setjarname,compile"  >
-    <jar destfile="${jarname}">
-      <fileset file="${zk.root}/LICENSE.txt" />
-      <fileset dir="${build.classes}" />
-      <fileset dir="src/main/resources/webapp"/>
-      <manifest>
-        <attribute name="Built-By" value="${user.name}"/>
-        <attribute name="Built-At" value="${build.time}"/>
-        <attribute name="Built-On" value="${host.name}" />
-        <attribute name="Implementation-Title" value="org.apache.zookeeper.graph"/>
-        <attribute name="Implementation-Version" value="${revision}"/>
-        <attribute name="Implementation-Vendor" value="The Apache Software Foundation"/>
-      </manifest>
-    </jar>
-  </target>
-  
-  <target name="test">
-    <echo message="No test target defined for this package" />
-  </target>
-  
-
-  <target name="package" depends="compile, zookeeperbuildcontrib.package" unless="skip.contrib">
-    <echo message="contrib: ${name}"/>
-    
-    <copy file="${basedir}/build.xml" todir="${dist.dir}/zookeeper-contrib/zookeeper-contrib-${name}"/>
-
-    <mkdir dir="${dist.dir}/zookeeper-contrib/zookeeper-contrib-${name}/src"/>
-    <copy todir="${dist.dir}/zookeeper-contrib/zookeeper-contrib-${name}/src">
-      <fileset dir="${basedir}/src/main"/>
-    </copy>
-
-  </target>
-
-</project>
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/ivy.xml b/zookeeper-contrib/zookeeper-contrib-loggraph/ivy.xml
deleted file mode 100644
index e3a1b486b7a..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/ivy.xml
+++ /dev/null
@@ -1,44 +0,0 @@
-<!--
-   Licensed to the Apache Software Foundation (ASF) under one or more
-   contributor license agreements.  See the NOTICE file distributed with
-   this work for additional information regarding copyright ownership.
-   The ASF licenses this file to You under the Apache License, Version 2.0
-   (the "License"); you may not use this file except in compliance with
-   the License.  You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
--->
-
-<ivy-module version="2.0"
-            xmlns:e="http://ant.apache.org/ivy/extra">
-
-  <info organisation="org.apache.zookeeper"
-        module="${name}" revision="${version}">
-    <license name="Apache 2.0"/>
-    <ivyauthor name="Apache ZooKeeper" url="http://zookeeper.apache.org"/>
-    <description>ZooKeeper Graphing</description>
-  </info>
-
-  <configurations defaultconfmapping="default">
-    <conf name="default"/>
-    <conf name="test"/>
-  </configurations>
-
-  <dependencies>
-    <dependency org="org.slf4j" name="slf4j-api" rev="1.7.5"/>
-    <dependency org="org.slf4j" name="slf4j-log4j12" rev="1.7.5" transitive="false"/>
-  
-    <!-- transitive false turns off dependency checking, log4j deps seem borked -->
-    <dependency org="log4j" name="log4j" rev="1.2.17" transitive="false"/>
-    <dependency org="org.eclipse.jetty" name="jetty-server" rev="9.2.18.v20160721" />
-    <dependency org="org.eclipse.jetty" name="jetty-servlet" rev="9.2.18.v20160721" />
-    <dependency org="com.googlecode.json-simple" name="json-simple" rev="1.1" />
-  </dependencies>
-
-</ivy-module>
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/FilterOp.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/FilterOp.java
deleted file mode 100644
index b29c8462bf4..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/FilterOp.java
+++ /dev/null
@@ -1,76 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph;
-
-import java.util.ArrayList;
-import java.util.List;
-import org.apache.zookeeper.graph.filterops.*;
-
-public abstract class FilterOp {
-    protected List<FilterOp> subOps;
-    protected List<Arg> args;
-
-    public enum ArgType {
-	STRING, NUMBER, SYMBOL
-    }
-
-    public FilterOp() {
-	subOps = new ArrayList<FilterOp>();
-	args = new ArrayList<Arg>();
-    }
-
-    public static FilterOp newOp(String op) throws FilterException {
-	if (op.equals("or")) 
-	    return new OrOp();
-	if (op.equals("and"))
-	    return new AndOp();
-	if (op.equals("not"))
-	    return new NotOp();
-	if (op.equals("xor"))
-	    return new XorOp();
-	if (op.equals("="))
-	    return new EqualsOp();
-	if (op.equals("<"))
-	    return new LessThanOp();
-	if (op.equals(">")) 
-	    return new GreaterThanOp();
-
-	throw new FilterException("Invalid operation '"+op+"'");
-    }
-
-    public void addSubOp(FilterOp op) {
-	subOps.add(op);
-    }
-    
-    public void addArg(Arg arg) {
-	args.add(arg); 
-    }
-
-    public abstract boolean matches(LogEntry entry) throws FilterException;
-    
-    public String toString() {
-	String op = "(" + getClass().getName();
-	for (FilterOp f :  subOps) {
-	    op += " " + f;
-	}
-	for (Arg a : args) {
-	    op += " " + a;
-	}
-	return op + ")";
-    }
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/FilterParser.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/FilterParser.java
deleted file mode 100644
index cf12e3a5335..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/FilterParser.java
+++ /dev/null
@@ -1,131 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph;
-
-import java.io.PushbackReader;
-import java.io.StringReader;
-import java.io.IOException;
-import java.util.ArrayList;
-
-import org.apache.zookeeper.graph.filterops.*;
-
-public class FilterParser {
-    private PushbackReader reader;
-
-    public FilterParser(String s) {
-	reader = new PushbackReader(new StringReader(s));
-    }
-
-    private String readUntilSpace() throws IOException {
-	StringBuffer buffer = new StringBuffer();
-
-	int c = reader.read();
-	while (!Character.isWhitespace(c) && c != ')' && c != '(') {
-	    buffer.append((char)c);
-	    c = reader.read();
-	    if (c == -1) {
-		break;
-	    }
-	}	
-	reader.unread(c);
-
-	return buffer.toString().trim();
-    }
-
-    private StringArg readStringArg() throws IOException, FilterException {
-	int c = reader.read();
-	int last = 0;
-	if (c != '"') {
-	    throw new FilterException("Check the parser, trying to read a string that doesn't begin with quotes");
-	}
-	StringBuffer buffer = new StringBuffer();
-	while (reader.ready()) {
-	    last = c;
-	    c = reader.read();
-	    if (c == -1) {
-		break;
-	    }
-	    
-	    if (c == '"' && last != '\\') {
-		return new StringArg(buffer.toString());
-	    } else {
-		buffer.append((char)c);
-	    }
-	}
-	throw new FilterException("Unterminated string");
-    }
-
-    private NumberArg readNumberArg() throws IOException, FilterException {
-	String strval = readUntilSpace();
-	
-	try {
-	    if (strval.startsWith("0x")) {
-		return new NumberArg(Long.valueOf(strval.substring(2), 16));
-	    } else {
-		return new NumberArg(Long.valueOf(strval));
-	    }
-	} catch (NumberFormatException e) {
-	    throw new FilterException("Not a number [" + strval + "]\n" + e);
-	}
-    }
-
-    private SymbolArg readSymbolArg() throws IOException, FilterException {
-	return new SymbolArg(readUntilSpace());
-    }
-
-    public FilterOp parse() throws IOException, FilterException {
-	int c = reader.read();
-	if (c != '(') {
-	    throw new FilterException("Invalid format");
-	}
-
-	String opstr = readUntilSpace();
-	FilterOp op = FilterOp.newOp(opstr);
-
-	while (reader.ready()) {
-	    c = reader.read();
-	    if (c == -1) {
-		break;
-	    }
-	    if (c == '(') {
-		reader.unread(c);
-		op.addSubOp(parse());
-	    } else if (c == ')') {
-		return op;
-	    } else if (c == '"') {
-		reader.unread(c);
-		op.addArg(readStringArg());
-	    } else if (Character.isDigit(c) || c == '-' || c == '+') {
-		reader.unread(c);
-		op.addArg(readNumberArg());
-	    } else if (Character.isJavaIdentifierStart(c)) {
-		reader.unread(c);
-		op.addArg(readSymbolArg());
-	    }
-	}
-	throw new FilterException("Incomplete filter");
-    }
-
-    public static void main(String[] args) throws IOException, FilterException {
-	if (args.length == 1) {
-	    System.out.println(new FilterParser(args[0]).parse());
-	} else {
-	    System.out.println(new FilterParser("(or (and (= session foobar) (= session barfoo)) (= session sdfs))").parse());
-	}
-    }
-};
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/JsonGenerator.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/JsonGenerator.java
deleted file mode 100644
index 8215833f298..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/JsonGenerator.java
+++ /dev/null
@@ -1,224 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph;
-
-
-import org.json.simple.JSONArray;
-import org.json.simple.JSONObject;
-import org.json.simple.JSONValue;
-
-import java.io.Writer;
-import java.io.OutputStreamWriter;
-import java.io.IOException;
-import java.util.regex.Pattern;
-import java.util.regex.Matcher;
-import java.util.HashSet;
-import java.util.Iterator;
-import java.util.LinkedList;
-import java.util.ListIterator;
-import java.util.Set;
-
-public class JsonGenerator {
-    private JSONObject root;
-    private Set<Integer> servers;
-
-    private class Message {
-	private int from;
-	private int to;
-	private long zxid;
-
-	public Message(int from, int to, long zxid) {
-	    this.from = from;
-	    this.to = to;
-	    this.zxid = zxid;
-	}
-	
-	public boolean equals(Message m) {
-	    return (m.from == this.from 
-		    && m.to == this.to
-		    && m.zxid == this.zxid);
-	}
-    };
-
-    public JSONObject txnEntry(TransactionEntry e) {
-	JSONObject event = new JSONObject();
-
-	event.put("time", Long.toString(e.getTimestamp()));
-	event.put("client", Long.toHexString(e.getClientId()));
-	event.put("cxid", Long.toHexString(e.getCxid()));
-	event.put("zxid", Long.toHexString(e.getZxid()));
-	event.put("op", e.getOp());
-	event.put("extra", e.getExtra());
-	event.put("type", "transaction");
-
-	return event;
-    }
-
-    /**
-       Assumes entries are sorted by timestamp.
-     */
-    public JsonGenerator(LogIterator iter) {
-	servers = new HashSet<Integer>();
-
-	Pattern stateChangeP = Pattern.compile("- (LOOKING|FOLLOWING|LEADING)");
-	Pattern newElectionP = Pattern.compile("New election. My id =  (\\d+), Proposed zxid = (\\d+)");
-	Pattern receivedProposalP = Pattern.compile("Notification: (\\d+) \\(n.leader\\), (\\d+) \\(n.zxid\\), (\\d+) \\(n.round\\), .+ \\(n.state\\), (\\d+) \\(n.sid\\), .+ \\(my state\\)");
-	Pattern exceptionP = Pattern.compile("xception");
-	
-	root = new JSONObject();
-	Matcher m = null;
-	JSONArray events = new JSONArray();
-	root.put("events", events);
-	
-	long starttime = Long.MAX_VALUE;
-	long endtime = 0;
-
-	int leader = 0;
-	long curEpoch = 0;
-	boolean newEpoch = false;
-
-	while (iter.hasNext()) {
-	    LogEntry ent = iter.next();
-	    
-	    if (ent.getTimestamp() < starttime) {
-		starttime = ent.getTimestamp();
-	    }
-	    if (ent.getTimestamp() > endtime) {
-		endtime = ent.getTimestamp();
-	    }
-	    
-	    if (ent.getType() == LogEntry.Type.TXN) {
-		events.add(txnEntry((TransactionEntry)ent));
-	    } else {
-		Log4JEntry e = (Log4JEntry)ent;
-		servers.add(e.getNode());
-		
-		if ((m = stateChangeP.matcher(e.getEntry())).find()) {
-		    JSONObject stateChange = new JSONObject();
-		    stateChange.put("type", "stateChange");
-		    stateChange.put("time", e.getTimestamp());
-		    stateChange.put("server", e.getNode());
-		    stateChange.put("state", m.group(1));
-		    events.add(stateChange);
-		    
-		    if (m.group(1).equals("LEADING")) {
-			leader = e.getNode();
-		    }
-		} else if ((m = newElectionP.matcher(e.getEntry())).find()) {
-		    Iterator<Integer> iterator = servers.iterator();
-		    long zxid = Long.valueOf(m.group(2));
-		    int count = (int)zxid;// & 0xFFFFFFFFL;
-		    int epoch = (int)Long.rotateRight(zxid, 32);// >> 32;
-		    
-		    if (leader != 0 && epoch > curEpoch) {
-			JSONObject stateChange = new JSONObject();
-			stateChange.put("type", "stateChange");
-			stateChange.put("time", e.getTimestamp());
-			stateChange.put("server", leader);
-			stateChange.put("state", "INIT");
-			events.add(stateChange);
-			leader = 0;
-		    }
-		    
-		    while (iterator.hasNext()) {
-			int dst = iterator.next();
-			if (dst != e.getNode()) {
-			    JSONObject msg = new JSONObject();
-			    msg.put("type", "postmessage");
-			    msg.put("src", e.getNode());
-			    msg.put("dst", dst);
-			    msg.put("time", e.getTimestamp());
-			    msg.put("zxid", m.group(2));
-			    msg.put("count", count);
-			    msg.put("epoch", epoch);
-			    
-			    events.add(msg);
-			}
-		    }
-		} else if ((m = receivedProposalP.matcher(e.getEntry())).find()) {
-		    // Pattern.compile("Notification: \\d+, (\\d+), (\\d+), \\d+, [^,]*, [^,]*, (\\d+)");//, LOOKING, LOOKING, 2
-		    int src = Integer.valueOf(m.group(4));
-		    long zxid = Long.valueOf(m.group(2));
-		    int dst = e.getNode();
-		    long epoch2 = Long.valueOf(m.group(3));
-		    
-		    int count = (int)zxid;// & 0xFFFFFFFFL;
-		    int epoch = (int)Long.rotateRight(zxid, 32);// >> 32;
-		    
-		    if (leader != 0 && epoch > curEpoch) {
-			JSONObject stateChange = new JSONObject();
-			stateChange.put("type", "stateChange");
-			stateChange.put("time", e.getTimestamp());
-			stateChange.put("server", leader);
-			stateChange.put("state", "INIT");
-			events.add(stateChange);
-			leader = 0;
-		    }
-		    
-		    if (src != dst) {
-			JSONObject msg = new JSONObject();
-			msg.put("type", "delivermessage");
-			msg.put("src", src);
-			msg.put("dst", dst);
-			msg.put("time", e.getTimestamp());
-			msg.put("zxid", zxid);
-			msg.put("epoch", epoch);
-			msg.put("count", count);
-			msg.put("epoch2", epoch2);
-			
-			events.add(msg);
-		    }
-		} else if ((m = exceptionP.matcher(e.getEntry())).find()) {
-		    JSONObject ex = new JSONObject();
-		    ex.put("type", "exception");
-		    ex.put("server", e.getNode());
-		    ex.put("time", e.getTimestamp());
-		    ex.put("text", e.getEntry());
-		    events.add(ex);
-		} 
-	    }
-	    JSONObject ex = new JSONObject();
-	    ex.put("type", "text");
-	    ex.put("time", ent.getTimestamp());
-	    String txt = ent.toString();
-	    ex.put("text", txt);
-	    events.add(ex);
-	}
-	//	System.out.println("pending messages: "+pendingMessages.size());
-	root.put("starttime", starttime);
-	root.put("endtime", endtime);
-
-	JSONArray serversarray = new JSONArray();
-	root.put("servers", serversarray);
-	
-	Iterator<Integer> iterator = servers.iterator();
-	while (iterator.hasNext()) {
-	    serversarray.add(iterator.next());
-	}
-    }
-
-    public String toString() {
-	return JSONValue.toJSONString(root);
-    }
-
-    public static void main(String[] args) throws Exception {
-	MergedLogSource src = new MergedLogSource(args);
-	LogIterator iter = src.iterator();
-	System.out.println(new JsonGenerator(iter));
-    }
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/Log4JSource.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/Log4JSource.java
deleted file mode 100644
index 84a9d983e78..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/Log4JSource.java
+++ /dev/null
@@ -1,391 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph;
-
-import java.io.File;
-import java.io.InputStreamReader;
-import java.io.BufferedReader;
-import java.io.FileReader;
-import java.io.IOException;
-import java.util.regex.Pattern;
-import java.util.regex.Matcher;
-import java.util.ArrayList;
-import java.util.Date;
-import java.text.SimpleDateFormat;
-import java.text.ParseException;
-import java.util.Calendar;
-import java.util.GregorianCalendar;
-
-import java.io.EOFException;
-import java.io.Closeable;
-import java.io.FileNotFoundException;
-import java.util.Iterator;
-import java.util.NoSuchElementException;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-public class Log4JSource implements LogSource {
-    private static final Logger LOG = LoggerFactory.getLogger(Log4JSource.class);
-    
-    private static final int skipN = 10000;
-    private static final String DATE_FORMAT = "yyyy-MM-dd HH:mm:ss,SSS";
-
-    private LogSkipList skiplist = null;
-
-    private String file = null;
-    private long starttime = 0;
-    private long endtime = 0;
-    private int serverid = 0;
-    private long size = 0;
-
-    private Pattern timep;
-
-    public boolean overlapsRange(long starttime, long endtime) {
-	return (starttime <= this.endtime && endtime >= this.starttime);
-    }
-    
-    public long size() { return size; }
-    public long getStartTime() { return starttime; }
-    public long getEndTime() { return endtime; }
-    public LogSkipList getSkipList() { return skiplist; }
-    
-    private class Log4JSourceIterator implements LogIterator {
-	private RandomAccessFileReader in;
-	private LogEntry next = null;
-	private long starttime = 0;
-	private long endtime = 0;
-	private String buf = "";	
-	private Log4JSource src = null;
-	private long skippedAtStart = 0;
-	private SimpleDateFormat dateformat = null;
-	private FilterOp filter = null;
-
-	public Log4JSourceIterator(Log4JSource src, long starttime, long endtime) throws IllegalArgumentException, FilterException {
-	    this(src, starttime, endtime, null);
-	}
-
-	public Log4JSourceIterator(Log4JSource src, long starttime, long endtime, FilterOp filter) throws IllegalArgumentException, FilterException {
-
-	    this.dateformat = new SimpleDateFormat(DATE_FORMAT);
-	    this.src = src;
-	    this.starttime = starttime;
-	    this.endtime = endtime;
-
-	    File f = new File(src.file);
-	    try {
-		in = new RandomAccessFileReader(f);
-	    } catch (FileNotFoundException e) {
-		throw new IllegalArgumentException("Bad file passed in (" + src.file +") cannot open:" + e);
-	    }
-
-	    // skip to the offset of latest skip point before starttime
-	    LogSkipList.Mark start = src.getSkipList().findMarkBefore(starttime);
-	    try {
-		in.seek(start.getBytes());
-		skippedAtStart = start.getEntriesSkipped();
-	    } catch (IOException ioe) {
-		// if we can't skip, we should just read from the start
-	    }
-
-	    LogEntry e;
-	    while ((e = readNextEntry()) != null && e.getTimestamp() < endtime) {
-		if (e.getTimestamp() >= starttime && (filter == null || filter.matches(e))) {
-		    next = e;
-		    return;
-		}
-		skippedAtStart++;
-	    }
-	    this.filter = filter;
-	}
-	
-	synchronized public long size() throws IOException {
-	    if (LOG.isTraceEnabled()) {
-		LOG.trace("size() called");
-	    }
-
-	    if (this.endtime >= src.getEndTime()) {
-		return src.size() - skippedAtStart;
-	    }
-	    
-	    long pos = in.getPosition();
-	    
-	    if (LOG.isTraceEnabled()) {
-		LOG.trace("saved pos () = " + pos);
-	    }
-	    
-	    LogEntry e;
-	  
-	    LogSkipList.Mark lastseg = src.getSkipList().findMarkBefore(this.endtime);
-	    in.seek(lastseg.getBytes());
-	    buf = "";  // clear the buf so we don't get something we read before we sought
-	    // number of entries skipped to get to the end of the iterator, less the number skipped to get to the start
-	    long count = lastseg.getEntriesSkipped() - skippedAtStart; 
-
-	    while ((e = readNextEntry()) != null) {
-		if (LOG.isTraceEnabled()) {
-		    //LOG.trace(e);
-		}
-		if (e.getTimestamp() > this.endtime) {
-		    break;
-		}
-		count++;
-	    }
-	    in.seek(pos);
-	    buf = "";
-
-	    if (LOG.isTraceEnabled()) {
-		LOG.trace("size() = " + count);
-	    }
-	    
-	    return count;
-	}
-
-	synchronized private LogEntry readNextEntry() {
-	    try {
-		try {
-		    while (true) {
-			String line = in.readLine();
-			if (line == null) {
-			    break;
-			}
-
-			Matcher m = src.timep.matcher(line);
-			if (m.lookingAt()) {
-			    if (buf.length() > 0) {
-				LogEntry e = new Log4JEntry(src.timestampFromText(dateformat, buf), src.getServerId(), buf);
-				buf = line;
-				return e;
-			    }
-			    buf = line;
-			} else if (buf.length() > 0) {
-			    buf += line + "\n";
-			}
-		    }
-		} catch (EOFException eof) {
-		    // ignore, we've simply come to the end of the file
-		}
-		if (buf.length() > 0) {
-		    LogEntry e = new Log4JEntry(src.timestampFromText(dateformat, buf), src.getServerId(), buf);
-		    buf = "";
-		    return e;
-		}
-	    } catch (Exception e) {
-		LOG.error("Error reading next entry in file (" + src.file + "): " + e);
-		return null;
-	    }
-	    return null;
-	}
-
-	public boolean hasNext() {
-	    return next != null;
-	}
-	
-	public LogEntry next() throws NoSuchElementException {
-	    LogEntry ret = next;
-	    LogEntry e = readNextEntry();
-
-	    if (filter != null) {
-		try {
-		    while (e != null && !filter.matches(e)) {
-			e = readNextEntry();
-		    }
-		} catch (FilterException fe) {
-		    throw new NoSuchElementException(e.toString());
-		}
-	    }
-
-	    if (e != null && e.getTimestamp() < endtime) {
-		next = e;
-	    } else {
-		next = null;
-	    }
-	    return ret;
-	}
-
-	public void remove() throws UnsupportedOperationException {
-	    throw new UnsupportedOperationException("remove not supported for L4J logs");
-	}
-	
-	public void close() throws IOException {
-	    in.close();
-	}
-	
-	public String toString() {
-	    String size;
-	    try {
-		size = new Long(size()).toString();
-	    } catch (IOException ioe) {
-		size = "Unable to read";
-	    }
-	    return "Log4JSourceIterator(start=" + starttime + ", end=" + endtime + ", size=" + size + ")";
-	}
-    }
-
-    public LogIterator iterator(long starttime, long endtime) throws IllegalArgumentException {
-	try {
-	    return iterator(starttime, endtime, null);
-	} catch (FilterException fe) {
-	    assert(false); //"This should never happen, you can't have a filter exception without a filter");
-	    return null;
-	}
-    }
-
-    public LogIterator iterator(long starttime, long endtime, FilterOp filter) throws IllegalArgumentException, FilterException{
-	// sanitise start and end times
-	if (endtime < starttime) {
-	    throw new IllegalArgumentException("End time (" +  endtime + ") must be greater or equal to starttime (" + starttime + ")");
-	}
-
-	return new Log4JSourceIterator(this, starttime, endtime, filter);
-    }
-
-    public LogIterator iterator() throws IllegalArgumentException {
-	return iterator(starttime, endtime+1);
-    }
-    
-    public Log4JSource(String file) throws IOException {
-	this.file=file;
-	
-	timep = Pattern.compile("^(\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2},\\d{3})");
-	skiplist = new LogSkipList();
-	init();
-    }
-    
-    private static long timestampFromText(SimpleDateFormat format, String s) {
-	Date d = null;
-	try {
-	    d = format.parse(s);
-	} catch (ParseException e) {
-	    return 0;
-	}
-	Calendar c = new GregorianCalendar();
-	c.setTime(d);
-	return c.getTimeInMillis();
-    }
-
-    private void init() throws IOException {
-	File f = new File(file);
-	RandomAccessFileReader in = new RandomAccessFileReader(f);
-	SimpleDateFormat dateformat = new SimpleDateFormat(DATE_FORMAT);
-	Pattern idp = Pattern.compile("\\[myid:(\\d+)\\]");
-
-	long lastFp = in.getPosition();
-	String line = in.readLine();
-	Matcher m = null;
-
-	// if we have read data from the file, and it matchs the timep pattern
-	if ((line != null) && (m = timep.matcher(line)).lookingAt()) {
-	    starttime = timestampFromText(dateformat, m.group(1));
-	} else {
-	    throw new IOException("Invalid log4j format. First line doesn't start with time");
-	}
-
-	/*
-	  Count number of log entries. Any line starting with a timestamp counts as an entry
-	*/
-	String lastentry = line;
-	try {
-	    while (line != null) {
-		m = timep.matcher(line);
-		if (m.lookingAt()) {
-		    if (size % skipN == 0) {
-			long time = timestampFromText(dateformat, m.group(1));
-			skiplist.addMark(time, lastFp, size);
-		    }
-		    size++;
-		    lastentry = line;
-		} 
-		if (serverid == 0 && (m = idp.matcher(line)).find()) {
-		    serverid = Integer.valueOf(m.group(1));
-		}
-
-		lastFp = in.getPosition();
-		line = in.readLine();
-	    }
-	} catch (EOFException eof) {
-	    // ignore, simply end of file, though really (line!=null) should have caught this
-	} finally {
-	    in.close();
-	}
-
-	m = timep.matcher(lastentry);
-	if (m.lookingAt()) {
-	    endtime = timestampFromText(dateformat, m.group(1));
-	} else {
-	    throw new IOException("Invalid log4j format. Last line doesn't start with time");
-	}
-    }
-    
-    public String toString() {
-	return "Log4JSource(file=" + file + ", size=" + size + ", start=" + starttime + ", end=" + endtime +", id=" + serverid +")";
-    }
-
-    public static void main(String[] args) throws IOException {
-	final Log4JSource s = new Log4JSource(args[0]);
-	System.out.println(s);
-
-	LogIterator iter;
-
-	if (args.length == 3) {
-	    final long starttime = Long.valueOf(args[1]);
-	    final long endtime = Long.valueOf(args[2]);
-	    iter = s.iterator(starttime, endtime);
-	    
-	    Thread t1 = new Thread() { public void run () { 
-		
-		LogIterator iter = s.iterator(starttime, endtime);
-		System.out.println(iter);
-		try {
-		  iter.close();
-		} catch (IOException ioe) {
-		  System.out.println(ioe.getMessage());
-		}
-	    }; };
-	    Thread t2 = new Thread() { public void run () { 
-		
-		LogIterator iter = s.iterator(starttime, endtime);
-		System.out.println(iter);
-		try {
-		  iter.close();
-		} catch (IOException ioe) {
-		  System.out.println(ioe.getMessage());
-		}
-	    }; };
-	    Thread t3 = new Thread() { public void run () { 
-		
-		LogIterator iter = s.iterator(starttime, endtime);
-		System.out.println(iter);
-	    }; };
-	    t1.start();
-	    t2.start();
-	    //	    t3.start();
-	} else {
-	    iter = s.iterator();
-	}
-
-	/*while (iter.hasNext()) {
-	    System.out.println(iter.next());
-	    }*/
-	iter.close();
-    }
-
-    public int getServerId() {
-	return serverid;
-    }
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogServer.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogServer.java
deleted file mode 100644
index 5cffcdd1d5f..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogServer.java
+++ /dev/null
@@ -1,66 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph;
-
-import java.io.IOException;
-
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.servlet.ServletException;
- 
-import java.io.IOException;
- 
-import org.eclipse.jetty.server.Server;
-import org.eclipse.jetty.server.Request;
-import org.eclipse.jetty.server.handler.AbstractHandler;
-import org.eclipse.jetty.servlet.ServletContextHandler;
-import org.eclipse.jetty.servlet.ServletHolder;
-
-import org.apache.zookeeper.graph.servlets.*;
-
-public class LogServer extends ServletContextHandler {    
-    public LogServer(MergedLogSource src) throws Exception {
-	super(ServletContextHandler.SESSIONS);
-	setContextPath("/");
-
-	addServlet(new ServletHolder(new StaticContent()),"/graph/*");
-
-	addServlet(new ServletHolder(new Fs()),"/fs");
-	addServlet(new ServletHolder(new GraphData(src)), "/data");
-	addServlet(new ServletHolder(new FileLoader(src)), "/loadfile");
-	addServlet(new ServletHolder(new NumEvents(src)), "/info");
-	addServlet(new ServletHolder(new Throughput(src)), "/throughput");
-    }
-
-    public static void main(String[] args) {  
-	try {  
-	    MergedLogSource src = new MergedLogSource(args);
-	    System.out.println(src);
-
-	    Server server = new Server(8182);
-	    server.setHandler(new LogServer(src));
-	    
-	    server.start();
-	    server.join();
-
-	} catch (Exception e) {  
-	    // Something is wrong.  
-	    e.printStackTrace();  
-	}  
-    } 
-} 
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogSkipList.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogSkipList.java
deleted file mode 100644
index e74444291af..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogSkipList.java
+++ /dev/null
@@ -1,95 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph;
-
-import java.util.List;
-import java.util.LinkedList;
-import java.util.NoSuchElementException;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
-Generic skip list for holding a rough index of a log file. When the log file is loaded, this 
-index is built by adding a mark every n entries. Then when a specific time position is requested
-from the file, a point at most n-1 entries before the time position can be jumped to.
-
-*/
-public class LogSkipList {
-    private static final Logger LOG = LoggerFactory.getLogger(LogSkipList.class);
-    
-    private LinkedList<Mark> marks;
-
-    public class Mark {
-	private long time;
-	private long bytes;
-	private long skipped;
-
-	public Mark(long time, long bytes, long skipped) {
-	    this.time = time;
-	    this.bytes = bytes;
-	    this.skipped = skipped;
-	}
-
-	public long getTime() { return this.time; }
-	public long getBytes() { return this.bytes; }
-	public long getEntriesSkipped() { return this.skipped; }
-
-	public String toString() {
-	    return "Mark(time=" + time + ", bytes=" + bytes + ", skipped=" + skipped + ")";
-	}
-    };
-
-    public LogSkipList() {
-	if (LOG.isTraceEnabled()) {
-	    LOG.trace("New skip list");
-	}
-	marks = new LinkedList<Mark>();
-    }
-
-    public void addMark(long time, long bytes, long skipped) {
-	if (LOG.isTraceEnabled()) {
-	    LOG.trace("addMark (time:" + time + ", bytes: " + bytes + ", skipped: " + skipped + ")");
-	}
-	marks.add(new Mark(time, bytes, skipped));
-    }
-
-    /** 
-	Find the last mark in the skip list before time.
-     */
-    public Mark findMarkBefore(long time) throws NoSuchElementException {
-	if (LOG.isTraceEnabled()) {
-	    LOG.trace("findMarkBefore(" + time + ")");
-	}
-		    
-	Mark last = marks.getFirst();
-	for (Mark m: marks) {
-	    if (m.getTime() > time) {
-		break;
-	    } 
-	    last = m;
-	}
-	
-	if (LOG.isTraceEnabled()) {
-	    LOG.trace("return " + last );
-	}
-	
-	return last;
-    }
-
-};
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/MeasureThroughput.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/MeasureThroughput.java
deleted file mode 100644
index a42354cb3fb..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/MeasureThroughput.java
+++ /dev/null
@@ -1,104 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph;
-
-import java.io.IOException;
-import java.io.BufferedOutputStream;
-import java.io.FileOutputStream;
-import java.io.DataOutputStream;
-import java.io.PrintStream;
-
-import java.util.HashSet;
-import java.util.Set;
-
-public class MeasureThroughput {
-    private static final int MS_PER_SEC = 1000;
-    private static final int MS_PER_MIN = MS_PER_SEC*60;
-    private static final int MS_PER_HOUR = MS_PER_MIN*60;
-    
-    public static void main(String[] args) throws IOException {	
-	MergedLogSource source = new MergedLogSource(args);
-
-	PrintStream ps_ms = new PrintStream(new BufferedOutputStream(new FileOutputStream("throughput-ms.out")));
-	PrintStream ps_sec = new PrintStream(new BufferedOutputStream(new FileOutputStream("throughput-sec.out")));
-	PrintStream ps_min = new PrintStream(new BufferedOutputStream(new FileOutputStream("throughput-min.out")));
-	PrintStream ps_hour = new PrintStream(new BufferedOutputStream(new FileOutputStream("throughput-hour.out")));
-	LogIterator iter;
-	
-	System.out.println(source);
-	iter = source.iterator();
-	long currentms = 0;
-	long currentsec = 0;
-	long currentmin = 0;
-	long currenthour = 0;
-	Set<Long> zxids_ms = new HashSet<Long>();
-	long zxid_sec = 0;
-	long zxid_min = 0;
-	long zxid_hour = 0;
-
-	while (iter.hasNext()) {
-	    LogEntry e = iter.next();
-	    TransactionEntry cxn = (TransactionEntry)e;
-	    
-	    long ms = cxn.getTimestamp();
-	    long sec = ms/MS_PER_SEC;
-	    long min = ms/MS_PER_MIN;
-	    long hour = ms/MS_PER_HOUR;
-
-	    if (currentms != ms && currentms != 0) {
-		ps_ms.println("" + currentms + " " + zxids_ms.size());
-
-		zxid_sec += zxids_ms.size();
-		zxid_min += zxids_ms.size();
-		zxid_hour += zxids_ms.size();
-		zxids_ms.clear();
-	    }
-
-	    if (currentsec != sec && currentsec != 0) {
-		ps_sec.println("" + currentsec*MS_PER_SEC + " " + zxid_sec);
-
-		zxid_sec = 0;
-	    }
-
-	    if (currentmin != min && currentmin != 0) {
-		ps_min.println("" + currentmin*MS_PER_MIN + " " + zxid_min);
-		
-		zxid_min = 0;
-	    }
-
-	    if (currenthour != hour && currenthour != 0) {
-		ps_hour.println("" + currenthour*MS_PER_HOUR + " " + zxid_hour);
-		
-		zxid_hour = 0;
-	    }
-
-	    currentms = ms;
-	    currentsec = sec;
-	    currentmin = min;
-	    currenthour = hour;
-
-	    zxids_ms.add(cxn.getZxid());
-	}
-
-	iter.close();
-	ps_ms.close();
-	ps_sec.close();
-	ps_min.close();
-	ps_hour.close();
-    }
-};
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/MergedLogSource.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/MergedLogSource.java
deleted file mode 100644
index bb789d39596..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/MergedLogSource.java
+++ /dev/null
@@ -1,219 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph;
-
-import java.io.ByteArrayInputStream;
-import java.io.EOFException;
-import java.io.FileInputStream;
-import java.io.IOException;
-import java.text.DateFormat;
-import java.util.Date;
-import java.util.zip.Adler32;
-import java.util.zip.Checksum;
-import java.util.HashMap;
-
-import org.apache.jute.BinaryInputArchive;
-import org.apache.jute.InputArchive;
-import org.apache.jute.Record;
-import org.apache.zookeeper.server.TraceFormatter;
-import org.apache.zookeeper.server.persistence.FileHeader;
-import org.apache.zookeeper.server.persistence.FileTxnLog;
-import org.apache.zookeeper.server.util.SerializeUtils;
-import org.apache.zookeeper.txn.TxnHeader;
-
-import org.apache.zookeeper.ZooDefs.OpCode;
-
-import org.apache.zookeeper.txn.CreateSessionTxn;
-import org.apache.zookeeper.txn.CreateTxn;
-import org.apache.zookeeper.txn.DeleteTxn;
-import org.apache.zookeeper.txn.ErrorTxn;
-import org.apache.zookeeper.txn.SetACLTxn;
-import org.apache.zookeeper.txn.SetDataTxn;
-import org.apache.zookeeper.txn.TxnHeader;
-
-import java.io.Closeable;
-import java.io.FileNotFoundException;
-import java.util.Vector;
-import java.util.Iterator;
-import java.util.Collections;
-import java.util.NoSuchElementException;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-public class MergedLogSource implements LogSource {
-    private static final Logger LOG = LoggerFactory.getLogger(MergedLogSource.class);
-    private Vector<LogSource> sources = null;
-    private long starttime = 0;
-    private long endtime = 0;
-    private long size = 0;
-
-    public boolean overlapsRange(long starttime, long endtime) {
-	return (starttime <= this.endtime && endtime >= this.starttime);
-    }
-    
-    public long size() { return size; }
-    public long getStartTime() { return starttime; }
-    public long getEndTime() { return endtime; }
-
-    private class MergedLogSourceIterator implements LogIterator {
-	private LogEntry next = null;
-	private long start = 0;
-	private long end = 0;
-	private MergedLogSource src = null;
-	private LogIterator[] sources = null;
-	private LogEntry[] nexts = null;
-	private FilterOp filter = null;
-	
-	public MergedLogSourceIterator(MergedLogSource src, long starttime, long endtime, FilterOp filter) throws IllegalArgumentException, FilterException {
-	    Vector<LogIterator> iters = new Vector<LogIterator>();
-	    for (LogSource s : src.sources) {
-		if (s.overlapsRange(starttime, endtime)) {
-		    iters.add(s.iterator(starttime, endtime, filter));
-		}
-	    }
-	    
-	    sources = new LogIterator[iters.size()];
-	    sources = iters.toArray(sources);
-	    nexts = new LogEntry[iters.size()];
-	    for (int i = 0; i < sources.length; i++) {
-		if (sources[i].hasNext()) 
-		    nexts[i] = sources[i].next();
-	    }
-	    this.filter = filter;
-	}
-		    
-	public MergedLogSourceIterator(MergedLogSource src, long starttime, long endtime) throws IllegalArgumentException, FilterException {
-	    this(src, starttime, endtime, null);
-	}
-	
-	public long size() throws IOException {
-	    long size = 0;
-	    for (LogIterator i : sources) {
-		size += i.size();
-	    }
-	    return size;
-	}
-
-	public boolean hasNext() {
-	    for (LogEntry n : nexts) {
-		if (n != null) return true;
-	    }
-	    return false;
-	}
-	
-	public LogEntry next() {
-	    int min = -1;
-	    for (int i = 0; i < nexts.length; i++) {
-		if (nexts[i] != null) {
-		    if (min == -1) {
-			min = i;
-		    } else if (nexts[i].getTimestamp() < nexts[min].getTimestamp()) {
-			min = i;
-		    }
-		}
-	    }
-	    if (min == -1) {
-		return null;
-	    } else {
-		LogEntry e =  nexts[min];
-		nexts[min] = sources[min].next();
-		return e;
-	    }
-	}
-
-	public void remove() throws UnsupportedOperationException {
-	    throw new UnsupportedOperationException("remove not supported for Merged logs");
-	}
-	
-	public void close() throws IOException {
-	    for (LogIterator i : sources) {
-		i.close();
-	    }
-	}
-    }
-
-    public LogIterator iterator(long starttime, long endtime) throws IllegalArgumentException {
-	try {
-	    return iterator(starttime, endtime, null);
-	} catch (FilterException fe) {
-	    assert(false); // shouldn't happen without filter
-	    return null;
-	}
-    }
-
-    public LogIterator iterator(long starttime, long endtime, FilterOp filter) throws IllegalArgumentException, FilterException {
-	// sanitise start and end times
-	if (endtime < starttime) {
-	    throw new IllegalArgumentException("End time (" +  endtime + ") must be greater or equal to starttime (" + starttime + ")");
-	}
-
-	return new MergedLogSourceIterator(this, starttime, endtime, filter);
-    }
-
-    public LogIterator iterator() throws IllegalArgumentException {
-	return iterator(starttime, endtime+1);
-    }
-    
-    public MergedLogSource(String[] files) throws IOException {
-	sources = new Vector<LogSource>();
-	for (String f : files) {
-	    addSource(f);
-	}
-    }
-    
-    public void addSource(String f) throws IOException {
-	LogSource s = null;
-	if (TxnLogSource.isTransactionFile(f)) {
-	    s = new TxnLogSource(f);
-	} else {
-	    s = new Log4JSource(f);
-	}
-
-	size += s.size();
-	endtime = s.getEndTime() > endtime ? s.getEndTime() : endtime;
-	starttime = s.getStartTime() < starttime || starttime == 0 ? s.getStartTime() : starttime;
-	sources.add(s);
-    }
-
-    public String toString() {
-	String s = "MergedLogSource(size=" + size + ", start=" + starttime + ", end=" + endtime +")";
-	for (LogSource src : sources) {
-	    s += "\n\t- " +src;
-	}
-	return s;
-    }
-
-    public static void main(String[] args) throws IOException {
-	System.out.println("Time: " + System.currentTimeMillis());
-	MergedLogSource s = new MergedLogSource(args);
-	System.out.println(s);
-
-	LogIterator iter;
-
-	iter = s.iterator();
-	System.out.println("Time: " + System.currentTimeMillis());
-	System.out.println("Iterator Size: " + iter.size());
-	System.out.println("Time: " + System.currentTimeMillis());
-	/*	while (iter.hasNext()) {
-	    System.out.println(iter.next());
-	    }*/
-	iter.close();
-	System.out.println("Time: " + System.currentTimeMillis());
-    }
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/RandomAccessFileReader.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/RandomAccessFileReader.java
deleted file mode 100644
index 13a41a5ae3a..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/RandomAccessFileReader.java
+++ /dev/null
@@ -1,329 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph;
-
-import java.io.File;
-import java.io.Reader;
-import java.io.IOException;
-import java.io.EOFException;
-import java.io.RandomAccessFile;
-import java.io.FileNotFoundException;
-
-import java.io.DataInputStream;
-import java.io.ByteArrayInputStream;
-import java.io.DataInput;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-public class RandomAccessFileReader extends Reader implements DataInput {
-    private static final Logger LOG = LoggerFactory.getLogger(RandomAccessFileReader.class);
-    private RandomAccessFile file;
-    private byte[] buffer;
-    private int buffersize;
-    private int bufferoffset;
-    private long fileoffset;
-    private long fp;
-
-    private static final int DEFAULT_BUFFER_SIZE = 512*1024; // 512k
-    private int point = 0;
-
-    public RandomAccessFileReader(File f) throws FileNotFoundException {
-	file = new RandomAccessFile(f, "r");
-	if (LOG.isDebugEnabled()) {
-	    try {
-		LOG.debug("Opened file(" + f + ") with FD (" + file.getFD() + ")");
-	    } catch (IOException ioe) { 
-		LOG.debug("Opened file(" + f + ") coulds get FD");
-	    }
-	}
-
-	buffer = new byte[DEFAULT_BUFFER_SIZE];
-	buffersize = 0;
-	bufferoffset = 0;
-	fileoffset = 0;
-	fp = 0;
-    }
-
-    /**
-       fill the buffer from the file.
-       fp keeps track of the file pointer.
-       fileoffset is the offset into the file to where the buffer came from.
-    */
-    private int fill() throws IOException {
-	fileoffset = fp;
-	int read = file.read(buffer, 0, buffer.length);
-
-	if (LOG.isDebugEnabled()) {
-	    String buf = new String(buffer, 0, 40, "UTF-8");
-	    LOG.debug("fill(buffer=" + buf + ")");
-	}
-
-	if (read == -1) { // eof reached
-	    buffersize = 0;
-	} else {
-	    buffersize = read;
-	}
-	fp += buffersize;
-	bufferoffset = 0;
-
-	return buffersize;
-    }
-
-    /**
-     * Reader interface 
-     */
-    public boolean markSupported() { return false; }
-
-    /**
-       copy what we can from buffer. if it's not enough, fill buffer again and copy again
-    */
-    synchronized public int read(char[] cbuf, int off, int len) throws IOException {
-	// This could be faster, but probably wont be used
-	byte[] b = new byte[2];
-	int bytesread = 0;
-	while (len > 0) {
-	    int read = read(b, 0, 2);
-	    bytesread += read;
-	    if (read < 2) {
-		return bytesread;
-	    }
-	    cbuf[off] = (char)((b[0] << 8) | (b[1] & 0xff));
-	    off += read;
-	    len -= read;
-	}
-
-	return bytesread;
-    }
-
-    synchronized public int read(byte[] buf, int off, int len) throws IOException {
-	if (LOG.isTraceEnabled()) {
-	    LOG.trace("read(buf, off=" + off + ", len=" + len);
-	}
-
-	int read = 0;
-	while (len > 0) {
-	    if (buffersize == 0) {
-		fill();
-		if (buffersize == 0) {
-		    break;
-		}
-	    }
-
-	    int tocopy = Math.min(len, buffersize);
-	    if (LOG.isTraceEnabled()) {
-		LOG.trace("tocopy=" + tocopy);
-	    }
-
-	    System.arraycopy(buffer, bufferoffset, buf, off, tocopy);
-	    buffersize -= tocopy;
-	    bufferoffset += tocopy;
-
-	    len -= tocopy;
-	    read += tocopy;
-	    off += tocopy;
-	}
-	if (LOG.isTraceEnabled()) {
-	    LOG.trace("read=" + read);
-	}
-
-	return read;
-    }
-
-    public void close() throws IOException {
-	file.close();
-    }
-
-    /**
-     * Seek interface 
-     */
-    public long getPosition() {
-	return bufferoffset + fileoffset;
-    }
-    
-    synchronized public void seek(long pos) throws IOException {
-	if (LOG.isDebugEnabled()) {
-	    LOG.debug("seek(" + pos + ")");
-	}
-	file.seek(pos);
-	fp = pos;
-	buffersize = 0; // force a buffer fill on next read
-    }
-
-    /**
-       works like the usual readLine but disregards \r to make things easier
-    */
-    synchronized public String readLine() throws IOException {
-	StringBuffer s = null;
-	
-	// go through buffer until i find a \n, if i reach end of buffer first, put whats in buffer into string buffer,
-	// repeat
-	buffering:
-	for (;;) {
-	    if (buffersize == 0) {
-		fill();
-		if (buffersize == 0) {
-		    break;
-		}
-	    }
-
-	    for (int i = 0; i < buffersize; i++) {
-		if (buffer[bufferoffset + i] == '\n') { 
-		    if (i > 0) { // if \n is first char in buffer, leave the string buffer empty
-			if (s == null) { s = new StringBuffer(); }
-			s.append(new String(buffer, bufferoffset, i, "UTF-8"));
-		    }
-		    bufferoffset += i+1;
-		    buffersize -= i+1; 
-		    break buffering;
-		}
-	    }
-
-	    // We didn't find \n, read the whole buffer into string buffer
-	    if (s == null) { s = new StringBuffer(); }
-	    s.append(new String(buffer, bufferoffset, buffersize, "UTF-8"));
-	    buffersize = 0; 
-	}
-
-	if (s == null) {
-	    return null;
-	} else {
-	    return s.toString();
-	}	    
-    }
-
-    /**
-       DataInput interface
-    */
-    public void readFully(byte[] b) throws IOException {
-	readFully(b, 0, b.length);
-    }
-
-    public void readFully(byte[] b, int off, int len) throws IOException
-    {
-	while (len > 0) {
-	    int read = read(b, off, len);
-	    len -= read;
-	    off += read;
-
-	    if (read == 0) {
-		throw new EOFException("End of file reached");
-	    }	    
-	}
-    }
-
-    public int skipBytes(int n) throws IOException {
-	seek(getPosition() + n);
-	return n;
-    }
-
-    public boolean readBoolean() throws IOException {
-	return (readByte() != 0);	    
-    }
-
-    public byte readByte() throws IOException {
-	byte[] b = new byte[1];
-	readFully(b, 0, 1);
-	return b[0];
-    }
-
-    public int readUnsignedByte() throws IOException {
-	return (int)readByte();
-    }
-
-    public short readShort() throws IOException {
-	byte[] b = new byte[2];
-	readFully(b, 0, 2);
-	return (short)((b[0] << 8) | (b[1] & 0xff));
-    }
-    
-    public int readUnsignedShort() throws IOException {
-	byte[] b = new byte[2];
-	readFully(b, 0, 2);
-	return (((b[0] & 0xff) << 8) | (b[1] & 0xff));
-    }
-
-    public char readChar() throws IOException {
-	return (char)readShort();
-    }
-
-    public int readInt() throws IOException {
-	byte[] b = new byte[4];
-	readFully(b, 0, 4);
-	return (((b[0] & 0xff) << 24) | ((b[1] & 0xff) << 16) |  ((b[2] & 0xff) << 8) | (b[3] & 0xff));
-    }
-
-    public long readLong() throws IOException {
-	byte[] b = new byte[8];
-	readFully(b, 0, 8);
-	
-	return (((long)(b[0] & 0xff) << 56) |  ((long)(b[1] & 0xff) << 48) |
-		((long)(b[2] & 0xff) << 40) |  ((long)(b[3] & 0xff) << 32) |
-		((long)(b[4] & 0xff) << 24) |  ((long)(b[5] & 0xff) << 16) |
-		((long)(b[6] & 0xff) <<  8) |  ((long)(b[7] & 0xff)));
-    }
-
-    public float readFloat() throws IOException {
-	return Float.intBitsToFloat(readInt());
-    }
-
-    public double readDouble() throws IOException {
-	return Double.longBitsToDouble(readLong());
-    }
-
-    public String readUTF() throws IOException {
-	int len = readUnsignedShort();
-	byte[] bytes = new byte[len+2];
-	bytes[0] = (byte)((len >> 8) & 0xFF);
-	bytes[1] = (byte)(len & 0xFF);
-	readFully(bytes, 2, len);
-	DataInputStream dis = new DataInputStream(new ByteArrayInputStream(bytes));
-	return dis.readUTF();
-    }
-
-    public static void main(String[] args) throws IOException {
-	RandomAccessFileReader f = new RandomAccessFileReader(new File(args[0]));
-	
-	long pos0 = f.getPosition();
-	for (int i = 0; i < 5; i++) {
-	    System.out.println(f.readLine());
-	}
-	System.out.println("=============");
-	long pos1 = f.getPosition();
-	System.out.println("pos: " + pos1);
-	for (int i = 0; i < 5; i++) {
-	    System.out.println(f.readLine());
-	}
-	System.out.println("=============");
-	f.seek(pos1);
-	for (int i = 0; i < 5; i++) {
-	    System.out.println(f.readLine());
-	}
-	System.out.println("=============");
-	f.seek(pos0);
-	for (int i = 0; i < 5; i++) {
-	    System.out.println(f.readLine());
-	}
-	long pos2 = f.getPosition();
-	System.out.println("=============");
-	System.out.println(f.readLine());
-	f.seek(pos2);
-	System.out.println(f.readLine());
-	f.close();
-    }
-};
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/TransactionEntry.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/TransactionEntry.java
deleted file mode 100644
index 33c7189c172..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/TransactionEntry.java
+++ /dev/null
@@ -1,59 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph;
-
-public class TransactionEntry extends LogEntry {
-    public TransactionEntry(long timestamp, long clientId, long Cxid, long Zxid, String op) {
-	this(timestamp, clientId, Cxid, Zxid, op, "");
-    }
-
-    public TransactionEntry(long timestamp, long clientId, long Cxid, long Zxid, String op, String extra) {
-	super(timestamp);
-	setAttribute("client-id", new Long(clientId));
-	setAttribute("cxid", new Long(Cxid));
-	setAttribute("zxid", new Long(Zxid));
-	setAttribute("operation", op);
-	setAttribute("extra", extra);
-    }
-
-    public long getClientId() {
-	return (Long)getAttribute("client-id");
-    }
-
-    public long getCxid() {
-	return (Long)getAttribute("cxid");
-    }
-
-    public long getZxid() {
-	return (Long)getAttribute("zxid");
-    }
-
-    public String getOp() {
-	return (String)getAttribute("operation");
-    }
-
-    public String getExtra() {
-	return (String)getAttribute("extra");
-    }
-
-    public String toString() {
-	return getTimestamp() + ":::session(0x" + Long.toHexString(getClientId()) + ") cxid(0x" + Long.toHexString(getCxid()) + ") zxid(0x" + Long.toHexString(getZxid()) + ") op(" + getOp() + ") extra(" + getExtra() +")";
-    }
-
-    public Type getType() { return LogEntry.Type.TXN; }
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/TxnLogSource.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/TxnLogSource.java
deleted file mode 100644
index ad2e2589376..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/TxnLogSource.java
+++ /dev/null
@@ -1,380 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph;
-
-import java.io.ByteArrayInputStream;
-import java.io.EOFException;
-import java.io.FileInputStream;
-import java.io.IOException;
-import java.text.DateFormat;
-import java.util.Date;
-import java.util.zip.Adler32;
-import java.util.zip.Checksum;
-import java.util.HashMap;
-
-import org.apache.jute.BinaryInputArchive;
-import org.apache.jute.InputArchive;
-import org.apache.jute.Record;
-import org.apache.zookeeper.server.TraceFormatter;
-import org.apache.zookeeper.server.TxnLogEntry;
-import org.apache.zookeeper.server.persistence.FileHeader;
-import org.apache.zookeeper.server.persistence.FileTxnLog;
-import org.apache.zookeeper.server.util.SerializeUtils;
-import org.apache.zookeeper.txn.TxnHeader;
-
-import org.apache.zookeeper.ZooDefs.OpCode;
-
-import org.apache.zookeeper.txn.CreateSessionTxn;
-import org.apache.zookeeper.txn.CreateTxn;
-import org.apache.zookeeper.txn.DeleteTxn;
-import org.apache.zookeeper.txn.ErrorTxn;
-import org.apache.zookeeper.txn.SetACLTxn;
-import org.apache.zookeeper.txn.SetDataTxn;
-import org.apache.zookeeper.txn.TxnHeader;
-
-import java.io.File;
-import java.io.Closeable;
-import java.io.FileNotFoundException;
-import java.util.Iterator;
-import java.util.NoSuchElementException;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-public class TxnLogSource implements LogSource {
-    private static final Logger LOG = LoggerFactory.getLogger(TxnLogSource.class);
-
-    private LogSkipList skiplist = null;
-    private static final int skipN = 10000;
-
-    private String file = null;
-    private long starttime = 0;
-    private long endtime = 0;
-    private long size = 0;
-
-    public boolean overlapsRange(long starttime, long endtime) {
-	return (starttime <= this.endtime && endtime >= this.starttime);
-    }
-
-    public long size() { return size; }
-    public long getStartTime() { return starttime; }
-    public long getEndTime() { return endtime; }
-    public LogSkipList getSkipList() { return skiplist; }
-
-    public static boolean isTransactionFile(String file) throws IOException {
-        RandomAccessFileReader reader = new RandomAccessFileReader(new File(file));
-        BinaryInputArchive logStream = new BinaryInputArchive(reader);
-        FileHeader fhdr = new FileHeader();
-        fhdr.deserialize(logStream, "fileheader");
-	reader.close();
-
-        return fhdr.getMagic() == FileTxnLog.TXNLOG_MAGIC;
-    }
-
-    private class TxnLogSourceIterator implements LogIterator {
-	private LogEntry next = null;
-	private long starttime = 0;
-	private long endtime = 0;
-	private TxnLogSource src = null;
-	private RandomAccessFileReader reader = null;
-	private BinaryInputArchive logStream = null;
-	private long skippedAtStart = 0;
-	private FilterOp filter = null;
-
-	public TxnLogSourceIterator(TxnLogSource src, long starttime, long endtime) throws IllegalArgumentException, FilterException {
-	    this(src,starttime,endtime,null);
-	}
-	
-	public TxnLogSourceIterator(TxnLogSource src, long starttime, long endtime, FilterOp filter) throws IllegalArgumentException, FilterException {
-	    try {
-		this.src = src;
-		this.starttime = starttime;
-		this.endtime = endtime;
-		reader = new RandomAccessFileReader(new File(src.file));
-		logStream = new BinaryInputArchive(reader);
-		FileHeader fhdr = new FileHeader();
-		fhdr.deserialize(logStream, "fileheader");
-	    } catch (Exception e) {
-		throw new IllegalArgumentException("Cannot open transaction log ("+src.file+") :" + e);
-	    }
-	    
-	    LogSkipList.Mark start = src.getSkipList().findMarkBefore(starttime);
-	    try {
-		reader.seek(start.getBytes());
-		skippedAtStart = start.getEntriesSkipped();
-	    } catch (IOException ioe) {
-		// if we can't skip, we should just read from the start
-	    }
-
-	    this.filter = filter;
-
-	    LogEntry e;
-	    while ((e = readNextEntry()) != null && e.getTimestamp() < endtime) {
-		if (e.getTimestamp() >= starttime && (filter == null || filter.matches(e))  ) {
-		    next = e;
-		    return;
-		}
-		skippedAtStart++;
-	    }
-
-
-	}
-	
-	public long size() throws IOException {
-	    if (this.endtime >= src.getEndTime()) {
-		return src.size() - skippedAtStart;
-	    }
-	    
-	    long pos = reader.getPosition();
-	    LogEntry e;
-
-	    LogSkipList.Mark lastseg = src.getSkipList().findMarkBefore(this.endtime);
-	    reader.seek(lastseg.getBytes());
-	    // number of entries skipped to get to the end of the iterator, less the number skipped to get to the start
-	    long count = lastseg.getEntriesSkipped() - skippedAtStart; 
-
-	    while ((e = readNextEntry()) != null) {
-		if (e.getTimestamp() > this.endtime) {
-		    break;
-		}
-		count++;
-	    }
-	    reader.seek(pos);;
-
-	    return count;
-	}
-	
-	private LogEntry readNextEntry() {
-	    LogEntry e = null;
-	    try {
-		long crcValue;
-		byte[] bytes;
-		try {
-		    crcValue = logStream.readLong("crcvalue");
-		    
-		    bytes = logStream.readBuffer("txnEntry");
-		} catch (EOFException ex) {
-		    return null;
-		}
-		
-		if (bytes.length == 0) {
-		    return null;
-		}
-		Checksum crc = new Adler32();
-		crc.update(bytes, 0, bytes.length);
-		if (crcValue != crc.getValue()) {
-		    throw new IOException("CRC doesn't match " + crcValue +
-					  " vs " + crc.getValue());
-		}
-    
-		TxnLogEntry logEntry = SerializeUtils.deserializeTxn(bytes);
-		TxnHeader hdr = logEntry.getHeader();
-		Record r = logEntry.getTxn();
-
-		switch (hdr.getType()) {
-		case OpCode.createSession: {
-		    e = new TransactionEntry(hdr.getTime(), hdr.getClientId(), hdr.getCxid(), hdr.getZxid(), "createSession");
-		}
-		    break;
-		case OpCode.closeSession: {
-		    e = new TransactionEntry(hdr.getTime(), hdr.getClientId(), hdr.getCxid(), hdr.getZxid(), "closeSession");
-		}
-		    break;
-		case OpCode.create:
-		    if (r != null) {
-			CreateTxn create = (CreateTxn)r;
-			String path = create.getPath();
-			e = new TransactionEntry(hdr.getTime(), hdr.getClientId(), hdr.getCxid(), hdr.getZxid(), "create", path);
-		    }
-		    break;
-		case OpCode.setData:
-		    if (r != null) {
-			SetDataTxn set = (SetDataTxn)r;
-			String path = set.getPath();
-			e = new TransactionEntry(hdr.getTime(), hdr.getClientId(), hdr.getCxid(), hdr.getZxid(), "setData", path);
-		    }
-		    break;
-		case OpCode.setACL:
-		    if (r != null) {
-			SetACLTxn setacl = (SetACLTxn)r;
-			String path = setacl.getPath();
-		    e = new TransactionEntry(hdr.getTime(), hdr.getClientId(), hdr.getCxid(), hdr.getZxid(), "setACL", path);
-		    }
-		    break;
-		case OpCode.error:
-		    if (r != null)  {
-			ErrorTxn error = (ErrorTxn)r;
-			
-			e = new TransactionEntry(hdr.getTime(), hdr.getClientId(), hdr.getCxid(), hdr.getZxid(), "error", "Error: " + error.getErr());
-		    }
-		    break;
-		default:
-		    LOG.info("Unknown op: " + hdr.getType());
-		    break;
-		}
-		
-		if (logStream.readByte("EOR") != 'B') {
-		    throw new EOFException("Last transaction was partial.");
-		}
-	    } catch (Exception ex) {
-		LOG.error("Error reading transaction from (" + src.file + ") :" + e);
-		return null;
-	    }
-	    return e;
-	}
-
-	public boolean hasNext() {
-	    return next != null;
-	}
-	
-	public LogEntry next() throws NoSuchElementException {
-	    LogEntry ret = next;
-	    LogEntry e = readNextEntry();
-
-	    if (filter != null) {
-		try {
-		    while (e != null && !filter.matches(e)) {
-			e = readNextEntry();
-		    }
-		} catch (FilterException fe) {
-		    throw new NoSuchElementException(fe.toString());
-		}
-	    }
-	    if (e != null && e.getTimestamp() < endtime) {
-		next = e;
-	    } else {
-		next = null;
-	    }
-	    return ret;
-	}
-
-	public void remove() throws UnsupportedOperationException {
-	    throw new UnsupportedOperationException("remove not supported for Txn logs");
-	}
-	
-	public void close() throws IOException {
-	    reader.close();
-	}
-    }
-
-    public LogIterator iterator(long starttime, long endtime) throws IllegalArgumentException {
-	try {
-	    return iterator(starttime, endtime, null);
-	} catch (FilterException fe) {
-	    assert(false); // should never ever happen
-	    return null;
-	}
-    }
-
-    public LogIterator iterator(long starttime, long endtime, FilterOp filter) throws IllegalArgumentException, FilterException {
-	// sanitise start and end times
-	if (endtime < starttime) {
-	    throw new IllegalArgumentException("End time (" +  endtime + ") must be greater or equal to starttime (" + starttime + ")");
-	}
-
-	return new TxnLogSourceIterator(this, starttime, endtime, filter);
-    }
-
-    public LogIterator iterator() throws IllegalArgumentException {
-	return iterator(starttime, endtime+1);
-    }
-    
-    public TxnLogSource(String file) throws IOException {
-	this.file = file;
-
-	skiplist = new LogSkipList();
-
-	RandomAccessFileReader reader = new RandomAccessFileReader(new File(file));
-	try {
-	    BinaryInputArchive logStream = new BinaryInputArchive(reader);
-	    FileHeader fhdr = new FileHeader();
-	    fhdr.deserialize(logStream, "fileheader");
-	    
-	    byte[] bytes = null;
-	    while (true) {
-		long lastFp = reader.getPosition();
-
-		long crcValue;
-
-		try {
-		    crcValue = logStream.readLong("crcvalue");
-		    bytes = logStream.readBuffer("txnEntry");
-		} catch (EOFException e) {
-		    break;
-		}
-		
-		if (bytes.length == 0) {
-		    break;
-		}
-		Checksum crc = new Adler32();
-		crc.update(bytes, 0, bytes.length);
-		if (crcValue != crc.getValue()) {
-		    throw new IOException("CRC doesn't match " + crcValue +
-					  " vs " + crc.getValue());
-		}
-		if (logStream.readByte("EOR") != 'B') {
-		    throw new EOFException("Last transaction was partial.");
-		}
-		TxnLogEntry logEntry = SerializeUtils.deserializeTxn(bytes);
-		TxnHeader hdr = logEntry.getHeader();
-		Record r = logEntry.getTxn();
-		
-		if (starttime == 0) {
-		    starttime = hdr.getTime();
-		}
-		endtime = hdr.getTime();
-
-		if (size % skipN == 0) {
-		    skiplist.addMark(hdr.getTime(), lastFp, size);
-		}
-		size++;
-	    }
-	    if (bytes == null) {
-		throw new IOException("Nothing read from ("+file+")");
-	    }
-	} finally {
-	    reader.close();
-	}
-    }
-
-    public String toString() {
-	return "TxnLogSource(file=" + file + ", size=" + size + ", start=" + starttime + ", end=" + endtime +")";
-    }
-
-    public static void main(String[] args) throws IOException, FilterException {
-	TxnLogSource s = new TxnLogSource(args[0]);
-	System.out.println(s);
-
-	LogIterator iter;
-
-	if (args.length == 3) {
-	    long starttime = Long.valueOf(args[1]);
-	    long endtime = Long.valueOf(args[2]);
-	    FilterOp fo = new FilterParser("(or (and (> zxid 0x2f0bd6f5e0) (< zxid 0x2f0bd6f5e9)) (= operation \"error\"))").parse();
-	    System.out.println("fo: " + fo);
-	    iter = s.iterator(starttime, endtime, fo);
-	} else {
-	    iter = s.iterator();
-	}
-	System.out.println(iter);
-	while (iter.hasNext()) {
-	    	    System.out.println(iter.next());
-	}
-	iter.close();
-    }
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/EqualsOp.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/EqualsOp.java
deleted file mode 100644
index 409815af212..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/EqualsOp.java
+++ /dev/null
@@ -1,44 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.filterops;
-
-import org.apache.zookeeper.graph.LogEntry;
-import org.apache.zookeeper.graph.FilterOp;
-import org.apache.zookeeper.graph.FilterException;
-
-public class EqualsOp extends FilterOp {
-    public boolean matches(LogEntry entry) throws FilterException {
-
-	Object last = null;
-	for (Arg a : args) {
-	    Object v = a.getValue();
-	    if (a.getType() == FilterOp.ArgType.SYMBOL) {
-		String key = (String)a.getValue();
-		v = entry.getAttribute(key);
-	    }
-
-	    if (last != null
-		&& !last.equals(v)) {
-		return false;
-	    }
-	    last = v;
-	}
-
-	return true;
-    }
-}    
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/GreaterThanOp.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/GreaterThanOp.java
deleted file mode 100644
index 244dd3dabdb..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/GreaterThanOp.java
+++ /dev/null
@@ -1,70 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.filterops;
-
-import org.apache.zookeeper.graph.LogEntry;
-import org.apache.zookeeper.graph.FilterOp;
-import org.apache.zookeeper.graph.FilterException;
-
-public class GreaterThanOp extends FilterOp {
-    public boolean matches(LogEntry entry) throws FilterException {
-	Arg first = args.get(0);
-	
-	if (first != null) {
-	    FilterOp.ArgType type = first.getType();
-	    if (type == FilterOp.ArgType.SYMBOL) {
-		String key = (String)first.getValue();
-		Object v = entry.getAttribute(key);
-		if (v instanceof String) {
-		    type = FilterOp.ArgType.STRING;
-		} else if (v instanceof Double || v instanceof Long || v instanceof Integer || v instanceof Short) {
-		    type = FilterOp.ArgType.NUMBER;
-		} else {
-		    throw new FilterException("LessThanOp: Invalid argument, first argument resolves to neither a String nor a Number");
-		}
-	    }
-	    
-	    Object last = null;
-	    for (Arg a : args) {
-		Object v = a.getValue();
-		if (a.getType() == FilterOp.ArgType.SYMBOL) {
-		    String key = (String)a.getValue();
-		    v = entry.getAttribute(key);
-		}
-
-		if (last != null) {
-		    if (type == FilterOp.ArgType.STRING) {
-			if (((String)last).compareTo((String)v) <= 0) {
-			    return false;
-			}
-		    } else if (type == FilterOp.ArgType.NUMBER) {
-			//			System.out.println("last[" + ((Number)last).longValue() + "] v["+ ((Number)v).longValue() + "]");
-			if (((Number)last).longValue() <= ((Number)v).longValue()) {
-			    return false;
-			}
-		    }
-		}
-		last = v;
-	    }
-	    return true;
-	} else { 
-	    return true; 
-	}
-    }
-	
-}    
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/LessThanOp.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/LessThanOp.java
deleted file mode 100644
index b7d9e09ac89..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/LessThanOp.java
+++ /dev/null
@@ -1,69 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.filterops;
-
-import org.apache.zookeeper.graph.LogEntry;
-import org.apache.zookeeper.graph.FilterOp;
-import org.apache.zookeeper.graph.FilterException;
-
-public class LessThanOp extends FilterOp {
-    public boolean matches(LogEntry entry) throws FilterException {
-	Arg first = args.get(0);
-	
-	if (first != null) {
-	    FilterOp.ArgType type = first.getType();
-	    if (type == FilterOp.ArgType.SYMBOL) {
-		String key = (String)first.getValue();
-		Object v = entry.getAttribute(key);
-		if (v instanceof String) {
-		    type = FilterOp.ArgType.STRING;
-		} else if (v instanceof Double || v instanceof Long || v instanceof Integer || v instanceof Short) {
-		    type = FilterOp.ArgType.NUMBER;
-		} else {
-		    throw new FilterException("LessThanOp: Invalid argument, first argument resolves to neither a String nor a Number");
-		}
-	    }
-	    
-	    Object last = null;
-	    for (Arg a : args) {
-		Object v = a.getValue();
-		if (a.getType() == FilterOp.ArgType.SYMBOL) {
-		    String key = (String)a.getValue();
-		    v = entry.getAttribute(key);
-		}
-
-		if (last != null) {
-		    if (type == FilterOp.ArgType.STRING) {
-			if (((String)last).compareTo((String)v) >= 0) {
-			    return false;
-			}
-		    } else if (type == FilterOp.ArgType.NUMBER) {
-			if (((Number)last).doubleValue() >= ((Number)v).doubleValue()) {
-			    return false;
-			}
-		    }
-		}
-		last = v;
-	    }
-	    return true;
-	} else { 
-	    return true; 
-	}
-    }
-	
-}    
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/OrOp.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/OrOp.java
deleted file mode 100644
index d6815894a9a..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/OrOp.java
+++ /dev/null
@@ -1,33 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.filterops;
-
-import org.apache.zookeeper.graph.LogEntry;
-import org.apache.zookeeper.graph.FilterOp;
-import org.apache.zookeeper.graph.FilterException;
-
-public class OrOp extends FilterOp {
-    public boolean matches(LogEntry entry) throws FilterException {
-	for (FilterOp f : subOps) {
-	    if (f.matches(entry)) {
-		return true;
-	    }
-	}
-	return false;
-    }
-}    
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/XorOp.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/XorOp.java
deleted file mode 100644
index 9e778b199d5..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/XorOp.java
+++ /dev/null
@@ -1,40 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.filterops;
-
-import org.apache.zookeeper.graph.LogEntry;
-import org.apache.zookeeper.graph.FilterOp;
-import org.apache.zookeeper.graph.FilterException;
-
-public class XorOp extends FilterOp {
-    public boolean matches(LogEntry entry) throws FilterException {
-	int count = 0;
-	for (FilterOp f : subOps) {
-	    if (f.matches(entry)) {
-		count++;
-		if (count > 1) {
-		    return false;
-		}
-	    }
-	}
-	if (count == 1) {
-	    return true;
-	}
-	return false;
-    }
-}    
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/FileLoader.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/FileLoader.java
deleted file mode 100644
index 67e89454ab5..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/FileLoader.java
+++ /dev/null
@@ -1,60 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.servlets;
-
-import java.io.File;
-import java.io.IOException;
-import java.io.FileNotFoundException;
-
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
-import org.json.simple.JSONArray;
-import org.json.simple.JSONObject;
-import org.json.simple.JSONValue;
-
-import org.apache.zookeeper.graph.*;
-
-public class FileLoader extends JsonServlet
-{
-    private MergedLogSource source = null;
-    
-    public FileLoader(MergedLogSource src) throws Exception {
-	source = src;
-    }
-
-    String handleRequest(JsonRequest request) throws Exception
-    {
-	String output = "";
-		
-	String file = request.getString("path", "/");
-	JSONObject o = new JSONObject();
-	try {
-	    this.source.addSource(file);
-	    o.put("status", "OK");
-	
-	} catch (Exception e) {
-	    o.put("status", "ERR");
-	    o.put("error",  e.toString());
-	}
-	
-	return JSONValue.toJSONString(o);
-    }
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/Fs.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/Fs.java
deleted file mode 100644
index e5b1a01339d..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/Fs.java
+++ /dev/null
@@ -1,69 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.servlets;
-
-import java.io.File;
-import java.io.IOException;
-import java.io.FileNotFoundException;
-
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
-import org.json.simple.JSONArray;
-import org.json.simple.JSONObject;
-import org.json.simple.JSONValue;
-import java.util.Arrays;
-import java.util.Comparator;
-
-public class Fs extends JsonServlet
-{
-    String handleRequest(JsonRequest request) throws Exception
-    {
-	String output = "";
-	JSONArray filelist = new JSONArray();
-
-	File base = new File(request.getString("path", "/"));
-	if (!base.exists() || !base.isDirectory()) {
-	    throw new FileNotFoundException("Couldn't find [" + request + "]");
-	}
-	File[] files = base.listFiles();
-	Arrays.sort(files, new Comparator<File>() { 
-		public int compare(File o1, File o2) {
-		    if (o1.isDirectory() != o2.isDirectory()) {
-			if (o1.isDirectory()) {
-			    return -1;
-			} else {
-			    return 1;
-			}
-		    }
-		    return o1.getName().compareToIgnoreCase(o2.getName());
-		} 
-	    });
-	
-	for (File f : files) {
-	    JSONObject o = new JSONObject();
-	    o.put("file", f.getName());
-	    o.put("type", f.isDirectory() ? "D" : "F");
-	    o.put("path", f.getCanonicalPath());
-	    filelist.add(o);
-	}
-	return JSONValue.toJSONString(filelist);
-    }
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/GraphData.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/GraphData.java
deleted file mode 100644
index fc10eb1a3d6..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/GraphData.java
+++ /dev/null
@@ -1,85 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.servlets;
-
-import java.io.File;
-import java.io.IOException;
-import java.io.FileNotFoundException;
-
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
-import java.util.regex.Pattern;
-import java.util.regex.Matcher;
-
-import org.json.simple.JSONArray;
-import org.json.simple.JSONObject;
-import org.json.simple.JSONValue;
-
-import org.apache.zookeeper.graph.*;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-public class GraphData extends JsonServlet
-{
-    private static final Logger LOG = LoggerFactory.getLogger(GraphData.class);
-    private static final int DEFAULT_PERIOD = 1000;
-
-    private LogSource source = null;
-
-    public GraphData(LogSource src) throws Exception {
-	this.source = src; 
-    }
-
-    String handleRequest(JsonRequest request) throws Exception {
-	
-
-	long starttime = 0;
-	long endtime = 0;
-	long period = 0;
-	FilterOp fo = null;
-
-	starttime = request.getNumber("start", 0);
-	endtime = request.getNumber("end", 0);
-	period = request.getNumber("period", 0);
-	String filterstr = request.getString("filter", "");
-
-	if (filterstr.length() > 0) {
-	    fo = new FilterParser(filterstr).parse();
-	}
-	
-	if (starttime == 0) { starttime = source.getStartTime(); }
-	if (endtime == 0) { 
-	    if (period > 0) {
-		endtime = starttime + period;
-	    } else {
-		endtime = starttime + DEFAULT_PERIOD; 
-	    }
-	}
-
-	if (LOG.isDebugEnabled()) {
-	    LOG.debug("handle(start= " + starttime + ", end=" + endtime + ", period=" + period + ")");
-	}
-	
-	LogIterator iterator = (fo != null) ? 
-	    source.iterator(starttime, endtime, fo) : source.iterator(starttime, endtime);
-	return new JsonGenerator(iterator).toString();
-    }
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/JsonServlet.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/JsonServlet.java
deleted file mode 100644
index 910d44f4ede..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/JsonServlet.java
+++ /dev/null
@@ -1,85 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.servlets;
-
-import java.io.IOException;
-
-import javax.servlet.ServletException;
-import javax.servlet.ServletRequest;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
-import org.json.simple.JSONObject;
-import org.json.simple.JSONValue;
-
-import java.util.Map;
-
-abstract public class JsonServlet extends HttpServlet {
-    abstract String handleRequest(JsonRequest request) throws Exception;
-
-    protected class JsonRequest {
-	private Map map;
-
-	public JsonRequest(ServletRequest request) {
-	    map = request.getParameterMap();
-	}
-	
-	public long getNumber(String name, long defaultnum) {
-	    String[] vals = (String[])map.get(name);
-	    if (vals == null || vals.length == 0) {
-		return defaultnum;
-	    }
-
-	    try {
-		return Long.valueOf(vals[0]);
-	    } catch (NumberFormatException e) {
-		return defaultnum;
-	    }
-	}
-	
-	public String getString(String name, String defaultstr) {
-	    String[] vals = (String[])map.get(name);
-	    if (vals == null || vals.length == 0) {
-		return defaultstr;
-	    } else {
-		return vals[0];
-	    }
-	}
-    }
-
-    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException
-    {
-        response.setContentType("text/plain;charset=utf-8");
-        response.setStatus(HttpServletResponse.SC_OK);
-	
-	try {
-	    String req = request.getRequestURI().substring(request.getServletPath().length());
-
-	    response.getWriter().println(handleRequest(new JsonRequest(request)));
-	} catch (Exception e) {
-	    JSONObject o = new JSONObject();
-	    o.put("error", e.toString());
-	    response.getWriter().println(JSONValue.toJSONString(o));
-	} catch (java.lang.OutOfMemoryError oom) {
-	    JSONObject o = new JSONObject();
-	    o.put("error", "Out of memory. Perhaps you've requested too many logs. Try narrowing you're filter criteria.");
-	    response.getWriter().println(JSONValue.toJSONString(o));
-	}
-    }
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/NumEvents.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/NumEvents.java
deleted file mode 100644
index 5961a125832..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/NumEvents.java
+++ /dev/null
@@ -1,88 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.servlets;
-
-import java.io.File;
-import java.io.IOException;
-import java.io.FileNotFoundException;
-
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
-import org.json.simple.JSONArray;
-import org.json.simple.JSONObject;
-import org.json.simple.JSONValue;
-
-import java.util.regex.Pattern;
-import java.util.regex.Matcher;
-
-import org.apache.zookeeper.graph.*;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-
-public class NumEvents extends JsonServlet
-{
-    private static final Logger LOG = LoggerFactory.getLogger(NumEvents.class);
-    private static final int DEFAULT_PERIOD = 1000;
-
-    private LogSource source = null;
-
-    public NumEvents(LogSource src) throws Exception {
-	this.source = src;
-    }
-
-    String handleRequest(JsonRequest request) throws Exception {
-	String output = "";
-
-	long starttime = 0;
-	long endtime = 0;
-	long period = 0;
-
-	starttime = request.getNumber("start", 0);
-	endtime = request.getNumber("end", 0);
-	period = request.getNumber("period", 0);
-
-	if (starttime == 0) { starttime = source.getStartTime(); }
-	if (endtime == 0) { 
-	    if (period > 0) {
-		endtime = starttime + period;
-	    } else {
-		endtime = source.getEndTime(); 
-	    }
-	}
-	
-	LogIterator iter = source.iterator(starttime, endtime);
-	JSONObject data = new JSONObject();
-	data.put("startTime", starttime);
-	data.put("endTime", endtime);
-	long size = 0;
-	
-	size = iter.size();
-	
-	data.put("numEntries",  size);
-	if (LOG.isDebugEnabled()) {
-	    LOG.debug("handle(start= " + starttime + ", end=" + endtime + ", numEntries=" + size +")");
-	}
-	iter.close();
-	return JSONValue.toJSONString(data);
-    }
-}
-
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/StaticContent.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/StaticContent.java
deleted file mode 100644
index d91acb60096..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/StaticContent.java
+++ /dev/null
@@ -1,53 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.servlets;
-
-import java.io.InputStream;
-import java.io.InputStreamReader;
-import java.io.BufferedReader;
-
-import java.io.IOException;
-
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
-public class StaticContent extends HttpServlet {
-    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException
-    {
-	String path = request.getRequestURI().substring(request.getServletPath().length());
-
-	InputStream resource = ClassLoader.getSystemResourceAsStream("org/apache/zookeeper/graph/resources" + path);	  
-	if (resource == null) {
-	    response.getWriter().println(path + " not found!");
-	    response.setStatus(HttpServletResponse.SC_NOT_FOUND);
-	    return;
-	}
-	try {
-	  while (resource.available() > 0) {
-	    response.getWriter().write(resource.read());
-	  }
-	} finally {
-	  resource.close();
-	}
-	//        response.setContentType("text/plain;charset=utf-8");
-        response.setStatus(HttpServletResponse.SC_OK);
-    }
-
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/Throughput.java b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/Throughput.java
deleted file mode 100644
index 80ed1dc2fd1..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/servlets/Throughput.java
+++ /dev/null
@@ -1,126 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.graph.servlets;
-
-import java.io.IOException;
-import java.io.BufferedOutputStream;
-import java.io.FileOutputStream;
-import java.io.DataOutputStream;
-import java.io.PrintStream;
-
-import java.util.HashSet;
-import java.util.LinkedHashMap;
-import java.util.Set;
-
-import org.apache.zookeeper.graph.*;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import org.json.simple.JSONArray;
-import org.json.simple.JSONObject;
-import org.json.simple.JSONValue;
-
-
-public class Throughput extends JsonServlet
-{
-    private static final int MS_PER_SEC = 1000;
-    private static final int MS_PER_MIN = MS_PER_SEC*60;
-    private static final int MS_PER_HOUR = MS_PER_MIN*60;
-
-    private LogSource source = null;
-
-    public Throughput(LogSource src) throws Exception {
-	this.source = src; 
-    }
-
-    public String handleRequest(JsonRequest request) throws Exception {
-	long starttime = 0;
-	long endtime = 0;
-	long period = 0;
-	long scale = 0;
-	
-	starttime = request.getNumber("start", 0);
-	endtime = request.getNumber("end", 0);
-	period = request.getNumber("period", 0);
-	
-
-	if (starttime == 0) { starttime = source.getStartTime(); }
-	if (endtime == 0) { 
-	    if (period > 0) {
-		endtime = starttime + period;
-	    } else {
-		endtime = source.getEndTime(); 
-	    }
-	}
-	
-	String scalestr = request.getString("scale", "minutes");
-	if (scalestr.equals("seconds")) {
-	    scale = MS_PER_SEC;
-	} else if (scalestr.equals("hours")) {
-	    scale = MS_PER_HOUR;
-	} else {
-	    scale = MS_PER_MIN;
-	} 	
-	
-	LogIterator iter = source.iterator(starttime, endtime);
-	
-	long current = 0;
-	long currentms = 0;
-	Set<Long> zxids_ms = new HashSet<Long>();
-	long zxidcount = 0;
-
-	JSONArray events = new JSONArray();
-	while (iter.hasNext()) {
-	    LogEntry e = iter.next();
-	    if (e.getType() != LogEntry.Type.TXN) {
-		continue;
-	    }
-
-	    TransactionEntry cxn = (TransactionEntry)e;
-	    
-	    long ms = cxn.getTimestamp();
-	    long inscale = ms/scale;
-
-	    if (currentms != ms && currentms != 0) {
-		zxidcount += zxids_ms.size();
-		zxids_ms.clear();
-	    }
-
-	    if (inscale != current && current != 0) {
-		JSONObject o = new JSONObject();
-		o.put("time", current*scale);
-		o.put("count", zxidcount);
-		events.add(o);
-		zxidcount = 0;
-	    }
-	    current = inscale;
-	    currentms = ms;
-
-	    zxids_ms.add(cxn.getZxid());
-	}
-	JSONObject o = new JSONObject();
-	o.put("time", current*scale);
-	o.put("count", zxidcount);
-	events.add(o);
-
-	iter.close();
-	
-	return JSONValue.toJSONString(events);
-    }
-
-};
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph-dev.sh b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph-dev.sh
deleted file mode 100755
index e04434ec53c..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph-dev.sh
+++ /dev/null
@@ -1,43 +0,0 @@
-#!/bin/sh
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-make_canonical () {
-    cd $1; pwd;
-}
-
-SCRIPTDIR=`dirname $0`
-BUILDDIR=`make_canonical $SCRIPTDIR/../../../../../build/contrib/loggraph`
-LIBDIR=`make_canonical $BUILDDIR/lib`
-WEBDIR=`make_canonical $SCRIPTDIR/../web`
-ZKDIR=`make_canonical $SCRIPTDIR/../../../../../build/`
-
-if [ ! -x $BUILDDIR ]; then
-    echo "\n\n*** You need to build loggraph before running it ***\n\n";
-    exit;
-fi
-
-for i in `ls $LIBDIR`; do 
-    CLASSPATH=$LIBDIR/$i:$CLASSPATH
-done
-
-for i in $ZKDIR/zookeeper-*.jar; do
-    CLASSPATH="$i:$CLASSPATH"
-done
-
-CLASSPATH=$BUILDDIR/classes:$WEBDIR:$CLASSPATH
-echo $CLASSPATH
-java -Dlog4j.configuration=org/apache/zookeeper/graph/log4j.properties -Xdebug -Xrunjdwp:transport=dt_socket,address=4444,server=y,suspend=n -cp $CLASSPATH org.apache.zookeeper.graph.LogServer $*
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/log4j.properties b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/log4j.properties
deleted file mode 100644
index ab8960b0e4f..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/log4j.properties
+++ /dev/null
@@ -1,11 +0,0 @@
-log4j.rootLogger=TRACE, CONSOLE
-
-# Print the date in ISO 8601 format
-log4j.appender.CONSOLE=org.apache.log4j.ConsoleAppender
-log4j.appender.CONSOLE.Threshold=TRACE
-log4j.appender.CONSOLE.layout=org.apache.log4j.PatternLayout
-log4j.appender.CONSOLE.layout.ConversionPattern=%d{ISO8601} - %-5p [%t:%C{1}@%L] - %m%n
-
-log4j.logger.org.apache.zookeeper.graph.LogSkipList=off
-log4j.logger.org.apache.zookeeper.graph.RandomAccessFileReader=off
-#log4j.logger.org.apache.zookeeper.graph.Log4JSource=off
\ No newline at end of file
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/date.format.js b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/date.format.js
deleted file mode 100644
index 55150099217..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/date.format.js
+++ /dev/null
@@ -1,126 +0,0 @@
-/*
- * Date Format 1.2.3
- * (c) 2007-2009 Steven Levithan <stevenlevithan.com>
- * MIT license
- *
- * Includes enhancements by Scott Trenda <scott.trenda.net>
- * and Kris Kowal <cixar.com/~kris.kowal/>
- *
- * Accepts a date, a mask, or a date and a mask.
- * Returns a formatted version of the given date.
- * The date defaults to the current date/time.
- * The mask defaults to dateFormat.masks.default.
- */
-
-var dateFormat = function () {
-	var	token = /d{1,4}|m{1,4}|yy(?:yy)?|([HhMsTt])\1?|[LloSZ]|"[^"]*"|'[^']*'/g,
-		timezone = /\b(?:[PMCEA][SDP]T|(?:Pacific|Mountain|Central|Eastern|Atlantic) (?:Standard|Daylight|Prevailing) Time|(?:GMT|UTC)(?:[-+]\d{4})?)\b/g,
-		timezoneClip = /[^-+\dA-Z]/g,
-		pad = function (val, len) {
-			val = String(val);
-			len = len || 2;
-			while (val.length < len) val = "0" + val;
-			return val;
-		};
-
-	// Regexes and supporting functions are cached through closure
-	return function (date, mask, utc) {
-		var dF = dateFormat;
-
-		// You can't provide utc if you skip other args (use the "UTC:" mask prefix)
-		if (arguments.length == 1 && Object.prototype.toString.call(date) == "[object String]" && !/\d/.test(date)) {
-			mask = date;
-			date = undefined;
-		}
-
-		// Passing date through Date applies Date.parse, if necessary
-		date = date ? new Date(date) : new Date;
-		if (isNaN(date)) throw SyntaxError("invalid date");
-
-		mask = String(dF.masks[mask] || mask || dF.masks["default"]);
-
-		// Allow setting the utc argument via the mask
-		if (mask.slice(0, 4) == "UTC:") {
-			mask = mask.slice(4);
-			utc = true;
-		}
-
-		var	_ = utc ? "getUTC" : "get",
-			d = date[_ + "Date"](),
-			D = date[_ + "Day"](),
-			m = date[_ + "Month"](),
-			y = date[_ + "FullYear"](),
-			H = date[_ + "Hours"](),
-			M = date[_ + "Minutes"](),
-			s = date[_ + "Seconds"](),
-			L = date[_ + "Milliseconds"](),
-			o = utc ? 0 : date.getTimezoneOffset(),
-			flags = {
-				d:    d,
-				dd:   pad(d),
-				ddd:  dF.i18n.dayNames[D],
-				dddd: dF.i18n.dayNames[D + 7],
-				m:    m + 1,
-				mm:   pad(m + 1),
-				mmm:  dF.i18n.monthNames[m],
-				mmmm: dF.i18n.monthNames[m + 12],
-				yy:   String(y).slice(2),
-				yyyy: y,
-				h:    H % 12 || 12,
-				hh:   pad(H % 12 || 12),
-				H:    H,
-				HH:   pad(H),
-				M:    M,
-				MM:   pad(M),
-				s:    s,
-				ss:   pad(s),
-				l:    pad(L, 3),
-				L:    pad(L > 99 ? Math.round(L / 10) : L),
-				t:    H < 12 ? "a"  : "p",
-				tt:   H < 12 ? "am" : "pm",
-				T:    H < 12 ? "A"  : "P",
-				TT:   H < 12 ? "AM" : "PM",
-				Z:    utc ? "UTC" : (String(date).match(timezone) || [""]).pop().replace(timezoneClip, ""),
-				o:    (o > 0 ? "-" : "+") + pad(Math.floor(Math.abs(o) / 60) * 100 + Math.abs(o) % 60, 4),
-				S:    ["th", "st", "nd", "rd"][d % 10 > 3 ? 0 : (d % 100 - d % 10 != 10) * d % 10]
-			};
-
-		return mask.replace(token, function ($0) {
-			return $0 in flags ? flags[$0] : $0.slice(1, $0.length - 1);
-		});
-	};
-}();
-
-// Some common format strings
-dateFormat.masks = {
-	"default":      "ddd mmm dd yyyy HH:MM:ss",
-	shortDate:      "m/d/yy",
-	mediumDate:     "mmm d, yyyy",
-	longDate:       "mmmm d, yyyy",
-	fullDate:       "dddd, mmmm d, yyyy",
-	shortTime:      "h:MM TT",
-	mediumTime:     "h:MM:ss TT",
-	longTime:       "h:MM:ss TT Z",
-	isoDate:        "yyyy-mm-dd",
-	isoTime:        "HH:MM:ss",
-	isoDateTime:    "yyyy-mm-dd'T'HH:MM:ss",
-	isoUtcDateTime: "UTC:yyyy-mm-dd'T'HH:MM:ss'Z'"
-};
-
-// Internationalization strings
-dateFormat.i18n = {
-	dayNames: [
-		"Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat",
-		"Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"
-	],
-	monthNames: [
-		"Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec",
-		"January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December"
-	]
-};
-
-// For convenience...
-Date.prototype.format = function (mask, utc) {
-	return dateFormat(this, mask, utc);
-};
-
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.bar.js b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.bar.js
deleted file mode 100644
index 2f7212ad61b..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.bar.js
+++ /dev/null
@@ -1,385 +0,0 @@
-/*
- * g.Raphael 0.4 - Charting library, based on Raphaël
- *
- * Copyright (c) 2009 Dmitry Baranovskiy (http://g.raphaeljs.com)
- * Licensed under the MIT (http://www.opensource.org/licenses/mit-license.php) license.
- */
-Raphael.fn.g.barchart = function (x, y, width, height, values, opts) {
-    opts = opts || {};
-    var type = {round: "round", sharp: "sharp", soft: "soft"}[opts.type] || "square",
-        gutter = parseFloat(opts.gutter || "20%"),
-        chart = this.set(),
-        bars = this.set(),
-        covers = this.set(),
-        covers2 = this.set(),
-        total = Math.max.apply(Math, values),
-        stacktotal = [],
-        paper = this,
-        multi = 0,
-        colors = opts.colors || this.g.colors,
-        len = values.length;
-    if (this.raphael.is(values[0], "array")) {
-        total = [];
-        multi = len;
-        len = 0;
-        for (var i = values.length; i--;) {
-            bars.push(this.set());
-            total.push(Math.max.apply(Math, values[i]));
-            len = Math.max(len, values[i].length);
-        }
-        if (opts.stacked) {
-            for (var i = len; i--;) {
-                var tot = 0;
-                for (var j = values.length; j--;) {
-                    tot +=+ values[j][i] || 0;
-                }
-                stacktotal.push(tot);
-            }
-        }
-        for (var i = values.length; i--;) {
-            if (values[i].length < len) {
-                for (var j = len; j--;) {
-                    values[i].push(0);
-                }
-            }
-        }
-        total = Math.max.apply(Math, opts.stacked ? stacktotal : total);
-    }
-    
-    total = (opts.to) || total;
-    var barwidth = width / (len * (100 + gutter) + gutter) * 100,
-        barhgutter = barwidth * gutter / 100,
-        barvgutter = opts.vgutter == null ? 20 : opts.vgutter,
-        stack = [],
-        X = x + barhgutter,
-        Y = (height - 2 * barvgutter) / total;
-    if (!opts.stretch) {
-        barhgutter = Math.round(barhgutter);
-        barwidth = Math.floor(barwidth);
-    }
-    !opts.stacked && (barwidth /= multi || 1);
-    for (var i = 0; i < len; i++) {
-        stack = [];
-        for (var j = 0; j < (multi || 1); j++) {
-            var h = Math.round((multi ? values[j][i] : values[i]) * Y),
-                top = y + height - barvgutter - h,
-                bar = this.g.finger(Math.round(X + barwidth / 2), top + h, barwidth, h, true, type).attr({stroke: colors[multi ? j : i], fill: colors[multi ? j : i]});
-            if (multi) {
-                bars[j].push(bar);
-            } else {
-                bars.push(bar);
-            }
-            bar.y = top;
-            bar.x = Math.round(X + barwidth / 2);
-            bar.w = barwidth;
-            bar.h = h;
-            bar.value = multi ? values[j][i] : values[i];
-            if (!opts.stacked) {
-                X += barwidth;
-            } else {
-                stack.push(bar);
-            }
-        }
-        if (opts.stacked) {
-            var cvr;
-            covers2.push(cvr = this.rect(stack[0].x - stack[0].w / 2, y, barwidth, height).attr(this.g.shim));
-            cvr.bars = this.set();
-            var size = 0;
-            for (var s = stack.length; s--;) {
-                stack[s].toFront();
-            }
-            for (var s = 0, ss = stack.length; s < ss; s++) {
-                var bar = stack[s],
-                    cover,
-                    h = (size + bar.value) * Y,
-                    path = this.g.finger(bar.x, y + height - barvgutter - !!size * .5, barwidth, h, true, type, 1);
-                cvr.bars.push(bar);
-                size && bar.attr({path: path});
-                bar.h = h;
-                bar.y = y + height - barvgutter - !!size * .5 - h;
-                covers.push(cover = this.rect(bar.x - bar.w / 2, bar.y, barwidth, bar.value * Y).attr(this.g.shim));
-                cover.bar = bar;
-                cover.value = bar.value;
-                size += bar.value;
-            }
-            X += barwidth;
-        }
-        X += barhgutter;
-    }
-    covers2.toFront();
-    X = x + barhgutter;
-    if (!opts.stacked) {
-        for (var i = 0; i < len; i++) {
-            for (var j = 0; j < (multi || 1); j++) {
-                var cover;
-                covers.push(cover = this.rect(Math.round(X), y + barvgutter, barwidth, height - barvgutter).attr(this.g.shim));
-                cover.bar = multi ? bars[j][i] : bars[i];
-                cover.value = cover.bar.value;
-                X += barwidth;
-            }
-            X += barhgutter;
-        }
-    }
-    chart.label = function (labels, isBottom) {
-        labels = labels || [];
-        this.labels = paper.set();
-        var L, l = -Infinity;
-        if (opts.stacked) {
-            for (var i = 0; i < len; i++) {
-                var tot = 0;
-                for (var j = 0; j < (multi || 1); j++) {
-                    tot += multi ? values[j][i] : values[i];
-                    if (j == multi - 1) {
-                        var label = paper.g.labelise(labels[i], tot, total);
-                        L = paper.g.text(bars[i * (multi || 1) + j].x, y + height - barvgutter / 2, label).insertBefore(covers[i * (multi || 1) + j]);
-                        var bb = L.getBBox();
-                        if (bb.x - 7 < l) {
-                            L.remove();
-                        } else {
-                            this.labels.push(L);
-                            l = bb.x + bb.width;
-                        }
-                    }
-                }
-            }
-        } else {
-            for (var i = 0; i < len; i++) {
-                for (var j = 0; j < (multi || 1); j++) {
-                    var label = paper.g.labelise(multi ? labels[j] && labels[j][i] : labels[i], multi ? values[j][i] : values[i], total);
-                    L = paper.g.text(bars[i * (multi || 1) + j].x, isBottom ? y + height - barvgutter / 2 : bars[i * (multi || 1) + j].y - 10, label).insertBefore(covers[i * (multi || 1) + j]);
-                    var bb = L.getBBox();
-                    if (bb.x - 7 < l) {
-                        L.remove();
-                    } else {
-                        this.labels.push(L);
-                        l = bb.x + bb.width;
-                    }
-                }
-            }
-        }
-        return this;
-    };
-    chart.hover = function (fin, fout) {
-        covers2.hide();
-        covers.show();
-        covers.mouseover(fin).mouseout(fout);
-        return this;
-    };
-    chart.hoverColumn = function (fin, fout) {
-        covers.hide();
-        covers2.show();
-        fout = fout || function () {};
-        covers2.mouseover(fin).mouseout(fout);
-        return this;
-    };
-    chart.click = function (f) {
-        covers2.hide();
-        covers.show();
-        covers.click(f);
-        return this;
-    };
-    chart.each = function (f) {
-        if (!Raphael.is(f, "function")) {
-            return this;
-        }
-        for (var i = covers.length; i--;) {
-            f.call(covers[i]);
-        }
-        return this;
-    };
-    chart.eachColumn = function (f) {
-        if (!Raphael.is(f, "function")) {
-            return this;
-        }
-        for (var i = covers2.length; i--;) {
-            f.call(covers2[i]);
-        }
-        return this;
-    };
-    chart.clickColumn = function (f) {
-        covers.hide();
-        covers2.show();
-        covers2.click(f);
-        return this;
-    };
-    chart.push(bars, covers, covers2);
-    chart.bars = bars;
-    chart.covers = covers;
-    return chart;
-};
-Raphael.fn.g.hbarchart = function (x, y, width, height, values, opts) {
-    opts = opts || {};
-    var type = {round: "round", sharp: "sharp", soft: "soft"}[opts.type] || "square",
-        gutter = parseFloat(opts.gutter || "20%"),
-        chart = this.set(),
-        bars = this.set(),
-        covers = this.set(),
-        covers2 = this.set(),
-        total = Math.max.apply(Math, values),
-        stacktotal = [],
-        paper = this,
-        multi = 0,
-        colors = opts.colors || this.g.colors,
-        len = values.length;
-    if (this.raphael.is(values[0], "array")) {
-        total = [];
-        multi = len;
-        len = 0;
-        for (var i = values.length; i--;) {
-            bars.push(this.set());
-            total.push(Math.max.apply(Math, values[i]));
-            len = Math.max(len, values[i].length);
-        }
-        if (opts.stacked) {
-            for (var i = len; i--;) {
-                var tot = 0;
-                for (var j = values.length; j--;) {
-                    tot +=+ values[j][i] || 0;
-                }
-                stacktotal.push(tot);
-            }
-        }
-        for (var i = values.length; i--;) {
-            if (values[i].length < len) {
-                for (var j = len; j--;) {
-                    values[i].push(0);
-                }
-            }
-        }
-        total = Math.max.apply(Math, opts.stacked ? stacktotal : total);
-    }
-    
-    total = (opts.to) || total;
-    var barheight = Math.floor(height / (len * (100 + gutter) + gutter) * 100),
-        bargutter = Math.floor(barheight * gutter / 100),
-        stack = [],
-        Y = y + bargutter,
-        X = (width - 1) / total;
-    !opts.stacked && (barheight /= multi || 1);
-    for (var i = 0; i < len; i++) {
-        stack = [];
-        for (var j = 0; j < (multi || 1); j++) {
-            var val = multi ? values[j][i] : values[i],
-                bar = this.g.finger(x, Y + barheight / 2, Math.round(val * X), barheight - 1, false, type).attr({stroke: colors[multi ? j : i], fill: colors[multi ? j : i]});
-            if (multi) {
-                bars[j].push(bar);
-            } else {
-                bars.push(bar);
-            }
-            bar.x = x + Math.round(val * X);
-            bar.y = Y + barheight / 2;
-            bar.w = Math.round(val * X);
-            bar.h = barheight;
-            bar.value = +val;
-            if (!opts.stacked) {
-                Y += barheight;
-            } else {
-                stack.push(bar);
-            }
-        }
-        if (opts.stacked) {
-            var cvr = this.rect(x, stack[0].y - stack[0].h / 2, width, barheight).attr(this.g.shim);
-            covers2.push(cvr);
-            cvr.bars = this.set();
-            var size = 0;
-            for (var s = stack.length; s--;) {
-                stack[s].toFront();
-            }
-            for (var s = 0, ss = stack.length; s < ss; s++) {
-                var bar = stack[s],
-                    cover,
-                    val = Math.round((size + bar.value) * X),
-                    path = this.g.finger(x, bar.y, val, barheight - 1, false, type, 1);
-                cvr.bars.push(bar);
-                size && bar.attr({path: path});
-                bar.w = val;
-                bar.x = x + val;
-                covers.push(cover = this.rect(x + size * X, bar.y - bar.h / 2, bar.value * X, barheight).attr(this.g.shim));
-                cover.bar = bar;
-                size += bar.value;
-            }
-            Y += barheight;
-        }
-        Y += bargutter;
-    }
-    covers2.toFront();
-    Y = y + bargutter;
-    if (!opts.stacked) {
-        for (var i = 0; i < len; i++) {
-            for (var j = 0; j < multi; j++) {
-                var cover = this.rect(x, Y, width, barheight).attr(this.g.shim);
-                covers.push(cover);
-                cover.bar = bars[j][i];
-                Y += barheight;
-            }
-            Y += bargutter;
-        }
-    }
-    chart.label = function (labels, isRight) {
-        labels = labels || [];
-        this.labels = paper.set();
-        for (var i = 0; i < len; i++) {
-            for (var j = 0; j < multi; j++) {
-                var  label = paper.g.labelise(multi ? labels[j] && labels[j][i] : labels[i], multi ? values[j][i] : values[i], total);
-                var X = isRight ? bars[i * (multi || 1) + j].x - barheight / 2 + 3 : x + 5,
-                    A = isRight ? "end" : "start",
-                    L;
-                this.labels.push(L = paper.g.text(X, bars[i * (multi || 1) + j].y, label).attr({"text-anchor": A}).insertBefore(covers[0]));
-                if (L.getBBox().x < x + 5) {
-                    L.attr({x: x + 5, "text-anchor": "start"});
-                } else {
-                    bars[i * (multi || 1) + j].label = L;
-                }
-            }
-        }
-        return this;
-    };
-    chart.hover = function (fin, fout) {
-        covers2.hide();
-        covers.show();
-        fout = fout || function () {};
-        covers.mouseover(fin).mouseout(fout);
-        return this;
-    };
-    chart.hoverColumn = function (fin, fout) {
-        covers.hide();
-        covers2.show();
-        fout = fout || function () {};
-        covers2.mouseover(fin).mouseout(fout);
-        return this;
-    };
-    chart.each = function (f) {
-        if (!Raphael.is(f, "function")) {
-            return this;
-        }
-        for (var i = covers.length; i--;) {
-            f.call(covers[i]);
-        }
-        return this;
-    };
-    chart.eachColumn = function (f) {
-        if (!Raphael.is(f, "function")) {
-            return this;
-        }
-        for (var i = covers2.length; i--;) {
-            f.call(covers2[i]);
-        }
-        return this;
-    };
-    chart.click = function (f) {
-        covers2.hide();
-        covers.show();
-        covers.click(f);
-        return this;
-    };
-    chart.clickColumn = function (f) {
-        covers.hide();
-        covers2.show();
-        covers2.click(f);
-        return this;
-    };
-    chart.push(bars, covers, covers2);
-    chart.bars = bars;
-    chart.covers = covers;
-    return chart;
-};
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.dot.js b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.dot.js
deleted file mode 100644
index 2821e62c730..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.dot.js
+++ /dev/null
@@ -1,110 +0,0 @@
-/*
- * g.Raphael 0.4 - Charting library, based on Raphaël
- *
- * Copyright (c) 2009 Dmitry Baranovskiy (http://g.raphaeljs.com)
- * Licensed under the MIT (http://www.opensource.org/licenses/mit-license.php) license.
- */
-Raphael.fn.g.dotchart = function (x, y, width, height, valuesx, valuesy, size, opts) {
-    function drawAxis(ax) {
-        +ax[0] && (ax[0] = paper.g.axis(x + gutter, y + gutter, width - 2 * gutter, minx, maxx, opts.axisxstep || Math.floor((width - 2 * gutter) / 20), 2, opts.axisxlabels || null, opts.axisxtype || "t"));
-        +ax[1] && (ax[1] = paper.g.axis(x + width - gutter, y + height - gutter, height - 2 * gutter, miny, maxy, opts.axisystep || Math.floor((height - 2 * gutter) / 20), 3, opts.axisylabels || null, opts.axisytype || "t"));
-        +ax[2] && (ax[2] = paper.g.axis(x + gutter, y + height - gutter + maxR, width - 2 * gutter, minx, maxx, opts.axisxstep || Math.floor((width - 2 * gutter) / 20), 0, opts.axisxlabels || null, opts.axisxtype || "t"));
-        +ax[3] && (ax[3] = paper.g.axis(x + gutter - maxR, y + height - gutter, height - 2 * gutter, miny, maxy, opts.axisystep || Math.floor((height - 2 * gutter) / 20), 1, opts.axisylabels || null, opts.axisytype || "t"));
-    }
-    opts = opts || {};
-    var xdim = this.g.snapEnds(Math.min.apply(Math, valuesx), Math.max.apply(Math, valuesx), valuesx.length - 1),
-        minx = xdim.from,
-        maxx = xdim.to,
-        gutter = opts.gutter || 10,
-        ydim = this.g.snapEnds(Math.min.apply(Math, valuesy), Math.max.apply(Math, valuesy), valuesy.length - 1),
-        miny = ydim.from,
-        maxy = ydim.to,
-        len = Math.max(valuesx.length, valuesy.length, size.length),
-        symbol = this.g.markers[opts.symbol] || "disc",
-        res = this.set(),
-        series = this.set(),
-        max = opts.max || 100,
-        top = Math.max.apply(Math, size),
-        R = [],
-        paper = this,
-        k = Math.sqrt(top / Math.PI) * 2 / max;
-
-    for (var i = 0; i < len; i++) {
-        R[i] = Math.min(Math.sqrt(size[i] / Math.PI) * 2 / k, max);
-    }
-    gutter = Math.max.apply(Math, R.concat(gutter));
-    var axis = this.set(),
-        maxR = Math.max.apply(Math, R);
-    if (opts.axis) {
-        var ax = (opts.axis + "").split(/[,\s]+/);
-        drawAxis(ax);
-        var g = [], b = [];
-        for (var i = 0, ii = ax.length; i < ii; i++) {
-            var bb = ax[i].all ? ax[i].all.getBBox()[["height", "width"][i % 2]] : 0;
-            g[i] = bb + gutter;
-            b[i] = bb;
-        }
-        gutter = Math.max.apply(Math, g.concat(gutter));
-        for (var i = 0, ii = ax.length; i < ii; i++) if (ax[i].all) {
-            ax[i].remove();
-            ax[i] = 1;
-        }
-        drawAxis(ax);
-        for (var i = 0, ii = ax.length; i < ii; i++) if (ax[i].all) {
-            axis.push(ax[i].all);
-        }
-        res.axis = axis;
-    }
-    var kx = (width - gutter * 2) / ((maxx - minx) || 1),
-        ky = (height - gutter * 2) / ((maxy - miny) || 1);
-    for (var i = 0, ii = valuesy.length; i < ii; i++) {
-        var sym = this.raphael.is(symbol, "array") ? symbol[i] : symbol,
-            X = x + gutter + (valuesx[i] - minx) * kx,
-            Y = y + height - gutter - (valuesy[i] - miny) * ky;
-        sym && R[i] && series.push(this.g[sym](X, Y, R[i]).attr({fill: opts.heat ? this.g.colorValue(R[i], maxR) : Raphael.fn.g.colors[0], "fill-opacity": opts.opacity ? R[i] / max : 1, stroke: "none"}));
-    }
-    var covers = this.set();
-    for (var i = 0, ii = valuesy.length; i < ii; i++) {
-        var X = x + gutter + (valuesx[i] - minx) * kx,
-            Y = y + height - gutter - (valuesy[i] - miny) * ky;
-        covers.push(this.circle(X, Y, maxR).attr(this.g.shim));
-        opts.href && opts.href[i] && covers[i].attr({href: opts.href[i]});
-        covers[i].r = +R[i].toFixed(3);
-        covers[i].x = +X.toFixed(3);
-        covers[i].y = +Y.toFixed(3);
-        covers[i].X = valuesx[i];
-        covers[i].Y = valuesy[i];
-        covers[i].value = size[i] || 0;
-        covers[i].dot = series[i];
-    }
-    res.covers = covers;
-    res.series = series;
-    res.push(series, axis, covers);
-    res.hover = function (fin, fout) {
-        covers.mouseover(fin).mouseout(fout);
-        return this;
-    };
-    res.click = function (f) {
-        covers.click(f);
-        return this;
-    };
-    res.each = function (f) {
-        if (!Raphael.is(f, "function")) {
-            return this;
-        }
-        for (var i = covers.length; i--;) {
-            f.call(covers[i]);
-        }
-        return this;
-    };
-    res.href = function (map) {
-        var cover;
-        for (var i = covers.length; i--;) {
-            cover = covers[i];
-            if (cover.X == map.x && cover.Y == map.y && cover.value == map.value) {
-                cover.attr({href: map.href});
-            }
-        }
-    };
-    return res;
-};
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.line.js b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.line.js
deleted file mode 100644
index eb56e5916dc..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.line.js
+++ /dev/null
@@ -1,230 +0,0 @@
-/*
- * g.Raphael 0.4 - Charting library, based on Raphaël
- *
- * Copyright (c) 2009 Dmitry Baranovskiy (http://g.raphaeljs.com)
- * Licensed under the MIT (http://www.opensource.org/licenses/mit-license.php) license.
- */
-Raphael.fn.g.linechart = function (x, y, width, height, valuesx, valuesy, opts) {
-    function shrink(values, dim) {
-        var k = values.length / dim,
-            j = 0,
-            l = k,
-            sum = 0,
-            res = [];
-        while (j < values.length) {
-            l--;
-            if (l < 0) {
-                sum += values[j] * (1 + l);
-                res.push(sum / k);
-                sum = values[j++] * -l;
-                l += k;
-            } else {
-                sum += values[j++];
-            }
-        }
-        return res;
-    }
-    opts = opts || {};
-    if (!this.raphael.is(valuesx[0], "array")) {
-        valuesx = [valuesx];
-    }
-    if (!this.raphael.is(valuesy[0], "array")) {
-        valuesy = [valuesy];
-    }
-    var allx = Array.prototype.concat.apply([], valuesx),
-        ally = Array.prototype.concat.apply([], valuesy),
-        xdim = this.g.snapEnds(Math.min.apply(Math, allx), Math.max.apply(Math, allx), valuesx[0].length - 1),
-        minx = xdim.from,
-        maxx = xdim.to,
-        gutter = opts.gutter || 10,
-        kx = (width - gutter * 2) / (maxx - minx),
-        ydim = this.g.snapEnds(Math.min.apply(Math, ally), Math.max.apply(Math, ally), valuesy[0].length - 1),
-        miny = ydim.from,
-        maxy = ydim.to,
-        ky = (height - gutter * 2) / (maxy - miny),
-        len = Math.max(valuesx[0].length, valuesy[0].length),
-        symbol = opts.symbol || "",
-        colors = opts.colors || Raphael.fn.g.colors,
-        that = this,
-        columns = null,
-        dots = null,
-        chart = this.set(),
-        path = [];
-
-    for (var i = 0, ii = valuesy.length; i < ii; i++) {
-        len = Math.max(len, valuesy[i].length);
-    }
-    var shades = this.set();
-    for (var i = 0, ii = valuesy.length; i < ii; i++) {
-        if (opts.shade) {
-            shades.push(this.path().attr({stroke: "none", fill: colors[i], opacity: opts.nostroke ? 1 : .3}));
-        }
-        if (valuesy[i].length > width - 2 * gutter) {
-            valuesy[i] = shrink(valuesy[i], width - 2 * gutter);
-            len = width - 2 * gutter;
-        }
-        if (valuesx[i] && valuesx[i].length > width - 2 * gutter) {
-            valuesx[i] = shrink(valuesx[i], width - 2 * gutter);
-        }
-    }
-    var axis = this.set();
-    if (opts.axis) {
-        var ax = (opts.axis + "").split(/[,\s]+/);
-        +ax[0] && axis.push(this.g.axis(x + gutter, y + gutter, width - 2 * gutter, minx, maxx, opts.axisxstep || Math.floor((width - 2 * gutter) / 20), 2, opts.northlabels));
-        +ax[1] && axis.push(this.g.axis(x + width - gutter, y + height - gutter, height - 2 * gutter, miny, maxy, opts.axisystep || Math.floor((height - 2 * gutter) / 20), 3, opts.eastlabels));
-        +ax[2] && axis.push(this.g.axis(x + gutter, y + height - gutter, width - 2 * gutter, minx, maxx, opts.axisxstep || Math.floor((width - 2 * gutter) / 20), 0, opts.southlabels));
-        +ax[3] && axis.push(this.g.axis(x + gutter, y + height - gutter, height - 2 * gutter, miny, maxy, opts.axisystep || Math.floor((height - 2 * gutter) / 20), 1, opts.westlabels));
-    }
-    if (opts.northAxisLabel) {
-	this.g.text(x + gutter + width/2, gutter, opts.northAxisLabel);
-    }
-    if (opts.southAxisLabel) {
-	this.g.text(x + gutter + width/2, y + height + 20, opts.southAxisLabel);
-    }
-    if (opts.westAxisLabel) {
-	this.g.text(gutter, y + gutter + height/2, opts.westAxisLabel).attr({rotation: -90});
-    }
-    if (opts.eastAxisLabel) {
-	this.g.text(x + gutter + width + 20, y + gutter + height/2, opts.eastAxisLabel).attr({rotation: 90});
-    }
-
-    var lines = this.set(),
-        symbols = this.set(),
-        line;
-    for (var i = 0, ii = valuesy.length; i < ii; i++) {
-        if (!opts.nostroke) {
-            lines.push(line = this.path().attr({
-                stroke: colors[i],
-                "stroke-width": opts.width || 2,
-                "stroke-linejoin": "round",
-                "stroke-linecap": "round",
-                "stroke-dasharray": opts.dash || ""
-            }));
-        }
-        var sym = this.raphael.is(symbol, "array") ? symbol[i] : symbol,
-            symset = this.set();
-        path = [];
-        for (var j = 0, jj = valuesy[i].length; j < jj; j++) {
-            var X = x + gutter + ((valuesx[i] || valuesx[0])[j] - minx) * kx;
-            var Y = y + height - gutter - (valuesy[i][j] - miny) * ky;
-            (Raphael.is(sym, "array") ? sym[j] : sym) && symset.push(this.g[Raphael.fn.g.markers[this.raphael.is(sym, "array") ? sym[j] : sym]](X, Y, (opts.width || 2) * 3).attr({fill: colors[i], stroke: "none"}));
-            path = path.concat([j ? "L" : "M", X, Y]);
-        }
-        symbols.push(symset);
-        if (opts.shade) {
-            shades[i].attr({path: path.concat(["L", X, y + height - gutter, "L",  x + gutter + ((valuesx[i] || valuesx[0])[0] - minx) * kx, y + height - gutter, "z"]).join(",")});
-        }
-        !opts.nostroke && line.attr({path: path.join(",")});
-    }
-    function createColumns(f) {
-        // unite Xs together
-        var Xs = [];
-        for (var i = 0, ii = valuesx.length; i < ii; i++) {
-            Xs = Xs.concat(valuesx[i]);
-        }
-        Xs.sort();
-        // remove duplicates
-        var Xs2 = [],
-            xs = [];
-        for (var i = 0, ii = Xs.length; i < ii; i++) {
-            Xs[i] != Xs[i - 1] && Xs2.push(Xs[i]) && xs.push(x + gutter + (Xs[i] - minx) * kx);
-        }
-        Xs = Xs2;
-        ii = Xs.length;
-        var cvrs = f || that.set();
-        for (var i = 0; i < ii; i++) {
-            var X = xs[i] - (xs[i] - (xs[i - 1] || x)) / 2,
-                w = ((xs[i + 1] || x + width) - xs[i]) / 2 + (xs[i] - (xs[i - 1] || x)) / 2,
-                C;
-            f ? (C = {}) : cvrs.push(C = that.rect(X - 1, y, Math.max(w + 1, 1), height).attr({stroke: "none", fill: "#000", opacity: 0}));
-            C.values = [];
-            C.symbols = that.set();
-            C.y = [];
-            C.x = xs[i];
-            C.axis = Xs[i];
-            for (var j = 0, jj = valuesy.length; j < jj; j++) {
-                Xs2 = valuesx[j] || valuesx[0];
-                for (var k = 0, kk = Xs2.length; k < kk; k++) {
-                    if (Xs2[k] == Xs[i]) {
-                        C.values.push(valuesy[j][k]);
-                        C.y.push(y + height - gutter - (valuesy[j][k] - miny) * ky);
-                        C.symbols.push(chart.symbols[j][k]);
-                    }
-                }
-            }
-            f && f.call(C);
-        }
-        !f && (columns = cvrs);
-    }
-    function createDots(f) {
-        var cvrs = f || that.set(),
-            C;
-        for (var i = 0, ii = valuesy.length; i < ii; i++) {
-            for (var j = 0, jj = valuesy[i].length; j < jj; j++) {
-                var X = x + gutter + ((valuesx[i] || valuesx[0])[j] - minx) * kx,
-                    nearX = x + gutter + ((valuesx[i] || valuesx[0])[j ? j - 1 : 1] - minx) * kx,
-                    Y = y + height - gutter - (valuesy[i][j] - miny) * ky;
-                f ? (C = {}) : cvrs.push(C = that.circle(X, Y, Math.abs(nearX - X) / 2).attr({stroke: "none", fill: "#000", opacity: 0}));
-                C.x = X;
-                C.y = Y;
-                C.value = valuesy[i][j];
-                C.line = chart.lines[i];
-                C.shade = chart.shades[i];
-                C.symbol = chart.symbols[i][j];
-                C.symbols = chart.symbols[i];
-                C.axis = (valuesx[i] || valuesx[0])[j];
-                f && f.call(C);
-            }
-        }
-        !f && (dots = cvrs);
-    }
-    chart.push(lines, shades, symbols, axis, columns, dots);
-    chart.lines = lines;
-    chart.shades = shades;
-    chart.symbols = symbols;
-    chart.axis = axis;
-    chart.hoverColumn = function (fin, fout) {
-        !columns && createColumns();
-        columns.mouseover(fin).mouseout(fout);
-        return this;
-    };
-    chart.clickColumn = function (f) {
-        !columns && createColumns();
-        columns.click(f);
-        return this;
-    };
-    chart.hrefColumn = function (cols) {
-        var hrefs = that.raphael.is(arguments[0], "array") ? arguments[0] : arguments;
-        if (!(arguments.length - 1) && typeof cols == "object") {
-            for (var x in cols) {
-                for (var i = 0, ii = columns.length; i < ii; i++) if (columns[i].axis == x) {
-                    columns[i].attr("href", cols[x]);
-                }
-            }
-        }
-        !columns && createColumns();
-        for (var i = 0, ii = hrefs.length; i < ii; i++) {
-            columns[i] && columns[i].attr("href", hrefs[i]);
-        }
-        return this;
-    };
-    chart.hover = function (fin, fout) {
-        !dots && createDots();
-        dots.mouseover(fin).mouseout(fout);
-        return this;
-    };
-    chart.click = function (f) {
-        !dots && createDots();
-        dots.click(f);
-        return this;
-    };
-    chart.each = function (f) {
-        createDots(f);
-        return this;
-    };
-    chart.eachColumn = function (f) {
-        createColumns(f);
-        return this;
-    };
-    return chart;
-};
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.pie.js b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.pie.js
deleted file mode 100644
index 8d203745528..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.pie.js
+++ /dev/null
@@ -1,205 +0,0 @@
-/*
- * g.Raphael 0.4 - Charting library, based on Raphaël
- *
- * Copyright (c) 2009 Dmitry Baranovskiy (http://g.raphaeljs.com)
- * Licensed under the MIT (http://www.opensource.org/licenses/mit-license.php) license.
- */
-Raphael.fn.g.piechart = function (cx, cy, r, values, opts) {
-    opts = opts || {};
-    var paper = this,
-        sectors = [],
-        covers = this.set(),
-        chart = this.set(),
-        series = this.set(),
-        order = [],
-        len = values.length,
-        angle = 0,
-        total = 0,
-        others = 0,
-        cut = 9,
-        defcut = true;
-    chart.covers = covers;
-    if (len == 1) {
-        series.push(this.circle(cx, cy, r).attr({fill: this.g.colors[0], stroke: opt.stroke || "#fff", "stroke-width": opts.strokewidth == null ? 1 : opts.strokewidth}));
-        covers.push(this.circle(cx, cy, r).attr(this.g.shim));
-        total = values[0];
-        values[0] = {value: values[0], order: 0, valueOf: function () { return this.value; }};
-        series[0].middle = {x: cx, y: cy};
-        series[0].mangle = 180;
-    } else {
-        function sector(cx, cy, r, startAngle, endAngle, fill) {
-            var rad = Math.PI / 180,
-                x1 = cx + r * Math.cos(-startAngle * rad),
-                x2 = cx + r * Math.cos(-endAngle * rad),
-                xm = cx + r / 2 * Math.cos(-(startAngle + (endAngle - startAngle) / 2) * rad),
-                y1 = cy + r * Math.sin(-startAngle * rad),
-                y2 = cy + r * Math.sin(-endAngle * rad),
-                ym = cy + r / 2 * Math.sin(-(startAngle + (endAngle - startAngle) / 2) * rad),
-                res = ["M", cx, cy, "L", x1, y1, "A", r, r, 0, +(Math.abs(endAngle - startAngle) > 180), 1, x2, y2, "z"];
-            res.middle = {x: xm, y: ym};
-            return res;
-        }
-        for (var i = 0; i < len; i++) {
-            total += values[i];
-            values[i] = {value: values[i], order: i, valueOf: function () { return this.value; }};
-        }
-        values.sort(function (a, b) {
-            return b.value - a.value;
-        });
-        for (var i = 0; i < len; i++) {
-            if (defcut && values[i] * 360 / total <= 1.5) {
-                cut = i;
-                defcut = false;
-            }
-            if (i > cut) {
-                defcut = false;
-                values[cut].value += values[i];
-                values[cut].others = true;
-                others = values[cut].value;
-            }
-        }
-        len = Math.min(cut + 1, values.length);
-        others && values.splice(len) && (values[cut].others = true);
-        for (var i = 0; i < len; i++) {
-            var mangle = angle - 360 * values[i] / total / 2;
-            if (!i) {
-                angle = 90 - mangle;
-                mangle = angle - 360 * values[i] / total / 2;
-            }
-            if (opts.init) {
-                var ipath = sector(cx, cy, 1, angle, angle - 360 * values[i] / total).join(",");
-            }
-            var path = sector(cx, cy, r, angle, angle -= 360 * values[i] / total);
-            var p = this.path(opts.init ? ipath : path).attr({fill: opts.colors && opts.colors[i] || this.g.colors[i] || "#666", stroke: opts.stroke || "#fff", "stroke-width": (opts.strokewidth == null ? 1 : opts.strokewidth), "stroke-linejoin": "round"});
-            p.value = values[i];
-            p.middle = path.middle;
-            p.mangle = mangle;
-            sectors.push(p);
-            series.push(p);
-            opts.init && p.animate({path: path.join(",")}, (+opts.init - 1) || 1000, ">");
-        }
-        for (var i = 0; i < len; i++) {
-            var p = paper.path(sectors[i].attr("path")).attr(this.g.shim);
-            opts.href && opts.href[i] && p.attr({href: opts.href[i]});
-            p.attr = function () {};
-            covers.push(p);
-            series.push(p);
-        }
-    }
-
-    chart.hover = function (fin, fout) {
-        fout = fout || function () {};
-        var that = this;
-        for (var i = 0; i < len; i++) {
-            (function (sector, cover, j) {
-                var o = {
-                    sector: sector,
-                    cover: cover,
-                    cx: cx,
-                    cy: cy,
-                    mx: sector.middle.x,
-                    my: sector.middle.y,
-                    mangle: sector.mangle,
-                    r: r,
-                    value: values[j],
-                    total: total,
-                    label: that.labels && that.labels[j]
-                };
-                cover.mouseover(function () {
-                    fin.call(o);
-                }).mouseout(function () {
-                    fout.call(o);
-                });
-            })(series[i], covers[i], i);
-        }
-        return this;
-    };
-    // x: where label could be put
-    // y: where label could be put
-    // value: value to show
-    // total: total number to count %
-    chart.each = function (f) {
-        var that = this;
-        for (var i = 0; i < len; i++) {
-            (function (sector, cover, j) {
-                var o = {
-                    sector: sector,
-                    cover: cover,
-                    cx: cx,
-                    cy: cy,
-                    x: sector.middle.x,
-                    y: sector.middle.y,
-                    mangle: sector.mangle,
-                    r: r,
-                    value: values[j],
-                    total: total,
-                    label: that.labels && that.labels[j]
-                };
-                f.call(o);
-            })(series[i], covers[i], i);
-        }
-        return this;
-    };
-    chart.click = function (f) {
-        var that = this;
-        for (var i = 0; i < len; i++) {
-            (function (sector, cover, j) {
-                var o = {
-                    sector: sector,
-                    cover: cover,
-                    cx: cx,
-                    cy: cy,
-                    mx: sector.middle.x,
-                    my: sector.middle.y,
-                    mangle: sector.mangle,
-                    r: r,
-                    value: values[j],
-                    total: total,
-                    label: that.labels && that.labels[j]
-                };
-                cover.click(function () { f.call(o); });
-            })(series[i], covers[i], i);
-        }
-        return this;
-    };
-    chart.inject = function (element) {
-        element.insertBefore(covers[0]);
-    };
-    var legend = function (labels, otherslabel, mark, dir) {
-        var x = cx + r + r / 5,
-            y = cy,
-            h = y + 10;
-        labels = labels || [];
-        dir = (dir && dir.toLowerCase && dir.toLowerCase()) || "east";
-        mark = paper.g.markers[mark && mark.toLowerCase()] || "disc";
-        chart.labels = paper.set();
-        for (var i = 0; i < len; i++) {
-            var clr = series[i].attr("fill"),
-                j = values[i].order,
-                txt;
-            values[i].others && (labels[j] = otherslabel || "Others");
-            labels[j] = paper.g.labelise(labels[j], values[i], total);
-            chart.labels.push(paper.set());
-            chart.labels[i].push(paper.g[mark](x + 5, h, 5).attr({fill: clr, stroke: "none"}));
-            chart.labels[i].push(txt = paper.text(x + 20, h, labels[j] || values[j]).attr(paper.g.txtattr).attr({fill: opts.legendcolor || "#000", "text-anchor": "start"}));
-            covers[i].label = chart.labels[i];
-            h += txt.getBBox().height * 1.2;
-        }
-        var bb = chart.labels.getBBox(),
-            tr = {
-                east: [0, -bb.height / 2],
-                west: [-bb.width - 2 * r - 20, -bb.height / 2],
-                north: [-r - bb.width / 2, -r - bb.height - 10],
-                south: [-r - bb.width / 2, r + 10]
-            }[dir];
-        chart.labels.translate.apply(chart.labels, tr);
-        chart.push(chart.labels);
-    };
-    if (opts.legend) {
-        legend(opts.legend, opts.legendothers, opts.legendmark, opts.legendpos);
-    }
-    chart.push(series, covers);
-    chart.series = series;
-    chart.covers = covers;
-    return chart;
-};
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.raphael.js b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.raphael.js
deleted file mode 100644
index 8e94c36cc07..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/g.raphael.js
+++ /dev/null
@@ -1,481 +0,0 @@
-/*
- * g.Raphael 0.4 - Charting library, based on Raphaël
- *
- * Copyright (c) 2009 Dmitry Baranovskiy (http://g.raphaeljs.com)
- * Licensed under the MIT (http://www.opensource.org/licenses/mit-license.php) license.
- */
- 
- 
-(function () {
-    Raphael.fn.g = Raphael.fn.g || {};
-    Raphael.fn.g.markers = {
-        disc: "disc",
-        o: "disc",
-        flower: "flower",
-        f: "flower",
-        diamond: "diamond",
-        d: "diamond",
-        square: "square",
-        s: "square",
-        triangle: "triangle",
-        t: "triangle",
-        star: "star",
-        "*": "star",
-        cross: "cross",
-        x: "cross",
-        plus: "plus",
-        "+": "plus",
-        arrow: "arrow",
-        "->": "arrow"
-    };
-    Raphael.fn.g.shim = {stroke: "none", fill: "#000", "fill-opacity": 0};
-    Raphael.fn.g.txtattr = {font: "12px Arial, sans-serif"};
-    Raphael.fn.g.colors = [];
-    var hues = [.6, .2, .05, .1333, .75, 0];
-    for (var i = 0; i < 10; i++) {
-        if (i < hues.length) {
-            Raphael.fn.g.colors.push("hsb(" + hues[i] + ", .75, .75)");
-        } else {
-            Raphael.fn.g.colors.push("hsb(" + hues[i - hues.length] + ", 1, .5)");
-        }
-    }
-    Raphael.fn.g.text = function (x, y, text) {
-        return this.text(x, y, text).attr(this.g.txtattr);
-    };
-    Raphael.fn.g.labelise = function (label, val, total) {
-        if (label) {
-            return (label + "").replace(/(##+(?:\.#+)?)|(%%+(?:\.%+)?)/g, function (all, value, percent) {
-                if (value) {
-                    return (+val).toFixed(value.replace(/^#+\.?/g, "").length);
-                }
-                if (percent) {
-                    return (val * 100 / total).toFixed(percent.replace(/^%+\.?/g, "").length) + "%";
-                }
-            });
-        } else {
-            return (+val).toFixed(0);
-        }
-    };
-
-    Raphael.fn.g.finger = function (x, y, width, height, dir, ending, isPath) {
-        // dir 0 for horisontal and 1 for vertical
-        if ((dir && !height) || (!dir && !width)) {
-            return isPath ? "" : this.path();
-        }
-        ending = {square: "square", sharp: "sharp", soft: "soft"}[ending] || "round";
-        var path;
-        height = Math.round(height);
-        width = Math.round(width);
-        x = Math.round(x);
-        y = Math.round(y);
-        switch (ending) {
-            case "round":
-            if (!dir) {
-                var r = Math.floor(height / 2);
-                if (width < r) {
-                    r = width;
-                    path = ["M", x + .5, y + .5 - Math.floor(height / 2), "l", 0, 0, "a", r, Math.floor(height / 2), 0, 0, 1, 0, height, "l", 0, 0, "z"];
-                } else {
-                    path = ["M", x + .5, y + .5 - r, "l", width - r, 0, "a", r, r, 0, 1, 1, 0, height, "l", r - width, 0, "z"];
-                }
-            } else {
-                var r = Math.floor(width / 2);
-                if (height < r) {
-                    r = height;
-                    path = ["M", x - Math.floor(width / 2), y, "l", 0, 0, "a", Math.floor(width / 2), r, 0, 0, 1, width, 0, "l", 0, 0, "z"];
-                } else {
-                    path = ["M", x - r, y, "l", 0, r - height, "a", r, r, 0, 1, 1, width, 0, "l", 0, height - r, "z"];
-                }
-            }
-            break;
-            case "sharp":
-            if (!dir) {
-                var half = Math.floor(height / 2);
-                path = ["M", x, y + half, "l", 0, -height, Math.max(width - half, 0), 0, Math.min(half, width), half, -Math.min(half, width), half + (half * 2 < height), "z"];
-            } else {
-                var half = Math.floor(width / 2);
-                path = ["M", x + half, y, "l", -width, 0, 0, -Math.max(height - half, 0), half, -Math.min(half, height), half, Math.min(half, height), half, "z"];
-            }
-            break;
-            case "square":
-            if (!dir) {
-                path = ["M", x, y + Math.floor(height / 2), "l", 0, -height, width, 0, 0, height, "z"];
-            } else {
-                path = ["M", x + Math.floor(width / 2), y, "l", 1 - width, 0, 0, -height, width - 1, 0, "z"];
-            }
-            break;
-            case "soft":
-            var r;
-            if (!dir) {
-                r = Math.min(width, Math.round(height / 5));
-                path = ["M", x + .5, y + .5 - Math.floor(height / 2), "l", width - r, 0, "a", r, r, 0, 0, 1, r, r, "l", 0, height - r * 2, "a", r, r, 0, 0, 1, -r, r, "l", r - width, 0, "z"];
-            } else {
-                r = Math.min(Math.round(width / 5), height);
-                path = ["M", x - Math.floor(width / 2), y, "l", 0, r - height, "a", r, r, 0, 0, 1, r, -r, "l", width - 2 * r, 0, "a", r, r, 0, 0, 1, r, r, "l", 0, height - r, "z"];
-            }
-        }
-        if (isPath) {
-            return path.join(",");
-        } else {
-            return this.path(path);
-        }
-    };
-
-    // Symbols
-    Raphael.fn.g.disc = function (cx, cy, r) {
-        return this.circle(cx, cy, r);
-    };
-    Raphael.fn.g.line = function (cx, cy, r) {
-        return this.rect(cx - r, cy - r / 5, 2 * r, 2 * r / 5);
-    };
-    Raphael.fn.g.square = function (cx, cy, r) {
-        r = r * .7;
-        return this.rect(cx - r, cy - r, 2 * r, 2 * r);
-    };
-    Raphael.fn.g.triangle = function (cx, cy, r) {
-        r *= 1.75;
-        return this.path("M".concat(cx, ",", cy, "m0-", r * .58, "l", r * .5, ",", r * .87, "-", r, ",0z"));
-    };
-    Raphael.fn.g.diamond = function (cx, cy, r) {
-        return this.path(["M", cx, cy - r, "l", r, r, -r, r, -r, -r, r, -r, "z"]);
-    };
-    Raphael.fn.g.flower = function (cx, cy, r, n) {
-        r = r * 1.25;
-        var rout = r,
-            rin = rout * .5;
-        n = +n < 3 || !n ? 5 : n;
-        var points = ["M", cx, cy + rin, "Q"],
-            R;
-        for (var i = 1; i < n * 2 + 1; i++) {
-            R = i % 2 ? rout : rin;
-            points = points.concat([+(cx + R * Math.sin(i * Math.PI / n)).toFixed(3), +(cy + R * Math.cos(i * Math.PI / n)).toFixed(3)]);
-        }
-        points.push("z");
-        return this.path(points.join(","));
-    };
-    Raphael.fn.g.star = function (cx, cy, r, r2) {
-        r2 = r2 || r * .5;
-        var points = ["M", cx, cy + r2, "L"],
-            R;
-        for (var i = 1; i < 10; i++) {
-            R = i % 2 ? r : r2;
-            points = points.concat([(cx + R * Math.sin(i * Math.PI * .2)).toFixed(3), (cy + R * Math.cos(i * Math.PI * .2)).toFixed(3)]);
-        }
-        points.push("z");
-        return this.path(points.join(","));
-    };
-    Raphael.fn.g.cross = function (cx, cy, r) {
-        r = r / 2.5;
-        return this.path("M".concat(cx - r, ",", cy, "l", [-r, -r, r, -r, r, r, r, -r, r, r, -r, r, r, r, -r, r, -r, -r, -r, r, -r, -r, "z"]));
-    };
-    Raphael.fn.g.plus = function (cx, cy, r) {
-        r = r / 2;
-        return this.path("M".concat(cx - r / 2, ",", cy - r / 2, "l", [0, -r, r, 0, 0, r, r, 0, 0, r, -r, 0, 0, r, -r, 0, 0, -r, -r, 0, 0, -r, "z"]));
-    };
-    Raphael.fn.g.arrow = function (cx, cy, r) {
-        return this.path("M".concat(cx - r * .7, ",", cy - r * .4, "l", [r * .6, 0, 0, -r * .4, r, r * .8, -r, r * .8, 0, -r * .4, -r * .6, 0], "z"));
-    };
-
-    // Tooltips
-    Raphael.fn.g.tag = function (x, y, text, angle, r) {
-        angle = angle || 0;
-        r = r == null ? 5 : r;
-        text = text == null ? "$9.99" : text;
-        var R = .5522 * r,
-            res = this.set(),
-            d = 3;
-        res.push(this.path().attr({fill: "#000", stroke: "none"}));
-        res.push(this.text(x, y, text).attr(this.g.txtattr).attr({fill: "#fff"}));
-        res.update = function () {
-            this.rotate(0, x, y);
-            var bb = this[1].getBBox();
-            if (bb.height >= r * 2) {
-                this[0].attr({path: ["M", x, y + r, "a", r, r, 0, 1, 1, 0, -r * 2, r, r, 0, 1, 1, 0, r * 2, "m", 0, -r * 2 -d, "a", r + d, r + d, 0, 1, 0, 0, (r + d) * 2, "L", x + r + d, y + bb.height / 2 + d, "l", bb.width + 2 * d, 0, 0, -bb.height - 2 * d, -bb.width - 2 * d, 0, "L", x, y - r - d].join(",")});
-            } else {
-                var dx = Math.sqrt(Math.pow(r + d, 2) - Math.pow(bb.height / 2 + d, 2));
-                // ["c", -R, 0, -r, R - r, -r, -r, 0, -R, r - R, -r, r, -r, R, 0, r, r - R, r, r, 0, R, R - r, r, -r, r]
-                // "a", r, r, 0, 1, 1, 0, -r * 2, r, r, 0, 1, 1, 0, r * 2,
-                this[0].attr({path: ["M", x, y + r, "c", -R, 0, -r, R - r, -r, -r, 0, -R, r - R, -r, r, -r, R, 0, r, r - R, r, r, 0, R, R - r, r, -r, r, "M", x + dx, y - bb.height / 2 - d, "a", r + d, r + d, 0, 1, 0, 0, bb.height + 2 * d, "l", r + d - dx + bb.width + 2 * d, 0, 0, -bb.height - 2 * d, "L", x + dx, y - bb.height / 2 - d].join(",")});
-            }
-            this[1].attr({x: x + r + d + bb.width / 2, y: y});
-            angle = (360 - angle) % 360;
-            this.rotate(angle, x, y);
-            angle > 90 && angle < 270 && this[1].attr({x: x - r - d - bb.width / 2, y: y, rotation: [180 + angle, x, y]});
-            return this;
-        };
-        res.update();
-        return res;
-    };
-    Raphael.fn.g.popupit = function (x, y, set, dir, size) {
-        dir = dir == null ? 2 : dir;
-        size = size || 5;
-        x = Math.round(x) + .5;
-        y = Math.round(y) + .5;
-        var bb = set.getBBox(),
-            w = Math.round(bb.width / 2),
-            h = Math.round(bb.height / 2),
-            dx = [0, w + size * 2, 0, -w - size * 2],
-            dy = [-h * 2 - size * 3, -h - size, 0, -h - size],
-            p = ["M", x - dx[dir], y - dy[dir], "l", -size, (dir == 2) * -size, -Math.max(w - size, 0), 0, "a", size, size, 0, 0, 1, -size, -size,
-                "l", 0, -Math.max(h - size, 0), (dir == 3) * -size, -size, (dir == 3) * size, -size, 0, -Math.max(h - size, 0), "a", size, size, 0, 0, 1, size, -size,
-                "l", Math.max(w - size, 0), 0, size, !dir * -size, size, !dir * size, Math.max(w - size, 0), 0, "a", size, size, 0, 0, 1, size, size,
-                "l", 0, Math.max(h - size, 0), (dir == 1) * size, size, (dir == 1) * -size, size, 0, Math.max(h - size, 0), "a", size, size, 0, 0, 1, -size, size,
-                "l", -Math.max(w - size, 0), 0, "z"].join(","),
-            xy = [{x: x, y: y + size * 2 + h}, {x: x - size * 2 - w, y: y}, {x: x, y: y - size * 2 - h}, {x: x + size * 2 + w, y: y}][dir];
-        set.translate(xy.x - w - bb.x, xy.y - h - bb.y);
-        return this.path(p).attr({fill: "#000", stroke: "none"}).insertBefore(set.node ? set : set[0]);
-    };
-    Raphael.fn.g.popup = function (x, y, text, dir, size) {
-        dir = dir == null ? 2 : dir;
-        size = size || 5;
-        text = text || "$9.99";
-        var res = this.set(),
-            d = 3;
-        res.push(this.path().attr({fill: "#000", stroke: "none"}));
-        res.push(this.text(x, y, text).attr(this.g.txtattr).attr({fill: "#fff"}));
-        res.update = function (X, Y, withAnimation) {
-            X = X || x;
-            Y = Y || y;
-            var bb = this[1].getBBox(),
-                w = bb.width / 2,
-                h = bb.height / 2,
-                dx = [0, w + size * 2, 0, -w - size * 2],
-                dy = [-h * 2 - size * 3, -h - size, 0, -h - size],
-                p = ["M", X - dx[dir], Y - dy[dir], "l", -size, (dir == 2) * -size, -Math.max(w - size, 0), 0, "a", size, size, 0, 0, 1, -size, -size,
-                    "l", 0, -Math.max(h - size, 0), (dir == 3) * -size, -size, (dir == 3) * size, -size, 0, -Math.max(h - size, 0), "a", size, size, 0, 0, 1, size, -size,
-                    "l", Math.max(w - size, 0), 0, size, !dir * -size, size, !dir * size, Math.max(w - size, 0), 0, "a", size, size, 0, 0, 1, size, size,
-                    "l", 0, Math.max(h - size, 0), (dir == 1) * size, size, (dir == 1) * -size, size, 0, Math.max(h - size, 0), "a", size, size, 0, 0, 1, -size, size,
-                    "l", -Math.max(w - size, 0), 0, "z"].join(","),
-                xy = [{x: X, y: Y + size * 2 + h}, {x: X - size * 2 - w, y: Y}, {x: X, y: Y - size * 2 - h}, {x: X + size * 2 + w, y: Y}][dir];
-            if (withAnimation) {
-                this[0].animate({path: p}, 500, ">");
-                this[1].animate(xy, 500, ">");
-            } else {
-                this[0].attr({path: p});
-                this[1].attr(xy);
-            }
-            return this;
-        };
-        return res.update(x, y);
-    };
-    Raphael.fn.g.flag = function (x, y, text, angle) {
-        angle = angle || 0;
-        text = text || "$9.99";
-        var res = this.set(),
-            d = 3;
-        res.push(this.path().attr({fill: "#000", stroke: "none"}));
-        res.push(this.text(x, y, text).attr(this.g.txtattr).attr({fill: "#fff"}));
-        res.update = function (x, y) {
-            this.rotate(0, x, y);
-            var bb = this[1].getBBox(),
-                h = bb.height / 2;
-            this[0].attr({path: ["M", x, y, "l", h + d, -h - d, bb.width + 2 * d, 0, 0, bb.height + 2 * d, -bb.width - 2 * d, 0, "z"].join(",")});
-            this[1].attr({x: x + h + d + bb.width / 2, y: y});
-            angle = 360 - angle;
-            this.rotate(angle, x, y);
-            angle > 90 && angle < 270 && this[1].attr({x: x - r - d - bb.width / 2, y: y, rotation: [180 + angle, x, y]});
-            return this;
-        };
-        return res.update(x, y);
-    };
-    Raphael.fn.g.label = function (x, y, text) {
-        var res = this.set();
-        res.push(this.rect(x, y, 10, 10).attr({stroke: "none", fill: "#000"}));
-        res.push(this.text(x, y, text).attr(this.g.txtattr).attr({fill: "#fff"}));
-        res.update = function () {
-            var bb = this[1].getBBox(),
-                r = Math.min(bb.width + 10, bb.height + 10) / 2;
-            this[0].attr({x: bb.x - r / 2, y: bb.y - r / 2, width: bb.width + r, height: bb.height + r, r: r});
-        };
-        res.update();
-        return res;
-    };
-    Raphael.fn.g.labelit = function (set) {
-        var bb = set.getBBox(),
-            r = Math.min(20, bb.width + 10, bb.height + 10) / 2;
-        return this.rect(bb.x - r / 2, bb.y - r / 2, bb.width + r, bb.height + r, r).attr({stroke: "none", fill: "#000"}).insertBefore(set[0]);
-    };
-    Raphael.fn.g.drop = function (x, y, text, size, angle) {
-        size = size || 30;
-        angle = angle || 0;
-        var res = this.set();
-        res.push(this.path(["M", x, y, "l", size, 0, "A", size * .4, size * .4, 0, 1, 0, x + size * .7, y - size * .7, "z"]).attr({fill: "#000", stroke: "none", rotation: [22.5 - angle, x, y]}));
-        angle = (angle + 90) * Math.PI / 180;
-        res.push(this.text(x + size * Math.sin(angle), y + size * Math.cos(angle), text).attr(this.g.txtattr).attr({"font-size": size * 12 / 30, fill: "#fff"}));
-        res.drop = res[0];
-        res.text = res[1];
-        return res;
-    };
-    Raphael.fn.g.blob = function (x, y, text, angle, size) {
-        angle = (+angle + 1 ? angle : 45) + 90;
-        size = size || 12;
-        var rad = Math.PI / 180,
-            fontSize = size * 12 / 12;
-        var res = this.set();
-        res.push(this.path().attr({fill: "#000", stroke: "none"}));
-        res.push(this.text(x + size * Math.sin((angle) * rad), y + size * Math.cos((angle) * rad) - fontSize / 2, text).attr(this.g.txtattr).attr({"font-size": fontSize, fill: "#fff"}));
-        res.update = function (X, Y, withAnimation) {
-            X = X || x;
-            Y = Y || y;
-            var bb = this[1].getBBox(),
-                w = Math.max(bb.width + fontSize, size * 25 / 12),
-                h = Math.max(bb.height + fontSize, size * 25 / 12),
-                x2 = X + size * Math.sin((angle - 22.5) * rad),
-                y2 = Y + size * Math.cos((angle - 22.5) * rad),
-                x1 = X + size * Math.sin((angle + 22.5) * rad),
-                y1 = Y + size * Math.cos((angle + 22.5) * rad),
-                dx = (x1 - x2) / 2,
-                dy = (y1 - y2) / 2,
-                rx = w / 2,
-                ry = h / 2,
-                k = -Math.sqrt(Math.abs(rx * rx * ry * ry - rx * rx * dy * dy - ry * ry * dx * dx) / (rx * rx * dy * dy + ry * ry * dx * dx)),
-                cx = k * rx * dy / ry + (x1 + x2) / 2,
-                cy = k * -ry * dx / rx + (y1 + y2) / 2;
-            if (withAnimation) {
-                this.animate({x: cx, y: cy, path: ["M", x, y, "L", x1, y1, "A", rx, ry, 0, 1, 1, x2, y2, "z"].join(",")}, 500, ">");
-            } else {
-                this.attr({x: cx, y: cy, path: ["M", x, y, "L", x1, y1, "A", rx, ry, 0, 1, 1, x2, y2, "z"].join(",")});
-            }
-            return this;
-        };
-        res.update(x, y);
-        return res;
-    };
-
-    Raphael.fn.g.colorValue = function (value, total, s, b) {
-        return "hsb(" + [Math.min((1 - value / total) * .4, 1), s || .75, b || .75] + ")";
-    };
-
-    Raphael.fn.g.snapEnds = function (from, to, steps) {
-        var f = from,
-            t = to;
-        if (f == t) {
-            return {from: f, to: t, power: 0};
-        }
-        function round(a) {
-            return Math.abs(a - .5) < .25 ? Math.floor(a) + .5 : Math.round(a);
-        }
-        var d = (t - f) / steps,
-            r = Math.floor(d),
-            R = r,
-            i = 0;
-        if (r) {
-            while (R) {
-                i--;
-                R = Math.floor(d * Math.pow(10, i)) / Math.pow(10, i);
-            }
-            i ++;
-        } else {
-            while (!r) {
-                i = i || 1;
-                r = Math.floor(d * Math.pow(10, i)) / Math.pow(10, i);
-                i++;
-            }
-            i && i--;
-        }
-        var t = round(to * Math.pow(10, i)) / Math.pow(10, i);
-        if (t < to) {
-            t = round((to + .5) * Math.pow(10, i)) / Math.pow(10, i);
-        }
-        var f = round((from - (i > 0 ? 0 : .5)) * Math.pow(10, i)) / Math.pow(10, i);
-        return {from: f, to: t, power: i};
-    };
-    Raphael.fn.g.axis = function (x, y, length, from, to, steps, orientation, labels, type, dashsize) {
-        dashsize = dashsize == null ? 3 : dashsize;
-        type = type || "t";
-        steps = steps || 10;
-        var path = type == "|" || type == " " ? ["M", x + .5, y, "l", 0, .001] : orientation == 1 || orientation == 3 ? ["M", x + .5, y, "l", 0, -length] : ["M", x, y + .5, "l", length, 0],
-            ends = this.g.snapEnds(from, to, steps),
-            f = ends.from,
-            t = ends.to,
-            i = ends.power,
-            j = 0,
-            text = this.set();
-        d = (t - f) / steps;
-        var label = f,
-            rnd = i > 0 ? i : 0;
-            dx = length / steps;
-        if (+orientation == 1 || +orientation == 3) {
-            var Y = y,
-                addon = (orientation - 1 ? 1 : -1) * (dashsize + 3 + !!(orientation - 1));
-            while (Y >= y - length) {
-                type != "-" && type != " " && (path = path.concat(["M", x - (type == "+" || type == "|" ? dashsize : !(orientation - 1) * dashsize * 2), Y + .5, "l", dashsize * 2 + 1, 0]));
-                text.push(this.text(x + addon, Y, (labels && labels[j++]) || (Math.round(label) == label ? label : +label.toFixed(rnd))).attr(this.g.txtattr).attr({"text-anchor": orientation - 1 ? "start" : "end"}));
-                label += d;
-                Y -= dx;
-            }
-            if (Math.round(Y + dx - (y - length))) {
-                type != "-" && type != " " && (path = path.concat(["M", x - (type == "+" || type == "|" ? dashsize : !(orientation - 1) * dashsize * 2), y - length + .5, "l", dashsize * 2 + 1, 0]));
-                text.push(this.text(x + addon, y - length, (labels && labels[j]) || (Math.round(label) == label ? label : +label.toFixed(rnd))).attr(this.g.txtattr).attr({"text-anchor": orientation - 1 ? "start" : "end"}));
-            }
-        } else {
-            var X = x,
-                label = f,
-                rnd = i > 0 ? i : 0,
-                addon = (orientation ? -1 : 1) * (dashsize + 9 + !orientation),
-                dx = length / steps,
-                txt = 0,
-                prev = 0;
-            while (X <= x + length) {
-
-                text.push(txt = this.text(X, y + addon, (labels && labels[j++]) || (Math.round(label) == label ? label : +label.toFixed(rnd))).attr(this.g.txtattr));
-		var bb = txt.getBBox();
-		var ds = dashsize;
-                if (prev >= bb.x - 5) {
-		    text.pop(text.length - 1).remove();
-		    ds = 1;
-                } else {
-                    prev = bb.x + bb.width;
-                }
-
-		type != "-" && type != " " && (path = path.concat(["M", X + .5, y - (type == "+" ? ds : !!orientation * ds * 2), "l", 0, ds * 2 + 1]));
-                
-                label += d;
-                X += dx;
-            }
-            if (Math.round(X - dx - x - length)) {
-                type != "-" && type != " " && (path = path.concat(["M", x + length + .5, y - (type == "+" ? dashsize : !!orientation * dashsize * 2), "l", 0, dashsize * 2 + 1]));
-                text.push(this.text(x + length, y + addon, (labels && labels[j]) || (Math.round(label) == label ? label : +label.toFixed(rnd))).attr(this.g.txtattr));
-            }
-        }
-        var res = this.path(path);
-        res.text = text;
-        res.all = this.set([res, text]);
-        res.remove = function () {
-            this.text.remove();
-            this.constructor.prototype.remove.call(this);
-        };
-        return res;
-    };
-
-    Raphael.el.lighter = function (times) {
-        times = times || 2;
-        var fs = [this.attrs.fill, this.attrs.stroke];
-        this.fs = this.fs || [fs[0], fs[1]];
-        fs[0] = Raphael.rgb2hsb(Raphael.getRGB(fs[0]).hex);
-        fs[1] = Raphael.rgb2hsb(Raphael.getRGB(fs[1]).hex);
-        fs[0].b = Math.min(fs[0].b * times, 1);
-        fs[0].s = fs[0].s / times;
-        fs[1].b = Math.min(fs[1].b * times, 1);
-        fs[1].s = fs[1].s / times;
-        this.attr({fill: "hsb(" + [fs[0].h, fs[0].s, fs[0].b] + ")", stroke: "hsb(" + [fs[1].h, fs[1].s, fs[1].b] + ")"});
-    };
-    Raphael.el.darker = function (times) {
-        times = times || 2;
-        var fs = [this.attrs.fill, this.attrs.stroke];
-        this.fs = this.fs || [fs[0], fs[1]];
-        fs[0] = Raphael.rgb2hsb(Raphael.getRGB(fs[0]).hex);
-        fs[1] = Raphael.rgb2hsb(Raphael.getRGB(fs[1]).hex);
-        fs[0].s = Math.min(fs[0].s * times, 1);
-        fs[0].b = fs[0].b / times;
-        fs[1].s = Math.min(fs[1].s * times, 1);
-        fs[1].b = fs[1].b / times;
-        this.attr({fill: "hsb(" + [fs[0].h, fs[0].s, fs[0].b] + ")", stroke: "hsb(" + [fs[1].h, fs[1].s, fs[1].b] + ")"});
-    };
-    Raphael.el.original = function () {
-        if (this.fs) {
-            this.attr({fill: this.fs[0], stroke: this.fs[1]});
-            delete this.fs;
-        }
-    };
-})();
\ No newline at end of file
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/load-big.gif b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/load-big.gif
deleted file mode 100644
index ddb7ff1aac1..00000000000
Binary files a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/load-big.gif and /dev/null differ
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/load.gif b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/load.gif
deleted file mode 100644
index d0bce154234..00000000000
Binary files a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/load.gif and /dev/null differ
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.css b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.css
deleted file mode 100644
index a84d90e07c4..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.css
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
-   Licensed to the Apache Software Foundation (ASF) under one or more
-   contributor license agreements.  See the NOTICE file distributed with
-   this work for additional information regarding copyright ownership.
-   The ASF licenses this file to You under the Apache License, Version 2.0
-   (the "License"); you may not use this file except in compliance with
-   the License.  You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-body { font-family: sans-serif; }
-
-div.fileSelector { border: solid 3px black; position: absolute; background: white; 
-		   -moz-border-radius: 10px; border-radius: 10px; 
-		   padding: 5px; font-family: sans-serif;
-		   right: 10px; top: 10px;
-		 }
-div.fileSelector a { cursor: pointer; }
-.fileSelector li.selectedFile { background: lightgreen; }
-
-div.selector { border: solid 3px black; position: absolute; background: white; 
-		   -moz-border-radius: 10px; border-radius: 10px; 
-		   padding: 5px; 
-		   right: 10px; top: 10px; background: #aaaaaa; opacity: 0.7;
-		 }
-div.selector a { cursor: pointer; }
-.fileSelector li.selectedFile { background: lightgreen; }
-
-#fileLoader  { -moz-border-radius: 10px; border-radius: 10px; background: #aaaaaa; opacity: 0.7; position: absolute; left: 20px; top: 20px; }
-#loadingScreen { position: absolute; top: 100px; margin-left: 40%; margin-right: 40%; width: 500px; background: #aaaaaa; opacity: 0.7; -moz-border-radius: 10px; border-radius: 10px; text-align: center }
-#filterinput { width: 500px; height: 100px; }
-/* main interface */
-#actions { float: right; }
-#views { float: left; }
-
-.closebutton { position: absolute; right: 5px; float: right; display: block; cursor: pointer; }
-
-.actionbutton { color: blue; text-decoration: none; padding: 3px; cursor: pointer; }
-span:hover.actionbutton { background: lightblue;  }
-
-#status { text-align: center; }
-
-#canvas { width: 100%; height: 1000px; }
-
-#logtable { width: 100%; }
-.popUp { border: 3px solid black; -moz-border-radius: 10px; border-radius: 10px; position: absolute; background: white; padding: 10px; min-width: 300px; }
-
-.errorpage { position: absolute; top: 100px; margin-left: 40%; margin-right: 40%; width: 500px; background: #aaaaaa; opacity: 0.7; -moz-border-radius: 10px; border-radius: 10px; padding: 10px; }
\ No newline at end of file
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.js b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.js
deleted file mode 100644
index 87bb7d89da2..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.js
+++ /dev/null
@@ -1,262 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-LogGraph = function(canvas, status) {
-    this.canvas = document.getElementById(canvas);
-    this.status = document.getElementById(status);
-    this.starttime = 0;
-    this.endtime = 0;
-    this.period = 0;
-    this.numEntries = 0;
-    this.currentRender = 0;
-    this.filter = "";
-
-    this.saveFilters = function () {
-	localStorage.starttime = this.starttime;
-	localStorage.endtime = this.endtime;
-	localStorage.period = this.period;
-	localStorage.filter = this.filter;
-	
-    };
-    this.loadFilters = function () {
-	if (localStorage.starttime) { this.starttime = parseInt(localStorage.starttime); }
-	if (localStorage.endtime) { this.endtime = parseInt(localStorage.endtime); }
-	if (localStorage.period) { this.period = parseInt(localStorage.period); }
-	if (localStorage.filter) { this.filter = localStorage.filter; }
-    };
-    this.loadFilters();
-    var self = this;
-
-    var updateStatus = function (starttime, period, filter, numEntries) {
-	self.starttime = starttime;
-	self.endtime = starttime + period;
-	self.period = period;
-	self.filter = filter;
-	self.saveFilters(); 
-       
-	self.status.innerHTML = dateFormat(starttime, "HH:MM:ss,l") + " &rArr; " + dateFormat(self.endtime, "HH:MM:ss,l") + " &nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp; " + numEntries + " entries  &nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp; " +  (filter ? filter : "No filter");
-	
-	if (self.currentRender) {
-	    self.currentRender();
-	}
-    };
-	
-    YUI().use("io-base", function(Y) {
-	    var uri = "/info";
-	    if (self.starttime) {
-		var uri = "/info?start=" + self.starttime + "&period=" + self.period + "&filter=" + self.filter;
-	    }
-	    
-	    function complete(id, o, args) {
-		var data = eval("(" + o.responseText + ")"); // Response data.
-		var period = data.endTime - data.startTime;
-		updateStatus(data.startTime, period, self.filter, data.numEntries);
-	    };
-	    
-	    Y.on('io:complete', complete, Y, []);
-	    var request = Y.io(uri);
-	});
-    
-    this.addLogs = function() {
-	new LogGraph.fileSelector(function (files) { new LogGraph.fileLoader(files); });
-    };
-
-    this.editFilters = function() {
-	new LogGraph.filterSelector(this.starttime, this.period, this.filter, updateStatus);
-    };	
-	
-    this.getCleanCanvas = function () {
-	this.canvas.innerHTML = "";
-	return this.canvas;
-    };
-
-    this.showLoadingScreen = function () {
-	this.loadingScreen = document.createElement("div");
-	this.loadingScreen.id = "loadingScreen";
-	this.loadingScreen.innerHTML = "<img src=\"load-big.gif\" /> <p>Loading...</p>";
-	document.body.appendChild(this.loadingScreen);
-    };
-
-    this.hideLoadingScreen = function () {
-	document.body.removeChild(this.loadingScreen);
-	this.loadingScreen.style.visibility = "hidden";
-    };
-
-
-    /***
-     * TODO: refactor these to load the data first, before handing to a draw funciton. 
-     *       We shouldn't pass the async q into the drawing function
-     */
-    this.showLogs = function() {
-	var self= this;
-	YUI().use('async-queue', function(Y) {
-		var q = new Y.AsyncQueue(self.showLoadingScreen,
-					 // The second callback will pause the Queue and send an XHR for data
-					 function () {
-					     q.pause();
-					     var loggraph = new LogGraph.LogTable(q, self.getCleanCanvas(), self.starttime, self.endtime, self.filter);
-					     self.currentRender = self.showLogs;
-					 },
-					 self.hideLoadingScreen);
-		q.run();
-	    }
-	    );
-    };
-
-    this.serverGraph = function() {
-	var self= this;
-	YUI().use('async-queue', function(Y) {
-		var q = new Y.AsyncQueue(self.showLoadingScreen,
-					 // The second callback will pause the Queue and send an XHR for data
-					 function () {
-					     q.pause();
-					     var servergraph = new LogGraph.ServerGraph(q, self.getCleanCanvas(), self.starttime, self.endtime, self.filter);
-					     self.currentRender = self.showLogs;
-					 },
-					 self.hideLoadingScreen);
-		q.run();
-	    }
-	    );
-    };
-    
-    this.sessionGraph = function() {
-	var self= this;
-	YUI().use('async-queue', function(Y) {
-		var q = new Y.AsyncQueue(self.showLoadingScreen,
-					 // The second callback will pause the Queue and send an XHR for data
-					 function () {
-					     q.pause();
-					     var sessiongraph = new LogGraph.SessionGraph(q, self.getCleanCanvas(), self.starttime, self.endtime, self.filter);
-					     self.currentRender = self.sessionGraph;
-					 },
-					 self.hideLoadingScreen);
-		q.run();
-	    }
-	    );
-    };
-    
-    this.showStats = function() {
-	var self= this;
-	YUI().use('async-queue', function(Y) {
-		var q = new Y.AsyncQueue(self.showLoadingScreen,
-					 // The second callback will pause the Queue and send an XHR for data
-					 function () {
-					     q.pause();
-					     var statgraph = new LogGraph.StatsGraph(q, self.getCleanCanvas(), self.starttime, self.endtime, self.filter);
-					     self.currentRender = self.showStats;
-					 },
-					 self.hideLoadingScreen);
-		q.run();
-	    }
-	    );
-    };
-};
-
-LogGraph.error = function(description) {
-    var errorPage = document.createElement("div");
-    errorPage.className = "errorpage";
-    var p = document.createElement("p");
-    p.innerHTML = description;
-    errorPage.appendChild(p);
-    
-    var span = document.createElement("span");
-    p = document.createElement("p");
-    span.className = "actionButton";
-    span.innerHTML = "OK";
-    span.onclick = function (evt) {
-	document.body.removeChild(errorPage);
-	delete errorPage;
-    }
-    p.appendChild(span);
-    errorPage.appendChild(p);
-
-    document.body.appendChild(errorPage);
-};
-
-LogGraph.ticker =function(allow_dups) {
-    this.ticks = new Array();
-    this.current_tick = 0;
-    this.allow_dups = allow_dups;;
-    
-    this.tick = function(time) {
-	if (time == this.ticks[this.ticks.length - 1] && this.allow_dups == true) 
-	    return this.current_tick;
-	
-	this.ticks.push(time);
-	return this.current_tick++;
-    };
-    
-    this.current = function() {
-	return this.current_tick;
-    };
-    
-    this.reset = function() {
-	while (this.ticks.length) {
-	    this.ticks.pop();
-	}
-	this.current_tick = 0;
-    };
-};
-
-
-LogGraph.timescale = function(starttime, endtime) {
-    this.starttime = starttime;
-    this.endtime = endtime;
-    this.millis = endtime - starttime;
-    
-    this.draw = function(paper) {
-	var scale = paper.set();
-	scale.push(paper.path("M0 0 L" + paper.width + " 0"));
-	
-	for (var i = 0; i < paper.width; i += 100) {
-	    scale.push(paper.path("M" + i + " 0 L" + i + " 5"));
-	    //		var time = dateFormat((this.starttime + (i*ms_per_pixel)), "h:MM:ss,l");
-		//	paper.text(i + 5, 10, time);
-	}
-	
-	scale.attr({"stroke-width": 2});
-    };
-};
-
-/*
-  Fetch data from an uri and process it, the process data func returns true if any of the data is useful  
-*/
-LogGraph.loadData = function (asyncq, uri, processdata) {
-    YUI().use("io-base", function(Y) {
-	    function success(id, o, args) {
-		var data = eval("(" + o.responseText + ")"); // Response data.
-		if (data.error) {
-		    LogGraph.error(data.error);
-		} else {
-		    if (!processdata(data)) {
-			LogGraph.error("No data. Perhaps you should loosen your filter criteria.");
-		    }
-		}
-		asyncq.run();
-	    };
-	    function failure(id, o, args) {
-		LogGraph.error("Error contacting server: (" + o.status + ") " + o.statusText);
-		asyncq.run();
-	    };
-
-	    Y.on('io:success', success, Y, []);
-	    Y.on('io:failure', failure, Y, []);
-	    
-	    var request = Y.io(uri);
-	});
-}
\ No newline at end of file
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.log.js b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.log.js
deleted file mode 100644
index 551ea4b2373..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.log.js
+++ /dev/null
@@ -1,57 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-LogGraph.LogTable = function (asyncq, canvas, starttime, endtime, filter) {
-    this.starttime = starttime;
-    this.endtime = endtime;
-    this.filter = filter;
-
-    var table = document.createElement("table");
-    table.id = "logtable";
-    canvas.appendChild(table);
-
-    this.addLogLine = function(time, text) {
-	var tr = document.createElement("tr");
-	table.appendChild(tr);
-	
-	var td = document.createElement("td");
-	td.innerHTML = dateFormat(time, "h:MM:ss,l");
-	tr.appendChild(td);
-
-	td = document.createElement("td");
-	td.innerHTML = text;
-	tr.appendChild(td);
-    }
-
-    var self = this;
-    var processdata = function(data) {
-	var events = data["events"];
-	var count = 0;
-	for (var i in events) {
-	    var e = events[i];
-	    if (e.type == "text") {
-		self.addLogLine(e.time, e.text);
-		count++;
-	    }
-	}
-	return count != 0;
-    };
-
-    var uri = "/data?start=" + self.starttime + "&end=" + self.endtime + "&filter=" + self.filter; 
-    LogGraph.loadData(asyncq, uri, processdata);
-};
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.server.js b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.server.js
deleted file mode 100644
index 0a74b5c24b8..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.server.js
+++ /dev/null
@@ -1,329 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-LogGraph.ServerGraph = function(asyncq, canvas, starttime, endtime, filter) {
-    this.starttime = starttime;
-    this.endtime = endtime;
-    this.millis = endtime - starttime;
-    this.nextserverid = 0;
-    this.serveroffset = 100;
-    this.filter = filter;
-    
-    this.pixels_per_tick =  20;
-    this.ticker = new LogGraph.ticker();
-
-    
-    var paper = Raphael(canvas, 1, 1);
-
-    var self = this;
-
-    this.timescale = new LogGraph.timescale(starttime, endtime);
-    this.objects = new Array();
-    
-    this.add = function(obj) {
-	this.objects.push(obj);
-    }
-    
-    this.tick_to_x = function (timestamp) {
-	var x = timestamp * this.pixels_per_tick; 
-	return x;
-    }; 
-    
-    this._drawTime  = function(paper, x, time) {
-	var p = paper.path("M" + x + " 0 L" + x + " " + paper.height);
-	var t = paper.text(x, 10, dateFormat(time, "h:MM:ss,l"));
-	
-	t.hide();
-	p.mouseover(function(evt) {
-		t.show();
-		p.attr({stroke: "red"});
-	    });
-	p.mouseout(function(evt) {
-		t.hide();
-		p.attr({stroke: "lightgray"});
-	    });
-	
-	return p;
-    };
-    
-    this.draw = function(paper) {
-	var grid = paper.set();
-	for (var i = 0; i < paper.height; i += 20) {
-	    grid.push(paper.path("M0 " + i + " L" + paper.width + " " + i));
-	}
-	var lasttick = this.starttime;
-	var scale = 500; // 500 ms
-	
-	var y = 0;
-	
-	for (var t = 0, len = this.ticker.ticks.length; t < len; t++) {
-	    var basex = t * this.pixels_per_tick;
-	    var thistick = this.ticker.ticks[t];
-	    var nexttick = t + 1 == this.ticker.ticks.length ? this.endtime : this.ticker.ticks[t+1];
-	    if (nexttick == thistick) {
-		continue;
-	    }
-	    var time = thistick - lasttick;
-	    var first = scale - (lasttick % scale);
-	    
-	    /*		for (var i = 0; (first+scale*i) < time; i++) {
-			
-			var toffset = first+scale*i;
-			var x = basex + LogGraph._pixels_per_tick * toffset/time;
-			grid.push(this._drawTime(paper, x, lasttick + toffset, grid));
-			
-			}*/
-	    
-	    
-	    //grid.push(paper.path("M" + i + " 0 L" + i + " " + paper.height));
-	    lasttick = thistick;
-	}
-	grid.attr({stroke: "lightgray"});
-	this.timescale.draw(paper);
-	
-	for (o in this.objects) {
-	    this.objects[o].draw(paper);
-	}
-    };
-
-
-    var processdata = function(data) {
-	var servermap = {};
-	var servers = data.servers;
-	var count = 0;
-	for (s in servers) {
-	    var server = new LogGraph.ServerGraph.server(self, "Server " + servers[s]);
-	    servermap[servers[s]] = server;
-	    self.add(server);
-	    count++;
-	}
-	
-	var messages = {};
-	var events = data.events;
-	for (var i in events) {
-	    var e = events[i];
-	    var t = e.time;
-	    if (e.type == "stateChange") {
-		servermap[e.server].addState(e.state, self.ticker.tick(e.time));
-	    }
-	    if (e.type == "postmessage") {
-		src = servermap[e.src];
-		dst = servermap[e.dst];
-		var key = "key:s" + e.src + ",d" + e.dst + ",z" + e.zxid;
-		    
-		var m = new LogGraph.ServerGraph.message(self, src, self.ticker.tick(e.time), dst, e.zxid);
-		messages[key] = m;
-	    } 
-	    if (e.type == "delivermessage") {
-		var key = "key:s" + e.src + ",d" + e.dst + ",z" + e.zxid;
-		
-		var m = messages[key];
-		if (m) {
-		    m.dsttime = self.ticker.tick(e.time);
-		    m.name = "Propose";
-		    self.add(m);
-		    delete messages[key];
-		}
-	    } 
-	    if (e.type == "exception") {
-		servermap[e.server].addException(self.ticker.tick(e.time), e.text, e.time);
-	    }
-	    count++;
-	}
-	
-	for (var i in messages) {
-	    var m = messages[i];
-	    m.markIncomplete();
-	    self.add(m);
-	    count++;
-	}
-
-	if (count != 0) {
-	    paper.setSize(self.tick_to_x(self.ticker.current()), 1000);	    
-	    
-	    var line = paper.path("M0 0 L0 1000");	    
-	    line.attr({"stroke": "red", "stroke-dasharray": "- "});
-	    var base = canvas.offsetLeft;// + ((canvas.offsetWidth - paper.width)/2);
-	    canvas.onmousemove = function (evt) {
-		var x = evt.screenX - base;
-		
-		line.attr({"path": "M" + x + " 0 L"+ x +" 1000"});
-		
-	    };
-
-	    self.draw(paper);
-	    return true;
-	} else {
-	    return false;
-	}
-    };
-		
-    var uri = "/data?start=" + self.starttime + "&end=" + self.endtime + "&filter=" + filter;
-
-    LogGraph.loadData(asyncq, uri, processdata);    
-};
-
-LogGraph.ServerGraph.server = function (graph, name) {
-    this.graph = graph;
-    this.serverid = graph.nextserverid++;
-    this.name = name;
-    this.y = (this.serverid * 300 + graph.serveroffset);
-    this.states = new Array();
-    this.exception = new Array();
-    
-    this.addState = function(state, time) {
-	this.states.push([state, time]);
-    }
-    
-    this.addException = function(tick, exception, time) {
-	this.exception.push(new LogGraph.ServerGraph.exception(this.graph, tick, exception, time));
-    }
-    
-    this.draw = function(paper) {
-	var st = paper.set();
-	st.push(paper.path("M0 " + this.y + " L" + paper.width + " " + this.y));
-	st.push(paper.text(20, this.y - 10, this.name));
-	st.attr({stroke: "gray"});
-	
-	var numstates = this.states.length;
-	
-	for (s = 0; s < numstates; s++) {
-	    var style = {};
-	    switch (this.states[s][0]) {
-	    case "INIT": style = {stroke: "yellow", "stroke-width":3}; break;
-	    case "FOLLOWING": style = {stroke: "lightgreen", "stroke-width":7}; break;
-	    case "LEADING": style = {stroke: "green", "stroke-width":10}; break;
-	    case "LOOKING": style = {stroke: "orange", "stroke-width":5}; break;
-	    }
-	    var startx = this.graph.tick_to_x(this.states[s][1]);
-	    var endx = s + 1 < numstates ? this.graph.tick_to_x(this.states[(s+1)][1]) : paper.width;
-	    var p = paper.path("M" + startx + " " + this.y + " L" + endx + " " + this.y);
-	    p.attr(style);
-	}
-	
-	for (e in this.exception) {
-	    this.exception[e].draw(paper, this);
-	}
-    }
-};    
-    
-LogGraph.ServerGraph.message = function(graph, src, srctime, dst, zxid) {
-    this.graph = graph;
-    this.src = src;
-    this.srctime = srctime;
-    this.dst = dst;
-    this.dsttime = 0; //dsttime;
-    this.name = "Unknown";
-    this.zxid = zxid;
-    this.moreinfo = "No extra information";
-    this.incomplete = false;
-    
-    this.markIncomplete = function() {
-	this.incomplete = true;
-	this.dsttime = this.srctime;
-    }
-
-    this.draw = function(paper) {
-	var srcx = this.graph.tick_to_x(this.srctime);
-	var dstx = this.graph.tick_to_x(this.dsttime);
-	
-	var arrow = paper.set();
-	var p = paper.path("M" + srcx + " " + this.src.y + " L" + dstx + " " + this.dst.y);
-	arrow.push(p);
-	
-	var tx = (srcx + dstx)/2;
-	var ty = (this.src.y + this.dst.y)/2;
-	var t = paper.text(tx, ty, this.name);
-	
-	var gradiant = (this.dst.y - this.src.y)/(dstx - srcx);
-	var angle = Math.atan(gradiant) * 57.2958;
-	t.rotate(angle, true);
-	
-	var arrowl = paper.path("M" + dstx + " " + this.dst.y + " L" + (dstx - 10) +" " + this.dst.y);
-	arrowl.rotate(angle + 20, dstx, this.dst.y);
-	arrow.push(arrowl);
-	var arrowr = paper.path("M" + dstx + " " + this.dst.y + " L" + (dstx - 10) +" " + this.dst.y);
-	arrowr.rotate(angle - 20, dstx, this.dst.y);
-	arrow.push(arrowr);
-	
-	arrow.attr({"stroke-width": 2, stroke: "gray"});
-	if (this.incomplete) {
-	    arrow.attr({"stroke-dasharray": "- .", stroke: "pink", "stroke-width": 2});
-	}
-	arrow.mouseover(function(evt) {
-		t.attr({"font-size": 20});
-		arrow.attr({stroke: "red", "stroke-width": 3});
-	    });
-	arrow.mouseout(function(evt) {
-		t.attr({"font-size": 10});
-		
-		if (this.incomplete) {
-		    arrow.attr({stroke: "pink", "stroke-width": 2});
-		} else {
-		    arrow.attr({stroke: "gray", "stroke-width": 2});
-		}
-	    });
-	
-	
-
-	arrow.click(function(evt) { 
-		var popup = document.createElement("div");
-		popup.className = "popUp";
-		popup.innerHTML = "zxid: " + parseInt(this.zxid).toString(16);
-
-		popup.style.top = evt.clientY;
-		popup.style.left = evt.clientX;
-		document.body.appendChild(popup);
-
-		popup.onclick = function(evt) { 
-		    document.body.removeChild(popup);
-		};
-	    });
-    }
-};
-    
-LogGraph.ServerGraph.exception = function(graph, tick, exceptiontext, time) {
-    this.graph = graph;
-    this.time = time;
-    this.text = exceptiontext;
-    this.tick = tick;
-    
-    var self = this;
-
-    this.draw = function(paper, server) {
-	var center = this.graph.tick_to_x(this.tick);
-	var p = paper.circle(center, server.y, 5);
-	p.attr({stroke: "orange", fill: "red"});
-	
-	p.mouseover(function(evt) {
-		p.popup = document.createElement("div");
-		p.popup.className = "popUp";
-		p.popup.innerHTML = self.text.replace("\n", "<br/>");;
-		p.popup.style.top = server.y + 50;
-		p.popup.style.left = center + 25;
-		document.body.appendChild(p.popup);
-
-		p.animate({r: 10}, 500, "elastic");
-	    });
-	p.mouseout(function(evt) {
-		document.body.removeChild(p.popup);
-		p.animate({r: 5}, 100);
-	    });
-    }
-};
-    
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.session.js b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.session.js
deleted file mode 100644
index 5a314d8a120..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.session.js
+++ /dev/null
@@ -1,202 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-LogGraph.SessionGraph = function (asyncq, canvas, starttime, endtime, filter) {
-    this.sessions = new Array();
-    this.counter = 0;
-    this.exceptions = new Array();
-    
-    this.pix_per_ticks = 4;
-    this.pix_per_session = 7;
-
-    var paper = Raphael(canvas, 1, 1);
-    this.ticker = new LogGraph.ticker();
-    var self = this;
-
-    this.starttime = starttime;
-    this.endtime = endtime;
-    this.filter = filter;
-
-    this.findOrCreateSession = function(id) {
-	if (this.sessions[id] == undefined) {
-	    this.sessions[id] = new LogGraph.SessionGraph.session(this, ++this.counter, id);
-	}
-	return this.sessions[id];
-    }
-    
-    this.height = function () { return this.counter * this.pix_per_session + 10; };
-    this.width = function () { return (self.ticker.current() * this.pix_per_ticks); };
-
-    this.draw = function(paper) {
-	
-
-	var line = paper.path("M0 0 L0 " + this.height());	    
-	line.attr({"stroke": "red", "stroke-dasharray": "- "});
-	var base = canvas.offsetLeft;
-	var width = this.width();
-	canvas.onmousemove = function (evt) {
-	    var x = evt.clientX - base;
-
-	    line.attr({"path": "M" + x + " 0 L" + x + " " + self.height() });
-	};	
-	
-	for (var i in this.sessions) {
-	    var s = this.sessions[i];
-	    s.draw(paper);
-	}
-    };
-
-    var processdata = function(data) {
-	var count = 0;
-	for (var i in data.events) {
-	    var e = data.events[i];
-	    if (e.type == "transaction") {
-		e.tick = self.ticker.tick(e.time, true);
-		var session = self.findOrCreateSession(e.client);
-		session.addEvent(e);
-		count++;
-	    }
-	}
-	paper.setSize(self.width(), self.height());
-	
-	if (count != 0) {
-	    self.draw(paper);
-	    return true;
-	} else {
-	    return false;
-	}
-    };
-    
-    var uri = "/data?start=" + self.starttime + "&end=" + self.endtime + "&filter=" + filter;
-
-    LogGraph.loadData(asyncq, uri, processdata);    
-};
-
-LogGraph.SessionGraph.sessionevent = function () {
-    this.time = time;
-    this.type = type;
-    this.client = client;
-    this.cxid = cxid;
-    this.zxid = zxid;
-    this.op = op;
-    this.extra = extra;
-};
-
-LogGraph.SessionGraph.sessionEventPopup = function (obj, e, x, y) {
-    obj.click(function(evt) {
-	    var popup = document.createElement("div");
-	    popup.className = "popUp";
-
-	    var closebutton = document.createElement("div");
-	    closebutton.className = "closebutton";
-	    closebutton.title = "Close popup";
-	    closebutton.innerHTML = "&times;";
-	    popup.appendChild(closebutton);
-	    closebutton.onclick= function(evt) { popup.style.visibility = "hidden"; document.body.removeChild(popup) };
-	    var txt = document.createElement("span");
-	    txt.innerHTML = "session: " + e.client + "<br/>op: " + e.op + "<br/>zxid: " + e.zxid + "<br/>time: " + e.time + "<br/>extra: " + e.extra;
-	    popup.appendChild(txt);
-	    
-	    popup.style.top = y;
-	    popup.style.left = x;
-	    document.body.appendChild(popup);
-	    
-	    YUI().use('dd-drag', function(Y) {
-		    //Selector of the node to make draggable
-		    var dd = new Y.DD.Drag({
-			    node: popup
-			});   
-		});
-	});
-};
-    
-LogGraph.SessionGraph.session = function (graph, index, id) {
-    this.index = index;
-    this.id = id;
-    this.graph = graph;
-    
-    this.events = new Array();
-    this.starttick = 0;
-    this.endtick = undefined;
-    
-    this.addEvent = function(e) {
-	this.events.push(e);
-	
-	if (e.op == "createSession") {
-	    //		document.write("createSession for " + id.toString(16));
-	    this.starttick = e.tick;
-	} else if (e.op == "closeSession") {
-	    this.endtick = e.tick;
-	}
-    },
-    
-    this._attach_action = function (sess, label) {
-	sess.mouseover(function(evt) {
-		label.show();
-		sess.attr({stroke: "gray"});
-	    });
-	
-	sess.mouseout(function(evt) {
-		label.hide();
-		sess.attr({stroke: "black"});
-	    });
-    },
-    
-    this.drawEvent = function (paper, y, e) {
-	var x = e.tick * this.graph.pix_per_ticks;;
-	var s = paper.path("M" + x + " " + (y - 3) + " L" + x + " " + (y + 3));
-	s.attr({"stroke-width": 2});
-	if (e.op == "error") {
-	    s.attr({"stroke": "red"});
-	} 
-	s.mouseover(function(evt) {
-		s.attr({"stroke-width": 5});
-	    });
-	
-	s.mouseout(function(evt) {
-		s.attr({"stroke-width": 2});
-	    });
-	
-	LogGraph.SessionGraph.sessionEventPopup(s, e, x, y);
-    },
-    
-    this.draw = function(paper) {
-	var y = this.index*this.graph.pix_per_session;;
-	var start = this.starttick * this.graph.pix_per_ticks;
-	var end = this.endtick * this.graph.pix_per_ticks;
-	
-	var sess = paper.set();
-	
-	if (this.endtick == undefined) {
-	    end = this.graph.width();
-	} 
-
-	sess.push(paper.path("M" + start + " " + y + " L" + end + " " + y));
-	for (var i in this.events) {
-	    var e = this.events[i];
-	    this.drawEvent(paper, y, e);
-	}
-	
-	//sess.attr({"stroke-width": 3});
-	label = paper.text(start + 100, y, this.id);
-	label.attr({"font-size": "14px"});
-	label.hide();
-	this._attach_action(sess, label);
-    }
-};
-
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.stats.js b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.stats.js
deleted file mode 100644
index 0a8ac4fcce0..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.stats.js
+++ /dev/null
@@ -1,44 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-LogGraph.StatsGraph = function (asyncq, canvas, starttime, endtime, filter) {
-    var processdata = function(data) {
-	var r = Raphael(canvas);
-	var x = data.map(function (x) { return x.time; });
-	var y = data.map(function (x) { return x.count; });
-	var xlabels = data.map(function (x) { return dateFormat(x.time, "HH:MM:ss,l"); } );
-	var h1 = function () {
-	    this.tags = r.set();
-	    for (var i = 0, ii = this.y.length; i < ii; i++) {
-		this.tags.push(r.g.tag(this.x, this.y[i], this.values[i], 160, 10).insertBefore(this).attr([{fill: "#fff"}, {fill: this.symbols[i].attr("fill")}]));
-	    }
-	};
-	var h2 = function () {
-	    this.tags && this.tags.remove();
-	};
-	r.g.linechart(40, 40, 1000, 500,  x, y, {shade: true, axis: "0 0 1 1", symbol: "x", southlabels: xlabels, axisxstep: xlabels.length - 1 , westAxisLabel: "Write requests", southAxisLabel: "Time (min)"}).hoverColumn(h1, h2);
-
-	return true;
-	//r.g.barchart(0, 0, 1000, 100,  y, {shade: true, symbol: "x"}).hoverColumn(h1, h2);
-    };
-    
-    var uri = "/throughput?scale=minutes";
-    LogGraph.loadData(asyncq, uri, processdata);    
-};
-
-    
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.ui.js b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.ui.js
deleted file mode 100644
index 819765a3e4b..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/loggraph.ui.js
+++ /dev/null
@@ -1,377 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-// Opens a window to load files into the engine
-LogGraph.fileSelector = function(callback) {
-    var self = this;	
-    this.callback = callback;
-    this.selectedFiles = new Array();
-    
-    var divTag = document.createElement("div");
-    divTag.id = "fileSelector" + Math.round(Math.random()*100000);
-    //	divTag.className = "popUp";
-    divTag.className = "selector fileSelector";
-    document.body.appendChild(divTag);
-    
-    YUI().use('dd-drag', function(Y) {
-	    //Selector of the node to make draggable
-	    var dd = new Y.DD.Drag({
-			node: '#' + divTag.id
-		});   
-	});
-    
-    var list = document.createElement("ul");
-    divTag.appendChild(list);
-    var selectedList = document.createElement("selectedlist");
-    divTag.appendChild(selectedList);
-    
-    var clearanchor = document.createElement("span");
-    clearanchor.innerHTML = "Remove All";
-    clearanchor.className = "actionbutton";
-    clearanchor.style.cssFloat = "right";
-    clearanchor.onclick = function () {
-	self.selectedFiles = new Array();
-	self.updateSelectedList();
-    };
-    divTag.appendChild(clearanchor);
-    
-    var doneanchor = document.createElement("span");
-    doneanchor.innerHTML = "Process Files";
-    doneanchor.className = "actionbutton";
-    doneanchor.style.cssFloat = "left";
-    doneanchor.onclick = function () {
-	self.callback(self.selectedFiles);
-	document.body.removeChild(divTag);
-	delete divTag;
-    };
-    divTag.appendChild(doneanchor);
-    
-    var cancelanchor = document.createElement("span");
-    cancelanchor.innerHTML = "Cancel";
-    cancelanchor.className = "actionbutton";
-    cancelanchor.style.cssFloat = "left";
-    cancelanchor.onclick = function () {
-	document.body.removeChild(divTag);
-	delete divTag;
-    };
-    divTag.appendChild(cancelanchor);
-    
-    this.createFileListItem = function (file) {
-	var li = document.createElement("li");
-	var a = document.createElement("a");
-	if (file.type == "D") {
-	    a.innerHTML = file.file + "/";
-	    a.onclick = function () { self.updateList(file.path); };
-	} else {
-	    a.innerHTML = file.file;
-	    a.onclick = function () { self.addSelectedFile(file.path); };
-	}
-	
-	a.fullpath = file.path;;
-	li.appendChild(a);
-	return li;
-    };
-    
-    this.addSelectedFile = function (file) {
-	if (this.selectedFiles.indexOf(file) == -1) {
-	    this.selectedFiles.push(file);
-	    this.updateSelectedList();
-	}
-    };
-    
-    this.removeSelectedFile = function (file) {
-	this.selectedFiles = this.selectedFiles.filter(function(f) { return !(file == f); });
-	this.updateSelectedList();
-    };
-    
-    this.createSelectedListItem = function (file) {
-	var li = document.createElement("li");
-	var a = document.createElement("a");
-	li.className = "selectedFile";
-	a.onclick = function () { self.removeSelectedFile(file); };
-	a.innerHTML = file;
-	li.appendChild(a);
-	return li;
-    };
-    
-    this.updateSelectedList = function () {
-	while (selectedList.firstChild) { selectedList.removeChild(selectedList.firstChild); }
-	
-	for (var i in this.selectedFiles) {
-	    var f = this.selectedFiles[i];
-	    selectedList.appendChild(this.createSelectedListItem(f));
-	}
-    };
-    
-    this.updateList = function (base) {
-	while (list.firstChild) list.removeChild(list.firstChild);
-	
-	// Create a YUI instance using io-base module.
-	YUI().use("io-base", function(Y) {
-		var uri = "/fs?path=" + base;
-		
-		// Define a function to handle the response data.
-		function complete(id, o, args) {
-		    var id = id; // Transaction ID.
-		    var data = eval("(" + o.responseText + ")"); // Response data.
-		    var parts = base.split("/").slice(0,-1);
-		    var parent = ""
-			if (parts.length < 2) {
-			    parent = "/";
-			} else {
-			    parent = parts.join("/");
-			}
-		    if (base != "/") {
-			var li = self.createFileListItem({"file": "..", type: "D", path: parent});
-			list.appendChild(li);
-		    }
-		    for (var i in data) {
-			var f = data[i];
-			if (f.file[0] != '.') {
-			    var li = self.createFileListItem(f);
-			    list.appendChild(li);
-			}
-		    }
-		};
-		
-		Y.on('io:complete', complete, Y, []);
-		var request = Y.io(uri);
-	    });
-    };
-    
-    this.updateList("/");
-};
-
-// Open a window which loads files into the engine
-LogGraph.fileLoader = function(files) {
-    var div = document.createElement("div");
-    div.id = "fileLoader";
-    
-    var imgArray = new Array();
-    var pArray = new Array();
-    for (var index in files) {
-	var f = files[index];
-	var p = document.createElement("p");
-	var i = document.createElement("img");
-	i.src = "load.gif";
-	i.style.visibility = "hidden";
-	imgArray.push(i);
-	pArray.push(p);
-	var span = document.createElement("span");
-	span.innerHTML = f;
-	
-	p.appendChild(span);
-	p.appendChild(i);
-	
-	div.appendChild(p);
-    }
-    
-    var loadFile = function (index) {
-	// Create a YUI instance using io-base module.
-	YUI().use("io-base", function(Y) {
-		var file = files[index];
-		    var uri = "/loadfile?path=" + file;
-		imgArray[index].style.visibility = "visible";
-		
-		// Define a function to handle the response data.
-		function complete(id, o, args) {
-		    var id = id; // Transaction ID.
-			var data = eval("(" + o.responseText + ")"); // Response data.
-			if (data.status == "ERR") {
-			    var err = document.createElement("div");
-			    err.innerHTML = data.error;
-			    pArray[index].appendChild(err);
-			} else if (data.status == "OK") {
-			    var ok = document.createElement("div");
-			    ok.innerHTML = "OK";
-			    pArray[index].appendChild(ok);
-			}
-			
-			imgArray[index].style.visibility = "hidden";
-			if (index + 1 < files.length) {
-			    loadFile(index + 1);
-			} else {
-			    //alert("DONE");
-			}
-		};
-		
-		Y.on('io:complete', complete, Y, []);
-		var request = Y.io(uri);
-	    });
-    };
-	
-    var doneanchor = document.createElement("a");
-    doneanchor.className = "actionbutton";
-    doneanchor.innerHTML = "Done";
-    doneanchor.onclick = function () {
-	document.body.removeChild(div);
-	delete div;
-    };
-    
-    document.body.appendChild(div);
-    if (files.length > 0) {
-	loadFile(0);
-    } else {
-	div.innerHTML ="No files to load";
-    }
-    div.appendChild(doneanchor);
-}
-
-// select a time period
-LogGraph.filterSelector = function(starttime, period, filter, callback) {
-    var self = this;	
-    this.callback = callback;
-    
-    // Container other widgets will be in
-    var container = document.createElement("div");
-    container.id = "filterSelector" + Math.round(Math.random()*100000);
-    container.className = "selector filterSelector";
-    document.body.appendChild(container);
-    
-    YUI().use('dd-drag', function(Y) {
-	    //Selector of the node to make draggable
-	    var dd = new Y.DD.Drag({
-		    node: '#' + container.id
-		});   
-	});
-    
-    // Temporary loading screen
-    var loadingp = document.createElement("p");
-    loadingp.innerHTML = "Loading...";
-    var loadimg = document.createElement("img");
-    loadimg.src = "load.gif";
-    loadingp.appendChild(loadimg);
-    container.appendChild(loadingp);
-    
-    var addWithLabel = function (container, labeltxt, object) {
-	var p = document.createElement("p");
-	var label = document.createElement("label");
-	label.innerHTML = labeltxt + ":";
-	p.appendChild(label);
-	p.appendChild(object);
-	container.appendChild(p);
-    };
-    var draw = function(minstart, maxstart, entries) { 
-	container.removeChild(loadingp);
-	var inittime = minstart > starttime ? minstart : starttime;
-	
-	var numEntries = 0;
-	var startspan = document.createElement("span");
-	addWithLabel(container, "Start time", startspan);
-	var startinput = document.createElement("input");
-	startinput.type = "hidden";
-	startinput.value = inittime;
-	container.appendChild(startinput);
-	var sliderspan = document.createElement("span");
-	container.appendChild(sliderspan);
-	
-	var countspan = document.createElement("p");
-	countspan.innerHTML = entries + " entries";;
-	container.appendChild(countspan);
-	
-	var windowinput = document.createElement("input");
-	windowinput.type = "text";
-	windowinput.value = period;
-	addWithLabel(container, "Time window (ms)", windowinput);
-	
-	var filterinput = document.createElement("textarea");
-	filterinput.id = "filterinput";
-	filterinput.value = filter;
-	addWithLabel(container, "Filter", filterinput);
-
-	/* done link, when clicked time is updated, */
-	var doneanchor = document.createElement("a");
-	doneanchor.className = "actionbutton";
-	doneanchor.innerHTML = "Done";
-	doneanchor.onclick = function () {
-	    var start = parseInt(startinput.value);
-	    var period = parseInt(windowinput.value);
-	    var filter = filterinput.value;
-	    document.body.removeChild(container);
-	    delete container;
-	    
-	    update(start, period, filter, function() {
-		    callback(start, period, filter, numEntries);
-		});
-	};
-	container.appendChild(doneanchor);
-	
-	var update = function(start, period, filter, thenrun) {
-	    startspan.innerHTML = dateFormat(start, "HH:MM:ss,l");
-	    // get the min and max start time
-	    YUI().use("io-base", function(Y) {
-		    var uri = "/info?start=" + start + "&period=" + period + "&filter=" + filter;
-		    function complete(id, o, args) {
-			var data = eval("(" + o.responseText + ")"); 
-			countspan.innerHTML = data.numEntries + " entries";
-			numEntries = data.numEntries;
-			if (thenrun) {
-			    thenrun();
-			}
-		    };
-		    
-		    Y.on('io:complete', complete, Y, []);
-		    var request = Y.io(uri);
-		});
-	};
-	
-	var updatewindow = function(evt) {		
-	    var start = parseInt(startinput.value);
-	    var period = parseInt(windowinput.value);
-	    var filter = filterinput.value;
-	    update(start, period, filter);
-	};
-	windowinput.onkeyup = updatewindow;
-
-	
-	YUI().use("slider", function (Y) {
-		var input, slider; 
-		
-		function updateInput( e ) {
-		    this.set( "value", e.newVal );
-		    
-		    update(parseInt(startinput.value), parseInt(windowinput.value), filterinput.value);
-		}
-		
-		xSlider = new Y.Slider({min: minstart, max: maxstart, value: inittime, length: "1000px" });
-		
-		// Link the input value to the Slider
-		xInput = Y.one( startinput );
-		xInput.setData( { slider: xSlider } );
-		
-		// Pass the input as the 'this' object inside updateInput
-		xSlider.after( "valueChange", updateInput, xInput );
-		
-		// Render the Slider next to the input
-		xSlider.render(sliderspan);
-	    });
-	update(inittime, windowinput.value, filterinput);
-    };
-    
-    // get the min and max start time
-    YUI().use("io-base", function(Y) {
-	    var uri = "/info";
-	    function complete(id, o, args) {
-		var data = eval("(" + o.responseText + ")"); 
-		draw(data.startTime, data.endTime, data.numEntries);
-	    };
-	    
-	    Y.on('io:complete', complete, Y, []);
-	    var request = Y.io(uri);
-	});
-}
\ No newline at end of file
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/main.html b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/main.html
deleted file mode 100644
index b9affe66585..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/main.html
+++ /dev/null
@@ -1,60 +0,0 @@
-<!--
-   Licensed to the Apache Software Foundation (ASF) under one or more
-   contributor license agreements.  See the NOTICE file distributed with
-   this work for additional information regarding copyright ownership.
-   The ASF licenses this file to You under the Apache License, Version 2.0
-   (the "License"); you may not use this file except in compliance with
-   the License.  You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
--->
-<html>
-<head>
-<script src="raphael.js"></script>
-<script src="date.format.js"></script>
-<script src="loggraph.js"></script>
-<script src="loggraph.ui.js"></script>
-<script src="loggraph.log.js"></script>
-<script src="loggraph.server.js"></script>
-<script src="loggraph.stats.js"></script>
-<script src="loggraph.session.js"></script>
-
-<script src="g.raphael.js"></script>
-<script src="g.line.js"></script>
-<script src="g.pie.js"></script>
-<script src="g.bar.js"></script>
-
-<script type="text/javascript" src="yui-min.js"></script>
-
-<link rel="stylesheet" type="text/css" href="loggraph.css">
-<script>
-var g;
-function init() {
-     g = new LogGraph("canvas", "status");
-}
-</script>
-</head>
-<body onLoad="init()" class="yui3-skin-sam  yui-skin-sam">
-
-<div id="actions" class="maininterface">
-  <span onclick="javascript:g.editFilters()" class="actionbutton">Edit Filters</span> 
-  <span onclick="g.addLogs()" class="actionbutton">Add logs</span>
-</div>
-<div id="views" class="maininterface">
-  <span onclick="g.showLogs()" class="actionbutton">Log view</span>
-  <span onclick="g.serverGraph()" class="actionbutton">Servers view</span>
-  <span onclick="g.sessionGraph()" class="actionbutton">Sessions view</span> 
-  <span onclick="g.showStats()" class="actionbutton">Statistics</span>
-</div>
-  <div id="status"></div>
-<div id="outercontainer">
-<div id="canvas"></div>
-</div>
-</body>
-</html>
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/raphael.js b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/raphael.js
deleted file mode 100644
index 3740d0f02ad..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/raphael.js
+++ /dev/null
@@ -1,3296 +0,0 @@
-/*!
- * Raphael 1.3.2 - JavaScript Vector Library
- *
- * Copyright (c) 2009 Dmitry Baranovskiy (http://raphaeljs.com)
- * Licensed under the MIT (http://www.opensource.org/licenses/mit-license.php) license.
- */
- 
-Raphael = (function () {
-    var separator = /[, ]+/,
-        elements = /^(circle|rect|path|ellipse|text|image)$/,
-        proto = "prototype",
-        has = "hasOwnProperty",
-        doc = document,
-        win = window,
-        oldRaphael = {
-            was: Object[proto][has].call(win, "Raphael"),
-            is: win.Raphael
-        },
-        R = function () {
-            if (R.is(arguments[0], "array")) {
-                var a = arguments[0],
-                    cnv = create[apply](R, a.splice(0, 3 + R.is(a[0], nu))),
-                    res = cnv.set();
-                for (var i = 0, ii = a[length]; i < ii; i++) {
-                    var j = a[i] || {};
-                    elements.test(j.type) && res[push](cnv[j.type]().attr(j));
-                }
-                return res;
-            }
-            return create[apply](R, arguments);
-        },
-        Paper = function () {},
-        appendChild = "appendChild",
-        apply = "apply",
-        concat = "concat",
-        E = "",
-        S = " ",
-        split = "split",
-        events = "click dblclick mousedown mousemove mouseout mouseover mouseup"[split](S),
-        join = "join",
-        length = "length",
-        lowerCase = String[proto].toLowerCase,
-        math = Math,
-        mmax = math.max,
-        mmin = math.min,
-        nu = "number",
-        toString = "toString",
-        objectToString = Object[proto][toString],
-        paper = {},
-        pow = math.pow,
-        push = "push",
-        rg = /^(?=[\da-f]$)/,
-        ISURL = /^url\(['"]?([^\)]+?)['"]?\)$/i, //"
-        colourRegExp = /^\s*((#[a-f\d]{6})|(#[a-f\d]{3})|rgb\(\s*([\d\.]+\s*,\s*[\d\.]+\s*,\s*[\d\.]+)\s*\)|rgb\(\s*([\d\.]+%\s*,\s*[\d\.]+%\s*,\s*[\d\.]+%)\s*\)|hs[bl]\(\s*([\d\.]+\s*,\s*[\d\.]+\s*,\s*[\d\.]+)\s*\)|hs[bl]\(\s*([\d\.]+%\s*,\s*[\d\.]+%\s*,\s*[\d\.]+%)\s*\))\s*$/i,
-        round = math.round,
-        setAttribute = "setAttribute",
-        toFloat = parseFloat,
-        toInt = parseInt,
-        upperCase = String[proto].toUpperCase,
-        availableAttrs = {blur: 0, "clip-rect": "0 0 1e9 1e9", cursor: "default", cx: 0, cy: 0, fill: "#fff", "fill-opacity": 1, font: '10px "Arial"', "font-family": '"Arial"', "font-size": "10", "font-style": "normal", "font-weight": 400, gradient: 0, height: 0, href: "http://raphaeljs.com/", opacity: 1, path: "M0,0", r: 0, rotation: 0, rx: 0, ry: 0, scale: "1 1", src: "", stroke: "#000", "stroke-dasharray": "", "stroke-linecap": "butt", "stroke-linejoin": "butt", "stroke-miterlimit": 0, "stroke-opacity": 1, "stroke-width": 1, target: "_blank", "text-anchor": "middle", title: "Raphael", translation: "0 0", width: 0, x: 0, y: 0},
-        availableAnimAttrs = {along: "along", blur: nu, "clip-rect": "csv", cx: nu, cy: nu, fill: "colour", "fill-opacity": nu, "font-size": nu, height: nu, opacity: nu, path: "path", r: nu, rotation: "csv", rx: nu, ry: nu, scale: "csv", stroke: "colour", "stroke-opacity": nu, "stroke-width": nu, translation: "csv", width: nu, x: nu, y: nu},
-        rp = "replace";
-    R.version = "1.3.2";
-    R.type = (win.SVGAngle || doc.implementation.hasFeature("http://www.w3.org/TR/SVG11/feature#BasicStructure", "1.1") ? "SVG" : "VML");
-    if (R.type == "VML") {
-        var d = doc.createElement("div");
-        d.innerHTML = '<!--[if vml]><br><br><![endif]-->';
-        if (d.childNodes[length] != 2) {
-            return R.type = null;
-        }
-        d = null;
-    }
-    R.svg = !(R.vml = R.type == "VML");
-    Paper[proto] = R[proto];
-    R._id = 0;
-    R._oid = 0;
-    R.fn = {};
-    R.is = function (o, type) {
-        type = lowerCase.call(type);
-        return ((type == "object" || type == "undefined") && typeof o == type) || (o == null && type == "null") || lowerCase.call(objectToString.call(o).slice(8, -1)) == type;
-    };
-    R.setWindow = function (newwin) {
-        win = newwin;
-        doc = win.document;
-    };
-    // colour utilities
-    var toHex = function (color) {
-        if (R.vml) {
-            // http://dean.edwards.name/weblog/2009/10/convert-any-colour-value-to-hex-in-msie/
-            var trim = /^\s+|\s+$/g;
-            toHex = cacher(function (color) {
-                var bod;
-                color = (color + E)[rp](trim, E);
-                try {
-                    var docum = new win.ActiveXObject("htmlfile");
-                    docum.write("<body>");
-                    docum.close();
-                    bod = docum.body;
-                } catch(e) {
-                    bod = win.createPopup().document.body;
-                }
-                var range = bod.createTextRange();
-                try {
-                    bod.style.color = color;
-                    var value = range.queryCommandValue("ForeColor");
-                    value = ((value & 255) << 16) | (value & 65280) | ((value & 16711680) >>> 16);
-                    return "#" + ("000000" + value[toString](16)).slice(-6);
-                } catch(e) {
-                    return "none";
-                }
-            });
-        } else {
-            var i = doc.createElement("i");
-            i.title = "Rapha\xebl Colour Picker";
-            i.style.display = "none";
-            doc.body[appendChild](i);
-            toHex = cacher(function (color) {
-                i.style.color = color;
-                return doc.defaultView.getComputedStyle(i, E).getPropertyValue("color");
-            });
-        }
-        return toHex(color);
-    };
-    var hsbtoString = function () {
-        return "hsb(" + [this.h, this.s, this.b] + ")";
-    },
-    rgbtoString = function () {
-        return this.hex;
-    };
-    R.hsb2rgb = cacher(function (hue, saturation, brightness) {
-        if (R.is(hue, "object") && "h" in hue && "s" in hue && "b" in hue) {
-            brightness = hue.b;
-            saturation = hue.s;
-            hue = hue.h;
-        }
-        var red,
-            green,
-            blue;
-        if (brightness == 0) {
-            return {r: 0, g: 0, b: 0, hex: "#000"};
-        }
-        if (hue > 1 || saturation > 1 || brightness > 1) {
-            hue /= 255;
-            saturation /= 255;
-            brightness /= 255;
-        }
-        var i = ~~(hue * 6),
-            f = (hue * 6) - i,
-            p = brightness * (1 - saturation),
-            q = brightness * (1 - (saturation * f)),
-            t = brightness * (1 - (saturation * (1 - f)));
-        red = [brightness, q, p, p, t, brightness, brightness][i];
-        green = [t, brightness, brightness, q, p, p, t][i];
-        blue = [p, p, t, brightness, brightness, q, p][i];
-        red *= 255;
-        green *= 255;
-        blue *= 255;
-        var rgb = {r: red, g: green, b: blue, toString: rgbtoString},
-            r = (~~red)[toString](16),
-            g = (~~green)[toString](16),
-            b = (~~blue)[toString](16);
-        r = r[rp](rg, "0");
-        g = g[rp](rg, "0");
-        b = b[rp](rg, "0");
-        rgb.hex = "#" + r + g + b;
-        return rgb;
-    }, R);
-    R.rgb2hsb = cacher(function (red, green, blue) {
-        if (R.is(red, "object") && "r" in red && "g" in red && "b" in red) {
-            blue = red.b;
-            green = red.g;
-            red = red.r;
-        }
-        if (R.is(red, "string")) {
-            var clr = R.getRGB(red);
-            red = clr.r;
-            green = clr.g;
-            blue = clr.b;
-        }
-        if (red > 1 || green > 1 || blue > 1) {
-            red /= 255;
-            green /= 255;
-            blue /= 255;
-        }
-        var max = mmax(red, green, blue),
-            min = mmin(red, green, blue),
-            hue,
-            saturation,
-            brightness = max;
-        if (min == max) {
-            return {h: 0, s: 0, b: max};
-        } else {
-            var delta = (max - min);
-            saturation = delta / max;
-            if (red == max) {
-                hue = (green - blue) / delta;
-            } else if (green == max) {
-                hue = 2 + ((blue - red) / delta);
-            } else {
-                hue = 4 + ((red - green) / delta);
-            }
-            hue /= 6;
-            hue < 0 && hue++;
-            hue > 1 && hue--;
-        }
-        return {h: hue, s: saturation, b: brightness, toString: hsbtoString};
-    }, R);
-    var p2s = /,?([achlmqrstvxz]),?/gi;
-    R._path2string = function () {
-        return this.join(",")[rp](p2s, "$1");
-    };
-    function cacher(f, scope, postprocessor) {
-        function newf() {
-            var arg = Array[proto].slice.call(arguments, 0),
-                args = arg[join]("\u25ba"),
-                cache = newf.cache = newf.cache || {},
-                count = newf.count = newf.count || [];
-            if (cache[has](args)) {
-                return postprocessor ? postprocessor(cache[args]) : cache[args];
-            }
-            count[length] >= 1e3 && delete cache[count.shift()];
-            count[push](args);
-            cache[args] = f[apply](scope, arg);
-            return postprocessor ? postprocessor(cache[args]) : cache[args];
-        }
-        return newf;
-    }
- 
-    R.getRGB = cacher(function (colour) {
-        if (!colour || !!((colour = colour + E).indexOf("-") + 1)) {
-            return {r: -1, g: -1, b: -1, hex: "none", error: 1};
-        }
-        if (colour == "none") {
-            return {r: -1, g: -1, b: -1, hex: "none"};
-        }
-        !(({hs: 1, rg: 1})[has](colour.substring(0, 2)) || colour.charAt() == "#") && (colour = toHex(colour));
-        var res,
-            red,
-            green,
-            blue,
-            t,
-            rgb = colour.match(colourRegExp);
-        if (rgb) {
-            if (rgb[2]) {
-                blue = toInt(rgb[2].substring(5), 16);
-                green = toInt(rgb[2].substring(3, 5), 16);
-                red = toInt(rgb[2].substring(1, 3), 16);
-            }
-            if (rgb[3]) {
-                blue = toInt((t = rgb[3].charAt(3)) + t, 16);
-                green = toInt((t = rgb[3].charAt(2)) + t, 16);
-                red = toInt((t = rgb[3].charAt(1)) + t, 16);
-            }
-            if (rgb[4]) {
-                rgb = rgb[4][split](/\s*,\s*/);
-                red = toFloat(rgb[0]);
-                green = toFloat(rgb[1]);
-                blue = toFloat(rgb[2]);
-            }
-            if (rgb[5]) {
-                rgb = rgb[5][split](/\s*,\s*/);
-                red = toFloat(rgb[0]) * 2.55;
-                green = toFloat(rgb[1]) * 2.55;
-                blue = toFloat(rgb[2]) * 2.55;
-            }
-            if (rgb[6]) {
-                rgb = rgb[6][split](/\s*,\s*/);
-                red = toFloat(rgb[0]);
-                green = toFloat(rgb[1]);
-                blue = toFloat(rgb[2]);
-                return R.hsb2rgb(red, green, blue);
-            }
-            if (rgb[7]) {
-                rgb = rgb[7][split](/\s*,\s*/);
-                red = toFloat(rgb[0]) * 2.55;
-                green = toFloat(rgb[1]) * 2.55;
-                blue = toFloat(rgb[2]) * 2.55;
-                return R.hsb2rgb(red, green, blue);
-            }
-            rgb = {r: red, g: green, b: blue};
-            var r = (~~red)[toString](16),
-                g = (~~green)[toString](16),
-                b = (~~blue)[toString](16);
-            r = r[rp](rg, "0");
-            g = g[rp](rg, "0");
-            b = b[rp](rg, "0");
-            rgb.hex = "#" + r + g + b;
-            return rgb;
-        }
-        return {r: -1, g: -1, b: -1, hex: "none", error: 1};
-    }, R);
-    R.getColor = function (value) {
-        var start = this.getColor.start = this.getColor.start || {h: 0, s: 1, b: value || .75},
-            rgb = this.hsb2rgb(start.h, start.s, start.b);
-        start.h += .075;
-        if (start.h > 1) {
-            start.h = 0;
-            start.s -= .2;
-            start.s <= 0 && (this.getColor.start = {h: 0, s: 1, b: start.b});
-        }
-        return rgb.hex;
-    };
-    R.getColor.reset = function () {
-        delete this.start;
-    };
-    // path utilities
-    var pathCommand = /([achlmqstvz])[\s,]*((-?\d*\.?\d*(?:e[-+]?\d+)?\s*,?\s*)+)/ig,
-        pathValues = /(-?\d*\.?\d*(?:e[-+]?\d+)?)\s*,?\s*/ig;
-    R.parsePathString = cacher(function (pathString) {
-        if (!pathString) {
-            return null;
-        }
-        var paramCounts = {a: 7, c: 6, h: 1, l: 2, m: 2, q: 4, s: 4, t: 2, v: 1, z: 0},
-            data = [];
-        if (R.is(pathString, "array") && R.is(pathString[0], "array")) { // rough assumption
-            data = pathClone(pathString);
-        }
-        if (!data[length]) {
-            (pathString + E)[rp](pathCommand, function (a, b, c) {
-                var params = [],
-                    name = lowerCase.call(b);
-                c[rp](pathValues, function (a, b) {
-                    b && params[push](+b);
-                });
-                if (name == "m" && params[length] > 2) {
-                    data[push]([b][concat](params.splice(0, 2)));
-                    name = "l";
-                    b = b == "m" ? "l" : "L";
-                }
-                while (params[length] >= paramCounts[name]) {
-                    data[push]([b][concat](params.splice(0, paramCounts[name])));
-                    if (!paramCounts[name]) {
-                        break;
-                    }
-                }
-            });
-        }
-        data[toString] = R._path2string;
-        return data;
-    });
-    R.findDotsAtSegment = function (p1x, p1y, c1x, c1y, c2x, c2y, p2x, p2y, t) {
-        var t1 = 1 - t,
-            x = pow(t1, 3) * p1x + pow(t1, 2) * 3 * t * c1x + t1 * 3 * t * t * c2x + pow(t, 3) * p2x,
-            y = pow(t1, 3) * p1y + pow(t1, 2) * 3 * t * c1y + t1 * 3 * t * t * c2y + pow(t, 3) * p2y,
-            mx = p1x + 2 * t * (c1x - p1x) + t * t * (c2x - 2 * c1x + p1x),
-            my = p1y + 2 * t * (c1y - p1y) + t * t * (c2y - 2 * c1y + p1y),
-            nx = c1x + 2 * t * (c2x - c1x) + t * t * (p2x - 2 * c2x + c1x),
-            ny = c1y + 2 * t * (c2y - c1y) + t * t * (p2y - 2 * c2y + c1y),
-            ax = (1 - t) * p1x + t * c1x,
-            ay = (1 - t) * p1y + t * c1y,
-            cx = (1 - t) * c2x + t * p2x,
-            cy = (1 - t) * c2y + t * p2y,
-            alpha = (90 - math.atan((mx - nx) / (my - ny)) * 180 / math.PI);
-        (mx > nx || my < ny) && (alpha += 180);
-        return {x: x, y: y, m: {x: mx, y: my}, n: {x: nx, y: ny}, start: {x: ax, y: ay}, end: {x: cx, y: cy}, alpha: alpha};
-    };
-    var pathDimensions = cacher(function (path) {
-        if (!path) {
-            return {x: 0, y: 0, width: 0, height: 0};
-        }
-        path = path2curve(path);
-        var x = 0, 
-            y = 0,
-            X = [],
-            Y = [],
-            p;
-        for (var i = 0, ii = path[length]; i < ii; i++) {
-            p = path[i];
-            if (p[0] == "M") {
-                x = p[1];
-                y = p[2];
-                X[push](x);
-                Y[push](y);
-            } else {
-                var dim = curveDim(x, y, p[1], p[2], p[3], p[4], p[5], p[6]);
-                X = X[concat](dim.min.x, dim.max.x);
-                Y = Y[concat](dim.min.y, dim.max.y);
-                x = p[5];
-                y = p[6];
-            }
-        }
-        var xmin = mmin[apply](0, X),
-            ymin = mmin[apply](0, Y);
-        return {
-            x: xmin,
-            y: ymin,
-            width: mmax[apply](0, X) - xmin,
-            height: mmax[apply](0, Y) - ymin
-        };
-    }),
-        pathClone = function (pathArray) {
-            var res = [];
-            if (!R.is(pathArray, "array") || !R.is(pathArray && pathArray[0], "array")) { // rough assumption
-                pathArray = R.parsePathString(pathArray);
-            }
-            for (var i = 0, ii = pathArray[length]; i < ii; i++) {
-                res[i] = [];
-                for (var j = 0, jj = pathArray[i][length]; j < jj; j++) {
-                    res[i][j] = pathArray[i][j];
-                }
-            }
-            res[toString] = R._path2string;
-            return res;
-        },
-        pathToRelative = cacher(function (pathArray) {
-            if (!R.is(pathArray, "array") || !R.is(pathArray && pathArray[0], "array")) { // rough assumption
-                pathArray = R.parsePathString(pathArray);
-            }
-            var res = [],
-                x = 0,
-                y = 0,
-                mx = 0,
-                my = 0,
-                start = 0;
-            if (pathArray[0][0] == "M") {
-                x = pathArray[0][1];
-                y = pathArray[0][2];
-                mx = x;
-                my = y;
-                start++;
-                res[push](["M", x, y]);
-            }
-            for (var i = start, ii = pathArray[length]; i < ii; i++) {
-                var r = res[i] = [],
-                    pa = pathArray[i];
-                if (pa[0] != lowerCase.call(pa[0])) {
-                    r[0] = lowerCase.call(pa[0]);
-                    switch (r[0]) {
-                        case "a":
-                            r[1] = pa[1];
-                            r[2] = pa[2];
-                            r[3] = pa[3];
-                            r[4] = pa[4];
-                            r[5] = pa[5];
-                            r[6] = +(pa[6] - x).toFixed(3);
-                            r[7] = +(pa[7] - y).toFixed(3);
-                            break;
-                        case "v":
-                            r[1] = +(pa[1] - y).toFixed(3);
-                            break;
-                        case "m":
-                            mx = pa[1];
-                            my = pa[2];
-                        default:
-                            for (var j = 1, jj = pa[length]; j < jj; j++) {
-                                r[j] = +(pa[j] - ((j % 2) ? x : y)).toFixed(3);
-                            }
-                    }
-                } else {
-                    r = res[i] = [];
-                    if (pa[0] == "m") {
-                        mx = pa[1] + x;
-                        my = pa[2] + y;
-                    }
-                    for (var k = 0, kk = pa[length]; k < kk; k++) {
-                        res[i][k] = pa[k];
-                    }
-                }
-                var len = res[i][length];
-                switch (res[i][0]) {
-                    case "z":
-                        x = mx;
-                        y = my;
-                        break;
-                    case "h":
-                        x += +res[i][len - 1];
-                        break;
-                    case "v":
-                        y += +res[i][len - 1];
-                        break;
-                    default:
-                        x += +res[i][len - 2];
-                        y += +res[i][len - 1];
-                }
-            }
-            res[toString] = R._path2string;
-            return res;
-        }, 0, pathClone),
-        pathToAbsolute = cacher(function (pathArray) {
-            if (!R.is(pathArray, "array") || !R.is(pathArray && pathArray[0], "array")) { // rough assumption
-                pathArray = R.parsePathString(pathArray);
-            }
-            var res = [],
-                x = 0,
-                y = 0,
-                mx = 0,
-                my = 0,
-                start = 0;
-            if (pathArray[0][0] == "M") {
-                x = +pathArray[0][1];
-                y = +pathArray[0][2];
-                mx = x;
-                my = y;
-                start++;
-                res[0] = ["M", x, y];
-            }
-            for (var i = start, ii = pathArray[length]; i < ii; i++) {
-                var r = res[i] = [],
-                    pa = pathArray[i];
-                if (pa[0] != upperCase.call(pa[0])) {
-                    r[0] = upperCase.call(pa[0]);
-                    switch (r[0]) {
-                        case "A":
-                            r[1] = pa[1];
-                            r[2] = pa[2];
-                            r[3] = pa[3];
-                            r[4] = pa[4];
-                            r[5] = pa[5];
-                            r[6] = +(pa[6] + x);
-                            r[7] = +(pa[7] + y);
-                            break;
-                        case "V":
-                            r[1] = +pa[1] + y;
-                            break;
-                        case "H":
-                            r[1] = +pa[1] + x;
-                            break;
-                        case "M":
-                            mx = +pa[1] + x;
-                            my = +pa[2] + y;
-                        default:
-                            for (var j = 1, jj = pa[length]; j < jj; j++) {
-                                r[j] = +pa[j] + ((j % 2) ? x : y);
-                            }
-                    }
-                } else {
-                    for (var k = 0, kk = pa[length]; k < kk; k++) {
-                        res[i][k] = pa[k];
-                    }
-                }
-                switch (r[0]) {
-                    case "Z":
-                        x = mx;
-                        y = my;
-                        break;
-                    case "H":
-                        x = r[1];
-                        break;
-                    case "V":
-                        y = r[1];
-                        break;
-                    default:
-                        x = res[i][res[i][length] - 2];
-                        y = res[i][res[i][length] - 1];
-                }
-            }
-            res[toString] = R._path2string;
-            return res;
-        }, null, pathClone),
-        l2c = function (x1, y1, x2, y2) {
-            return [x1, y1, x2, y2, x2, y2];
-        },
-        q2c = function (x1, y1, ax, ay, x2, y2) {
-            var _13 = 1 / 3,
-                _23 = 2 / 3;
-            return [
-                    _13 * x1 + _23 * ax,
-                    _13 * y1 + _23 * ay,
-                    _13 * x2 + _23 * ax,
-                    _13 * y2 + _23 * ay,
-                    x2,
-                    y2
-                ];
-        },
-        a2c = function (x1, y1, rx, ry, angle, large_arc_flag, sweep_flag, x2, y2, recursive) {
-            // for more information of where this math came from visit:
-            // http://www.w3.org/TR/SVG11/implnote.html#ArcImplementationNotes
-            var PI = math.PI,
-                _120 = PI * 120 / 180,
-                rad = PI / 180 * (+angle || 0),
-                res = [],
-                xy,
-                rotate = cacher(function (x, y, rad) {
-                    var X = x * math.cos(rad) - y * math.sin(rad),
-                        Y = x * math.sin(rad) + y * math.cos(rad);
-                    return {x: X, y: Y};
-                });
-            if (!recursive) {
-                xy = rotate(x1, y1, -rad);
-                x1 = xy.x;
-                y1 = xy.y;
-                xy = rotate(x2, y2, -rad);
-                x2 = xy.x;
-                y2 = xy.y;
-                var cos = math.cos(PI / 180 * angle),
-                    sin = math.sin(PI / 180 * angle),
-                    x = (x1 - x2) / 2,
-                    y = (y1 - y2) / 2;
-                // rx = mmax(rx, math.abs(x));
-                // ry = mmax(ry, math.abs(y));
-                var h = (x * x) / (rx * rx) + (y * y) / (ry * ry);
-                if (h > 1) {
-                    h = math.sqrt(h);
-                    rx = h * rx;
-                    ry = h * ry;
-                }
-                var rx2 = rx * rx,
-                    ry2 = ry * ry,
-                    k = (large_arc_flag == sweep_flag ? -1 : 1) *
-                        math.sqrt(math.abs((rx2 * ry2 - rx2 * y * y - ry2 * x * x) / (rx2 * y * y + ry2 * x * x))),
-                    cx = k * rx * y / ry + (x1 + x2) / 2,
-                    cy = k * -ry * x / rx + (y1 + y2) / 2,
-                    f1 = math.asin(((y1 - cy) / ry).toFixed(7)),
-                    f2 = math.asin(((y2 - cy) / ry).toFixed(7));
-
-                f1 = x1 < cx ? PI - f1 : f1;
-                f2 = x2 < cx ? PI - f2 : f2;
-                f1 < 0 && (f1 = PI * 2 + f1);
-                f2 < 0 && (f2 = PI * 2 + f2);
-                if (sweep_flag && f1 > f2) {
-                    f1 = f1 - PI * 2;
-                }
-                if (!sweep_flag && f2 > f1) {
-                    f2 = f2 - PI * 2;
-                }
-            } else {
-                f1 = recursive[0];
-                f2 = recursive[1];
-                cx = recursive[2];
-                cy = recursive[3];
-            }
-            var df = f2 - f1;
-            if (math.abs(df) > _120) {
-                var f2old = f2,
-                    x2old = x2,
-                    y2old = y2;
-                f2 = f1 + _120 * (sweep_flag && f2 > f1 ? 1 : -1);
-                x2 = cx + rx * math.cos(f2);
-                y2 = cy + ry * math.sin(f2);
-                res = a2c(x2, y2, rx, ry, angle, 0, sweep_flag, x2old, y2old, [f2, f2old, cx, cy]);
-            }
-            df = f2 - f1;
-            var c1 = math.cos(f1),
-                s1 = math.sin(f1),
-                c2 = math.cos(f2),
-                s2 = math.sin(f2),
-                t = math.tan(df / 4),
-                hx = 4 / 3 * rx * t,
-                hy = 4 / 3 * ry * t,
-                m1 = [x1, y1],
-                m2 = [x1 + hx * s1, y1 - hy * c1],
-                m3 = [x2 + hx * s2, y2 - hy * c2],
-                m4 = [x2, y2];
-            m2[0] = 2 * m1[0] - m2[0];
-            m2[1] = 2 * m1[1] - m2[1];
-            if (recursive) {
-                return [m2, m3, m4][concat](res);
-            } else {
-                res = [m2, m3, m4][concat](res)[join]()[split](",");
-                var newres = [];
-                for (var i = 0, ii = res[length]; i < ii; i++) {
-                    newres[i] = i % 2 ? rotate(res[i - 1], res[i], rad).y : rotate(res[i], res[i + 1], rad).x;
-                }
-                // alert(newres);
-                return newres;
-            }
-        },
-        findDotAtSegment = function (p1x, p1y, c1x, c1y, c2x, c2y, p2x, p2y, t) {
-            var t1 = 1 - t;
-            return {
-                x: pow(t1, 3) * p1x + pow(t1, 2) * 3 * t * c1x + t1 * 3 * t * t * c2x + pow(t, 3) * p2x,
-                y: pow(t1, 3) * p1y + pow(t1, 2) * 3 * t * c1y + t1 * 3 * t * t * c2y + pow(t, 3) * p2y
-            };
-        },
-        curveDim = cacher(function (p1x, p1y, c1x, c1y, c2x, c2y, p2x, p2y) {
-            var a = (c2x - 2 * c1x + p1x) - (p2x - 2 * c2x + c1x),
-                b = 2 * (c1x - p1x) - 2 * (c2x - c1x),
-                c = p1x - c1x,
-                t1 = (-b + math.sqrt(b * b - 4 * a * c)) / 2 / a,
-                t2 = (-b - math.sqrt(b * b - 4 * a * c)) / 2 / a,
-                y = [p1y, p2y],
-                x = [p1x, p2x],
-                dot;
-            math.abs(t1) > 1e12 && (t1 = .5);
-            math.abs(t2) > 1e12 && (t2 = .5);
-            if (t1 > 0 && t1 < 1) {
-                dot = findDotAtSegment(p1x, p1y, c1x, c1y, c2x, c2y, p2x, p2y, t1);
-                x[push](dot.x);
-                y[push](dot.y);
-            }
-            if (t2 > 0 && t2 < 1) {
-                dot = findDotAtSegment(p1x, p1y, c1x, c1y, c2x, c2y, p2x, p2y, t2);
-                x[push](dot.x);
-                y[push](dot.y);
-            }
-            a = (c2y - 2 * c1y + p1y) - (p2y - 2 * c2y + c1y);
-            b = 2 * (c1y - p1y) - 2 * (c2y - c1y);
-            c = p1y - c1y;
-            t1 = (-b + math.sqrt(b * b - 4 * a * c)) / 2 / a;
-            t2 = (-b - math.sqrt(b * b - 4 * a * c)) / 2 / a;
-            math.abs(t1) > 1e12 && (t1 = .5);
-            math.abs(t2) > 1e12 && (t2 = .5);
-            if (t1 > 0 && t1 < 1) {
-                dot = findDotAtSegment(p1x, p1y, c1x, c1y, c2x, c2y, p2x, p2y, t1);
-                x[push](dot.x);
-                y[push](dot.y);
-            }
-            if (t2 > 0 && t2 < 1) {
-                dot = findDotAtSegment(p1x, p1y, c1x, c1y, c2x, c2y, p2x, p2y, t2);
-                x[push](dot.x);
-                y[push](dot.y);
-            }
-            return {
-                min: {x: mmin[apply](0, x), y: mmin[apply](0, y)},
-                max: {x: mmax[apply](0, x), y: mmax[apply](0, y)}
-            };
-        }),
-        path2curve = cacher(function (path, path2) {
-            var p = pathToAbsolute(path),
-                p2 = path2 && pathToAbsolute(path2),
-                attrs = {x: 0, y: 0, bx: 0, by: 0, X: 0, Y: 0, qx: null, qy: null},
-                attrs2 = {x: 0, y: 0, bx: 0, by: 0, X: 0, Y: 0, qx: null, qy: null},
-                processPath = function (path, d) {
-                    var nx, ny;
-                    if (!path) {
-                        return ["C", d.x, d.y, d.x, d.y, d.x, d.y];
-                    }
-                    !(path[0] in {T:1, Q:1}) && (d.qx = d.qy = null);
-                    switch (path[0]) {
-                        case "M":
-                            d.X = path[1];
-                            d.Y = path[2];
-                            break;
-                        case "A":
-                            path = ["C"][concat](a2c[apply](0, [d.x, d.y][concat](path.slice(1))));
-                            break;
-                        case "S":
-                            nx = d.x + (d.x - (d.bx || d.x));
-                            ny = d.y + (d.y - (d.by || d.y));
-                            path = ["C", nx, ny][concat](path.slice(1));
-                            break;
-                        case "T":
-                            d.qx = d.x + (d.x - (d.qx || d.x));
-                            d.qy = d.y + (d.y - (d.qy || d.y));
-                            path = ["C"][concat](q2c(d.x, d.y, d.qx, d.qy, path[1], path[2]));
-                            break;
-                        case "Q":
-                            d.qx = path[1];
-                            d.qy = path[2];
-                            path = ["C"][concat](q2c(d.x, d.y, path[1], path[2], path[3], path[4]));
-                            break;
-                        case "L":
-                            path = ["C"][concat](l2c(d.x, d.y, path[1], path[2]));
-                            break;
-                        case "H":
-                            path = ["C"][concat](l2c(d.x, d.y, path[1], d.y));
-                            break;
-                        case "V":
-                            path = ["C"][concat](l2c(d.x, d.y, d.x, path[1]));
-                            break;
-                        case "Z":
-                            path = ["C"][concat](l2c(d.x, d.y, d.X, d.Y));
-                            break;
-                    }
-                    return path;
-                },
-                fixArc = function (pp, i) {
-                    if (pp[i][length] > 7) {
-                        pp[i].shift();
-                        var pi = pp[i];
-                        while (pi[length]) {
-                            pp.splice(i++, 0, ["C"][concat](pi.splice(0, 6)));
-                        }
-                        pp.splice(i, 1);
-                        ii = mmax(p[length], p2 && p2[length] || 0);
-                    }
-                },
-                fixM = function (path1, path2, a1, a2, i) {
-                    if (path1 && path2 && path1[i][0] == "M" && path2[i][0] != "M") {
-                        path2.splice(i, 0, ["M", a2.x, a2.y]);
-                        a1.bx = 0;
-                        a1.by = 0;
-                        a1.x = path1[i][1];
-                        a1.y = path1[i][2];
-                        ii = mmax(p[length], p2 && p2[length] || 0);
-                    }
-                };
-            for (var i = 0, ii = mmax(p[length], p2 && p2[length] || 0); i < ii; i++) {
-                p[i] = processPath(p[i], attrs);
-                fixArc(p, i);
-                p2 && (p2[i] = processPath(p2[i], attrs2));
-                p2 && fixArc(p2, i);
-                fixM(p, p2, attrs, attrs2, i);
-                fixM(p2, p, attrs2, attrs, i);
-                var seg = p[i],
-                    seg2 = p2 && p2[i],
-                    seglen = seg[length],
-                    seg2len = p2 && seg2[length];
-                attrs.x = seg[seglen - 2];
-                attrs.y = seg[seglen - 1];
-                attrs.bx = toFloat(seg[seglen - 4]) || attrs.x;
-                attrs.by = toFloat(seg[seglen - 3]) || attrs.y;
-                attrs2.bx = p2 && (toFloat(seg2[seg2len - 4]) || attrs2.x);
-                attrs2.by = p2 && (toFloat(seg2[seg2len - 3]) || attrs2.y);
-                attrs2.x = p2 && seg2[seg2len - 2];
-                attrs2.y = p2 && seg2[seg2len - 1];
-            }
-            return p2 ? [p, p2] : p;
-        }, null, pathClone),
-        parseDots = cacher(function (gradient) {
-            var dots = [];
-            for (var i = 0, ii = gradient[length]; i < ii; i++) {
-                var dot = {},
-                    par = gradient[i].match(/^([^:]*):?([\d\.]*)/);
-                dot.color = R.getRGB(par[1]);
-                if (dot.color.error) {
-                    return null;
-                }
-                dot.color = dot.color.hex;
-                par[2] && (dot.offset = par[2] + "%");
-                dots[push](dot);
-            }
-            for (i = 1, ii = dots[length] - 1; i < ii; i++) {
-                if (!dots[i].offset) {
-                    var start = toFloat(dots[i - 1].offset || 0),
-                        end = 0;
-                    for (var j = i + 1; j < ii; j++) {
-                        if (dots[j].offset) {
-                            end = dots[j].offset;
-                            break;
-                        }
-                    }
-                    if (!end) {
-                        end = 100;
-                        j = ii;
-                    }
-                    end = toFloat(end);
-                    var d = (end - start) / (j - i + 1);
-                    for (; i < j; i++) {
-                        start += d;
-                        dots[i].offset = start + "%";
-                    }
-                }
-            }
-            return dots;
-        }),
-        getContainer = function (x, y, w, h) {
-            var container;
-            if (R.is(x, "string") || R.is(x, "object")) {
-                container = R.is(x, "string") ? doc.getElementById(x) : x;
-                if (container.tagName) {
-                    if (y == null) {
-                        return {
-                            container: container,
-                            width: container.style.pixelWidth || container.offsetWidth,
-                            height: container.style.pixelHeight || container.offsetHeight
-                        };
-                    } else {
-                        return {container: container, width: y, height: w};
-                    }
-                }
-            } else if (R.is(x, nu) && h != null) {
-                return {container: 1, x: x, y: y, width: w, height: h};
-            }
-        },
-        plugins = function (con, add) {
-            var that = this;
-            for (var prop in add) {
-                if (add[has](prop) && !(prop in con)) {
-                    switch (typeof add[prop]) {
-                        case "function":
-                            (function (f) {
-                                con[prop] = con === that ? f : function () { return f[apply](that, arguments); };
-                            })(add[prop]);
-                        break;
-                        case "object":
-                            con[prop] = con[prop] || {};
-                            plugins.call(this, con[prop], add[prop]);
-                        break;
-                        default:
-                            con[prop] = add[prop];
-                        break;
-                    }
-                }
-            }
-        },
-        tear = function (el, paper) {
-            el == paper.top && (paper.top = el.prev);
-            el == paper.bottom && (paper.bottom = el.next);
-            el.next && (el.next.prev = el.prev);
-            el.prev && (el.prev.next = el.next);
-        },
-        tofront = function (el, paper) {
-            if (paper.top === el) {
-                return;
-            }
-            tear(el, paper);
-            el.next = null;
-            el.prev = paper.top;
-            paper.top.next = el;
-            paper.top = el;
-        },
-        toback = function (el, paper) {
-            if (paper.bottom === el) {
-                return;
-            }
-            tear(el, paper);
-            el.next = paper.bottom;
-            el.prev = null;
-            paper.bottom.prev = el;
-            paper.bottom = el;
-        },
-        insertafter = function (el, el2, paper) {
-            tear(el, paper);
-            el2 == paper.top && (paper.top = el);
-            el2.next && (el2.next.prev = el);
-            el.next = el2.next;
-            el.prev = el2;
-            el2.next = el;
-        },
-        insertbefore = function (el, el2, paper) {
-            tear(el, paper);
-            el2 == paper.bottom && (paper.bottom = el);
-            el2.prev && (el2.prev.next = el);
-            el.prev = el2.prev;
-            el2.prev = el;
-            el.next = el2;
-        },
-        removed = function (methodname) {
-            return function () {
-                throw new Error("Rapha\xebl: you are calling to method \u201c" + methodname + "\u201d of removed object");
-            };
-        },
-        radial_gradient = /^r(?:\(([^,]+?)\s*,\s*([^\)]+?)\))?/;
- 
-    // SVG
-    if (R.svg) {
-        Paper[proto].svgns = "http://www.w3.org/2000/svg";
-        Paper[proto].xlink = "http://www.w3.org/1999/xlink";
-        round = function (num) {
-            return +num + (~~num === num) * .5;
-        };
-        var roundPath = function (path) {
-            for (var i = 0, ii = path[length]; i < ii; i++) {
-                if (lowerCase.call(path[i][0]) != "a") {
-                    for (var j = 1, jj = path[i][length]; j < jj; j++) {
-                        path[i][j] = round(path[i][j]);
-                    }
-                } else {
-                    path[i][6] = round(path[i][6]);
-                    path[i][7] = round(path[i][7]);
-                }
-            }
-            return path;
-        },
-        $ = function (el, attr) {
-            if (attr) {
-                for (var key in attr) {
-                    if (attr[has](key)) {
-                        el[setAttribute](key, attr[key] + E);
-                    }
-                }
-            } else {
-                return doc.createElementNS(Paper[proto].svgns, el);
-            }
-        };
-        R[toString] = function () {
-            return  "Your browser supports SVG.\nYou are running Rapha\xebl " + this.version;
-        };
-        var thePath = function (pathString, SVG) {
-            var el = $("path");
-            SVG.canvas && SVG.canvas[appendChild](el);
-            var p = new Element(el, SVG);
-            p.type = "path";
-            setFillAndStroke(p, {fill: "none", stroke: "#000", path: pathString});
-            return p;
-        };
-        var addGradientFill = function (o, gradient, SVG) {
-            var type = "linear",
-                fx = .5, fy = .5,
-                s = o.style;
-            gradient = (gradient + E)[rp](radial_gradient, function (all, _fx, _fy) {
-                type = "radial";
-                if (_fx && _fy) {
-                    fx = toFloat(_fx);
-                    fy = toFloat(_fy);
-                    var dir = ((fy > .5) * 2 - 1);
-                    pow(fx - .5, 2) + pow(fy - .5, 2) > .25 &&
-                        (fy = math.sqrt(.25 - pow(fx - .5, 2)) * dir + .5) &&
-                        fy != .5 &&
-                        (fy = fy.toFixed(5) - 1e-5 * dir);
-                }
-                return E;
-            });
-            gradient = gradient[split](/\s*\-\s*/);
-            if (type == "linear") {
-                var angle = gradient.shift();
-                angle = -toFloat(angle);
-                if (isNaN(angle)) {
-                    return null;
-                }
-                var vector = [0, 0, math.cos(angle * math.PI / 180), math.sin(angle * math.PI / 180)],
-                    max = 1 / (mmax(math.abs(vector[2]), math.abs(vector[3])) || 1);
-                vector[2] *= max;
-                vector[3] *= max;
-                if (vector[2] < 0) {
-                    vector[0] = -vector[2];
-                    vector[2] = 0;
-                }
-                if (vector[3] < 0) {
-                    vector[1] = -vector[3];
-                    vector[3] = 0;
-                }
-            }
-            var dots = parseDots(gradient);
-            if (!dots) {
-                return null;
-            }
-            var id = o.getAttribute("fill");
-            id = id.match(/^url\(#(.*)\)$/);
-            id && SVG.defs.removeChild(doc.getElementById(id[1]));
-            
-            var el = $(type + "Gradient");
-            el.id = "r" + (R._id++)[toString](36);
-            $(el, type == "radial" ? {fx: fx, fy: fy} : {x1: vector[0], y1: vector[1], x2: vector[2], y2: vector[3]});
-            SVG.defs[appendChild](el);
-            for (var i = 0, ii = dots[length]; i < ii; i++) {
-                var stop = $("stop");
-                $(stop, {
-                    offset: dots[i].offset ? dots[i].offset : !i ? "0%" : "100%",
-                    "stop-color": dots[i].color || "#fff"
-                });
-                el[appendChild](stop);
-            }
-            $(o, {
-                fill: "url(#" + el.id + ")",
-                opacity: 1,
-                "fill-opacity": 1
-            });
-            s.fill = E;
-            s.opacity = 1;
-            s.fillOpacity = 1;
-            return 1;
-        };
-        var updatePosition = function (o) {
-            var bbox = o.getBBox();
-            $(o.pattern, {patternTransform: R.format("translate({0},{1})", bbox.x, bbox.y)});
-        };
-        var setFillAndStroke = function (o, params) {
-            var dasharray = {
-                    "": [0],
-                    "none": [0],
-                    "-": [3, 1],
-                    ".": [1, 1],
-                    "-.": [3, 1, 1, 1],
-                    "-..": [3, 1, 1, 1, 1, 1],
-                    ". ": [1, 3],
-                    "- ": [4, 3],
-                    "--": [8, 3],
-                    "- .": [4, 3, 1, 3],
-                    "--.": [8, 3, 1, 3],
-                    "--..": [8, 3, 1, 3, 1, 3]
-                },
-                node = o.node,
-                attrs = o.attrs,
-                rot = o.rotate(),
-                addDashes = function (o, value) {
-                    value = dasharray[lowerCase.call(value)];
-                    if (value) {
-                        var width = o.attrs["stroke-width"] || "1",
-                            butt = {round: width, square: width, butt: 0}[o.attrs["stroke-linecap"] || params["stroke-linecap"]] || 0,
-                            dashes = [];
-                        var i = value[length];
-                        while (i--) {
-                            dashes[i] = value[i] * width + ((i % 2) ? 1 : -1) * butt;
-                        }
-                        $(node, {"stroke-dasharray": dashes[join](",")});
-                    }
-                };
-            params[has]("rotation") && (rot = params.rotation);
-            var rotxy = (rot + E)[split](separator);
-            if (!(rotxy.length - 1)) {
-                rotxy = null;
-            } else {
-                rotxy[1] = +rotxy[1];
-                rotxy[2] = +rotxy[2];
-            }
-            toFloat(rot) && o.rotate(0, true);
-            for (var att in params) {
-                if (params[has](att)) {
-                    if (!availableAttrs[has](att)) {
-                        continue;
-                    }
-                    var value = params[att];
-                    attrs[att] = value;
-                    switch (att) {
-                        case "blur":
-                            o.blur(value);
-                            break;
-                        case "rotation":
-                            o.rotate(value, true);
-                            break;
-                        // Hyperlink
-                        case "href":
-                        case "title":
-                        case "target":
-                            var pn = node.parentNode;
-                            if (lowerCase.call(pn.tagName) != "a") {
-                                var hl = $("a");
-                                pn.insertBefore(hl, node);
-                                hl[appendChild](node);
-                                pn = hl;
-                            }
-                            pn.setAttributeNS(o.paper.xlink, att, value);
-                            break;
-                        case "cursor":
-                            node.style.cursor = value;
-                            break;
-                        case "clip-rect":
-                            var rect = (value + E)[split](separator);
-                            if (rect[length] == 4) {
-                                o.clip && o.clip.parentNode.parentNode.removeChild(o.clip.parentNode);
-                                var el = $("clipPath"),
-                                    rc = $("rect");
-                                el.id = "r" + (R._id++)[toString](36);
-                                $(rc, {
-                                    x: rect[0],
-                                    y: rect[1],
-                                    width: rect[2],
-                                    height: rect[3]
-                                });
-                                el[appendChild](rc);
-                                o.paper.defs[appendChild](el);
-                                $(node, {"clip-path": "url(#" + el.id + ")"});
-                                o.clip = rc;
-                            }
-                            if (!value) {
-                                var clip = doc.getElementById(node.getAttribute("clip-path")[rp](/(^url\(#|\)$)/g, E));
-                                clip && clip.parentNode.removeChild(clip);
-                                $(node, {"clip-path": E});
-                                delete o.clip;
-                            }
-                        break;
-                        case "path":
-                            if (o.type == "path") {
-                                $(node, {d: value ? attrs.path = roundPath(pathToAbsolute(value)) : "M0,0"});
-                            }
-                            break;
-                        case "width":
-                            node[setAttribute](att, value);
-                            if (attrs.fx) {
-                                att = "x";
-                                value = attrs.x;
-                            } else {
-                                break;
-                            }
-                        case "x":
-                            if (attrs.fx) {
-                                value = -attrs.x - (attrs.width || 0);
-                            }
-                        case "rx":
-                            if (att == "rx" && o.type == "rect") {
-                                break;
-                            }
-                        case "cx":
-                            rotxy && (att == "x" || att == "cx") && (rotxy[1] += value - attrs[att]);
-                            node[setAttribute](att, round(value));
-                            o.pattern && updatePosition(o);
-                            break;
-                        case "height":
-                            node[setAttribute](att, value);
-                            if (attrs.fy) {
-                                att = "y";
-                                value = attrs.y;
-                            } else {
-                                break;
-                            }
-                        case "y":
-                            if (attrs.fy) {
-                                value = -attrs.y - (attrs.height || 0);
-                            }
-                        case "ry":
-                            if (att == "ry" && o.type == "rect") {
-                                break;
-                            }
-                        case "cy":
-                            rotxy && (att == "y" || att == "cy") && (rotxy[2] += value - attrs[att]);
-                            node[setAttribute](att, round(value));
-                            o.pattern && updatePosition(o);
-                            break;
-                        case "r":
-                            if (o.type == "rect") {
-                                $(node, {rx: value, ry: value});
-                            } else {
-                                node[setAttribute](att, value);
-                            }
-                            break;
-                        case "src":
-                            if (o.type == "image") {
-                                node.setAttributeNS(o.paper.xlink, "href", value);
-                            }
-                            break;
-                        case "stroke-width":
-                            node.style.strokeWidth = value;
-                            // Need following line for Firefox
-                            node[setAttribute](att, value);
-                            if (attrs["stroke-dasharray"]) {
-                                addDashes(o, attrs["stroke-dasharray"]);
-                            }
-                            break;
-                        case "stroke-dasharray":
-                            addDashes(o, value);
-                            break;
-                        case "translation":
-                            var xy = (value + E)[split](separator);
-                            xy[0] = +xy[0] || 0;
-                            xy[1] = +xy[1] || 0;
-                            if (rotxy) {
-                                rotxy[1] += xy[0];
-                                rotxy[2] += xy[1];
-                            }
-                            translate.call(o, xy[0], xy[1]);
-                            break;
-                        case "scale":
-                            xy = (value + E)[split](separator);
-                            o.scale(+xy[0] || 1, +xy[1] || +xy[0] || 1, isNaN(toFloat(xy[2])) ? null : +xy[2], isNaN(toFloat(xy[3])) ? null : +xy[3]);
-                            break;
-                        case "fill":
-                            var isURL = (value + E).match(ISURL);
-                            if (isURL) {
-                                el = $("pattern");
-                                var ig = $("image");
-                                el.id = "r" + (R._id++)[toString](36);
-                                $(el, {x: 0, y: 0, patternUnits: "userSpaceOnUse", height: 1, width: 1});
-                                $(ig, {x: 0, y: 0});
-                                ig.setAttributeNS(o.paper.xlink, "href", isURL[1]);
-                                el[appendChild](ig);
- 
-                                var img = doc.createElement("img");
-                                img.style.cssText = "position:absolute;left:-9999em;top-9999em";
-                                img.onload = function () {
-                                    $(el, {width: this.offsetWidth, height: this.offsetHeight});
-                                    $(ig, {width: this.offsetWidth, height: this.offsetHeight});
-                                    doc.body.removeChild(this);
-                                    o.paper.safari();
-                                };
-                                doc.body[appendChild](img);
-                                img.src = isURL[1];
-                                o.paper.defs[appendChild](el);
-                                node.style.fill = "url(#" + el.id + ")";
-                                $(node, {fill: "url(#" + el.id + ")"});
-                                o.pattern = el;
-                                o.pattern && updatePosition(o);
-                                break;
-                            }
-                            if (!R.getRGB(value).error) {
-                                delete params.gradient;
-                                delete attrs.gradient;
-                                !R.is(attrs.opacity, "undefined") &&
-                                    R.is(params.opacity, "undefined") &&
-                                    $(node, {opacity: attrs.opacity});
-                                !R.is(attrs["fill-opacity"], "undefined") &&
-                                    R.is(params["fill-opacity"], "undefined") &&
-                                    $(node, {"fill-opacity": attrs["fill-opacity"]});
-                            } else if ((({circle: 1, ellipse: 1})[has](o.type) || (value + E).charAt() != "r") && addGradientFill(node, value, o.paper)) {
-                                attrs.gradient = value;
-                                attrs.fill = "none";
-                                break;
-                            }
-                        case "stroke":
-                            node[setAttribute](att, R.getRGB(value).hex);
-                            break;
-                        case "gradient":
-                            (({circle: 1, ellipse: 1})[has](o.type) || (value + E).charAt() != "r") && addGradientFill(node, value, o.paper);
-                            break;
-                        case "opacity":
-                        case "fill-opacity":
-                            if (attrs.gradient) {
-                                var gradient = doc.getElementById(node.getAttribute("fill")[rp](/^url\(#|\)$/g, E));
-                                if (gradient) {
-                                    var stops = gradient.getElementsByTagName("stop");
-                                    stops[stops[length] - 1][setAttribute]("stop-opacity", value);
-                                }
-                                break;
-                            }
-                        default:
-                            att == "font-size" && (value = toInt(value, 10) + "px");
-                            var cssrule = att[rp](/(\-.)/g, function (w) {
-                                return upperCase.call(w.substring(1));
-                            });
-                            node.style[cssrule] = value;
-                            // Need following line for Firefox
-                            node[setAttribute](att, value);
-                            break;
-                    }
-                }
-            }
-            
-            tuneText(o, params);
-            if (rotxy) {
-                o.rotate(rotxy.join(S));
-            } else {
-                toFloat(rot) && o.rotate(rot, true);
-            }
-        };
-        var leading = 1.2,
-        tuneText = function (el, params) {
-            if (el.type != "text" || !(params[has]("text") || params[has]("font") || params[has]("font-size") || params[has]("x") || params[has]("y"))) {
-                return;
-            }
-            var a = el.attrs,
-                node = el.node,
-                fontSize = node.firstChild ? toInt(doc.defaultView.getComputedStyle(node.firstChild, E).getPropertyValue("font-size"), 10) : 10;
- 
-            if (params[has]("text")) {
-                a.text = params.text;
-                while (node.firstChild) {
-                    node.removeChild(node.firstChild);
-                }
-                var texts = (params.text + E)[split]("\n");
-                for (var i = 0, ii = texts[length]; i < ii; i++) if (texts[i]) {
-                    var tspan = $("tspan");
-                    i && $(tspan, {dy: fontSize * leading, x: a.x});
-                    tspan[appendChild](doc.createTextNode(texts[i]));
-                    node[appendChild](tspan);
-                }
-            } else {
-                texts = node.getElementsByTagName("tspan");
-                for (i = 0, ii = texts[length]; i < ii; i++) {
-                    i && $(texts[i], {dy: fontSize * leading, x: a.x});
-                }
-            }
-            $(node, {y: a.y});
-            var bb = el.getBBox(),
-                dif = a.y - (bb.y + bb.height / 2);
-            dif && isFinite(dif) && $(node, {y: a.y + dif});
-        },
-        Element = function (node, svg) {
-            var X = 0,
-                Y = 0;
-            this[0] = node;
-            this.id = R._oid++;
-            this.node = node;
-            node.raphael = this;
-            this.paper = svg;
-            this.attrs = this.attrs || {};
-            this.transformations = []; // rotate, translate, scale
-            this._ = {
-                tx: 0,
-                ty: 0,
-                rt: {deg: 0, cx: 0, cy: 0},
-                sx: 1,
-                sy: 1
-            };
-            !svg.bottom && (svg.bottom = this);
-            this.prev = svg.top;
-            svg.top && (svg.top.next = this);
-            svg.top = this;
-            this.next = null;
-        };
-        Element[proto].rotate = function (deg, cx, cy) {
-            if (this.removed) {
-                return this;
-            }
-            if (deg == null) {
-                if (this._.rt.cx) {
-                    return [this._.rt.deg, this._.rt.cx, this._.rt.cy][join](S);
-                }
-                return this._.rt.deg;
-            }
-            var bbox = this.getBBox();
-            deg = (deg + E)[split](separator);
-            if (deg[length] - 1) {
-                cx = toFloat(deg[1]);
-                cy = toFloat(deg[2]);
-            }
-            deg = toFloat(deg[0]);
-            if (cx != null) {
-                this._.rt.deg = deg;
-            } else {
-                this._.rt.deg += deg;
-            }
-            (cy == null) && (cx = null);
-            this._.rt.cx = cx;
-            this._.rt.cy = cy;
-            cx = cx == null ? bbox.x + bbox.width / 2 : cx;
-            cy = cy == null ? bbox.y + bbox.height / 2 : cy;
-            if (this._.rt.deg) {
-                this.transformations[0] = R.format("rotate({0} {1} {2})", this._.rt.deg, cx, cy);
-                this.clip && $(this.clip, {transform: R.format("rotate({0} {1} {2})", -this._.rt.deg, cx, cy)});
-            } else {
-                this.transformations[0] = E;
-                this.clip && $(this.clip, {transform: E});
-            }
-            $(this.node, {transform: this.transformations[join](S)});
-            return this;
-        };
-        Element[proto].hide = function () {
-            !this.removed && (this.node.style.display = "none");
-            return this;
-        };
-        Element[proto].show = function () {
-            !this.removed && (this.node.style.display = "");
-            return this;
-        };
-        Element[proto].remove = function () {
-            if (this.removed) {
-                return;
-            }
-            tear(this, this.paper);
-            this.node.parentNode.removeChild(this.node);
-            for (var i in this) {
-                delete this[i];
-            }
-            this.removed = true;
-        };
-        Element[proto].getBBox = function () {
-            if (this.removed) {
-                return this;
-            }
-            if (this.type == "path") {
-                return pathDimensions(this.attrs.path);
-            }
-            if (this.node.style.display == "none") {
-                this.show();
-                var hide = true;
-            }
-            var bbox = {};
-            try {
-                bbox = this.node.getBBox();
-            } catch(e) {
-                // Firefox 3.0.x plays badly here
-            } finally {
-                bbox = bbox || {};
-            }
-            if (this.type == "text") {
-                bbox = {x: bbox.x, y: Infinity, width: 0, height: 0};
-                for (var i = 0, ii = this.node.getNumberOfChars(); i < ii; i++) {
-                    var bb = this.node.getExtentOfChar(i);
-                    (bb.y < bbox.y) && (bbox.y = bb.y);
-                    (bb.y + bb.height - bbox.y > bbox.height) && (bbox.height = bb.y + bb.height - bbox.y);
-                    (bb.x + bb.width - bbox.x > bbox.width) && (bbox.width = bb.x + bb.width - bbox.x);
-                }
-            }
-            hide && this.hide();
-            return bbox;
-        };
-        Element[proto].attr = function (name, value) {
-            if (this.removed) {
-                return this;
-            }
-            if (name == null) {
-                var res = {};
-                for (var i in this.attrs) if (this.attrs[has](i)) {
-                    res[i] = this.attrs[i];
-                }
-                this._.rt.deg && (res.rotation = this.rotate());
-                (this._.sx != 1 || this._.sy != 1) && (res.scale = this.scale());
-                res.gradient && res.fill == "none" && (res.fill = res.gradient) && delete res.gradient;
-                return res;
-            }
-            if (value == null && R.is(name, "string")) {
-                if (name == "translation") {
-                    return translate.call(this);
-                }
-                if (name == "rotation") {
-                    return this.rotate();
-                }
-                if (name == "scale") {
-                    return this.scale();
-                }
-                if (name == "fill" && this.attrs.fill == "none" && this.attrs.gradient) {
-                    return this.attrs.gradient;
-                }
-                return this.attrs[name];
-            }
-            if (value == null && R.is(name, "array")) {
-                var values = {};
-                for (var j = 0, jj = name.length; j < jj; j++) {
-                    values[name[j]] = this.attr(name[j]);
-                }
-                return values;
-            }
-            if (value != null) {
-                var params = {};
-                params[name] = value;
-                setFillAndStroke(this, params);
-            } else if (name != null && R.is(name, "object")) {
-                setFillAndStroke(this, name);
-            }
-            return this;
-        };
-        Element[proto].toFront = function () {
-            if (this.removed) {
-                return this;
-            }
-            this.node.parentNode[appendChild](this.node);
-            var svg = this.paper;
-            svg.top != this && tofront(this, svg);
-            return this;
-        };
-        Element[proto].toBack = function () {
-            if (this.removed) {
-                return this;
-            }
-            if (this.node.parentNode.firstChild != this.node) {
-                this.node.parentNode.insertBefore(this.node, this.node.parentNode.firstChild);
-                toback(this, this.paper);
-                var svg = this.paper;
-            }
-            return this;
-        };
-        Element[proto].insertAfter = function (element) {
-            if (this.removed) {
-                return this;
-            }
-            var node = element.node;
-            if (node.nextSibling) {
-                node.parentNode.insertBefore(this.node, node.nextSibling);
-            } else {
-                node.parentNode[appendChild](this.node);
-            }
-            insertafter(this, element, this.paper);
-            return this;
-        };
-        Element[proto].insertBefore = function (element) {
-            if (this.removed) {
-                return this;
-            }
-            var node = element.node;
-            node.parentNode.insertBefore(this.node, node);
-            insertbefore(this, element, this.paper);
-            return this;
-        };
-        Element[proto].blur = function (size) {
-            // Experimental. No Safari support. Use it on your own risk.
-            var t = this;
-            if (+size !== 0) {
-                var fltr = $("filter"),
-                    blur = $("feGaussianBlur");
-                t.attrs.blur = size;
-                fltr.id = "r" + (R._id++)[toString](36);
-                $(blur, {stdDeviation: +size || 1.5});
-                fltr.appendChild(blur);
-                t.paper.defs.appendChild(fltr);
-                t._blur = fltr;
-                $(t.node, {filter: "url(#" + fltr.id + ")"});
-            } else {
-                if (t._blur) {
-                    t._blur.parentNode.removeChild(t._blur);
-                    delete t._blur;
-                    delete t.attrs.blur;
-                }
-                t.node.removeAttribute("filter");
-            }
-        };
-        var theCircle = function (svg, x, y, r) {
-            x = round(x);
-            y = round(y);
-            var el = $("circle");
-            svg.canvas && svg.canvas[appendChild](el);
-            var res = new Element(el, svg);
-            res.attrs = {cx: x, cy: y, r: r, fill: "none", stroke: "#000"};
-            res.type = "circle";
-            $(el, res.attrs);
-            return res;
-        };
-        var theRect = function (svg, x, y, w, h, r) {
-            x = round(x);
-            y = round(y);
-            var el = $("rect");
-            svg.canvas && svg.canvas[appendChild](el);
-            var res = new Element(el, svg);
-            res.attrs = {x: x, y: y, width: w, height: h, r: r || 0, rx: r || 0, ry: r || 0, fill: "none", stroke: "#000"};
-            res.type = "rect";
-            $(el, res.attrs);
-            return res;
-        };
-        var theEllipse = function (svg, x, y, rx, ry) {
-            x = round(x);
-            y = round(y);
-            var el = $("ellipse");
-            svg.canvas && svg.canvas[appendChild](el);
-            var res = new Element(el, svg);
-            res.attrs = {cx: x, cy: y, rx: rx, ry: ry, fill: "none", stroke: "#000"};
-            res.type = "ellipse";
-            $(el, res.attrs);
-            return res;
-        };
-        var theImage = function (svg, src, x, y, w, h) {
-            var el = $("image");
-            $(el, {x: x, y: y, width: w, height: h, preserveAspectRatio: "none"});
-            el.setAttributeNS(svg.xlink, "href", src);
-            svg.canvas && svg.canvas[appendChild](el);
-            var res = new Element(el, svg);
-            res.attrs = {x: x, y: y, width: w, height: h, src: src};
-            res.type = "image";
-            return res;
-        };
-        var theText = function (svg, x, y, text) {
-            var el = $("text");
-            $(el, {x: x, y: y, "text-anchor": "middle"});
-            svg.canvas && svg.canvas[appendChild](el);
-            var res = new Element(el, svg);
-            res.attrs = {x: x, y: y, "text-anchor": "middle", text: text, font: availableAttrs.font, stroke: "none", fill: "#000"};
-            res.type = "text";
-            setFillAndStroke(res, res.attrs);
-            return res;
-        };
-        var setSize = function (width, height) {
-            this.width = width || this.width;
-            this.height = height || this.height;
-            this.canvas[setAttribute]("width", this.width);
-            this.canvas[setAttribute]("height", this.height);
-            return this;
-        };
-        var create = function () {
-            var con = getContainer[apply](0, arguments),
-                container = con && con.container,
-                x = con.x,
-                y = con.y,
-                width = con.width,
-                height = con.height;
-            if (!container) {
-                throw new Error("SVG container not found.");
-            }
-            var cnvs = $("svg");
-            width = width || 512;
-            height = height || 342;
-            $(cnvs, {
-                xmlns: "http://www.w3.org/2000/svg",
-                version: 1.1,
-                width: width,
-                height: height
-            });
-            if (container == 1) {
-                cnvs.style.cssText = "position:absolute;left:" + x + "px;top:" + y + "px";
-                doc.body[appendChild](cnvs);
-            } else {
-                if (container.firstChild) {
-                    container.insertBefore(cnvs, container.firstChild);
-                } else {
-                    container[appendChild](cnvs);
-                }
-            }
-            container = new Paper;
-            container.width = width;
-            container.height = height;
-            container.canvas = cnvs;
-            plugins.call(container, container, R.fn);
-            container.clear();
-            return container;
-        };
-        Paper[proto].clear = function () {
-            var c = this.canvas;
-            while (c.firstChild) {
-                c.removeChild(c.firstChild);
-            }
-            this.bottom = this.top = null;
-            (this.desc = $("desc"))[appendChild](doc.createTextNode("Created with Rapha\xebl"));
-            c[appendChild](this.desc);
-            c[appendChild](this.defs = $("defs"));
-        };
-        Paper[proto].remove = function () {
-            this.canvas.parentNode && this.canvas.parentNode.removeChild(this.canvas);
-            for (var i in this) {
-                this[i] = removed(i);
-            }
-        };
-    }
-
-    // VML
-    if (R.vml) {
-        var map = {M: "m", L: "l", C: "c", Z: "x", m: "t", l: "r", c: "v", z: "x"},
-            bites = /([clmz]),?([^clmz]*)/gi,
-            val = /-?[^,\s-]+/g,
-            coordsize = 1e3 + S + 1e3,
-            zoom = 10,
-            path2vml = function (path) {
-                var total =  /[ahqstv]/ig,
-                    command = pathToAbsolute;
-                (path + E).match(total) && (command = path2curve);
-                total = /[clmz]/g;
-                if (command == pathToAbsolute && !(path + E).match(total)) {
-                    var res = (path + E)[rp](bites, function (all, command, args) {
-                        var vals = [],
-                            isMove = lowerCase.call(command) == "m",
-                            res = map[command];
-                        args[rp](val, function (value) {
-                            if (isMove && vals[length] == 2) {
-                                res += vals + map[command == "m" ? "l" : "L"];
-                                vals = [];
-                            }
-                            vals[push](round(value * zoom));
-                        });
-                        return res + vals;
-                    });
-                    return res;
-                }
-                var pa = command(path), p, r;
-                res = [];
-                for (var i = 0, ii = pa[length]; i < ii; i++) {
-                    p = pa[i];
-                    r = lowerCase.call(pa[i][0]);
-                    r == "z" && (r = "x");
-                    for (var j = 1, jj = p[length]; j < jj; j++) {
-                        r += round(p[j] * zoom) + (j != jj - 1 ? "," : E);
-                    }
-                    res[push](r);
-                }
-                return res[join](S);
-            };
-        
-        R[toString] = function () {
-            return  "Your browser doesn\u2019t support SVG. Falling down to VML.\nYou are running Rapha\xebl " + this.version;
-        };
-        thePath = function (pathString, vml) {
-            var g = createNode("group");
-            g.style.cssText = "position:absolute;left:0;top:0;width:" + vml.width + "px;height:" + vml.height + "px";
-            g.coordsize = vml.coordsize;
-            g.coordorigin = vml.coordorigin;
-            var el = createNode("shape"), ol = el.style;
-            ol.width = vml.width + "px";
-            ol.height = vml.height + "px";
-            el.coordsize = coordsize;
-            el.coordorigin = vml.coordorigin;
-            g[appendChild](el);
-            var p = new Element(el, g, vml),
-                attr = {fill: "none", stroke: "#000"};
-            pathString && (attr.path = pathString);
-            p.isAbsolute = true;
-            p.type = "path";
-            p.path = [];
-            p.Path = E;
-            setFillAndStroke(p, attr);
-            vml.canvas[appendChild](g);
-            return p;
-        };
-        setFillAndStroke = function (o, params) {
-            o.attrs = o.attrs || {};
-            var node = o.node,
-                a = o.attrs,
-                s = node.style,
-                xy,
-                res = o;
-            for (var par in params) if (params[has](par)) {
-                a[par] = params[par];
-            }
-            params.href && (node.href = params.href);
-            params.title && (node.title = params.title);
-            params.target && (node.target = params.target);
-            params.cursor && (s.cursor = params.cursor);
-            "blur" in params && o.blur(params.blur);
-            if (params.path && o.type == "path") {
-                a.path = params.path;
-                node.path = path2vml(a.path);
-            }
-            if (params.rotation != null) {
-                o.rotate(params.rotation, true);
-            }
-            if (params.translation) {
-                xy = (params.translation + E)[split](separator);
-                translate.call(o, xy[0], xy[1]);
-                if (o._.rt.cx != null) {
-                    o._.rt.cx +=+ xy[0];
-                    o._.rt.cy +=+ xy[1];
-                    o.setBox(o.attrs, xy[0], xy[1]);
-                }
-            }
-            if (params.scale) {
-                xy = (params.scale + E)[split](separator);
-                o.scale(+xy[0] || 1, +xy[1] || +xy[0] || 1, +xy[2] || null, +xy[3] || null);
-            }
-            if ("clip-rect" in params) {
-                var rect = (params["clip-rect"] + E)[split](separator);
-                if (rect[length] == 4) {
-                    rect[2] = +rect[2] + (+rect[0]);
-                    rect[3] = +rect[3] + (+rect[1]);
-                    var div = node.clipRect || doc.createElement("div"),
-                        dstyle = div.style,
-                        group = node.parentNode;
-                    dstyle.clip = R.format("rect({1}px {2}px {3}px {0}px)", rect);
-                    if (!node.clipRect) {
-                        dstyle.position = "absolute";
-                        dstyle.top = 0;
-                        dstyle.left = 0;
-                        dstyle.width = o.paper.width + "px";
-                        dstyle.height = o.paper.height + "px";
-                        group.parentNode.insertBefore(div, group);
-                        div[appendChild](group);
-                        node.clipRect = div;
-                    }
-                }
-                if (!params["clip-rect"]) {
-                    node.clipRect && (node.clipRect.style.clip = E);
-                }
-            }
-            if (o.type == "image" && params.src) {
-                node.src = params.src;
-            }
-            if (o.type == "image" && params.opacity) {
-                node.filterOpacity = " progid:DXImageTransform.Microsoft.Alpha(opacity=" + (params.opacity * 100) + ")";
-                s.filter = (node.filterMatrix || E) + (node.filterOpacity || E);
-            }
-            params.font && (s.font = params.font);
-            params["font-family"] && (s.fontFamily = '"' + params["font-family"][split](",")[0][rp](/^['"]+|['"]+$/g, E) + '"'); //'
-            params["font-size"] && (s.fontSize = params["font-size"]);
-            params["font-weight"] && (s.fontWeight = params["font-weight"]);
-            params["font-style"] && (s.fontStyle = params["font-style"]);
-            if (params.opacity != null || 
-                params["stroke-width"] != null ||
-                params.fill != null ||
-                params.stroke != null ||
-                params["stroke-width"] != null ||
-                params["stroke-opacity"] != null ||
-                params["fill-opacity"] != null ||
-                params["stroke-dasharray"] != null ||
-                params["stroke-miterlimit"] != null ||
-                params["stroke-linejoin"] != null ||
-                params["stroke-linecap"] != null) {
-                node = o.shape || node;
-                var fill = (node.getElementsByTagName("fill") && node.getElementsByTagName("fill")[0]),
-                    newfill = false;
-                !fill && (newfill = fill = createNode("fill"));
-                if ("fill-opacity" in params || "opacity" in params) {
-                    var opacity = ((+a["fill-opacity"] + 1 || 2) - 1) * ((+a.opacity + 1 || 2) - 1);
-                    opacity < 0 && (opacity = 0);
-                    opacity > 1 && (opacity = 1);
-                    fill.opacity = opacity;
-                }
-                params.fill && (fill.on = true);
-                if (fill.on == null || params.fill == "none") {
-                    fill.on = false;
-                }
-                if (fill.on && params.fill) {
-                    var isURL = params.fill.match(ISURL);
-                    if (isURL) {
-                        fill.src = isURL[1];
-                        fill.type = "tile";
-                    } else {
-                        fill.color = R.getRGB(params.fill).hex;
-                        fill.src = E;
-                        fill.type = "solid";
-                        if (R.getRGB(params.fill).error && (res.type in {circle: 1, ellipse: 1} || (params.fill + E).charAt() != "r") && addGradientFill(res, params.fill)) {
-                            a.fill = "none";
-                            a.gradient = params.fill;
-                        }
-                    }
-                }
-                newfill && node[appendChild](fill);
-                var stroke = (node.getElementsByTagName("stroke") && node.getElementsByTagName("stroke")[0]),
-                newstroke = false;
-                !stroke && (newstroke = stroke = createNode("stroke"));
-                if ((params.stroke && params.stroke != "none") ||
-                    params["stroke-width"] ||
-                    params["stroke-opacity"] != null ||
-                    params["stroke-dasharray"] ||
-                    params["stroke-miterlimit"] ||
-                    params["stroke-linejoin"] ||
-                    params["stroke-linecap"]) {
-                    stroke.on = true;
-                }
-                (params.stroke == "none" || stroke.on == null || params.stroke == 0 || params["stroke-width"] == 0) && (stroke.on = false);
-                stroke.on && params.stroke && (stroke.color = R.getRGB(params.stroke).hex);
-                opacity = ((+a["stroke-opacity"] + 1 || 2) - 1) * ((+a.opacity + 1 || 2) - 1);
-                var width = (toFloat(params["stroke-width"]) || 1) * .75;
-                opacity < 0 && (opacity = 0);
-                opacity > 1 && (opacity = 1);
-                params["stroke-width"] == null && (width = a["stroke-width"]);
-                params["stroke-width"] && (stroke.weight = width);
-                width && width < 1 && (opacity *= width) && (stroke.weight = 1);
-                stroke.opacity = opacity;
-                
-                params["stroke-linejoin"] && (stroke.joinstyle = params["stroke-linejoin"] || "miter");
-                stroke.miterlimit = params["stroke-miterlimit"] || 8;
-                params["stroke-linecap"] && (stroke.endcap = params["stroke-linecap"] == "butt" ? "flat" : params["stroke-linecap"] == "square" ? "square" : "round");
-                if (params["stroke-dasharray"]) {
-                    var dasharray = {
-                        "-": "shortdash",
-                        ".": "shortdot",
-                        "-.": "shortdashdot",
-                        "-..": "shortdashdotdot",
-                        ". ": "dot",
-                        "- ": "dash",
-                        "--": "longdash",
-                        "- .": "dashdot",
-                        "--.": "longdashdot",
-                        "--..": "longdashdotdot"
-                    };
-                    stroke.dashstyle = dasharray[has](params["stroke-dasharray"]) ? dasharray[params["stroke-dasharray"]] : E;
-                }
-                newstroke && node[appendChild](stroke);
-            }
-            if (res.type == "text") {
-                s = res.paper.span.style;
-                a.font && (s.font = a.font);
-                a["font-family"] && (s.fontFamily = a["font-family"]);
-                a["font-size"] && (s.fontSize = a["font-size"]);
-                a["font-weight"] && (s.fontWeight = a["font-weight"]);
-                a["font-style"] && (s.fontStyle = a["font-style"]);
-                res.node.string && (res.paper.span.innerHTML = (res.node.string + E)[rp](/</g, "&#60;")[rp](/&/g, "&#38;")[rp](/\n/g, "<br>"));
-                res.W = a.w = res.paper.span.offsetWidth;
-                res.H = a.h = res.paper.span.offsetHeight;
-                res.X = a.x;
-                res.Y = a.y + round(res.H / 2);
- 
-                // text-anchor emulationm
-                switch (a["text-anchor"]) {
-                    case "start":
-                        res.node.style["v-text-align"] = "left";
-                        res.bbx = round(res.W / 2);
-                    break;
-                    case "end":
-                        res.node.style["v-text-align"] = "right";
-                        res.bbx = -round(res.W / 2);
-                    break;
-                    default:
-                        res.node.style["v-text-align"] = "center";
-                    break;
-                }
-            }
-        };
-        addGradientFill = function (o, gradient) {
-            o.attrs = o.attrs || {};
-            var attrs = o.attrs,
-                fill = o.node.getElementsByTagName("fill"),
-                type = "linear",
-                fxfy = ".5 .5";
-            o.attrs.gradient = gradient;
-            gradient = (gradient + E)[rp](radial_gradient, function (all, fx, fy) {
-                type = "radial";
-                if (fx && fy) {
-                    fx = toFloat(fx);
-                    fy = toFloat(fy);
-                    pow(fx - .5, 2) + pow(fy - .5, 2) > .25 && (fy = math.sqrt(.25 - pow(fx - .5, 2)) * ((fy > .5) * 2 - 1) + .5);
-                    fxfy = fx + S + fy;
-                }
-                return E;
-            });
-            gradient = gradient[split](/\s*\-\s*/);
-            if (type == "linear") {
-                var angle = gradient.shift();
-                angle = -toFloat(angle);
-                if (isNaN(angle)) {
-                    return null;
-                }
-            }
-            var dots = parseDots(gradient);
-            if (!dots) {
-                return null;
-            }
-            o = o.shape || o.node;
-            fill = fill[0] || createNode("fill");
-            if (dots[length]) {
-                fill.on = true;
-                fill.method = "none";
-                fill.type = (type == "radial") ? "gradientradial" : "gradient";
-                fill.color = dots[0].color;
-                fill.color2 = dots[dots[length] - 1].color;
-                var clrs = [];
-                for (var i = 0, ii = dots[length]; i < ii; i++) {
-                    dots[i].offset && clrs[push](dots[i].offset + S + dots[i].color);
-                }
-                fill.colors && (fill.colors.value = clrs[length] ? clrs[join](",") : "0% " + fill.color);
-                if (type == "radial") {
-                    fill.focus = "100%";
-                    fill.focussize = fxfy;
-                    fill.focusposition = fxfy;
-                } else {
-                    fill.angle = (270 - angle) % 360;
-                }
-            }
-            return 1;
-        };
-        Element = function (node, group, vml) {
-            var Rotation = 0,
-                RotX = 0,
-                RotY = 0,
-                Scale = 1;
-            this[0] = node;
-            this.id = R._oid++;
-            this.node = node;
-            node.raphael = this;
-            this.X = 0;
-            this.Y = 0;
-            this.attrs = {};
-            this.Group = group;
-            this.paper = vml;
-            this._ = {
-                tx: 0,
-                ty: 0,
-                rt: {deg:0},
-                sx: 1,
-                sy: 1
-            };
-            !vml.bottom && (vml.bottom = this);
-            this.prev = vml.top;
-            vml.top && (vml.top.next = this);
-            vml.top = this;
-            this.next = null;
-        };
-        Element[proto].rotate = function (deg, cx, cy) {
-            if (this.removed) {
-                return this;
-            }
-            if (deg == null) {
-                if (this._.rt.cx) {
-                    return [this._.rt.deg, this._.rt.cx, this._.rt.cy][join](S);
-                }
-                return this._.rt.deg;
-            }
-            deg = (deg + E)[split](separator);
-            if (deg[length] - 1) {
-                cx = toFloat(deg[1]);
-                cy = toFloat(deg[2]);
-            }
-            deg = toFloat(deg[0]);
-            if (cx != null) {
-                this._.rt.deg = deg;
-            } else {
-                this._.rt.deg += deg;
-            }
-            cy == null && (cx = null);
-            this._.rt.cx = cx;
-            this._.rt.cy = cy;
-            this.setBox(this.attrs, cx, cy);
-            this.Group.style.rotation = this._.rt.deg;
-            // gradient fix for rotation. TODO
-            // var fill = (this.shape || this.node).getElementsByTagName("fill");
-            // fill = fill[0] || {};
-            // var b = ((360 - this._.rt.deg) - 270) % 360;
-            // !R.is(fill.angle, "undefined") && (fill.angle = b);
-            return this;
-        };
-        Element[proto].setBox = function (params, cx, cy) {
-            if (this.removed) {
-                return this;
-            }
-            var gs = this.Group.style,
-                os = (this.shape && this.shape.style) || this.node.style;
-            params = params || {};
-            for (var i in params) if (params[has](i)) {
-                this.attrs[i] = params[i];
-            }
-            cx = cx || this._.rt.cx;
-            cy = cy || this._.rt.cy;
-            var attr = this.attrs,
-                x,
-                y,
-                w,
-                h;
-            switch (this.type) {
-                case "circle":
-                    x = attr.cx - attr.r;
-                    y = attr.cy - attr.r;
-                    w = h = attr.r * 2;
-                    break;
-                case "ellipse":
-                    x = attr.cx - attr.rx;
-                    y = attr.cy - attr.ry;
-                    w = attr.rx * 2;
-                    h = attr.ry * 2;
-                    break;
-                case "rect":
-                case "image":
-                    x = +attr.x;
-                    y = +attr.y;
-                    w = attr.width || 0;
-                    h = attr.height || 0;
-                    break;
-                case "text":
-                    this.textpath.v = ["m", round(attr.x), ", ", round(attr.y - 2), "l", round(attr.x) + 1, ", ", round(attr.y - 2)][join](E);
-                    x = attr.x - round(this.W / 2);
-                    y = attr.y - this.H / 2;
-                    w = this.W;
-                    h = this.H;
-                    break;
-                case "path":
-                    if (!this.attrs.path) {
-                        x = 0;
-                        y = 0;
-                        w = this.paper.width;
-                        h = this.paper.height;
-                    } else {
-                        var dim = pathDimensions(this.attrs.path);
-                        x = dim.x;
-                        y = dim.y;
-                        w = dim.width;
-                        h = dim.height;
-                    }
-                    break;
-                default:
-                    x = 0;
-                    y = 0;
-                    w = this.paper.width;
-                    h = this.paper.height;
-                    break;
-            }
-            cx = (cx == null) ? x + w / 2 : cx;
-            cy = (cy == null) ? y + h / 2 : cy;
-            var left = cx - this.paper.width / 2,
-                top = cy - this.paper.height / 2, t;
-            gs.left != (t = left + "px") && (gs.left = t);
-            gs.top != (t = top + "px") && (gs.top = t);
-            this.X = this.type == "path" ? -left : x;
-            this.Y = this.type == "path" ? -top : y;
-            this.W = w;
-            this.H = h;
-            if (this.type == "path") {
-                os.left != (t = -left * zoom + "px") && (os.left = t);
-                os.top != (t = -top * zoom + "px") && (os.top = t);
-            } else if (this.type == "text") {
-                os.left != (t = -left + "px") && (os.left = t);
-                os.top != (t = -top + "px") && (os.top = t);
-            } else {
-                gs.width != (t = this.paper.width + "px") && (gs.width = t);
-                gs.height != (t = this.paper.height + "px") && (gs.height = t);
-                os.left != (t = x - left + "px") && (os.left = t);
-                os.top != (t = y - top + "px") && (os.top = t);
-                os.width != (t = w + "px") && (os.width = t);
-                os.height != (t = h + "px") && (os.height = t);
-                var arcsize = (+params.r || 0) / mmin(w, h);
-                if (this.type == "rect" && this.arcsize.toFixed(4) != arcsize.toFixed(4) && (arcsize || this.arcsize)) {
-                    // We should replace element with the new one
-                    var o = createNode("roundrect"),
-                        a = {},
-                        ii = this.events && this.events[length];
-                    i = 0;
-                    o.arcsize = arcsize;
-                    o.raphael = this;
-                    this.Group[appendChild](o);
-                    this.Group.removeChild(this.node);
-                    this[0] = this.node = o;
-                    this.arcsize = arcsize;
-                    for (i in attr) {
-                        a[i] = attr[i];
-                    }
-                    delete a.scale;
-                    this.attr(a);
-                    if (this.events) for (; i < ii; i++) {
-                        this.events[i].unbind = addEvent(this.node, this.events[i].name, this.events[i].f, this);
-                    }
-                }
-            }
-        };
-        Element[proto].hide = function () {
-            !this.removed && (this.Group.style.display = "none");
-            return this;
-        };
-        Element[proto].show = function () {
-            !this.removed && (this.Group.style.display = "block");
-            return this;
-        };
-        Element[proto].getBBox = function () {
-            if (this.removed) {
-                return this;
-            }
-            if (this.type == "path") {
-                return pathDimensions(this.attrs.path);
-            }
-            return {
-                x: this.X + (this.bbx || 0),
-                y: this.Y,
-                width: this.W,
-                height: this.H
-            };
-        };
-        Element[proto].remove = function () {
-            if (this.removed) {
-                return;
-            }
-            tear(this, this.paper);
-            this.node.parentNode.removeChild(this.node);
-            this.Group.parentNode.removeChild(this.Group);
-            this.shape && this.shape.parentNode.removeChild(this.shape);
-            for (var i in this) {
-                delete this[i];
-            }
-            this.removed = true;
-        };
-        Element[proto].attr = function (name, value) {
-            if (this.removed) {
-                return this;
-            }
-            if (name == null) {
-                var res = {};
-                for (var i in this.attrs) if (this.attrs[has](i)) {
-                    res[i] = this.attrs[i];
-                }
-                this._.rt.deg && (res.rotation = this.rotate());
-                (this._.sx != 1 || this._.sy != 1) && (res.scale = this.scale());
-                res.gradient && res.fill == "none" && (res.fill = res.gradient) && delete res.gradient;
-                return res;
-            }
-            if (value == null && R.is(name, "string")) {
-                if (name == "translation") {
-                    return translate.call(this);
-                }
-                if (name == "rotation") {
-                    return this.rotate();
-                }
-                if (name == "scale") {
-                    return this.scale();
-                }
-                if (name == "fill" && this.attrs.fill == "none" && this.attrs.gradient) {
-                    return this.attrs.gradient;
-                }
-                return this.attrs[name];
-            }
-            if (this.attrs && value == null && R.is(name, "array")) {
-                var ii, values = {};
-                for (i = 0, ii = name[length]; i < ii; i++) {
-                    values[name[i]] = this.attr(name[i]);
-                }
-                return values;
-            }
-            var params;
-            if (value != null) {
-                params = {};
-                params[name] = value;
-            }
-            value == null && R.is(name, "object") && (params = name);
-            if (params) {
-                if (params.text && this.type == "text") {
-                    this.node.string = params.text;
-                }
-                setFillAndStroke(this, params);
-                if (params.gradient && (({circle: 1, ellipse: 1})[has](this.type) || (params.gradient + E).charAt() != "r")) {
-                    addGradientFill(this, params.gradient);
-                }
-                (this.type != "path" || this._.rt.deg) && this.setBox(this.attrs);
-            }
-            return this;
-        };
-        Element[proto].toFront = function () {
-            !this.removed && this.Group.parentNode[appendChild](this.Group);
-            this.paper.top != this && tofront(this, this.paper);
-            return this;
-        };
-        Element[proto].toBack = function () {
-            if (this.removed) {
-                return this;
-            }
-            if (this.Group.parentNode.firstChild != this.Group) {
-                this.Group.parentNode.insertBefore(this.Group, this.Group.parentNode.firstChild);
-                toback(this, this.paper);
-            }
-            return this;
-        };
-        Element[proto].insertAfter = function (element) {
-            if (this.removed) {
-                return this;
-            }
-            if (element.Group.nextSibling) {
-                element.Group.parentNode.insertBefore(this.Group, element.Group.nextSibling);
-            } else {
-                element.Group.parentNode[appendChild](this.Group);
-            }
-            insertafter(this, element, this.paper);
-            return this;
-        };
-        Element[proto].insertBefore = function (element) {
-            if (this.removed) {
-                return this;
-            }
-            element.Group.parentNode.insertBefore(this.Group, element.Group);
-            insertbefore(this, element, this.paper);
-            return this;
-        };
-        var blurregexp = / progid:\S+Blur\([^\)]+\)/g;
-        Element[proto].blur = function (size) {
-            var s = this.node.style,
-                f = s.filter;
-            f = f.replace(blurregexp, "");
-            if (+size !== 0) {
-                this.attrs.blur = size;
-                s.filter = f + " progid:DXImageTransform.Microsoft.Blur(pixelradius=" + (+size || 1.5) + ")";
-                s.margin = Raphael.format("-{0}px 0 0 -{0}px", Math.round(+size || 1.5));
-            } else {
-                s.filter = f;
-                s.margin = 0;
-                delete this.attrs.blur;
-            }
-        };
- 
-        theCircle = function (vml, x, y, r) {
-            var g = createNode("group"),
-                o = createNode("oval"),
-                ol = o.style;
-            g.style.cssText = "position:absolute;left:0;top:0;width:" + vml.width + "px;height:" + vml.height + "px";
-            g.coordsize = coordsize;
-            g.coordorigin = vml.coordorigin;
-            g[appendChild](o);
-            var res = new Element(o, g, vml);
-            res.type = "circle";
-            setFillAndStroke(res, {stroke: "#000", fill: "none"});
-            res.attrs.cx = x;
-            res.attrs.cy = y;
-            res.attrs.r = r;
-            res.setBox({x: x - r, y: y - r, width: r * 2, height: r * 2});
-            vml.canvas[appendChild](g);
-            return res;
-        };
-        theRect = function (vml, x, y, w, h, r) {
-            var g = createNode("group"),
-                o = createNode("roundrect"),
-                arcsize = (+r || 0) / (mmin(w, h));
-            g.style.cssText = "position:absolute;left:0;top:0;width:" + vml.width + "px;height:" + vml.height + "px";
-            g.coordsize = coordsize;
-            g.coordorigin = vml.coordorigin;
-            g[appendChild](o);
-            o.arcsize = arcsize;
-            var res = new Element(o, g, vml);
-            res.type = "rect";
-            setFillAndStroke(res, {stroke: "#000"});
-            res.arcsize = arcsize;
-            res.setBox({x: x, y: y, width: w, height: h, r: r});
-            vml.canvas[appendChild](g);
-            return res;
-        };
-        theEllipse = function (vml, x, y, rx, ry) {
-            var g = createNode("group"),
-                o = createNode("oval"),
-                ol = o.style;
-            g.style.cssText = "position:absolute;left:0;top:0;width:" + vml.width + "px;height:" + vml.height + "px";
-            g.coordsize = coordsize;
-            g.coordorigin = vml.coordorigin;
-            g[appendChild](o);
-            var res = new Element(o, g, vml);
-            res.type = "ellipse";
-            setFillAndStroke(res, {stroke: "#000"});
-            res.attrs.cx = x;
-            res.attrs.cy = y;
-            res.attrs.rx = rx;
-            res.attrs.ry = ry;
-            res.setBox({x: x - rx, y: y - ry, width: rx * 2, height: ry * 2});
-            vml.canvas[appendChild](g);
-            return res;
-        };
-        theImage = function (vml, src, x, y, w, h) {
-            var g = createNode("group"),
-                o = createNode("image"),
-                ol = o.style;
-            g.style.cssText = "position:absolute;left:0;top:0;width:" + vml.width + "px;height:" + vml.height + "px";
-            g.coordsize = coordsize;
-            g.coordorigin = vml.coordorigin;
-            o.src = src;
-            g[appendChild](o);
-            var res = new Element(o, g, vml);
-            res.type = "image";
-            res.attrs.src = src;
-            res.attrs.x = x;
-            res.attrs.y = y;
-            res.attrs.w = w;
-            res.attrs.h = h;
-            res.setBox({x: x, y: y, width: w, height: h});
-            vml.canvas[appendChild](g);
-            return res;
-        };
-        theText = function (vml, x, y, text) {
-            var g = createNode("group"),
-                el = createNode("shape"),
-                ol = el.style,
-                path = createNode("path"),
-                ps = path.style,
-                o = createNode("textpath");
-            g.style.cssText = "position:absolute;left:0;top:0;width:" + vml.width + "px;height:" + vml.height + "px";
-            g.coordsize = coordsize;
-            g.coordorigin = vml.coordorigin;
-            path.v = R.format("m{0},{1}l{2},{1}", round(x * 10), round(y * 10), round(x * 10) + 1);
-            path.textpathok = true;
-            ol.width = vml.width;
-            ol.height = vml.height;
-            o.string = text + E;
-            o.on = true;
-            el[appendChild](o);
-            el[appendChild](path);
-            g[appendChild](el);
-            var res = new Element(o, g, vml);
-            res.shape = el;
-            res.textpath = path;
-            res.type = "text";
-            res.attrs.text = text;
-            res.attrs.x = x;
-            res.attrs.y = y;
-            res.attrs.w = 1;
-            res.attrs.h = 1;
-            setFillAndStroke(res, {font: availableAttrs.font, stroke: "none", fill: "#000"});
-            res.setBox();
-            vml.canvas[appendChild](g);
-            return res;
-        };
-        setSize = function (width, height) {
-            var cs = this.canvas.style;
-            width == +width && (width += "px");
-            height == +height && (height += "px");
-            cs.width = width;
-            cs.height = height;
-            cs.clip = "rect(0 " + width + " " + height + " 0)";
-            return this;
-        };
-        var createNode;
-        doc.createStyleSheet().addRule(".rvml", "behavior:url(#default#VML)");
-        try {
-            !doc.namespaces.rvml && doc.namespaces.add("rvml", "urn:schemas-microsoft-com:vml");
-            createNode = function (tagName) {
-                return doc.createElement('<rvml:' + tagName + ' class="rvml">');
-            };
-        } catch (e) {
-            createNode = function (tagName) {
-                return doc.createElement('<' + tagName + ' xmlns="urn:schemas-microsoft.com:vml" class="rvml">');
-            };
-        }
-        create = function () {
-            var con = getContainer[apply](0, arguments),
-                container = con.container,
-                height = con.height,
-                s,
-                width = con.width,
-                x = con.x,
-                y = con.y;
-            if (!container) {
-                throw new Error("VML container not found.");
-            }
-            var res = new Paper,
-                c = res.canvas = doc.createElement("div"),
-                cs = c.style;
-            width = width || 512;
-            height = height || 342;
-            width == +width && (width += "px");
-            height == +height && (height += "px");
-            res.width = 1e3;
-            res.height = 1e3;
-            res.coordsize = zoom * 1e3 + S + zoom * 1e3;
-            res.coordorigin = "0 0";
-            res.span = doc.createElement("span");
-            res.span.style.cssText = "position:absolute;left:-9999em;top:-9999em;padding:0;margin:0;line-height:1;display:inline;";
-            c[appendChild](res.span);
-            cs.cssText = R.format("width:{0};height:{1};position:absolute;clip:rect(0 {0} {1} 0);overflow:hidden", width, height);
-            if (container == 1) {
-                doc.body[appendChild](c);
-                cs.left = x + "px";
-                cs.top = y + "px";
-            } else {
-                container.style.width = width;
-                container.style.height = height;
-                if (container.firstChild) {
-                    container.insertBefore(c, container.firstChild);
-                } else {
-                    container[appendChild](c);
-                }
-            }
-            plugins.call(res, res, R.fn);
-            return res;
-        };
-        Paper[proto].clear = function () {
-            this.canvas.innerHTML = E;
-            this.span = doc.createElement("span");
-            this.span.style.cssText = "position:absolute;left:-9999em;top:-9999em;padding:0;margin:0;line-height:1;display:inline;";
-            this.canvas[appendChild](this.span);
-            this.bottom = this.top = null;
-        };
-        Paper[proto].remove = function () {
-            this.canvas.parentNode.removeChild(this.canvas);
-            for (var i in this) {
-                this[i] = removed(i);
-            }
-            return true;
-        };
-    }
- 
-    // rest
-    // Safari or Chrome (WebKit) rendering bug workaround method
-    if ((/^Apple|^Google/).test(win.navigator.vendor) && !(win.navigator.userAgent.indexOf("Version/4.0") + 1)) {
-        Paper[proto].safari = function () {
-            var rect = this.rect(-99, -99, this.width + 99, this.height + 99);
-            win.setTimeout(function () {rect.remove();});
-        };
-    } else {
-        Paper[proto].safari = function () {};
-    }
- 
-    // Events
-    var addEvent = (function () {
-        if (doc.addEventListener) {
-            return function (obj, type, fn, element) {
-                var f = function (e) {
-                    return fn.call(element, e);
-                };
-                obj.addEventListener(type, f, false);
-                return function () {
-                    obj.removeEventListener(type, f, false);
-                    return true;
-                };
-            };
-        } else if (doc.attachEvent) {
-            return function (obj, type, fn, element) {
-                var f = function (e) {
-                    return fn.call(element, e || win.event);
-                };
-                obj.attachEvent("on" + type, f);
-                var detacher = function () {
-                    obj.detachEvent("on" + type, f);
-                    return true;
-                };
-                return detacher;
-            };
-        }
-    })();
-    for (var i = events[length]; i--;) {
-        (function (eventName) {
-            Element[proto][eventName] = function (fn) {
-                if (R.is(fn, "function")) {
-                    this.events = this.events || [];
-                    this.events.push({name: eventName, f: fn, unbind: addEvent(this.shape || this.node, eventName, fn, this)});
-                }
-                return this;
-            };
-            Element[proto]["un" + eventName] = function (fn) {
-                var events = this.events,
-                    l = events[length];
-                while (l--) if (events[l].name == eventName && events[l].f == fn) {
-                    events[l].unbind();
-                    events.splice(l, 1);
-                    !events.length && delete this.events;
-                    return this;
-                }
-                return this;
-            };
-        })(events[i]);
-    }
-    Element[proto].hover = function (f_in, f_out) {
-        return this.mouseover(f_in).mouseout(f_out);
-    };
-    Element[proto].unhover = function (f_in, f_out) {
-        return this.unmouseover(f_in).unmouseout(f_out);
-    };
-    Paper[proto].circle = function (x, y, r) {
-        return theCircle(this, x || 0, y || 0, r || 0);
-    };
-    Paper[proto].rect = function (x, y, w, h, r) {
-        return theRect(this, x || 0, y || 0, w || 0, h || 0, r || 0);
-    };
-    Paper[proto].ellipse = function (x, y, rx, ry) {
-        return theEllipse(this, x || 0, y || 0, rx || 0, ry || 0);
-    };
-    Paper[proto].path = function (pathString) {
-        pathString && !R.is(pathString, "string") && !R.is(pathString[0], "array") && (pathString += E);
-        return thePath(R.format[apply](R, arguments), this);
-    };
-    Paper[proto].image = function (src, x, y, w, h) {
-        return theImage(this, src || "about:blank", x || 0, y || 0, w || 0, h || 0);
-    };
-    Paper[proto].text = function (x, y, text) {
-        return theText(this, x || 0, y || 0, text || E);
-    };
-    Paper[proto].set = function (itemsArray) {
-        arguments[length] > 1 && (itemsArray = Array[proto].splice.call(arguments, 0, arguments[length]));
-        return new Set(itemsArray);
-    };
-    Paper[proto].setSize = setSize;
-    Paper[proto].top = Paper[proto].bottom = null;
-    Paper[proto].raphael = R;
-    function x_y() {
-        return this.x + S + this.y;
-    }
-    Element[proto].scale = function (x, y, cx, cy) {
-        if (x == null && y == null) {
-            return {
-                x: this._.sx,
-                y: this._.sy,
-                toString: x_y
-            };
-        }
-        y = y || x;
-        !+y && (y = x);
-        var dx,
-            dy,
-            dcx,
-            dcy,
-            a = this.attrs;
-        if (x != 0) {
-            var bb = this.getBBox(),
-                rcx = bb.x + bb.width / 2,
-                rcy = bb.y + bb.height / 2,
-                kx = x / this._.sx,
-                ky = y / this._.sy;
-            cx = (+cx || cx == 0) ? cx : rcx;
-            cy = (+cy || cy == 0) ? cy : rcy;
-            var dirx = ~~(x / math.abs(x)),
-                diry = ~~(y / math.abs(y)),
-                s = this.node.style,
-                ncx = cx + (rcx - cx) * kx,
-                ncy = cy + (rcy - cy) * ky;
-            switch (this.type) {
-                case "rect":
-                case "image":
-                    var neww = a.width * dirx * kx,
-                        newh = a.height * diry * ky;
-                    this.attr({
-                        height: newh,
-                        r: a.r * mmin(dirx * kx, diry * ky),
-                        width: neww,
-                        x: ncx - neww / 2,
-                        y: ncy - newh / 2
-                    });
-                    break;
-                case "circle":
-                case "ellipse":
-                    this.attr({
-                        rx: a.rx * dirx * kx,
-                        ry: a.ry * diry * ky,
-                        r: a.r * mmin(dirx * kx, diry * ky),
-                        cx: ncx,
-                        cy: ncy
-                    });
-                    break;
-                case "path":
-                    var path = pathToRelative(a.path),
-                        skip = true;
-                    for (var i = 0, ii = path[length]; i < ii; i++) {
-                        var p = path[i],
-                            P0 = upperCase.call(p[0]);
-                        if (P0 == "M" && skip) {
-                            continue;
-                        } else {
-                            skip = false;
-                        }
-                        if (P0 == "A") {
-                            p[path[i][length] - 2] *= kx;
-                            p[path[i][length] - 1] *= ky;
-                            p[1] *= dirx * kx;
-                            p[2] *= diry * ky;
-                            p[5] = +!(dirx + diry ? !+p[5] : +p[5]);
-                        } else if (P0 == "H") {
-                            for (var j = 1, jj = p[length]; j < jj; j++) {
-                                p[j] *= kx;
-                            }
-                        } else if (P0 == "V") {
-                            for (j = 1, jj = p[length]; j < jj; j++) {
-                                p[j] *= ky;
-                            }
-                         } else {
-                            for (j = 1, jj = p[length]; j < jj; j++) {
-                                p[j] *= (j % 2) ? kx : ky;
-                            }
-                        }
-                    }
-                    var dim2 = pathDimensions(path);
-                    dx = ncx - dim2.x - dim2.width / 2;
-                    dy = ncy - dim2.y - dim2.height / 2;
-                    path[0][1] += dx;
-                    path[0][2] += dy;
-                    this.attr({path: path});
-                break;
-            }
-            if (this.type in {text: 1, image:1} && (dirx != 1 || diry != 1)) {
-                if (this.transformations) {
-                    this.transformations[2] = "scale("[concat](dirx, ",", diry, ")");
-                    this.node[setAttribute]("transform", this.transformations[join](S));
-                    dx = (dirx == -1) ? -a.x - (neww || 0) : a.x;
-                    dy = (diry == -1) ? -a.y - (newh || 0) : a.y;
-                    this.attr({x: dx, y: dy});
-                    a.fx = dirx - 1;
-                    a.fy = diry - 1;
-                } else {
-                    this.node.filterMatrix = " progid:DXImageTransform.Microsoft.Matrix(M11="[concat](dirx,
-                        ", M12=0, M21=0, M22=", diry,
-                        ", Dx=0, Dy=0, sizingmethod='auto expand', filtertype='bilinear')");
-                    s.filter = (this.node.filterMatrix || E) + (this.node.filterOpacity || E);
-                }
-            } else {
-                if (this.transformations) {
-                    this.transformations[2] = E;
-                    this.node[setAttribute]("transform", this.transformations[join](S));
-                    a.fx = 0;
-                    a.fy = 0;
-                } else {
-                    this.node.filterMatrix = E;
-                    s.filter = (this.node.filterMatrix || E) + (this.node.filterOpacity || E);
-                }
-            }
-            a.scale = [x, y, cx, cy][join](S);
-            this._.sx = x;
-            this._.sy = y;
-        }
-        return this;
-    };
-    Element[proto].clone = function () {
-        var attr = this.attr();
-        delete attr.scale;
-        delete attr.translation;
-        return this.paper[this.type]().attr(attr);
-    };
-    var getPointAtSegmentLength = cacher(function (p1x, p1y, c1x, c1y, c2x, c2y, p2x, p2y, length) {
-        var len = 0,
-            old;
-        for (var i = 0; i < 1.001; i+=.001) {
-            var dot = R.findDotsAtSegment(p1x, p1y, c1x, c1y, c2x, c2y, p2x, p2y, i);
-            i && (len += pow(pow(old.x - dot.x, 2) + pow(old.y - dot.y, 2), .5));
-            if (len >= length) {
-                return dot;
-            }
-            old = dot;
-        }
-    }),
-    getLengthFactory = function (istotal, subpath) {
-        return function (path, length, onlystart) {
-            path = path2curve(path);
-            var x, y, p, l, sp = "", subpaths = {}, point,
-                len = 0;
-            for (var i = 0, ii = path.length; i < ii; i++) {
-                p = path[i];
-                if (p[0] == "M") {
-                    x = +p[1];
-                    y = +p[2];
-                } else {
-                    l = segmentLength(x, y, p[1], p[2], p[3], p[4], p[5], p[6]);
-                    if (len + l > length) {
-                        if (subpath && !subpaths.start) {
-                            point = getPointAtSegmentLength(x, y, p[1], p[2], p[3], p[4], p[5], p[6], length - len);
-                            sp += ["C", point.start.x, point.start.y, point.m.x, point.m.y, point.x, point.y];
-                            if (onlystart) {return sp;}
-                            subpaths.start = sp;
-                            sp = ["M", point.x, point.y + "C", point.n.x, point.n.y, point.end.x, point.end.y, p[5], p[6]][join]();
-                            len += l;
-                            x = +p[5];
-                            y = +p[6];
-                            continue;
-                        }
-                        if (!istotal && !subpath) {
-                            point = getPointAtSegmentLength(x, y, p[1], p[2], p[3], p[4], p[5], p[6], length - len);
-                            return {x: point.x, y: point.y, alpha: point.alpha};
-                        }
-                    }
-                    len += l;
-                    x = +p[5];
-                    y = +p[6];
-                }
-                sp += p;
-            }
-            subpaths.end = sp;
-            point = istotal ? len : subpath ? subpaths : R.findDotsAtSegment(x, y, p[1], p[2], p[3], p[4], p[5], p[6], 1);
-            point.alpha && (point = {x: point.x, y: point.y, alpha: point.alpha});
-            return point;
-        };
-    },
-    segmentLength = cacher(function (p1x, p1y, c1x, c1y, c2x, c2y, p2x, p2y) {
-        var old = {x: 0, y: 0},
-            len = 0;
-        for (var i = 0; i < 1.01; i+=.01) {
-            var dot = findDotAtSegment(p1x, p1y, c1x, c1y, c2x, c2y, p2x, p2y, i);
-            i && (len += pow(pow(old.x - dot.x, 2) + pow(old.y - dot.y, 2), .5));
-            old = dot;
-        }
-        return len;
-    });
-    var getTotalLength = getLengthFactory(1),
-        getPointAtLength = getLengthFactory(),
-        getSubpathsAtLength = getLengthFactory(0, 1);
-    Element[proto].getTotalLength = function () {
-        if (this.type != "path") {return;}
-        return getTotalLength(this.attrs.path);
-    };
-    Element[proto].getPointAtLength = function (length) {
-        if (this.type != "path") {return;}
-        return getPointAtLength(this.attrs.path, length);
-    };
-    Element[proto].getSubpath = function (from, to) {
-        if (this.type != "path") {return;}
-        if (math.abs(this.getTotalLength() - to) < 1e-6) {
-            return getSubpathsAtLength(this.attrs.path, from).end;
-        }
-        var a = getSubpathsAtLength(this.attrs.path, to, 1);
-        return from ? getSubpathsAtLength(a, from).end : a;
-    };
-
-    // animation easing formulas
-    R.easing_formulas = {
-        linear: function (n) {
-            return n;
-        },
-        "<": function (n) {
-            return pow(n, 3);
-        },
-        ">": function (n) {
-            return pow(n - 1, 3) + 1;
-        },
-        "<>": function (n) {
-            n = n * 2;
-            if (n < 1) {
-                return pow(n, 3) / 2;
-            }
-            n -= 2;
-            return (pow(n, 3) + 2) / 2;
-        },
-        backIn: function (n) {
-            var s = 1.70158;
-            return n * n * ((s + 1) * n - s);
-        },
-        backOut: function (n) {
-            n = n - 1;
-            var s = 1.70158;
-            return n * n * ((s + 1) * n + s) + 1;
-        },
-        elastic: function (n) {
-            if (n == 0 || n == 1) {
-                return n;
-            }
-            var p = .3,
-                s = p / 4;
-            return pow(2, -10 * n) * math.sin((n - s) * (2 * math.PI) / p) + 1;
-        },
-        bounce: function (n) {
-            var s = 7.5625,
-                p = 2.75,
-                l;
-            if (n < (1 / p)) {
-                l = s * n * n;
-            } else {
-                if (n < (2 / p)) {
-                    n -= (1.5 / p);
-                    l = s * n * n + .75;
-                } else {
-                    if (n < (2.5 / p)) {
-                        n -= (2.25 / p);
-                        l = s * n * n + .9375;
-                    } else {
-                        n -= (2.625 / p);
-                        l = s * n * n + .984375;
-                    }
-                }
-            }
-            return l;
-        }
-    };
- 
-    var animationElements = {length : 0},
-        animation = function () {
-            var Now = +new Date;
-            for (var l in animationElements) if (l != "length" && animationElements[has](l)) {
-                var e = animationElements[l];
-                if (e.stop || e.el.removed) {
-                    delete animationElements[l];
-                    animationElements[length]--;
-                    continue;
-                }
-                var time = Now - e.start,
-                    ms = e.ms,
-                    easing = e.easing,
-                    from = e.from,
-                    diff = e.diff,
-                    to = e.to,
-                    t = e.t,
-                    prev = e.prev || 0,
-                    that = e.el,
-                    callback = e.callback,
-                    set = {},
-                    now;
-                if (time < ms) {
-                    var pos = R.easing_formulas[easing] ? R.easing_formulas[easing](time / ms) : time / ms;
-                    for (var attr in from) if (from[has](attr)) {
-                        switch (availableAnimAttrs[attr]) {
-                            case "along":
-                                now = pos * ms * diff[attr];
-                                to.back && (now = to.len - now);
-                                var point = getPointAtLength(to[attr], now);
-                                that.translate(diff.sx - diff.x || 0, diff.sy - diff.y || 0);
-                                diff.x = point.x;
-                                diff.y = point.y;
-                                that.translate(point.x - diff.sx, point.y - diff.sy);
-                                to.rot && that.rotate(diff.r + point.alpha, point.x, point.y);
-                                break;
-                            case "number":
-                                now = +from[attr] + pos * ms * diff[attr];
-                                break;
-                            case "colour":
-                                now = "rgb(" + [
-                                    upto255(round(from[attr].r + pos * ms * diff[attr].r)),
-                                    upto255(round(from[attr].g + pos * ms * diff[attr].g)),
-                                    upto255(round(from[attr].b + pos * ms * diff[attr].b))
-                                ][join](",") + ")";
-                                break;
-                            case "path":
-                                now = [];
-                                for (var i = 0, ii = from[attr][length]; i < ii; i++) {
-                                    now[i] = [from[attr][i][0]];
-                                    for (var j = 1, jj = from[attr][i][length]; j < jj; j++) {
-                                        now[i][j] = +from[attr][i][j] + pos * ms * diff[attr][i][j];
-                                    }
-                                    now[i] = now[i][join](S);
-                                }
-                                now = now[join](S);
-                                break;
-                            case "csv":
-                                switch (attr) {
-                                    case "translation":
-                                        var x = diff[attr][0] * (time - prev),
-                                            y = diff[attr][1] * (time - prev);
-                                        t.x += x;
-                                        t.y += y;
-                                        now = x + S + y;
-                                    break;
-                                    case "rotation":
-                                        now = +from[attr][0] + pos * ms * diff[attr][0];
-                                        from[attr][1] && (now += "," + from[attr][1] + "," + from[attr][2]);
-                                    break;
-                                    case "scale":
-                                        now = [+from[attr][0] + pos * ms * diff[attr][0], +from[attr][1] + pos * ms * diff[attr][1], (2 in to[attr] ? to[attr][2] : E), (3 in to[attr] ? to[attr][3] : E)][join](S);
-                                    break;
-                                    case "clip-rect":
-                                        now = [];
-                                        i = 4;
-                                        while (i--) {
-                                            now[i] = +from[attr][i] + pos * ms * diff[attr][i];
-                                        }
-                                    break;
-                                }
-                                break;
-                        }
-                        set[attr] = now;
-                    }
-                    that.attr(set);
-                    that._run && that._run.call(that);
-                } else {
-                    if (to.along) {
-                        point = getPointAtLength(to.along, to.len * !to.back);
-                        that.translate(diff.sx - (diff.x || 0) + point.x - diff.sx, diff.sy - (diff.y || 0) + point.y - diff.sy);
-                        to.rot && that.rotate(diff.r + point.alpha, point.x, point.y);
-                    }
-                    (t.x || t.y) && that.translate(-t.x, -t.y);
-                    to.scale && (to.scale = to.scale + E);
-                    that.attr(to);
-                    delete animationElements[l];
-                    animationElements[length]--;
-                    that.in_animation = null;
-                    R.is(callback, "function") && callback.call(that);
-                }
-                e.prev = time;
-            }
-            R.svg && that && that.paper.safari();
-            animationElements[length] && win.setTimeout(animation);
-        },
-        upto255 = function (color) {
-            return color > 255 ? 255 : (color < 0 ? 0 : color);
-        },
-        translate = function (x, y) {
-            if (x == null) {
-                return {x: this._.tx, y: this._.ty, toString: x_y};
-            }
-            this._.tx += +x;
-            this._.ty += +y;
-            switch (this.type) {
-                case "circle":
-                case "ellipse":
-                    this.attr({cx: +x + this.attrs.cx, cy: +y + this.attrs.cy});
-                    break;
-                case "rect":
-                case "image":
-                case "text":
-                    this.attr({x: +x + this.attrs.x, y: +y + this.attrs.y});
-                    break;
-                case "path":
-                    var path = pathToRelative(this.attrs.path);
-                    path[0][1] += +x;
-                    path[0][2] += +y;
-                    this.attr({path: path});
-                break;
-            }
-            return this;
-        };
-    Element[proto].animateWith = function (element, params, ms, easing, callback) {
-        animationElements[element.id] && (params.start = animationElements[element.id].start);
-        return this.animate(params, ms, easing, callback);
-    };
-    Element[proto].animateAlong = along();
-    Element[proto].animateAlongBack = along(1);
-    function along(isBack) {
-        return function (path, ms, rotate, callback) {
-            var params = {back: isBack};
-            R.is(rotate, "function") ? (callback = rotate) : (params.rot = rotate);
-            path && path.constructor == Element && (path = path.attrs.path);
-            path && (params.along = path);
-            return this.animate(params, ms, callback);
-        };
-    }
-    Element[proto].onAnimation = function (f) {
-        this._run = f || 0;
-        return this;
-    };
-    Element[proto].animate = function (params, ms, easing, callback) {
-        if (R.is(easing, "function") || !easing) {
-            callback = easing || null;
-        }
-        var from = {},
-            to = {},
-            diff = {};
-        for (var attr in params) if (params[has](attr)) {
-            if (availableAnimAttrs[has](attr)) {
-                from[attr] = this.attr(attr);
-                (from[attr] == null) && (from[attr] = availableAttrs[attr]);
-                to[attr] = params[attr];
-                switch (availableAnimAttrs[attr]) {
-                    case "along":
-                        var len = getTotalLength(params[attr]),
-                            point = getPointAtLength(params[attr], len * !!params.back),
-                            bb = this.getBBox();
-                        diff[attr] = len / ms;
-                        diff.tx = bb.x;
-                        diff.ty = bb.y;
-                        diff.sx = point.x;
-                        diff.sy = point.y;
-                        to.rot = params.rot;
-                        to.back = params.back;
-                        to.len = len;
-                        params.rot && (diff.r = toFloat(this.rotate()) || 0);
-                        break;
-                    case "number":
-                        diff[attr] = (to[attr] - from[attr]) / ms;
-                        break;
-                    case "colour":
-                        from[attr] = R.getRGB(from[attr]);
-                        var toColour = R.getRGB(to[attr]);
-                        diff[attr] = {
-                            r: (toColour.r - from[attr].r) / ms,
-                            g: (toColour.g - from[attr].g) / ms,
-                            b: (toColour.b - from[attr].b) / ms
-                        };
-                        break;
-                    case "path":
-                        var pathes = path2curve(from[attr], to[attr]);
-                        from[attr] = pathes[0];
-                        var toPath = pathes[1];
-                        diff[attr] = [];
-                        for (var i = 0, ii = from[attr][length]; i < ii; i++) {
-                            diff[attr][i] = [0];
-                            for (var j = 1, jj = from[attr][i][length]; j < jj; j++) {
-                                diff[attr][i][j] = (toPath[i][j] - from[attr][i][j]) / ms;
-                            }
-                        }
-                        break;
-                    case "csv":
-                        var values = (params[attr] + E)[split](separator),
-                            from2 = (from[attr] + E)[split](separator);
-                        switch (attr) {
-                            case "translation":
-                                from[attr] = [0, 0];
-                                diff[attr] = [values[0] / ms, values[1] / ms];
-                            break;
-                            case "rotation":
-                                from[attr] = (from2[1] == values[1] && from2[2] == values[2]) ? from2 : [0, values[1], values[2]];
-                                diff[attr] = [(values[0] - from[attr][0]) / ms, 0, 0];
-                            break;
-                            case "scale":
-                                params[attr] = values;
-                                from[attr] = (from[attr] + E)[split](separator);
-                                diff[attr] = [(values[0] - from[attr][0]) / ms, (values[1] - from[attr][1]) / ms, 0, 0];
-                            break;
-                            case "clip-rect":
-                                from[attr] = (from[attr] + E)[split](separator);
-                                diff[attr] = [];
-                                i = 4;
-                                while (i--) {
-                                    diff[attr][i] = (values[i] - from[attr][i]) / ms;
-                                }
-                            break;
-                        }
-                        to[attr] = values;
-                }
-            }
-        }
-        this.stop();
-        this.in_animation = 1;
-        animationElements[this.id] = {
-            start: params.start || +new Date,
-            ms: ms,
-            easing: easing,
-            from: from,
-            diff: diff,
-            to: to,
-            el: this,
-            callback: callback,
-            t: {x: 0, y: 0}
-        };
-        ++animationElements[length] == 1 && animation();
-        return this;
-    };
-    Element[proto].stop = function () {
-        animationElements[this.id] && animationElements[length]--;
-        delete animationElements[this.id];
-        return this;
-    };
-    Element[proto].translate = function (x, y) {
-        return this.attr({translation: x + " " + y});
-    };
-    Element[proto][toString] = function () {
-        return "Rapha\xebl\u2019s object";
-    };
-    R.ae = animationElements;
- 
-    // Set
-    var Set = function (items) {
-        this.items = [];
-        this[length] = 0;
-        if (items) {
-            for (var i = 0, ii = items[length]; i < ii; i++) {
-                if (items[i] && (items[i].constructor == Element || items[i].constructor == Set)) {
-                    this[this.items[length]] = this.items[this.items[length]] = items[i];
-                    this[length]++;
-                }
-            }
-        }
-    };
-    Set[proto][push] = function () {
-        var item,
-            len;
-        for (var i = 0, ii = arguments[length]; i < ii; i++) {
-            item = arguments[i];
-            if (item && (item.constructor == Element || item.constructor == Set)) {
-                len = this.items[length];
-                this[len] = this.items[len] = item;
-                this[length]++;
-            }
-        }
-        return this;
-    };
-    Set[proto].pop = function () {
-        delete this[this[length]--];
-        return this.items.pop();
-    };
-    for (var method in Element[proto]) if (Element[proto][has](method)) {
-        Set[proto][method] = (function (methodname) {
-            return function () {
-                for (var i = 0, ii = this.items[length]; i < ii; i++) {
-                    this.items[i][methodname][apply](this.items[i], arguments);
-                }
-                return this;
-            };
-        })(method);
-    }
-    Set[proto].attr = function (name, value) {
-        if (name && R.is(name, "array") && R.is(name[0], "object")) {
-            for (var j = 0, jj = name[length]; j < jj; j++) {
-                this.items[j].attr(name[j]);
-            }
-        } else {
-            for (var i = 0, ii = this.items[length]; i < ii; i++) {
-                this.items[i].attr(name, value);
-            }
-        }
-        return this;
-    };
-    Set[proto].animate = function (params, ms, easing, callback) {
-        (R.is(easing, "function") || !easing) && (callback = easing || null);
-        var len = this.items[length],
-            i = len,
-            set = this,
-            collector;
-        callback && (collector = function () {
-            !--len && callback.call(set);
-        });
-        this.items[--i].animate(params, ms, easing || collector, collector);
-        while (i--) {
-            this.items[i].animateWith(this.items[len - 1], params, ms, easing || collector, collector);
-        }
-        return this;
-    };
-    Set[proto].insertAfter = function (el) {
-        var i = this.items[length];
-        while (i--) {
-            this.items[i].insertAfter(el);
-        }
-        return this;
-    };
-    Set[proto].getBBox = function () {
-        var x = [],
-            y = [],
-            w = [],
-            h = [];
-        for (var i = this.items[length]; i--;) {
-            var box = this.items[i].getBBox();
-            x[push](box.x);
-            y[push](box.y);
-            w[push](box.x + box.width);
-            h[push](box.y + box.height);
-        }
-        x = mmin[apply](0, x);
-        y = mmin[apply](0, y);
-        return {
-            x: x,
-            y: y,
-            width: mmax[apply](0, w) - x,
-            height: mmax[apply](0, h) - y
-        };
-    };
-    Set[proto].clone = function (s) {
-        s = new Set;
-        for (var i = 0, ii = this.items[length]; i < ii; i++) {
-            s[push](this.items[i].clone());
-        }
-        return s;
-    };
-
-    R.registerFont = function (font) {
-        if (!font.face) {
-            return font;
-        }
-        this.fonts = this.fonts || {};
-        var fontcopy = {
-                w: font.w,
-                face: {},
-                glyphs: {}
-            },
-            family = font.face["font-family"];
-        for (var prop in font.face) if (font.face[has](prop)) {
-            fontcopy.face[prop] = font.face[prop];
-        }
-        if (this.fonts[family]) {
-            this.fonts[family][push](fontcopy);
-        } else {
-            this.fonts[family] = [fontcopy];
-        }
-        if (!font.svg) {
-            fontcopy.face["units-per-em"] = toInt(font.face["units-per-em"], 10);
-            for (var glyph in font.glyphs) if (font.glyphs[has](glyph)) {
-                var path = font.glyphs[glyph];
-                fontcopy.glyphs[glyph] = {
-                    w: path.w,
-                    k: {},
-                    d: path.d && "M" + path.d[rp](/[mlcxtrv]/g, function (command) {
-                            return {l: "L", c: "C", x: "z", t: "m", r: "l", v: "c"}[command] || "M";
-                        }) + "z"
-                };
-                if (path.k) {
-                    for (var k in path.k) if (path[has](k)) {
-                        fontcopy.glyphs[glyph].k[k] = path.k[k];
-                    }
-                }
-            }
-        }
-        return font;
-    };
-    Paper[proto].getFont = function (family, weight, style, stretch) {
-        stretch = stretch || "normal";
-        style = style || "normal";
-        weight = +weight || {normal: 400, bold: 700, lighter: 300, bolder: 800}[weight] || 400;
-        var font = R.fonts[family];
-        if (!font) {
-            var name = new RegExp("(^|\\s)" + family[rp](/[^\w\d\s+!~.:_-]/g, E) + "(\\s|$)", "i");
-            for (var fontName in R.fonts) if (R.fonts[has](fontName)) {
-                if (name.test(fontName)) {
-                    font = R.fonts[fontName];
-                    break;
-                }
-            }
-        }
-        var thefont;
-        if (font) {
-            for (var i = 0, ii = font[length]; i < ii; i++) {
-                thefont = font[i];
-                if (thefont.face["font-weight"] == weight && (thefont.face["font-style"] == style || !thefont.face["font-style"]) && thefont.face["font-stretch"] == stretch) {
-                    break;
-                }
-            }
-        }
-        return thefont;
-    };
-    Paper[proto].print = function (x, y, string, font, size, origin) {
-        origin = origin || "middle"; // baseline|middle
-        var out = this.set(),
-            letters = (string + E)[split](E),
-            shift = 0,
-            path = E,
-            scale;
-        R.is(font, "string") && (font = this.getFont(font));
-        if (font) {
-            scale = (size || 16) / font.face["units-per-em"];
-            var bb = font.face.bbox.split(separator),
-                top = +bb[0],
-                height = +bb[1] + (origin == "baseline" ? bb[3] - bb[1] + (+font.face.descent) : (bb[3] - bb[1]) / 2);
-            for (var i = 0, ii = letters[length]; i < ii; i++) {
-                var prev = i && font.glyphs[letters[i - 1]] || {},
-                    curr = font.glyphs[letters[i]];
-                shift += i ? (prev.w || font.w) + (prev.k && prev.k[letters[i]] || 0) : 0;
-                curr && curr.d && out[push](this.path(curr.d).attr({fill: "#000", stroke: "none", translation: [shift, 0]}));
-            }
-            out.scale(scale, scale, top, height).translate(x - top, y - height);
-        }
-        return out;
-    };
-
-    var formatrg = /\{(\d+)\}/g;
-    R.format = function (token, array) {
-        var args = R.is(array, "array") ? [0][concat](array) : arguments;
-        token && R.is(token, "string") && args[length] - 1 && (token = token[rp](formatrg, function (str, i) {
-            return args[++i] == null ? E : args[i];
-        }));
-        return token || E;
-    };
-    R.ninja = function () {
-        oldRaphael.was ? (Raphael = oldRaphael.is) : delete Raphael;
-        return R;
-    };
-    R.el = Element[proto];
-    return R;
-})();
\ No newline at end of file
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/yui-min.js b/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/yui-min.js
deleted file mode 100644
index 55f017d9b7f..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/yui-min.js
+++ /dev/null
@@ -1,12 +0,0 @@
-/*
-Copyright (c) 2010, Yahoo! Inc. All rights reserved.
-Code licensed under the BSD License:
-http://developer.yahoo.com/yui/license.html
-version: 3.1.0
-build: 2026
-*/
-if(typeof YUI==="undefined"){var YUI=function(F,E,D,C,A){var B=this,J=arguments,I,G=J.length,H=(typeof YUI_config!=="undefined")&&YUI_config;if(!(B instanceof YUI)){return new YUI(F,E,D,C,A);}else{B._init();if(H){B._config(H);}for(I=0;I<G;I++){B._config(J[I]);}B._setup();return B;}};}(function(){var L,B,M="3.1.0",K="http://yui.yahooapis.com/",P="yui3-js-enabled",I=function(){},G=Array.prototype.slice,N={"io.xdrReady":1,"io.xdrResponse":1,"SWF.eventHandler":1},F=(typeof window!="undefined"),E=(F)?window:null,R=(F)?E.document:null,D=R&&R.documentElement,A=D&&D.className,C={},H=new Date().getTime(),J=function(V,U,T,S){if(V&&V.addEventListener){V.addEventListener(U,T,S);}else{if(V&&V.attachEvent){V.attachEvent("on"+U,T);}}},Q=function(V,U,T,S){if(V&&V.removeEventListener){V.removeEventListener(U,T,S);}else{if(V&&V.detachEvent){V.detachEvent("on"+U,T);}}},O=function(){YUI.Env.windowLoaded=true;YUI.Env.DOMReady=true;if(F){Q(window,"load",O);}};if(D&&A.indexOf(P)==-1){if(A){A+=" ";}A+=P;D.className=A;}if(M.indexOf("@")>-1){M="3.0.0";}YUI.prototype={_config:function(Y){Y=Y||{};var T,V,W,U=this.config,X=U.modules,S=U.groups;for(V in Y){T=Y[V];if(X&&V=="modules"){for(W in T){X[W]=T[W];}}else{if(S&&V=="groups"){for(W in T){S[W]=T[W];}}else{if(V=="win"){U[V]=T.contentWindow||T;U.doc=U[V].document;}else{U[V]=T;}}}}},_init:function(){var U,V=this,S=YUI.Env,T=V.Env;V.version=M;if(!T){V.Env={mods:{},base:K,cdn:K+M+"/build/",bootstrapped:false,_idx:0,_used:{},_attached:{},_yidx:0,_uidx:0,_guidp:"y",_loaded:{},getBase:function(c,a){var W,X,Z,d,Y;X=(R&&R.getElementsByTagName("script"))||[];for(Z=0;Z<X.length;Z=Z+1){d=X[Z].src;if(d){Y=d.match(c);W=Y&&Y[1];if(W){U=Y[2];Y=d.match(a);if(Y&&Y[3]){W=Y[1]+Y[3];}break;}}}return W||T.cdn;}};T=V.Env;T._loaded[M]={};if(S&&V!==YUI){T._yidx=++S._yidx;T._guidp=("yui_"+M+"_"+T._yidx+"_"+H).replace(/\./g,"_");}V.id=V.stamp(V);C[V.id]=V;}V.constructor=YUI;V.config=V.config||{win:E,doc:R,debug:true,useBrowserConsole:true,throwFail:true,bootstrap:true,fetchCSS:true};V.config.base=YUI.config.base||V.Env.getBase(/^(.*)yui\/yui([\.\-].*)js(\?.*)?$/,/^(.*\?)(.*\&)(.*)yui\/yui[\.\-].*js(\?.*)?$/);V.config.loaderPath=YUI.config.loaderPath||"loader/loader"+(U||"-min.")+"js";},_setup:function(X){var T,W=this,S=[],V=YUI.Env.mods,U=W.config.core||["get","intl-base","loader","yui-log","yui-later","yui-throttle"];for(T=0;T<U.length;T++){if(V[U[T]]){S.push(U[T]);}}W.use("yui-base");W.use.apply(W,S);},applyTo:function(Y,X,U){if(!(X in N)){this.log(X+": applyTo not allowed","warn","yui");return null;}var T=C[Y],W,S,V;if(T){W=X.split(".");S=T;for(V=0;V<W.length;V=V+1){S=S[W[V]];if(!S){this.log("applyTo not found: "+X,"warn","yui");}}return S.apply(T,U);}return null;},add:function(T,V,S,U){U=U||{};YUI.Env.mods[T]={name:T,fn:V,version:S,details:U};return this;},_attach:function(S,W){var Y,V,b,T,a,U,c=YUI.Env.mods,X=this.Env._attached,Z=S.length;for(Y=0;Y<Z;Y++){V=S[Y];b=c[V];if(!X[V]&&b){X[V]=true;T=b.details;a=T.requires;U=T.use;if(a){this._attach(this.Array(a));}if(b.fn){b.fn(this,V);}if(U){this._attach(this.Array(U));}}}},use:function(){if(!this.Array){this._attach(["yui-base"]);}var i,c,j,T=this,k=YUI.Env,U=G.call(arguments,0),V=k.mods,S=T.Env,Z=S._used,g=k._loaderQueue,m=U[0],W=U[U.length-1],b=T.Array,l=T.config,a=l.bootstrap,h=[],e=[],X=l.fetchCSS,f=function(o){e.push(o);if(Z[o]){return;}var Y=V[o],p,n;if(Y){Z[o]=true;p=Y.details.requires;n=Y.details.use;}else{if(!k._loaded[M][o]){h.push(o);}else{Z[o]=true;}}if(p){b.each(b(p),f);}if(n){b.each(b(n),f);}},d=function(q){var o=q||{success:true,msg:"not dynamic"},p,n,Y,r=o.data;T._loading=false;if(r){Y=h.concat();h=[];T.Array.each(r,f);n=h.length;if(n){if(h.sort().join()==Y.sort().join()){n=false;}}}if(n&&r){p=r.concat();p.push(function(){T._attach(r);if(W){W(T,o);}});T._loading=false;T.use.apply(T,p);}else{if(r){T._attach(r);}if(W){W(T,o);}}if(T._useQueue&&T._useQueue.size()&&!T._loading){T.use.apply(T,T._useQueue.next());}};if(T._loading){T._useQueue=T._useQueue||new T.Queue();T._useQueue.add(U);return T;}if(typeof W==="function"){U.pop();}else{W=null;}if(m==="*"){U=T.Object.keys(V);}if(T.Loader){c=new T.Loader(l);c.require(U);c.ignoreRegistered=true;c.calculate(null,(X)?null:"js");U=c.sorted;}b.each(U,f);i=h.length;if(i){h=T.Object.keys(b.hash(h));i=h.length;}if(a&&i&&T.Loader){T._loading=true;c=new T.Loader(l);c.onEnd=d;c.context=T;c.attaching=U;c.data=U;c.require((X)?h:U);c.insert(null,(X)?null:"js");}else{if(a&&i&&T.Get&&!S.bootstrapped){T._loading=true;U=b(arguments,0,true);j=function(){T._loading=false;g.running=false;S.bootstrapped=true;T._attach(["loader"]);T.use.apply(T,U);};if(k._bootstrapping){g.add(j);}else{k._bootstrapping=true;T.Get.script(l.base+l.loaderPath,{onEnd:j});}}else{if(i){T.message("Requirement NOT loaded: "+h,"warn","yui");}T._attach(e);d();}}return T;},namespace:function(){var S=arguments,W=null,U,T,V;for(U=0;U<S.length;U=U+1){V=(""+S[U]).split(".");W=this;for(T=(V[0]=="YAHOO")?1:0;T<V.length;T=T+1){W[V[T]]=W[V[T]]||{};W=W[V[T]];}}return W;},log:I,message:I,error:function(T,S){if(this.config.throwFail){throw (S||new Error(T));}else{this.message(T,"error");}return this;},guid:function(S){var T=this.Env._guidp+(++this.Env._uidx);return(S)?(S+T):T;},stamp:function(U,V){if(!U){return U;}var S=(typeof U==="string")?U:U._yuid;if(!S){S=this.guid();if(!V){try{U._yuid=S;}catch(T){S=null;}}}return S;}};L=YUI.prototype;for(B in L){YUI[B]=L[B];}YUI._init();if(F){J(window,"load",O);}else{O();}YUI.Env.add=J;YUI.Env.remove=Q;if(typeof exports=="object"){exports.YUI=YUI;}})();YUI.add("yui-base",function(B){(function(){B.Lang=B.Lang||{};var R=B.Lang,G="array",I="boolean",D="date",M="error",S="function",H="number",K="null",F="object",O="regexp",N="string",C=Object.prototype.toString,P="undefined",E={"undefined":P,"number":H,"boolean":I,"string":N,"[object Function]":S,"[object RegExp]":O,"[object Array]":G,"[object Date]":D,"[object Error]":M},J=/^\s+|\s+$/g,Q="";R.isArray=function(L){return R.type(L)===G;};R.isBoolean=function(L){return typeof L===I;
-};R.isFunction=function(L){return R.type(L)===S;};R.isDate=function(L){return R.type(L)===D&&L.toString()!=="Invalid Date"&&!isNaN(L);};R.isNull=function(L){return L===null;};R.isNumber=function(L){return typeof L===H&&isFinite(L);};R.isObject=function(U,T){var L=typeof U;return(U&&(L===F||(!T&&(L===S||R.isFunction(U)))))||false;};R.isString=function(L){return typeof L===N;};R.isUndefined=function(L){return typeof L===P;};R.trim=function(L){try{return L.replace(J,Q);}catch(T){return L;}};R.isValue=function(T){var L=R.type(T);switch(L){case H:return isFinite(T);case K:case P:return false;default:return !!(L);}};R.type=function(L){return E[typeof L]||E[C.call(L)]||(L?F:K);};})();(function(){var C=B.Lang,D=Array.prototype,E="length",F=function(M,K,I){var J=(I)?2:F.test(M),H,G,N=K||0;if(J){try{return D.slice.call(M,N);}catch(L){G=[];H=M.length;for(;N<H;N++){G.push(M[N]);}return G;}}else{return[M];}};B.Array=F;F.test=function(I){var G=0;if(C.isObject(I)){if(C.isArray(I)){G=1;}else{try{if((E in I)&&!I.tagName&&!I.alert&&!I.apply){G=2;}}catch(H){}}}return G;};F.each=(D.forEach)?function(G,H,I){D.forEach.call(G||[],H,I||B);return B;}:function(H,J,K){var G=(H&&H.length)||0,I;for(I=0;I<G;I=I+1){J.call(K||B,H[I],I,H);}return B;};F.hash=function(I,H){var L={},G=I.length,K=H&&H.length,J;for(J=0;J<G;J=J+1){if(I[J]){L[I[J]]=(K&&K>J)?H[J]:true;}}return L;};F.indexOf=(D.indexOf)?function(G,H){return D.indexOf.call(G,H);}:function(G,I){for(var H=0;H<G.length;H=H+1){if(G[H]===I){return H;}}return -1;};F.numericSort=function(H,G){return(H-G);};F.some=(D.some)?function(G,H,I){return D.some.call(G,H,I);}:function(H,J,K){var G=H.length,I;for(I=0;I<G;I=I+1){if(J.call(K,H[I],I,H)){return true;}}return false;};})();function A(){this._init();this.add.apply(this,arguments);}A.prototype={_init:function(){this._q=[];},next:function(){return this._q.shift();},last:function(){return this._q.pop();},add:function(){B.Array.each(B.Array(arguments,0,true),function(C){this._q.push(C);},this);return this;},size:function(){return this._q.length;}};B.Queue=A;YUI.Env._loaderQueue=YUI.Env._loaderQueue||new A();(function(){var D=B.Lang,C="__",E=function(H,G){var F=G.toString;if(D.isFunction(F)&&F!=Object.prototype.toString){H.toString=F;}};B.merge=function(){var G=arguments,I={},H,F=G.length;for(H=0;H<F;H=H+1){B.mix(I,G[H],true);}return I;};B.mix=function(F,O,H,N,L,M){if(!O||!F){return F||B;}if(L){switch(L){case 1:return B.mix(F.prototype,O.prototype,H,N,0,M);case 2:B.mix(F.prototype,O.prototype,H,N,0,M);break;case 3:return B.mix(F,O.prototype,H,N,0,M);case 4:return B.mix(F.prototype,O,H,N,0,M);default:}}var K=M&&D.isArray(F),J,I,G;if(N&&N.length){for(J=0,I=N.length;J<I;++J){G=N[J];if(O.hasOwnProperty(G)){if(M&&D.isObject(F[G],true)){B.mix(F[G],O[G]);}else{if(!K&&(H||!(G in F))){F[G]=O[G];}else{if(K){F.push(O[G]);}}}}}}else{for(J in O){if(O.hasOwnProperty(J)){if(M&&D.isObject(F[J],true)){B.mix(F[J],O[J],H,N,0,true);}else{if(!K&&(H||!(J in F))){F[J]=O[J];}else{if(K){F.push(O[J]);}}}}}if(B.UA.ie){E(F,O);}}return F;};B.cached=function(H,F,G){F=F||{};return function(K,J){var I=(J)?Array.prototype.join.call(arguments,C):K;if(!(I in F)||(G&&F[I]==G)){F[I]=H.apply(H,arguments);}return F[I];};};})();(function(){B.Object=function(H){var G=function(){};G.prototype=H;return new G();};var E=B.Object,F=function(H,G){return H&&H.hasOwnProperty&&H.hasOwnProperty(G);},D=undefined,C=function(K,J){var I=(J===2),G=(I)?0:[],H;for(H in K){if(F(K,H)){if(I){G++;}else{G.push((J)?K[H]:H);}}}return G;};E.keys=function(G){return C(G);};E.values=function(G){return C(G,1);};E.size=function(G){return C(G,2);};E.hasKey=F;E.hasValue=function(H,G){return(B.Array.indexOf(E.values(H),G)>-1);};E.owns=F;E.each=function(K,J,L,I){var H=L||B,G;for(G in K){if(I||F(K,G)){J.call(H,K[G],G,K);}}return B;};E.some=function(K,J,L,I){var H=L||B,G;for(G in K){if(I||F(K,G)){if(J.call(H,K[G],G,K)){return true;}}}return false;};E.getValue=function(K,J){if(!B.Lang.isObject(K)){return D;}var H,I=B.Array(J),G=I.length;for(H=0;K!==D&&H<G;H++){K=K[I[H]];}return K;};E.setValue=function(M,K,L){var G,J=B.Array(K),I=J.length-1,H=M;if(I>=0){for(G=0;H!==D&&G<I;G++){H=H[J[G]];}if(H!==D){H[J[G]]=L;}else{return D;}}return M;};})();B.UA=function(){var F=function(K){var L=0;return parseFloat(K.replace(/\./g,function(){return(L++==1)?"":".";}));},G=B.config.win,J=G&&G.navigator,I={ie:0,opera:0,gecko:0,webkit:0,chrome:0,mobile:null,air:0,caja:J&&J.cajaVersion,secure:false,os:null},E=J&&J.userAgent,H=G&&G.location,D=H&&H.href,C;I.secure=D&&(D.toLowerCase().indexOf("https")===0);if(E){if((/windows|win32/i).test(E)){I.os="windows";}else{if((/macintosh/i).test(E)){I.os="macintosh";}else{if((/rhino/i).test(E)){I.os="rhino";}}}if((/KHTML/).test(E)){I.webkit=1;}C=E.match(/AppleWebKit\/([^\s]*)/);if(C&&C[1]){I.webkit=F(C[1]);if(/ Mobile\//.test(E)){I.mobile="Apple";}else{C=E.match(/NokiaN[^\/]*|Android \d\.\d|webOS\/\d\.\d/);if(C){I.mobile=C[0];}}C=E.match(/Chrome\/([^\s]*)/);if(C&&C[1]){I.chrome=F(C[1]);}else{C=E.match(/AdobeAIR\/([^\s]*)/);if(C){I.air=C[0];}}}if(!I.webkit){C=E.match(/Opera[\s\/]([^\s]*)/);if(C&&C[1]){I.opera=F(C[1]);C=E.match(/Opera Mini[^;]*/);if(C){I.mobile=C[0];}}else{C=E.match(/MSIE\s([^;]*)/);if(C&&C[1]){I.ie=F(C[1]);}else{C=E.match(/Gecko\/([^\s]*)/);if(C){I.gecko=1;C=E.match(/rv:([^\s\)]*)/);if(C&&C[1]){I.gecko=F(C[1]);}}}}}}return I;}();},"3.1.0");YUI.add("get",function(A){(function(){var C=A.UA,B=A.Lang,E="text/javascript",F="text/css",D="stylesheet";A.Get=function(){var M,N,J,L={},K=0,U,W=function(a,X,b){var Y=b||A.config.win,c=Y.document,e=c.createElement(a),Z;for(Z in X){if(X[Z]&&X.hasOwnProperty(Z)){e.setAttribute(Z,X[Z]);}}return e;},T=function(Y,Z,X){var a={id:A.guid(),type:F,rel:D,href:Y};if(X){A.mix(a,X);}return W("link",a,Z);},S=function(Y,Z,X){var a={id:A.guid(),type:E};if(X){A.mix(a,X);}a.src=Y;return W("script",a,Z);},P=function(Y,Z,X){return{tId:Y.tId,win:Y.win,data:Y.data,nodes:Y.nodes,msg:Z,statusText:X,purge:function(){N(this.tId);}};},O=function(b,a,X){var Y=L[b],Z;
-if(Y&&Y.onEnd){Z=Y.context||Y;Y.onEnd.call(Z,P(Y,a,X));}},V=function(a,Z){var X=L[a],Y;if(X.timer){clearTimeout(X.timer);}if(X.onFailure){Y=X.context||X;X.onFailure.call(Y,P(X,Z));}O(a,Z,"failure");},I=function(a){var X=L[a],Z,Y;if(X.timer){clearTimeout(X.timer);}X.finished=true;if(X.aborted){Z="transaction "+a+" was aborted";V(a,Z);return;}if(X.onSuccess){Y=X.context||X;X.onSuccess.call(Y,P(X));}O(a,Z,"OK");},Q=function(Z){var X=L[Z],Y;if(X.onTimeout){Y=X.context||X;X.onTimeout.call(Y,P(X));}O(Z,"timeout","timeout");},H=function(Z,c){var Y=L[Z],b,g,f,e,a,X,i;if(Y.timer){clearTimeout(Y.timer);}if(Y.aborted){b="transaction "+Z+" was aborted";V(Z,b);return;}if(c){Y.url.shift();if(Y.varName){Y.varName.shift();}}else{Y.url=(B.isString(Y.url))?[Y.url]:Y.url;if(Y.varName){Y.varName=(B.isString(Y.varName))?[Y.varName]:Y.varName;}}g=Y.win;f=g.document;e=f.getElementsByTagName("head")[0];if(Y.url.length===0){I(Z);return;}X=Y.url[0];if(!X){Y.url.shift();return H(Z);}if(Y.timeout){Y.timer=setTimeout(function(){Q(Z);},Y.timeout);}if(Y.type==="script"){a=S(X,g,Y.attributes);}else{a=T(X,g,Y.attributes);}J(Y.type,a,Z,X,g,Y.url.length);Y.nodes.push(a);if(Y.insertBefore){i=M(Y.insertBefore,Z);if(i){i.parentNode.insertBefore(a,i);}}else{e.appendChild(a);}if((C.webkit||C.gecko)&&Y.type==="css"){H(Z,X);}},G=function(){if(U){return;}U=true;var X,Y;for(X in L){if(L.hasOwnProperty(X)){Y=L[X];if(Y.autopurge&&Y.finished){N(Y.tId);delete L[X];}}}U=false;},R=function(Y,X,Z){Z=Z||{};var d="q"+(K++),a,c=Z.purgethreshold||A.Get.PURGE_THRESH;if(K%c===0){G();}L[d]=A.merge(Z,{tId:d,type:Y,url:X,finished:false,nodes:[]});a=L[d];a.win=a.win||A.config.win;a.context=a.context||a;a.autopurge=("autopurge" in a)?a.autopurge:(Y==="script")?true:false;a.attributes=a.attributes||{};var b=Z.charset||a.attributes.charset;if(b){a.attributes.charset=b;}setTimeout(function(){H(d);},0);return{tId:d};};J=function(Z,e,d,Y,c,b,X){var a=X||H;if(C.ie){e.onreadystatechange=function(){var f=this.readyState;if("loaded"===f||"complete"===f){e.onreadystatechange=null;a(d,Y);}};}else{if(C.webkit){if(Z==="script"){e.addEventListener("load",function(){a(d,Y);});}}else{e.onload=function(){a(d,Y);};e.onerror=function(f){V(d,f+": "+Y);};}}};M=function(X,a){var Y=L[a],Z=(B.isString(X))?Y.win.document.getElementById(X):X;if(!Z){V(a,"target node not found: "+X);}return Z;};N=function(c){var Y,a,g,e,j,b,Z,f,X=L[c];if(X){Y=X.nodes;a=Y.length;g=X.win.document;e=g.getElementsByTagName("head")[0];if(X.insertBefore){j=M(X.insertBefore,c);if(j){e=j.parentNode;}}for(b=0;b<a;b=b+1){Z=Y[b];if(Z.clearAttributes){Z.clearAttributes();}else{for(f in Z){if(Z.hasOwnProperty(f)){delete Z[f];}}}e.removeChild(Z);}}X.nodes=[];};return{PURGE_THRESH:20,_finalize:function(X){setTimeout(function(){I(X);},0);},abort:function(Y){var Z=(B.isString(Y))?Y:Y.tId,X=L[Z];if(X){X.aborted=true;}},script:function(X,Y){return R("script",X,Y);},css:function(X,Y){return R("css",X,Y);}};}();})();},"3.1.0");YUI.add("intl-base",function(B){var A=/[, ]/;B.mix(B.namespace("Intl"),{lookupBestLang:function(G,H){var F,I,C,E;function D(K){var J;for(J=0;J<H.length;J+=1){if(K.toLowerCase()===H[J].toLowerCase()){return H[J];}}}if(B.Lang.isString(G)){G=G.split(A);}for(F=0;F<G.length;F+=1){I=G[F];if(!I||I==="*"){continue;}while(I.length>0){C=D(I);if(C){return C;}else{E=I.lastIndexOf("-");if(E>=0){I=I.substring(0,E);if(E>=2&&I.charAt(E-2)==="-"){I=I.substring(0,E-2);}}else{break;}}}}return"";}});},"3.1.0",{requires:["yui-base"]});YUI.add("yui-log",function(A){(function(){var E,D=A,F="yui:log",B="undefined",C={debug:1,info:1,warn:1,error:1};D.log=function(I,Q,G,O){var K,N,L,J,M,H=D,P=H.config;if(P.debug){if(G){N=P.logExclude;L=P.logInclude;if(L&&!(G in L)){K=1;}else{if(N&&(G in N)){K=1;}}}if(!K){if(P.useBrowserConsole){J=(G)?G+": "+I:I;if(H.Lang.isFunction(P.logFn)){P.logFn(I,Q,G);}else{if(typeof console!=B&&console.log){M=(Q&&console[Q]&&(Q in C))?Q:"log";console[M](J);}else{if(typeof opera!=B){opera.postError(J);}}}}if(H.fire&&!O){if(!E){H.publish(F,{broadcast:2});E=1;}H.fire(F,{msg:I,cat:Q,src:G});}}}return H;};D.message=function(){return D.log.apply(D,arguments);};})();},"3.1.0",{requires:["yui-base"]});YUI.add("yui-later",function(A){(function(){var B=A.Lang,C=function(K,E,L,G,H){K=K||0;E=E||{};var F=L,J=A.Array(G),I,D;if(B.isString(L)){F=E[L];}if(!F){}I=function(){F.apply(E,J);};D=(H)?setInterval(I,K):setTimeout(I,K);return{id:D,interval:H,cancel:function(){if(this.interval){clearInterval(D);}else{clearTimeout(D);}}};};A.later=C;B.later=C;})();},"3.1.0",{requires:["yui-base"]});YUI.add("yui-throttle",function(Y){
-/* Based on work by Simon Willison: http://gist.github.com/292562 */
-var throttle=function(fn,ms){ms=(ms)?ms:(Y.config.throttleTime||150);if(ms===-1){return(function(){fn.apply(null,arguments);});}var last=(new Date()).getTime();return(function(){var now=(new Date()).getTime();if(now-last>ms){last=now;fn.apply(null,arguments);}});};Y.throttle=throttle;},"3.1.0",{requires:["yui-base"]});YUI.add("yui",function(A){},"3.1.0",{use:["yui-base","get","intl-base","yui-log","yui-later","yui-throttle"]});
\ No newline at end of file
diff --git a/zookeeper-contrib/zookeeper-contrib-monitoring/cacti/README b/zookeeper-contrib/zookeeper-contrib-monitoring/cacti/README
index 8188723e5e2..3beddb36e1a 100644
--- a/zookeeper-contrib/zookeeper-contrib-monitoring/cacti/README
+++ b/zookeeper-contrib/zookeeper-contrib-monitoring/cacti/README
@@ -29,7 +29,7 @@ WARNING: I have wrote these instructions while installing and configuring the pl
 
 WARNING: I'm going to make the assumption that you know how to work with Cacti and how to setup Data Input Methods for custom scripts. I'm also going to assume that you have already installed Cacti and everything works as expected.
 
-You can extend the Cacti's data gathering functionality through external scripts. Cacti comes with a number of scripts out of the box wich are localted in the scripts/ directory. 
+You can extend the Cacti's data gathering functionality through external scripts. Cacti comes with a number of scripts out of the box which are located in the scripts/ directory.
 
 
 The check_zookeeper.py script can be used a  custom data input method for Cacti.
diff --git a/zookeeper-contrib/zookeeper-contrib-monitoring/check_zookeeper.py b/zookeeper-contrib/zookeeper-contrib-monitoring/check_zookeeper.py
index cff6a1f2618..6badf190c11 100755
--- a/zookeeper-contrib/zookeeper-contrib-monitoring/check_zookeeper.py
+++ b/zookeeper-contrib/zookeeper-contrib-monitoring/check_zookeeper.py
@@ -19,7 +19,7 @@
 Generic monitoring script that could be used with multiple platforms (Ganglia, Nagios, Cacti).
 
 It requires ZooKeeper 3.4.0 or greater. The script needs the 'mntr' 4letter word 
-command (patch ZOOKEEPER-744) that was now commited to the trunk.
+command (patch ZOOKEEPER-744) that was now committed to the trunk.
 The script also works with ZooKeeper 3.3.x but in a limited way.
 """
 
@@ -311,10 +311,12 @@ def _parse_line(self, line):
         if not key:
             raise ValueError('The key is mandatory and should not be empty')
 
-        try:
-            value = int(value)
-        except (TypeError, ValueError):
-            pass
+        for typ in [int, float]:
+            try:
+                value = typ(value)
+                break
+            except (TypeError, ValueError):
+                pass
 
         return key, value
 
diff --git a/zookeeper-contrib/zookeeper-contrib-monitoring/ganglia/zookeeper.pyconf b/zookeeper-contrib/zookeeper-contrib-monitoring/ganglia/zookeeper.pyconf
index 44acd93e162..861028010a9 100644
--- a/zookeeper-contrib/zookeeper-contrib-monitoring/ganglia/zookeeper.pyconf
+++ b/zookeeper-contrib/zookeeper-contrib-monitoring/ganglia/zookeeper.pyconf
@@ -43,7 +43,7 @@ collection_group {
   metric { name = "zk_approximate_data_size" }
   metric { name = "zk_open_file_descriptor_count" }
   metric { name = "zk_max_file_descriptor_count" }
-  metric { name = "zk_followers" }
+  metric { name = "zk_learners" }
   metric { name = "zk_synced_followers" }
   metric { name = "zk_pending_syncs" }
   metric { name = "zk_last_proposal_size" }
diff --git a/zookeeper-contrib/zookeeper-contrib-monitoring/ganglia/zookeeper_ganglia.py b/zookeeper-contrib/zookeeper-contrib-monitoring/ganglia/zookeeper_ganglia.py
index bbb7a8e68e0..eb0e92052bb 100644
--- a/zookeeper-contrib/zookeeper-contrib-monitoring/ganglia/zookeeper_ganglia.py
+++ b/zookeeper-contrib/zookeeper-contrib-monitoring/ganglia/zookeeper_ganglia.py
@@ -212,7 +212,7 @@ def metric_init(params=None):
         'zk_approximate_data_size': {'units': 'bytes'},
         'zk_open_file_descriptor_count': {'units': 'descriptors'},
         'zk_max_file_descriptor_count': {'units': 'descriptors'},
-        'zk_followers': {'units': 'nodes'},
+        'zk_learners': {'units': 'nodes'},
         'zk_synced_followers': {'units': 'nodes'},
         'zk_pending_syncs': {'units': 'syncs'},
         'zk_last_proposal_size': {'units': 'bytes'},
diff --git a/zookeeper-contrib/zookeeper-contrib-monitoring/nagios/README.txt b/zookeeper-contrib/zookeeper-contrib-monitoring/nagios/README.txt
index 317ae14869b..27a12566ffa 100644
--- a/zookeeper-contrib/zookeeper-contrib-monitoring/nagios/README.txt
+++ b/zookeeper-contrib/zookeeper-contrib-monitoring/nagios/README.txt
@@ -39,7 +39,7 @@ $ cp zookeeper.cfg /etc/nagios-plugins/config
 
 4. Create a virtual host in Nagios used for monitoring the cluster as a whole -OR-  Create a hostgroup named 'zookeeper-servers' and add all the zookeeper cluster nodes. 
 
-5. Define service checks like I have ilustrated bellow or just use the provided definitions.
+5. Define service checks like I have illustrated bellow or just use the provided definitions.
 
 define service {
     use         generic-service
diff --git a/zookeeper-contrib/zookeeper-contrib-rest/SPEC.txt b/zookeeper-contrib/zookeeper-contrib-rest/SPEC.txt
index 8c5f70175a6..3b25bb2df9a 100644
--- a/zookeeper-contrib/zookeeper-contrib-rest/SPEC.txt
+++ b/zookeeper-contrib/zookeeper-contrib-rest/SPEC.txt
@@ -39,7 +39,7 @@ that are easy and familiar to program against, and deployed as part of
 the language runtime. Thus, for simple CRUD clients, an HTTP gateway
 would be a less cumbersome interface than the ZooKeeper library.
 
-This document describes a gatway for using HTTP to interact with a
+This document describes a gateway for using HTTP to interact with a
 ZooKeeper repository.
 
 Binding ZooKeeper to HTTP
@@ -72,7 +72,7 @@ best practice.
 Root
 ----
 
-The following examples assume that the ZooKeeper znode heirarchy is
+The following examples assume that the ZooKeeper znode hierarchy is
 bound to the root of the HTTP servers namespace. This may not be the
 case in practice however, the gateway may bind to some prefix, for
 example the URL for accessing /a/b/c may be:
@@ -128,14 +128,14 @@ a new session.
 
 If the session creation is successful, then a 201 code will be returned.
 
-A session is just an UUID that you can pass around as a parameter and
-the REST server will foward your request on the attached persistent 
+A session is just a UUID that you can pass around as a parameter and
+the REST server will forward your request on the attached persistent
 connection.
 
 Keeping a session alive
 -----------------------
 
-To keep a session alive you must send hearbeat requests:
+To keep a session alive you must send heartbeat requests:
 
   PUT /sessions/v1/<SESSION-UUID> HTTP/1.1
 
diff --git a/zookeeper-contrib/zookeeper-contrib-rest/conf/log4j.properties b/zookeeper-contrib/zookeeper-contrib-rest/conf/log4j.properties
deleted file mode 100644
index 21ba7e4851b..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-rest/conf/log4j.properties
+++ /dev/null
@@ -1,68 +0,0 @@
-#
-# 
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-# 
-#   http://www.apache.org/licenses/LICENSE-2.0
-# 
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-# 
-#
-
-#
-# ZooKeeper Logging Configuration
-#
-
-# Format is "<default threshold> (, <appender>)+
-
-# DEFAULT: console appender only
-log4j.rootLogger=INFO, CONSOLE
-
-# Example with rolling log file
-#log4j.rootLogger=DEBUG, CONSOLE, ROLLINGFILE
-
-# Example with rolling log file and tracing
-#log4j.rootLogger=TRACE, CONSOLE, ROLLINGFILE, TRACEFILE
-
-#
-# Log INFO level and above messages to the console
-#
-log4j.appender.CONSOLE=org.apache.log4j.ConsoleAppender
-log4j.appender.CONSOLE.Threshold=INFO
-log4j.appender.CONSOLE.layout=org.apache.log4j.PatternLayout
-log4j.appender.CONSOLE.layout.ConversionPattern=%d{ISO8601} - %-5p - [%t:%C{1}@%L] - %m%n
-
-#
-# Add ROLLINGFILE to rootLogger to get log file output
-#    Log DEBUG level and above messages to a log file
-log4j.appender.ROLLINGFILE=org.apache.log4j.ConsoleAppender
-log4j.appender.ROLLINGFILE.Threshold=DEBUG
-log4j.appender.ROLLINGFILE.File=bookkeeper.log
-log4j.appender.ROLLINGFILE.layout=org.apache.log4j.PatternLayout
-log4j.appender.ROLLINGFILE.layout.ConversionPattern=%d{ISO8601} - %-5p - [%t:%C{1}@%L] - %m%n
-
-# Max log file size of 10MB
-log4j.appender.ROLLINGFILE.MaxFileSize=10MB
-# uncomment the next line to limit number of backup files
-#log4j.appender.ROLLINGFILE.MaxBackupIndex=10
-
-#
-# Add TRACEFILE to rootLogger to get log file output
-#    Log DEBUG level and above messages to a log file
-log4j.appender.TRACEFILE=org.apache.log4j.FileAppender
-log4j.appender.TRACEFILE.Threshold=TRACE
-log4j.appender.TRACEFILE.File=bookkeeper_trace.log
-
-log4j.appender.TRACEFILE.layout=org.apache.log4j.PatternLayout
-### Notice we are including log4j's NDC here (%x)
-log4j.appender.TRACEFILE.layout.ConversionPattern=%d{ISO8601} - %-5p [%t:%C{1}@%L][%x] - %m%n
diff --git a/zookeeper-contrib/zookeeper-contrib-rest/conf/logback.xml b/zookeeper-contrib/zookeeper-contrib-rest/conf/logback.xml
new file mode 100644
index 00000000000..84a53896954
--- /dev/null
+++ b/zookeeper-contrib/zookeeper-contrib-rest/conf/logback.xml
@@ -0,0 +1,114 @@
+<!--
+ Copyright 2022 The Apache Software Foundation
+
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements.  See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership.  The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+ Define some default values that can be overridden by system properties
+-->
+<configuration>
+  <!-- Uncomment this if you would like to expose Logback JMX beans -->
+  <!--jmxConfigurator /-->
+
+  <property name="zookeeper.console.threshold" value="INFO" />
+
+  <property name="zookeeper.log.dir" value="." />
+  <property name="zookeeper.log.file" value="zookeeper.log" />
+  <property name="zookeeper.log.threshold" value="INFO" />
+  <property name="zookeeper.log.maxfilesize" value="256MB" />
+  <property name="zookeeper.log.maxbackupindex" value="20" />
+
+  <!--
+    console
+    Add "console" to root logger if you want to use this
+  -->
+  <appender name="CONSOLE" class="ch.qos.logback.core.ConsoleAppender">
+    <encoder>
+      <pattern>%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L] - %m%n</pattern>
+    </encoder>
+    <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
+      <level>${zookeeper.console.threshold}</level>
+    </filter>
+  </appender>
+
+  <!--
+    Add ROLLINGFILE to root logger to get log file output
+  -->
+  <!--appender name="ROLLINGFILE" class="ch.qos.logback.core.rolling.RollingFileAppender">
+    <File>${zookeeper.log.dir}/${zookeeper.log.file}</File>
+    <encoder>
+      <pattern>%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L] - %m%n</pattern>
+    </encoder>
+    <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
+      <level>${zookeeper.log.threshold}</level>
+    </filter>
+    <rollingPolicy class="ch.qos.logback.core.rolling.FixedWindowRollingPolicy">
+      <maxIndex>${zookeeper.log.maxbackupindex}</maxIndex>
+      <FileNamePattern>${zookeeper.log.dir}/${zookeeper.log.file}.%i</FileNamePattern>
+    </rollingPolicy>
+    <triggeringPolicy class="ch.qos.logback.core.rolling.SizeBasedTriggeringPolicy">
+      <MaxFileSize>${zookeeper.log.maxfilesize}</MaxFileSize>
+    </triggeringPolicy>
+  </appender-->
+
+  <!--
+    Add TRACEFILE to root logger to get log file output
+    Log TRACE level and above messages to a log file
+  -->
+  <!--property name="zookeeper.tracelog.dir" value="${zookeeper.log.dir}" />
+  <property name="zookeeper.tracelog.file" value="zookeeper_trace.log" />
+  <appender name="TRACEFILE" class="ch.qos.logback.core.FileAppender">
+    <File>${zookeeper.tracelog.dir}/${zookeeper.tracelog.file}</File>
+    <encoder>
+      <pattern>%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L] - %m%n</pattern>
+    </encoder>
+    <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
+      <level>TRACE</level>
+    </filter>
+  </appender-->
+
+  <!--
+    zk audit logging
+  -->
+  <!--property name="zookeeper.auditlog.file" value="zookeeper_audit.log" />
+  <property name="zookeeper.auditlog.threshold" value="INFO" />
+  <property name="audit.logger" value="INFO, RFAAUDIT" />
+
+  <appender name="RFAAUDIT" class="ch.qos.logback.core.rolling.RollingFileAppender">
+    <File>${zookeeper.log.dir}/${zookeeper.auditlog.file}</File>
+    <encoder>
+      <pattern>%d{ISO8601} %p %c{2}: %m%n</pattern>
+    </encoder>
+    <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
+      <level>${zookeeper.auditlog.threshold}</level>
+    </filter>
+    <rollingPolicy class="ch.qos.logback.core.rolling.FixedWindowRollingPolicy">
+      <maxIndex>10</maxIndex>
+      <FileNamePattern>${zookeeper.log.dir}/${zookeeper.auditlog.file}.%i</FileNamePattern>
+    </rollingPolicy>
+    <triggeringPolicy class="ch.qos.logback.core.rolling.SizeBasedTriggeringPolicy">
+      <MaxFileSize>10MB</MaxFileSize>
+    </triggeringPolicy>
+  </appender>
+
+  <logger name="org.apache.zookeeper.audit.Slf4jAuditLogger" additivity="false" level="${audit.logger}">
+    <appender-ref ref="RFAAUDIT" />
+  </logger-->
+
+  <root level="INFO">
+    <appender-ref ref="CONSOLE" />
+  </root>
+</configuration>
diff --git a/zookeeper-contrib/zookeeper-contrib-rest/pom.xml b/zookeeper-contrib/zookeeper-contrib-rest/pom.xml
old mode 100755
new mode 100644
index 99e4f9f6121..94dc093c12b
--- a/zookeeper-contrib/zookeeper-contrib-rest/pom.xml
+++ b/zookeeper-contrib/zookeeper-contrib-rest/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-contrib</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-contrib-rest</artifactId>
@@ -69,18 +69,8 @@
       <artifactId>slf4j-api</artifactId>
     </dependency>
     <dependency>
-      <groupId>org.slf4j</groupId>
-      <artifactId>slf4j-log4j12</artifactId>
-      <exclusions>
-        <exclusion>
-          <groupId>*</groupId>
-          <artifactId>*</artifactId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>log4j</groupId>
-      <artifactId>log4j</artifactId>
+      <groupId>ch.qos.logback</groupId>
+      <artifactId>logback-core</artifactId>
       <exclusions>
         <exclusion>
           <groupId>*</groupId>
@@ -115,8 +105,8 @@
       <scope>test</scope>
     </dependency>
     <dependency>
-      <groupId>junit</groupId>
-      <artifactId>junit</artifactId>
+      <groupId>org.junit.vintage</groupId>
+      <artifactId>junit-vintage-engine</artifactId>
       <scope>test</scope>
     </dependency>
   </dependencies>
diff --git a/zookeeper-contrib/zookeeper-contrib-rest/rest.sh b/zookeeper-contrib/zookeeper-contrib-rest/rest.sh
old mode 100644
new mode 100755
index daa819836e2..efbf0126ef1
--- a/zookeeper-contrib/zookeeper-contrib-rest/rest.sh
+++ b/zookeeper-contrib/zookeeper-contrib-rest/rest.sh
@@ -1,19 +1,22 @@
-#!/bin/sh
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
 
 #
 # If this scripted is run out of /usr/bin or some other system bin directory
@@ -22,24 +25,27 @@
 #
 
 # Only follow symlinks if readlink supports it
-if readlink -f "$0" > /dev/null 2>&1
-then
-  ZKREST=`readlink -f "$0"`
+if readlink -f "$0" &>/dev/null; then
+  ZKREST=$(readlink -f "$0")
 else
   ZKREST="$0"
 fi
-ZKREST_HOME=`dirname "$ZKREST"`
+ZKREST_HOME=$(dirname "$ZKREST")
 
-if $cygwin
-then
-    # cygwin has a "kill" in the shell itself, gets confused
-    KILL=/bin/kill
+case "$(uname)" in
+  CYGWIN* | MINGW*) cygwin=true ;;
+  *) cygwin=false ;;
+esac
+
+if $cygwin; then
+  # cygwin has a "kill" in the shell itself, gets confused
+  KILL='/bin/kill'
 else
-    KILL=kill
+  KILL='kill'
 fi
 
-if [ -z $ZKREST_PIDFILE ]
-    then ZKREST_PIDFILE=$ZKREST_HOME/server.pid
+if [[ -z $ZKREST_PIDFILE ]]; then
+  ZKREST_PIDFILE=$ZKREST_HOME/server.pid
 fi
 
 ZKREST_MAIN=org.apache.zookeeper.server.jersey.RestMain
@@ -49,42 +55,43 @@ ZKREST_LOG=$ZKREST_HOME/zkrest.log
 
 CLASSPATH="$ZKREST_CONF:$CLASSPATH"
 
-for i in "$ZKREST_HOME"/lib/*.jar
-do
-    CLASSPATH="$i:$CLASSPATH"
+for i in "$ZKREST_HOME"/lib/*.jar; do
+  CLASSPATH="$i:$CLASSPATH"
 done
 
-for i in "$ZKREST_HOME"/zookeeper-*.jar
-do
-    CLASSPATH="$i:$CLASSPATH"
+for i in "$ZKREST_HOME"/zookeeper-*.jar; do
+  CLASSPATH="$i:$CLASSPATH"
 done
+export CLASSPATH
 
 case $1 in
-start)
-    echo  "Starting ZooKeeper REST Gateway ... "
-    java  -cp "$CLASSPATH" $JVMFLAGS $ZKREST_MAIN >$ZKREST_LOG 2>&1 &
-    /bin/echo -n $! > "$ZKREST_PIDFILE"
+  start)
+    echo "Starting ZooKeeper REST Gateway ... "
+    # shellcheck disable=SC2206
+    flags=($JVMFLAGS)
+    java "${flags[@]}" "$ZKREST_MAIN" &>"$ZKREST_LOG" &
+    echo -n $! >"$ZKREST_PIDFILE"
     echo STARTED
     ;;
-stop)
+  stop)
     echo "Stopping ZooKeeper REST Gateway ... "
-    if [ ! -f "$ZKREST_PIDFILE" ]
-    then
-    echo "error: could not find file $ZKREST_PIDFILE"
-    exit 1
+    if [[ ! -f $ZKREST_PIDFILE ]]; then
+      echo "error: could not find file $ZKREST_PIDFILE"
+      exit 1
     else
-    $KILL -9 $(cat "$ZKREST_PIDFILE")
-    rm "$ZKREST_PIDFILE"
-    echo STOPPED
+      $KILL -9 "$(cat "$ZKREST_PIDFILE")"
+      rm "$ZKREST_PIDFILE"
+      echo STOPPED
     fi
     ;;
-restart)
+  restart)
     shift
-    "$0" stop ${@}
+    "$0" stop "$@"
     sleep 3
-    "$0" start ${@}
+    "$0" start "$@"
     ;;
-*)
+  *)
     echo "Usage: $0 {start|stop|restart}" >&2
+    ;;
 
 esac
diff --git a/zookeeper-contrib/zookeeper-contrib-rest/src/main/java/org/apache/zookeeper/server/jersey/RestMain.java b/zookeeper-contrib/zookeeper-contrib-rest/src/main/java/org/apache/zookeeper/server/jersey/RestMain.java
index 954ad045b1c..209207f6b14 100644
--- a/zookeeper-contrib/zookeeper-contrib-rest/src/main/java/org/apache/zookeeper/server/jersey/RestMain.java
+++ b/zookeeper-contrib/zookeeper-contrib-rest/src/main/java/org/apache/zookeeper/server/jersey/RestMain.java
@@ -22,6 +22,7 @@
 import java.io.IOException;
 import java.net.URISyntaxException;
 import java.net.URL;
+import java.nio.file.Files;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -53,7 +54,8 @@ public void start() throws IOException {
        System.out.println("Starting grizzly ...");
 
        boolean useSSL = cfg.useSSL();
-       gws = new GrizzlyWebServer(cfg.getPort(), "/tmp/23cxv45345/2131xc2/", useSSL);
+       String zkRestResourcesTempPath = Files.createTempDirectory("zkRestResourcesTempPath").toFile().getCanonicalPath();
+       gws = new GrizzlyWebServer(cfg.getPort(), zkRestResourcesTempPath, useSSL);
        // BUG: Grizzly needs a doc root if you are going to register multiple adapters
 
        for (Endpoint e : cfg.getEndpoints()) {
diff --git a/zookeeper-contrib/zookeeper-contrib-rest/src/main/java/org/apache/zookeeper/server/jersey/resources/ZNodeResource.java b/zookeeper-contrib/zookeeper-contrib-rest/src/main/java/org/apache/zookeeper/server/jersey/resources/ZNodeResource.java
index 77371eab53d..84eaca819e2 100644
--- a/zookeeper-contrib/zookeeper-contrib-rest/src/main/java/org/apache/zookeeper/server/jersey/resources/ZNodeResource.java
+++ b/zookeeper-contrib/zookeeper-contrib-rest/src/main/java/org/apache/zookeeper/server/jersey/resources/ZNodeResource.java
@@ -307,7 +307,7 @@ public Response createZNode(
             throw new WebApplicationException(Response.status(
                     Response.Status.BAD_REQUEST).entity(
                     new ZError(ui.getRequestUri().toString(), path
-                            + " bad operaton " + op)).build());
+                            + " bad operation " + op)).build());
         }
 
         if (setNull.equals("true")) {
@@ -358,7 +358,7 @@ public Response createZNodeAsOctet(@PathParam("path") String path,
             throw new WebApplicationException(Response.status(
                     Response.Status.BAD_REQUEST).entity(
                     new ZError(ui.getRequestUri().toString(), path
-                            + " bad operaton " + op)).build());
+                            + " bad operation " + op)).build());
         }
 
         if (setNull.equals("true")) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/JUnit4ZKTestRunner.java b/zookeeper-contrib/zookeeper-contrib-rest/src/test/java/org/apache/zookeeper/JUnit4ZKTestRunner.java
similarity index 100%
rename from zookeeper-server/src/test/java/org/apache/zookeeper/JUnit4ZKTestRunner.java
rename to zookeeper-contrib/zookeeper-contrib-rest/src/test/java/org/apache/zookeeper/JUnit4ZKTestRunner.java
diff --git a/zookeeper-contrib/zookeeper-contrib-rest/src/test/zkServer.sh b/zookeeper-contrib/zookeeper-contrib-rest/src/test/zkServer.sh
index 4279d34265f..4272130173a 100755
--- a/zookeeper-contrib/zookeeper-contrib-rest/src/test/zkServer.sh
+++ b/zookeeper-contrib/zookeeper-contrib-rest/src/test/zkServer.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#! /usr/bin/env bash
 #
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements.  See the NOTICE file
@@ -8,84 +8,78 @@
 # "License"); you may not use this file except in compliance
 # with the License.  You may obtain a copy of the License at
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
 
-if [ "x$1" == "x" ]
-then
-    echo "USAGE: $0 startClean|start|stop hostPorts"
-    exit 2
+if [[ -z $1 ]]; then
+  echo "USAGE: $0 startClean|start|stop hostPorts"
+  exit 2
 fi
 
-if [ "x$1" == "xstartClean" ]
-then
-    if [ "x${base_dir}" == "x" ]
-    then
+if [[ $1 == "startClean" ]]; then
+  if [[ -z $base_dir ]]; then
     rm -rf /tmp/zkdata
-    else
-    rm -rf ${base_dir}/build/tmp
-    fi
+  else
+    rm -rf "$base_dir/build/tmp"
+  fi
 fi
 
 # Make sure nothing is left over from before
-if [ -r "/tmp/zk.pid" ]
-then
-pid=`cat /tmp/zk.pid`
-kill -9 $pid
-rm -f /tmp/zk.pid
+if [[ -r "/tmp/zk.pid" ]]; then
+  pid=$(cat /tmp/zk.pid)
+  kill -9 "$pid"
+  rm -f /tmp/zk.pid
 fi
 
-if [ -r "${base_dir}/build/tmp/zk.pid" ]
-then
-pid=`cat ${base_dir}/build/tmp/zk.pid`
-kill -9 $pid
-rm -f ${base_dir}/build/tmp/zk.pid
+if [[ -r "$base_dir/build/tmp/zk.pid" ]]; then
+  pid=$(cat "$base_dir/build/tmp/zk.pid")
+  kill -9 "$pid"
+  rm -f "$base_dir/build/tmp/zk.pid"
 fi
 
-if [ "x${base_dir}" == "x" ]	
-then
-zk_base="../../../"
+if [[ -z $base_dir ]]; then
+  zk_base="../../../"
 else
-zk_base="${base_dir}"
+  zk_base="$base_dir"
 fi
 
-CLASSPATH="$CLASSPATH:${zk_base}/build/classes"
-CLASSPATH="$CLASSPATH:${zk_base}/conf"
+CLASSPATH="$CLASSPATH:$zk_base/build/classes"
+CLASSPATH="$CLASSPATH:$zk_base/conf"
 
-for i in "${zk_base}"/build/lib/*.jar
-do
-    CLASSPATH="$CLASSPATH:$i"
+for i in "$zk_base"/build/lib/*.jar; do
+  CLASSPATH="$CLASSPATH:$i"
 done
 
-for i in "${zk_base}"/zookeeper-server/src/main/resource/lib/*.jar
-do
-    CLASSPATH="$CLASSPATH:$i"
+for i in "$zk_base"/zookeeper-server/src/main/resource/lib/*.jar; do
+  CLASSPATH="$CLASSPATH:$i"
 done
+export CLASSPATH
 
 case $1 in
-start|startClean)
-    if [ "x${base_dir}" == "x" ]
-        then
-        mkdir -p /tmp/zkdata
-        java -cp $CLASSPATH org.apache.zookeeper.server.ZooKeeperServerMain 22182 /tmp/zkdata &> /tmp/zk.log &
-        echo $! > /tmp/zk.pid
-        else
-        mkdir -p ${base_dir}/build/tmp/zkdata
-        java -cp $CLASSPATH org.apache.zookeeper.server.ZooKeeperServerMain 22182 ${base_dir}/build/tmp/zkdata &> ${base_dir}/build/tmp/zk.log &
-        echo $! > ${base_dir}/build/tmp/zk.pid
+  start | startClean)
+    if [[ -z $base_dir ]]; then
+      mkdir -p /tmp/zkdata
+      java org.apache.zookeeper.server.ZooKeeperServerMain 22182 /tmp/zkdata &>/tmp/zk.log &
+      echo $! >/tmp/zk.pid
+    else
+      mkdir -p "$base_dir/build/tmp/zkdata"
+      java org.apache.zookeeper.server.ZooKeeperServerMain 22182 "$base_dir/build/tmp/zkdata" &>"$base_dir/build/tmp/zk.log" &
+      echo $! >"$base_dir/build/tmp/zk.pid"
     fi
-        sleep 5
+    sleep 5
     ;;
-stop)
+  stop)
     # Already killed above
     ;;
-*)
-    echo "Unknown command " + $1
+  *)
+    echo "Unknown command $1"
     exit 2
+    ;;
 esac
-
diff --git a/zookeeper-contrib/zookeeper-contrib-zkfuse/src/blockingqueue.h b/zookeeper-contrib/zookeeper-contrib-zkfuse/src/blockingqueue.h
index 4677290d7b6..aad10c29839 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkfuse/src/blockingqueue.h
+++ b/zookeeper-contrib/zookeeper-contrib-zkfuse/src/blockingqueue.h
@@ -50,7 +50,7 @@ class BlockingQueue {
          * \brief Retrieves and removes the head of this queue, waiting if 
          * \brief no elements are present in this queue.
          * 
-         * @param timeout how long to wait until an element becomes availabe, 
+         * @param timeout how long to wait until an element becomes available,
          *                in milliseconds; if <code>0</code> then wait forever
          * @param timedOut if not NULL then set to true whether this function timed out
          * @return the element from the queue
diff --git a/zookeeper-contrib/zookeeper-contrib-zkfuse/src/doxygen.cfg b/zookeeper-contrib/zookeeper-contrib-zkfuse/src/doxygen.cfg
index 308b09450a4..da384f1b33a 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkfuse/src/doxygen.cfg
+++ b/zookeeper-contrib/zookeeper-contrib-zkfuse/src/doxygen.cfg
@@ -401,7 +401,7 @@ SHOW_DIRECTORIES       = YES
 # version control system). Doxygen will invoke the program by executing (via 
 # popen()) the command <command> <input-file>, where <command> is the value of 
 # the FILE_VERSION_FILTER tag, and <input-file> is the name of an input file 
-# provided by doxygen. Whatever the progam writes to standard output 
+# provided by doxygen. Whatever the program writes to standard output
 # is used as the file version. See the manual for examples.
 
 FILE_VERSION_FILTER    = 
diff --git a/zookeeper-contrib/zookeeper-contrib-zkfuse/src/event.h b/zookeeper-contrib/zookeeper-contrib-zkfuse/src/event.h
index 936ecc60453..f218be6e7b6 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkfuse/src/event.h
+++ b/zookeeper-contrib/zookeeper-contrib-zkfuse/src/event.h
@@ -183,7 +183,7 @@ class GenericEvent {
          * \brief Constructor.
          * 
          * @param type the type of this event
-         * @param eventWarpper the wrapper around event's data
+         * @param eventWrapper the wrapper around event's data
          */
         GenericEvent(int type, AbstractEventWrapper *eventWrapper) : 
             m_type(type), m_eventWrapper(eventWrapper) {
diff --git a/zookeeper-contrib/zookeeper-contrib-zkfuse/src/thread.h b/zookeeper-contrib/zookeeper-contrib-zkfuse/src/thread.h
index 0ed12d7f645..91321cd6873 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkfuse/src/thread.h
+++ b/zookeeper-contrib/zookeeper-contrib-zkfuse/src/thread.h
@@ -41,7 +41,7 @@ class Thread {
 
     void Create(void* ctx, ThreadFunc func);
     void Join() {
-        //avoid SEGFAULT because of unitialized mThread
+        //avoid SEGFAULT because of uninitialized mThread
         //in case Create(...) was never called
         if (_func != NULL) {
             pthread_join(mThread, 0);
diff --git a/zookeeper-contrib/zookeeper-contrib-zkfuse/src/zkadapter.cc b/zookeeper-contrib/zookeeper-contrib-zkfuse/src/zkadapter.cc
index 7f02fa33b72..55f72396829 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkfuse/src/zkadapter.cc
+++ b/zookeeper-contrib/zookeeper-contrib-zkfuse/src/zkadapter.cc
@@ -505,7 +505,7 @@ ZooKeeperAdapter::verifyConnection() throw(ZooKeeperException)
             if (m_state != AS_CONNECTING) {
                 LOG_TRACE( LOG, 
                            "yes. Checking if allowed to auto-reconnect..." );
-                //...not in progres, so check if we can reconnect
+                //...not in progress, so check if we can reconnect
                 if (!m_zkConfig.getAutoReconnect()) {
                     //...too bad, disallowed :(
                     LOG_TRACE( LOG, "no. Sorry." );
diff --git a/zookeeper-contrib/zookeeper-contrib-zkfuse/src/zkadapter.h b/zookeeper-contrib/zookeeper-contrib-zkfuse/src/zkadapter.h
index 8d4d1d57f0a..66312d5c4fd 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkfuse/src/zkadapter.h
+++ b/zookeeper-contrib/zookeeper-contrib-zkfuse/src/zkadapter.h
@@ -160,7 +160,7 @@ class ZooKeeperConfig
         const int m_leaseTimeout;
         
         /**
-         * True if this adapater should attempt to autoreconnect in case 
+         * True if this adapter should attempt to autoreconnect in case
          * the current session has been dropped.
          */
         const bool m_autoReconnect;
@@ -616,7 +616,7 @@ class ZooKeeperAdapter
 
         /**
          * Returns the remaining connect timeout. The timeout resets
-         * to {@link #m_connectTimeout} on a successfull connection to the ZK.
+         * to {@link #m_connectTimeout} on a successful connection to the ZK.
          * 
          * @return the remaining connect timeout, in milliseconds
          */
diff --git a/zookeeper-contrib/zookeeper-contrib-zkfuse/src/zkfuse.cc b/zookeeper-contrib/zookeeper-contrib-zkfuse/src/zkfuse.cc
index 6a8216885fa..cfe552c349c 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkfuse/src/zkfuse.cc
+++ b/zookeeper-contrib/zookeeper-contrib-zkfuse/src/zkfuse.cc
@@ -320,7 +320,7 @@ enum ZkFuseNameType {
      */
     ZkFuseNameRegType = 1,
     /**
-      ZkFuse path is synthesized and identifies the chidlren part of a
+      ZkFuse path is synthesized and identifies the children part of a
       ZooKeeper node, i.e.  Posix directory semantics is expected.
      */
     ZkFuseNameDirType = 2
@@ -707,7 +707,7 @@ class ZkFuseHandleManager : boost::noncopyable
   ZkFuseHandleManagerFactory - factory for ZkFuseHandleManager.
   
   This is the only way to create a ZkFuseHandleManager instance. 
-  to make sure that _thisWeakPtr of the instance is intialized 
+  to make sure that _thisWeakPtr of the instance is initialized
   after the instance is created.
  */
 class ZkFuseHandleManagerFactory
@@ -1354,7 +1354,7 @@ class ZkFuseFile : boost::noncopyable
          */
         uint32_t version;
         /**
-          Acces time in milliseconds.
+          Access time in milliseconds.
          */
         uint64_t atime;
         /**
@@ -1535,7 +1535,7 @@ class ZkFuseFile : boost::noncopyable
     /**
       Remove a ZkFuse directory.
 
-      If force is true, then the ZooKeeper node and its decendants
+      If force is true, then the ZooKeeper node and its descendants
       will be deleted.
 
       If force is false, then this method implements the semantics
@@ -1614,7 +1614,7 @@ class ZkFuseFile : boost::noncopyable
         the ZooKeeper node has no data.
       - If the ZkFuse regular file represents the data part of the 
         ZooKeeper node which is presented as a ZkFuse regular file,
-        the ZooKeeper node and its decendants are deleted.
+        the ZooKeeper node and its descendants are deleted.
 
       Returns -EISDIR if the ZkFuse regular file cannot be deleted
       because ZkFuse consider it to be a directory.
@@ -1711,7 +1711,7 @@ class ZkFuseFile : boost::noncopyable
       Get attributes without accessing metadata.
       
       The atime and mtime returned does not take into consideration
-      overrides present in a matadata file.
+      overrides present in a metadata file.
 
       \return 0 if successful, otherwise negative errno.
       \param stbuf return attributes here.
@@ -1836,7 +1836,7 @@ class ZkFuseFile : boost::noncopyable
       a client is trying to open the path. \see _refCount.
       Sets deleted to true. \see _deleted.
       Sets number of currently directory opens to zero. \see _openDirCount.
-      Invalidate cach for children information and data. 
+      Invalidate cache for children information and data.
 
       \param manager the ZkFuseHandleManager instance who is creating this 
                      ZkFuseFile instance.
@@ -2909,7 +2909,7 @@ class ZkFuseFile : boost::noncopyable
     /**
       Remove a ZkFuse directory.
 
-      If force is true, then the ZooKeeper node and its decendants
+      If force is true, then the ZooKeeper node and its descendants
       will be deleted.
 
       If force is false, then this method implements the semantics
@@ -2956,7 +2956,7 @@ class ZkFuseFile : boost::noncopyable
         the ZooKeeper node has no data.
       - If the ZkFuse regular file represents the data part of the 
         ZooKeeper node which is presented as a ZkFuse regular file,
-        the ZooKeeper node and its decendants are deleted.
+        the ZooKeeper node and its descendants are deleted.
 
       Returns -EISDIR if the ZkFuse regular file cannot be deleted
       because ZkFuse consider it to be a directory.
@@ -3043,7 +3043,7 @@ ZkFuseHandleManager::allocate(const std::string & path, bool & newFile)
             /* Not really supposed to invoke the new ZkFuseFile instance 
              * because this method is not supposed to invoke ZkFuseFile
              * methods that while holding _mutex. However, it is safe
-             * to do without casuing deadlock because these methods
+             * to do without causing deadlock because these methods
              * are known not to invoke other methods, especially one
              * that invoke this ZkFuseHandleManager instance.
              */
diff --git a/zookeeper-contrib/zookeeper-contrib-zkperl/Makefile.PL b/zookeeper-contrib/zookeeper-contrib-zkperl/Makefile.PL
index 9a0996dddcf..0c7486f9e29 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkperl/Makefile.PL
+++ b/zookeeper-contrib/zookeeper-contrib-zkperl/Makefile.PL
@@ -28,21 +28,25 @@ my $ZOO_REQUIRED_VERSION = qr{^$ZOO_MAJOR_VERSION\.\d+.\d+$}ismx;
 my @zk_inc_paths;
 my @zk_lib_paths;
 
+my $with_sasl2 = 0;
+my @sasl2_inc_paths;
+my @sasl2_lib_paths;
+
 GetOptions(
     'zookeeper-include=s' => \@zk_inc_paths,
-    'zookeeper-lib=s' => \@zk_lib_paths
+    'zookeeper-lib=s' => \@zk_lib_paths,
+    'with-sasl2!' => \$with_sasl2,
+    'sasl2-include=s' => \@sasl2_inc_paths,
+    'sasl2-lib=s' => \@sasl2_lib_paths
 );
 
-my $zk_inc_paths = join(' ', map("-I$_", @zk_inc_paths));
-my $zk_lib_paths = join(' ', map("-L$_", @zk_lib_paths));
-
-$zk_inc_paths .= ' ' unless ($zk_inc_paths eq '');
-$zk_lib_paths .= ' ' unless ($zk_lib_paths eq '');
+my $zk_inc = (join(' ', map("-I$_", @zk_inc_paths)) . ' -I.');
+my $zk_libs = (join(' ', map("-L$_", @zk_lib_paths)) . ' -lzookeeper_mt');
 
 my $cc = $Config{'cc'};
 my $check_file = 'build/check_zk_version';
 
-my $check_out = qx($cc $zk_inc_paths $zk_lib_paths -I. -o $check_file $check_file.c 2>&1);
+my $check_out = qx($cc $zk_inc -o $check_file $check_file.c $zk_libs 2>&1);
 
 if ($?) {
     if ($check_out =~ /zookeeper_version\.h/) {
@@ -63,11 +67,21 @@ elsif ($zk_ver !~ $ZOO_REQUIRED_VERSION) {
   warn "Net::ZooKeeper requires ZooKeeper 3.x, found $zk_ver!";
 }
 
+my @inc = ($zk_inc);
+my @libs = ($zk_libs);
+my %mmopt = ();
+
+if ($with_sasl2) {
+    push(@inc, join(' ', map("-I$_", @sasl2_inc_paths)));
+    push(@libs, join(' ', map("-L$_", @sasl2_lib_paths)) . ' -lsasl2');
+    $mmopt{DEFINE} = '-DHAVE_CYRUS_SASL_H';
+}
+
 WriteMakefile(
-    'INC'          => "$zk_inc_paths-I.",
-    'LIBS'         => [ "$zk_lib_paths-lzookeeper_mt" ],
+    'INC'          => join(' ', @inc),
+    'LIBS'         => \@libs,
     'NAME'         => 'Net::ZooKeeper',
     'VERSION_FROM' => 'ZooKeeper.pm',
-    'clean'        => { 'FILES' => 'build/check_zk_version.o' }
+    'clean'        => { 'FILES' => 'build/check_zk_version.o' },
+    %mmopt,
 );
-
diff --git a/zookeeper-contrib/zookeeper-contrib-zkperl/README b/zookeeper-contrib/zookeeper-contrib-zkperl/README
index bbe2a0d8f3b..ac13481529c 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkperl/README
+++ b/zookeeper-contrib/zookeeper-contrib-zkperl/README
@@ -32,6 +32,15 @@ ZooKeeper C include files.
 The path supplied to the --zookeeper-lib option should identify
 the directory that contains the libzookeeper_mt library.
 
+If the C client supports Cyrus SASL (ZOOKEEPER-1112), it can also be
+enabled in the Perl binding by passing a --with-sasl2 flag (and,
+optionally, non-standard locations):
+
+    perl Makefile.PL \
+        --with-sasl2 \
+        --sasl2-include=/path/to/sasl2/include \
+        --sasl2-lib=/path/to/sasl2/lib
+
 When running "make test", if no ZK_TEST_HOSTS environment
 variable is set, many tests will be skipped because no connection
 to a ZooKeeper server is available.  To execute these tests,
@@ -44,6 +53,18 @@ The tests expect to have full read/write/create/delete/admin
 ZooKeeper permissions under this path.  If no ZK_TEST_PATH
 variable is defined, the root ZooKeeper path ("/") is used.
 
+The ZK_TEST_SASL_OPTIONS environment variable, if defined, provides a
+JSON-encoded map of SASL authentication options, enabling SASL tests.
+E.g.,
+
+    {
+       "host": "zk-sasl-md5",
+       "mechlist": "DIGEST-MD5",
+       "service": "zookeeper",
+       "user": "bob",
+       "password_file": "bob.secret"
+    }
+
 DEPENDENCIES
 
 Version 3.1.1 of ZooKeeper is required at a minimum.
diff --git a/zookeeper-contrib/zookeeper-contrib-zkperl/ZooKeeper.pm b/zookeeper-contrib/zookeeper-contrib-zkperl/ZooKeeper.pm
index 507f0298d16..b17c9704c17 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkperl/ZooKeeper.pm
+++ b/zookeeper-contrib/zookeeper-contrib-zkperl/ZooKeeper.pm
@@ -688,7 +688,8 @@ The following methods are defined for the Net::ZooKeeper class.
   $zkh = Net::ZooKeeper->new('host1:7000,host2:7000');
   $zkh = Net::ZooKeeper->new('host1:7000,host2:7000',
                              'session_timeout' => $session_timeout,
-                             'session_id' => $session_id);
+                             'session_id' => $session_id,
+                             'sasl_options' => $sasl_options);
 
 Creates a new Net::ZooKeeper handle object and attempts to
 connect to the one of the servers of the given ZooKeeper
@@ -725,6 +726,33 @@ initial connection request; again, the actual timeout period to
 which the server agrees will be available subsequently as the
 value of the C<session_timeout> attribute.
 
+If a C<'sasl_options'> option is provided, it is used to automatically
+SASL-authenticate with the server during connections (including
+reconnects).  Here is a brief description of the recognized keys;
+please refer to the C client documentation for details:
+
+=over 5
+
+=item service => VALUE
+
+=item host => VALUE
+
+=item mechlist => VALUE
+
+These map to the corresponding fields of C<zoo_sasl_params_t> from the
+library.
+
+=item user => VALUE
+
+=item realm => VALUE
+
+=item password_file => VALUE
+
+These map to the corresponding parameters of
+C<zoo_sasl_make_basic_callbacks> from the library.
+
+=back
+
 Upon successful connection (i.e., after the success of a method
 which requires communication with the server), the C<session_id>
 attribute will hold a short binary string which represents the
diff --git a/zookeeper-contrib/zookeeper-contrib-zkperl/ZooKeeper.xs b/zookeeper-contrib/zookeeper-contrib-zkperl/ZooKeeper.xs
index 4b6067b1024..1fd178aba60 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkperl/ZooKeeper.xs
+++ b/zookeeper-contrib/zookeeper-contrib-zkperl/ZooKeeper.xs
@@ -28,7 +28,9 @@
 #include <limits.h>                     /* CHAR_BIT */
 #include <sys/time.h>                   /* gettimeofday() */
 
+#define THREADED
 #include <zookeeper/zookeeper.h>
+#undef THREADED
 
 #include "build/check_zk_version.h"
 
@@ -758,6 +760,13 @@ zk_new(package, hosts, ...)
         char *hosts
     PREINIT:
         int recv_timeout = DEFAULT_RECV_TIMEOUT_MSEC;
+#ifdef HAVE_CYRUS_SASL_H
+        zoo_sasl_params_t sasl_params = { 0 };
+        const char *sasl_user = NULL;
+        const char *sasl_realm = NULL;
+        const char *sasl_password_file = NULL;
+        int use_sasl = 0;
+#endif /* HAVE_CYRUS_SASL_H */
         const clientid_t *client_id = NULL;
         zk_t *zk;
         zk_handle_t *handle;
@@ -792,12 +801,61 @@ zk_new(package, hosts, ...)
                     Perl_croak(aTHX_ "invalid session ID");
                 }
             }
+#ifdef HAVE_CYRUS_SASL_H
+            else if (strcaseEQ(key, "sasl_options")) {
+                SV *hash_sv = ST(i + 1);
+                HV *hash;
+                char *key;
+                I32 key_length;
+                SV *value;
+
+                if (!SvROK(hash_sv) || SvTYPE(SvRV(hash_sv)) != SVt_PVHV) {
+                    Perl_croak(aTHX_ "sasl_options requires a hash reference");
+                }
+
+                hash = (HV *)SvRV(hash_sv);
+                hv_iterinit(hash);
+                while ((value = hv_iternextsv(hash, &key, &key_length))) {
+                    if (strcaseEQ(key, "service")) {
+                        sasl_params.service = SvPV_nolen(value);
+                    }
+                    else if (strcaseEQ(key, "host")) {
+                        sasl_params.host = SvPV_nolen(value);
+                    }
+                    else if (strcaseEQ(key, "mechlist")) {
+                        sasl_params.mechlist = SvPV_nolen(value);
+                    }
+                    else if (strcaseEQ(key, "user")) {
+                        sasl_user = SvPV_nolen(value);
+                    }
+                    else if (strcaseEQ(key, "realm")) {
+                        sasl_realm = SvPV_nolen(value);
+                    }
+                    else if (strcaseEQ(key, "password_file")) {
+                        sasl_password_file = SvPV_nolen(value);
+                    }
+                }
+                use_sasl = 1;
+            }
+#endif /* HAVE_CYRUS_SASL_H */
         }
 
         Newxz(zk, 1, zk_t);
+#ifdef HAVE_CYRUS_SASL_H
+        if (use_sasl) {
+            /* KLUDGE: Leaks a reference count.  Authen::SASL::XS does
+               the same, though.  TODO(ddiederen): Fix. */
+            sasl_client_init(NULL);
+            sasl_params.callbacks = zoo_sasl_make_basic_callbacks(sasl_user,
+                sasl_realm, sasl_password_file);
+        }
 
+        zk->handle = zookeeper_init_sasl(hosts, NULL, recv_timeout,
+            client_id, NULL, 0, NULL, use_sasl ? &sasl_params : NULL);
+#else
         zk->handle = zookeeper_init(hosts, NULL, recv_timeout,
-                                    client_id, NULL, 0);
+            client_id, NULL, 0);
+#endif /* HAVE_CYRUS_SASL_H */
 
         if (!zk->handle) {
             Safefree(zk);
@@ -1203,7 +1261,7 @@ zk_add_auth(zkh, scheme, cert)
         zk->last_errno = 0;
 
         if (cert_len > PERL_INT_MAX) {
-            Perl_croak(aTHX_ "invalid certificate length: %u", cert_len);
+            Perl_croak(aTHX_ "invalid certificate length: %zu", cert_len);
         }
 
         watch = _zk_create_watch(aTHX);
@@ -1283,7 +1341,7 @@ zk_create(zkh, path, buf, ...)
         }
 
         if (buf_len > PERL_INT_MAX) {
-            Perl_croak(aTHX_ "invalid data length: %u", buf_len);
+            Perl_croak(aTHX_ "invalid data length: %zu", buf_len);
         }
 
         path_buf_len = zk->path_buf_len;
@@ -1318,7 +1376,7 @@ zk_create(zkh, path, buf, ...)
                 err = _zk_fill_acl(aTHX_ acl_arr, &acl);
 
                 if (err) {
-                    Perl_croak(aTHX_ err);
+                    Perl_croak(aTHX_ "%s", err);
                 }
             }
         }
@@ -1757,7 +1815,7 @@ zk_set(zkh, path, buf, ...)
         }
 
         if (buf_len > PERL_INT_MAX) {
-            Perl_croak(aTHX_ "invalid data length: %u", buf_len);
+            Perl_croak(aTHX_ "invalid data length: %zu", buf_len);
         }
 
         for (i = 3; i < items; i += 2) {
@@ -1920,7 +1978,7 @@ zk_set_acl(zkh, path, acl_arr, ...)
         err = _zk_fill_acl(aTHX_ acl_arr, &acl);
 
         if (err) {
-            Perl_croak(aTHX_ err);
+            Perl_croak(aTHX_ "%s", err);
         }
 
         for (i = 3; i < items; i += 2) {
diff --git a/zookeeper-contrib/zookeeper-contrib-zkperl/t/10_invalid.t b/zookeeper-contrib/zookeeper-contrib-zkperl/t/10_invalid.t
index 5e080b64c7d..c1a118e008c 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkperl/t/10_invalid.t
+++ b/zookeeper-contrib/zookeeper-contrib-zkperl/t/10_invalid.t
@@ -527,13 +527,13 @@ like($@, qr/Usage: Net::ZooKeeper::set_acl\(zkh, path, acl_arr, \.\.\.\)/,
 eval {
     $zkh->set_acl($node_path, 'foo');
 };
-like($@, qr/acl_arr is not an array reference/,
+like($@, qr/acl_arr is not an array reference/i,
      'set_acl(): invalid ACL array reference');
 
 eval {
     $zkh->set_acl($node_path, {});
 };
-like($@, qr/acl_arr is not an array reference/,
+like($@, qr/acl_arr is not an array reference/i,
      'set_acl(): invalid ACL array reference to hash');
 
 eval {
diff --git a/zookeeper-contrib/zookeeper-contrib-zkperl/t/30_connect.t b/zookeeper-contrib/zookeeper-contrib-zkperl/t/30_connect.t
index c2b68bb4e5f..4745e427d14 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkperl/t/30_connect.t
+++ b/zookeeper-contrib/zookeeper-contrib-zkperl/t/30_connect.t
@@ -176,6 +176,13 @@ SKIP: {
     ## NOTE: to test re-connections with saved session IDs we create a second
     ## connection with the same ID while the first is still active;
     ## this is bad practice in normal usage
+    ##
+    ## Test disabled because it breaks with current ZooKeeper servers:
+    ## $zkh1's connection gets closed as soon as $zkh2 connects, which
+    ## causes it to reconnect, which kills $zkh2's connection, etc.
+    ## TODO: figure out a way to test this.
+    SKIP: {
+    skip 'does not work with current ZK servers', 4;
 
     my $zkh2 = Net::ZooKeeper->new($hosts,
                                   'session_id' => $session_id1,
@@ -198,5 +205,6 @@ SKIP: {
             and $session_id2 eq $session_id1),
            'FETCH(): reconnect with session ID');
     }
+    }
 }
 
diff --git a/zookeeper-contrib/zookeeper-contrib-zkperl/t/35_log.t b/zookeeper-contrib/zookeeper-contrib-zkperl/t/35_log.t
index 92821afc1f3..cb7f7dbc538 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkperl/t/35_log.t
+++ b/zookeeper-contrib/zookeeper-contrib-zkperl/t/35_log.t
@@ -31,7 +31,7 @@ my($hosts, $root_path, $node_path) = zk_test_setup(0);
 
 my $zkh = Net::ZooKeeper->new($hosts);
 
-Net::ZooKeeper::set_log_level(ZOO_LOG_LEVEL_INFO);
+Net::ZooKeeper::set_log_level(ZOO_LOG_LEVEL_DEBUG);
 
 SKIP: {
     skip 'no valid handle', 2 unless (defined($zkh));
@@ -45,6 +45,7 @@ SKIP: {
 
                 my $old_select = select(STDERR);
                 $| = 1;
+                $/ = undef;     # slurp mode.
                 select($old_select);
             }
             else {
@@ -63,7 +64,7 @@ SKIP: {
             skip 'no seek on stderr', 1 unless (seek(STDERR, 0, 0));
 
             my $log = <STDERR>;
-            like($log, qr/ZOO_/,
+            like($log, qr/ZOO_.*exists/,
                  'exists(): generated log message');
         }
 
@@ -75,7 +76,7 @@ SKIP: {
             skip 'no seek on stderr', 1 unless (seek(STDERR, 0, 0));
 
             my $log = <STDERR>;
-            like($log, qr/ZOO_/,
+            like($log, qr/ZOO_.*close/,
                  'DESTROY(): generated log message');
         }
 
diff --git a/zookeeper-contrib/zookeeper-contrib-zkperl/t/50_access.t b/zookeeper-contrib/zookeeper-contrib-zkperl/t/50_access.t
index ef61ed6688f..71eb17c883b 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkperl/t/50_access.t
+++ b/zookeeper-contrib/zookeeper-contrib-zkperl/t/50_access.t
@@ -18,6 +18,7 @@
 
 use File::Spec;
 use Test::More tests => 40;
+use Storable qw(dclone);
 
 BEGIN { use_ok('Net::ZooKeeper', qw(:all)) };
 
@@ -163,9 +164,16 @@ SKIP: {
         $! eq ''),
        'get_acl(): undef returned for non-extant node');
 
+    # The test is not running as ADMIN, which means that the server
+    # returns "redacted" ACLs (see ZOOKEEPER-1392 and OpCode.getACL in
+    # FinalRequestProcessor).  We must do the same for the comparison
+    # to succeed.
+    my $redacted_digest_acl = dclone($digest_acl);
+    $redacted_digest_acl->[1]->{id} =~ s/:.*/:x/;
+
     @acl = ('abc');
     @acl = $zkh->get_acl($acl_node_path);
-    is_deeply(\@acl, $digest_acl,
+    is_deeply(\@acl, $redacted_digest_acl,
               'get_acl(): retrieved digest ACL');
 
     my $stat = $zkh->stat();
diff --git a/zookeeper-contrib/zookeeper-contrib-zkperl/t/70_sasl.t b/zookeeper-contrib/zookeeper-contrib-zkperl/t/70_sasl.t
new file mode 100644
index 00000000000..9de379a7a4d
--- /dev/null
+++ b/zookeeper-contrib/zookeeper-contrib-zkperl/t/70_sasl.t
@@ -0,0 +1,110 @@
+# Net::ZooKeeper - Perl extension for Apache ZooKeeper
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+use File::Spec;
+use Test::More tests => 7;
+use JSON::PP qw(decode_json);
+
+BEGIN { use_ok('Net::ZooKeeper', qw(:all)) };
+
+
+my $test_dir;
+(undef, $test_dir, undef) = File::Spec->splitpath($0);
+require File::Spec->catfile($test_dir, 'util.pl');
+
+my($hosts, $root_path, $node_path) = zk_test_setup(0);
+
+my $sasl_options = $ENV{'ZK_TEST_SASL_OPTIONS'};
+if (defined($sasl_options)) {
+    $sasl_options = decode_json($sasl_options);
+}
+
+SKIP: {
+    skip 'no sasl_options', 6 unless defined($sasl_options);
+
+    my $zkh = Net::ZooKeeper->new($hosts,
+        'sasl_options' => $sasl_options);
+
+    my $path = $zkh->create($node_path, 'foo',
+                            'acl' => ZOO_OPEN_ACL_UNSAFE) if (defined($zkh));
+
+    skip 'no connection to ZooKeeper', 36 unless
+        (defined($path) and $path eq $node_path);
+
+    ## _zk_acl_constant()
+
+    my $acl_node_path = "$node_path/a1";
+
+    my $sasl_acl = [
+        {
+            'perms'  => ZOO_PERM_READ,
+            'scheme' => 'world',
+            'id'     => 'anyone'
+        },
+        {
+            'perms'  => ZOO_PERM_ALL,
+            'scheme' => 'sasl',
+            'id'     => $sasl_options->{user}
+        }
+    ];
+
+    $path = $zkh->create($acl_node_path, 'foo', 'acl' => $sasl_acl);
+    is($path, $acl_node_path,
+       'create(): created node with SASL ACL');
+
+
+    ## get_acl()
+
+    @acl = ('abc');
+    @acl = $zkh->get_acl($acl_node_path);
+    is_deeply(\@acl, $sasl_acl,
+              'get_acl(): retrieved SASL ACL');
+
+    SKIP: {
+        my $zkh2 = Net::ZooKeeper->new($hosts);
+
+        my $ret = $zkh->exists($root_path) if (defined($zkh));
+
+        skip 'no connection to ZooKeeper', 1 unless
+            (defined($ret) and $ret);
+
+        my $node = $zkh2->get($acl_node_path);
+        is($node, 'foo',
+           'get(): retrieved node value with world ACL');
+
+        $ret = $zkh2->set($acl_node_path, 'bar');
+        ok((!$ret and $zkh2->get_error() == ZNOAUTH and $! eq ''),
+           'set(): node value unchanged if no auth');
+    }
+
+    my $ret = $zkh->set($acl_node_path, 'bar');
+    ok($ret,
+       'set(): set node with SASL ACL');
+
+    my $node = $zkh->get($acl_node_path);
+    is($node, 'bar',
+       'get(): retrieved new node value with SASL ACL');
+
+    $ret = $zkh->delete($acl_node_path);
+    diag(sprintf('unable to delete node %s: %d, %s',
+                 $acl_node_path, $zkh->get_error(), $!)) unless ($ret);
+
+    $ret = $zkh->delete($node_path);
+    diag(sprintf('unable to delete node %s: %d, %s',
+                 $node_path, $zkh->get_error(), $!)) unless ($ret);
+}
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/README b/zookeeper-contrib/zookeeper-contrib-zkpython/README
index 56154618356..ffad255f06f 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/README
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/README
@@ -5,13 +5,15 @@ Please do not rely on APIs staying constant in the short term. The handling of e
 DEPENDENCIES:
 -------------
 
-This has only been tested against SVN (i.e. 3.2.0 in development) but should work against 3.1.1. 
+This has only been tested against SVN/Git (i.e. 3.2.0 in development) but should work against 3.1.1.
 
 You will need the Python development headers installed to build the module - on many package-management systems, these can be found in python-devel. (On ubuntu 18.4, install python2.7 and python2.7-dev.)
 
-Python >= 2.6 is required. We have tested against 2.6. We have not tested against 3.x. 
+Python >= 2.6 is required. We have tested against 2.6 and 3.5+.
 
-E.g. setting up tpyhon and python devel on ubuntu 18.4:
+By default, the extension assumes that the C client library was compiled with OpenSSL enabled (--with-openssl).  You can disable OpenSSL support in the Python binding by setting the ZKPYTHON_NO_SSL environment variable to a non-empty string before executing Ant or setup.py.
+
+E.g. setting up python and python devel on ubuntu 18.4:
 sudo apt-get install python2.7 python2.7-dev
 sudo update-alternatives --install /usr/bin/python python /usr/bin/python2.7 1
 
@@ -22,7 +24,7 @@ To install, make sure that the C client has been built (use `mvn clean install -
 
 ant install
 
-from zookeeper/src/contrib/zkpython/.
+from zookeeper-contrib/zookeeper-contrib-zkpython/.
 
 To test, run ant test from the same directory. 
 
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/c/zookeeper.c b/zookeeper-contrib/zookeeper-contrib-zkpython/src/c/zookeeper.c
index e84c2b70700..f534749ced1 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/src/c/zookeeper.c
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/src/c/zookeeper.c
@@ -16,6 +16,7 @@
  * limitations under the License.
  */
 
+#define PY_SSIZE_T_CLEAN
 #include <Python.h>
 #include <zookeeper.h>
 #include <assert.h>
@@ -600,7 +601,7 @@ void acl_completion_dispatch(int rc, struct ACL_vector *acl, struct Stat *stat,
 /* -------------------------------------------------------------------------- */
 
 
-static PyObject *pyzookeeper_init_optional_ssl(PyObject *self, PyObject *args, int ssl) {
+static PyObject *pyzookeeper_init_common(PyObject *self, PyObject *args, int ssl) {
   const char *host;
   const char *cert_str;
   PyObject *watcherfn = Py_None;
@@ -643,8 +644,13 @@ static PyObject *pyzookeeper_init_optional_ssl(PyObject *self, PyObject *args, i
   watchers[handle] = pyw;
 
   if (ssl) {
+#ifdef HAVE_OPENSSL_H
     zh = zookeeper_init_ssl( host, cert_str, watcherfn != Py_None ? watcher_dispatch : NULL,
                              recv_timeout, cid.client_id == -1 ? 0 : &cid, pyw, 0 );
+#else
+    fprintf(stderr, "SSL support not compiled in (called with ssl=%d).\n", ssl);
+    abort();
+#endif
   } else {
     zh = zookeeper_init( host, watcherfn != Py_None ? watcher_dispatch : NULL,
                          recv_timeout, cid.client_id == -1 ? 0 : &cid, pyw, 0 );
@@ -652,7 +658,7 @@ static PyObject *pyzookeeper_init_optional_ssl(PyObject *self, PyObject *args, i
 
   if (zh == NULL)
     {
-      PyErr_SetString( ZooKeeperException, "Could not internally obtain SSL zookeeper handle" );
+      PyErr_Format( ZooKeeperException, "Could not internally obtain%s zookeeper handle", ssl ? " SSL" : "" );
       return NULL;
     }
 
@@ -662,14 +668,16 @@ static PyObject *pyzookeeper_init_optional_ssl(PyObject *self, PyObject *args, i
 
 static PyObject *pyzookeeper_init(PyObject *self, PyObject *args)
 {
-  return pyzookeeper_init_optional_ssl(self, args, 0);
+  return pyzookeeper_init_common(self, args, /*ssl*/0);
 }
 
 
+#ifdef HAVE_OPENSSL_H
 static PyObject *pyzookeeper_init_ssl(PyObject *self, PyObject *args)
 {
-  return pyzookeeper_init_optional_ssl(self, args, 1);
+  return pyzookeeper_init_common(self, args, /*ssl*/1);
 }
+#endif
 
 
 /* -------------------------------------------------------------------------- */
@@ -1459,6 +1467,19 @@ PyObject *pyzoo_set_debug_level(PyObject *self, PyObject *args)
 }
 
 static PyObject *log_stream = NULL;
+#if PY_MAJOR_VERSION >= 3
+static PyObject *PyIOBase_TypeObj;
+static int init_file_emulator(void)
+{
+  PyObject *io = PyImport_ImportModule("_io");
+  if (io == NULL)
+    return -1;
+  PyIOBase_TypeObj = PyObject_GetAttrString(io, "_IOBase");
+  if (PyIOBase_TypeObj == NULL)
+    return -1;
+  return 0;
+}
+#endif
 
 /* Set the output file-like object for logging output. Returns Py_None */
 PyObject *pyzoo_set_log_stream(PyObject *self, PyObject *args)
@@ -1470,8 +1491,11 @@ PyObject *pyzoo_set_log_stream(PyObject *self, PyObject *args)
   }
   
 #if PY_MAJOR_VERSION >= 3
-  extern PyTypeObject PyIOBase_Type;
-  if (!PyObject_IsInstance(pystream, (PyObject *)&PyIOBase_Type)) {
+  if (init_file_emulator() < 0) {
+    return NULL;
+  }
+
+  if (!PyObject_IsInstance(pystream, PyIOBase_TypeObj)) {
 #else
   if(!PyFile_Check(pystream)) {
 #endif
@@ -1518,7 +1542,9 @@ PyObject *pyzoo_deterministic_conn_order(PyObject *self, PyObject *args)
 
 static PyMethodDef ZooKeeperMethods[] = {
   {"init", pyzookeeper_init, METH_VARARGS, pyzk_init_doc },
+#ifdef HAVE_OPENSSL_H
   {"init_ssl", pyzookeeper_init_ssl, METH_VARARGS, pyzk_init_ssl_doc },
+#endif
   {"create",pyzoo_create, METH_VARARGS, pyzk_create_doc },
   {"delete",pyzoo_delete, METH_VARARGS, pyzk_delete_doc },
   {"get_children", pyzoo_get_children, METH_VARARGS, pyzk_get_children_doc },
@@ -1589,8 +1615,14 @@ PyMODINIT_FUNC initzookeeper(void) {
 #else
   PyObject *module = Py_InitModule("zookeeper", ZooKeeperMethods);
 #endif
+
   if (init_zhandles(32) == 0) {
-    return; // TODO: Is there any way to raise an exception here?
+#if PY_MAJOR_VERSION >= 3
+    Py_DECREF(module);
+    return PyErr_NoMemory();
+#else
+    return;
+#endif
   }
 
   ZooKeeperException = PyErr_NewException("zookeeper.ZooKeeperException",
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/python/setup.py b/zookeeper-contrib/zookeeper-contrib-zkpython/src/python/setup.py
index 313c020569c..b225a317400 100755
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/src/python/setup.py
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/src/python/setup.py
@@ -15,11 +15,20 @@
 # limitations under the License.
 
 from distutils.core import setup, Extension
+import os
 
 zookeeper_basedir = "../../"
 
+zookeeper_macros = [("THREADED", None)]
+
+# Assume the C extension includes OpenSSL support unless told
+# otherwise.
+if not os.environ.get("ZKPYTHON_NO_SSL"):
+    zookeeper_macros.append(("HAVE_OPENSSL_H", True))
+
 zookeepermodule = Extension("zookeeper",
                             sources=["src/c/zookeeper.c"],
+                            define_macros=zookeeper_macros,
                             include_dirs=[zookeeper_basedir + "/zookeeper-client/zookeeper-client-c/include",
                                           zookeeper_basedir + "/zookeeper-client/zookeeper-client-c/target/c",
                                           zookeeper_basedir + "/zookeeper-client/zookeeper-client-c/generated"],
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/async_test.py b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/async_test.py
index e81343570ea..61740ae433f 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/async_test.py
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/async_test.py
@@ -26,7 +26,7 @@ def setUp( self ):
 
     def test_async(self):
         self.assertEqual(self.connected, True)
-        ret = zookeeper.async(self.handle, "/")
+        ret = getattr(zookeeper, 'async')(self.handle, "/")
         self.assertEqual(ret, zookeeper.OK, "async failed")
         
 if __name__ == '__main__':
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/callback_test.py b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/callback_test.py
index 55d7fe17866..95e20b4dea1 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/callback_test.py
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/callback_test.py
@@ -91,9 +91,9 @@ def dispatch_callback(*args, **kwargs):
                                                                self.create_callback( dispatch_callback )),
                                lambda: self.assertEqual(True, self.callback_flag, "Strings dispatch not fired"))
 
-        self.callback_harness( lambda: zookeeper.async(self.handle,
-                                                       "/",
-                                                       self.create_callback( dispatch_callback )),
+        self.callback_harness( lambda: getattr(zookeeper, 'async')(self.handle,
+                                                                   "/",
+                                                                   self.create_callback( dispatch_callback )),
                                lambda: self.assertEqual(True, self.callback_flag, "String dispatch not fired"))
 
         self.callback_harness( lambda: zookeeper.aget_acl(self.handle,
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/close_deadlock_test.py b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/close_deadlock_test.py
index 921d2cc4b05..b56d44eecce 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/close_deadlock_test.py
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/close_deadlock_test.py
@@ -26,7 +26,7 @@ class CloseDeadlockTest(zktestbase.TestBase):
   https://issues.apache.org/jira/browse/ZOOKEEPER-763
 
   zookeeper.close blocks on waiting for all completions to
-  finish. Previously it was doing so while holding teh GIL, stopping
+  finish. Previously it was doing so while holding the GIL, stopping
   any completions from actually continuing.
 
   This test is a failure if it does not exit within a few seconds.
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/connection_test.py b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/connection_test.py
index 2661e6ecaf8..3fbbd4bf85b 100755
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/connection_test.py
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/connection_test.py
@@ -58,7 +58,8 @@ def connection_watcher(handle, type, state, path):
                           self.handle,
                           "/")
 
-
+    @unittest.skipUnless(hasattr(zookeeper, 'init_ssl'),
+                         "SSL support not compiled in.")
     def testsslconnection(self):
         cv = threading.Condition()
         self.connected = False
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/create_test.py b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/create_test.py
index 8ab80f9565a..29f63a9ffb4 100755
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/create_test.py
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/create_test.py
@@ -59,7 +59,7 @@ def test_sync_create_existing(self):
 
     def test_exception_paths(self):
         """
-        Make sure common exceptions due to API misuse are correctly propogated
+        Make sure common exceptions due to API misuse are correctly propagated
         """
         self.assertRaises(zookeeper.BadArgumentsException,
                           zookeeper.create,
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/get_set_test.py b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/get_set_test.py
index b77b3b22165..226e8c183ff 100755
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/get_set_test.py
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/get_set_test.py
@@ -70,7 +70,7 @@ def test_sync_getset(self):
     def test_stat_deleted_node(self):
         """
         Test for a bug that surfaced when trying to build a
-        stat object from a non-existant node.
+        stat object from a non-existent node.
 
         """
         self.ensureDeleted("/zk-python-test-deleteme")
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/run_tests.sh b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/run_tests.sh
index a3cf4d87969..c7c0fdbdb04 100755
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/run_tests.sh
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/run_tests.sh
@@ -1,41 +1,47 @@
-#!/bin/sh
+#! /usr/bin/env bash
 #
-#  Licensed to the Apache Software Foundation (ASF) under one
+# Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements.  See the NOTICE file
 # distributed with this work for additional information
 # regarding copyright ownership.  The ASF licenses this file
 # to you under the Apache License, Version 2.0 (the
 # "License"); you may not use this file except in compliance
 # with the License.  You may obtain a copy of the License at
-
-#     http://www.apache.org/licenses/LICENSE-2.0
-
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
 
 # Usage: run_tests.sh testdir [logdir]
 # logdir is optional, defaults to cwd
 
+set -e
+
 # get the number of command-line arguments given
 ARGC=$#
 
 # check to make sure enough arguments were given or exit
-if [ $ARGC -lt 2 ]; then
-    export ZKPY_LOG_DIR="."
+if [[ $ARGC -eq 1 ]]; then
+  export ZKPY_LOG_DIR="."
+elif [[ $ARGC -eq 2 ]]; then
+  export ZKPY_LOG_DIR=$2
 else
-    export ZKPY_LOG_DIR=$2
+  echo "Usage: $0 testdir [logdir]" 1>&2
+  exit 1
 fi
 
 # Find the build directory containing zookeeper.so
-SO_PATH=`find ./target/ -name "zookeeper.so" | head -1`
-PYTHONPATH=`dirname $SO_PATH`
+SO_PATH=$(find ./target/ -name 'zookeeper*.so' | head -1)
+PYTHONPATH=$(dirname "$SO_PATH")
 LIB_PATH=../../zookeeper-client/zookeeper-client-c/target/c/.libs
-for test in `ls $1/*_test.py`; 
-do
-    echo "Running $test"
-    echo "Running LD_LIBRARY_PATH=$LIB_PATH:$LD_LIBRARY_PATH DYLD_LIBRARY_PATH=$LIB_PATH:$DYLD_LIBRARY_PATH PYTHONPATH=$PYTHONPATH python $test"
-    LD_LIBRARY_PATH=$LIB_PATH:$LD_LIBRARY_PATH DYLD_LIBRARY_PATH=$LIB_PATH:$DYLD_LIBRARY_PATH PYTHONPATH=$PYTHONPATH python $test
+for test in "$1"/*_test.py; do
+  echo "Running $test"
+  echo "Running LD_LIBRARY_PATH=$LIB_PATH:$LD_LIBRARY_PATH DYLD_LIBRARY_PATH=$LIB_PATH:$DYLD_LIBRARY_PATH PYTHONPATH=$PYTHONPATH python $test"
+  LD_LIBRARY_PATH=$LIB_PATH:$LD_LIBRARY_PATH DYLD_LIBRARY_PATH=$LIB_PATH:$DYLD_LIBRARY_PATH PYTHONPATH=$PYTHONPATH python "$test"
 done
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/zkServer.sh b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/zkServer.sh
index 3b6ed37fc12..a8049fd6794 100755
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/zkServer.sh
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/zkServer.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#! /usr/bin/env bash
 #
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements.  See the NOTICE file
@@ -8,95 +8,82 @@
 # "License"); you may not use this file except in compliance
 # with the License.  You may obtain a copy of the License at
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
 
-if [ "x$1" == "x" ]
-then
-    echo "USAGE: $0 startClean|start|stop"
-    exit 2
+if [[ -z $1 ]]; then
+  echo "USAGE: $0 startClean|start|stop"
+  exit 2
 fi
 
-if [ "x${base_dir}" == "x" ]
-then
+if [[ -n $base_dir ]]; then
   PROJECT_ROOT="../../"
 else
-  PROJECT_ROOT=${base_dir}
+  PROJECT_ROOT=$base_dir
 fi
-WORK_DIR=${PROJECT_ROOT}/zookeeper-contrib/zookeeper-contrib-zkpython/target/zkpython_tests
-TEST_DIR=${PROJECT_ROOT}/zookeeper-contrib/zookeeper-contrib-zkpython/src/test
-
+WORK_DIR=$PROJECT_ROOT/zookeeper-contrib/zookeeper-contrib-zkpython/target/zkpython_tests
+TEST_DIR=$PROJECT_ROOT/zookeeper-contrib/zookeeper-contrib-zkpython/src/test
 
-if [ -r "${WORK_DIR}/../zk.pid" ]
-then
-  pid=`cat "${WORK_DIR}/../zk.pid"`
-  kill -9 $pid
-  rm -f "${WORK_DIR}/../zk.pid"
+if [[ -r "$WORK_DIR/../zk.pid" ]]; then
+  pid=$(cat "$WORK_DIR/../zk.pid")
+  kill -9 "$pid"
+  rm -f "$WORK_DIR/../zk.pid"
 fi
 
-which lsof &> /dev/null
-if [ $? -eq 0  ]
-then
-    pid=`lsof -i :22182 | grep LISTEN | awk '{print $2}'`
-    if [ -n "$pid" ]
-    then
-        kill -9 $pid
-    fi
+if which lsof &>/dev/null; then
+  pid=$(lsof -i :22182 | grep LISTEN | awk '{print $2}')
+  if [[ -n $pid ]]; then
+    kill -9 "$pid"
+  fi
 fi
 
-
-
-
-if [ "x$1" == "xstartClean" ]
-then
-    rm -rf ${WORK_DIR}
+if [[ $1 == "startClean" ]]; then
+  rm -rf "$WORK_DIR"
 fi
 
+CLASSPATH="$CLASSPATH:$PROJECT_ROOT/zookeeper-server/target/classes"
+CLASSPATH="$CLASSPATH:$PROJECT_ROOT/conf"
 
-
-CLASSPATH="$CLASSPATH:${PROJECT_ROOT}/zookeeper-server/target/classes"
-CLASSPATH="$CLASSPATH:${zk_base}/conf"
-
-for i in "${PROJECT_ROOT}"/zookeeper-server/target/lib/*.jar
-do
-    CLASSPATH="$CLASSPATH:$i"
+for i in "$PROJECT_ROOT"/zookeeper-server/target/lib/*.jar; do
+  CLASSPATH="$CLASSPATH:$i"
 done
 
-for i in "${PROJECT_ROOT}"/zookeeper-server/src/main/resource/lib/*.jar
-do
-    CLASSPATH="$CLASSPATH:$i"
+for i in "$PROJECT_ROOT"/zookeeper-server/src/main/resource/lib/*.jar; do
+  CLASSPATH="$CLASSPATH:$i"
 done
+export CLASSPATH
 
 # Make sure nothing is left over from before
 #fuser -skn tcp 22182/tcp
 
 case $1 in
-start|startClean)
-    mkdir -p ${WORK_DIR}/zkdata
+  start | startClean)
+    mkdir -p "$WORK_DIR/zkdata"
 
-    rm -rf ${WORK_DIR}/ssl
-    mkdir -p ${WORK_DIR}/ssl
-    cp ${PROJECT_ROOT}/zookeeper-client/zookeeper-client-c/ssl/gencerts.sh ${WORK_DIR}/ssl/
-    cd ${WORK_DIR}/ssl/
-    ./gencerts.sh
-    cd -
+    rm -rf "$WORK_DIR/ssl"
+    mkdir -p "$WORK_DIR/ssl"
+    cp "$PROJECT_ROOT/zookeeper-client/zookeeper-client-c/ssl/gencerts.sh" "$WORK_DIR/ssl/"
+    (cd "$WORK_DIR/ssl/" && ./gencerts.sh)
 
-    sed "s#WORKDIR#${WORK_DIR}#g" ${TEST_DIR}/zoo.cfg > "${WORK_DIR}/zoo.cfg"
-    java  -Dzookeeper.extendedTypesEnabled=true -Dznode.container.checkIntervalMs=100 -cp $CLASSPATH org.apache.zookeeper.server.ZooKeeperServerMain "${WORK_DIR}/zoo.cfg" &> "${WORK_DIR}/zoo.log" &
+    sed "s#WORKDIR#$WORK_DIR#g" "$TEST_DIR/zoo.cfg" >"$WORK_DIR/zoo.cfg"
+    java -Dzookeeper.extendedTypesEnabled=true -Dznode.container.checkIntervalMs=100 \
+      org.apache.zookeeper.server.ZooKeeperServerMain "$WORK_DIR/zoo.cfg" &>"$WORK_DIR/zoo.log" &
     pid=$!
-    echo -n $! > ${WORK_DIR}/../zk.pid
+    echo -n $! >"$WORK_DIR"/../zk.pid
     sleep 5
     ;;
-stop)
+  stop)
     # Already killed above
     ;;
-*)
-    echo "Unknown command " + $1
+  *)
+    echo "Unknown command $1"
     exit 2
+    ;;
 esac
-
diff --git a/zookeeper-contrib/zookeeper-contrib-zktreeutil/README.txt b/zookeeper-contrib/zookeeper-contrib-zktreeutil/README.txt
index 43b06fa72c2..6a7ef63dacb 100644
--- a/zookeeper-contrib/zookeeper-contrib-zktreeutil/README.txt
+++ b/zookeeper-contrib/zookeeper-contrib-zktreeutil/README.txt
@@ -26,7 +26,7 @@ UPDATE: Make the incremental changes into the live ZK-tree from saved XML, essen
 lly after running the diff.
 
 DUMP: Dumps the ZK-tree on the standard output device reading either from live ZK
-server or XML file. Like export, ZK-subtree can be dumped with optionaly
+server or XML file. Like export, ZK-subtree can be dumped with optionally
 providing the path to the ZK-subtree, and till a certain depth of the (sub)tree.
 
 The exported ZK data into XML file can be shortened by only keeping the static ZK
@@ -38,7 +38,7 @@ Once ignored, the whole subtree is ignored during DIFF, UPDATE and WRITE.
 Pre-requisites
 --------------
 1. Linux system with 2.6.X kernel.
-2. Zookeeper C client library (locally built at ../../c/.libs) >= 3.X.X
+2. Zookeeper C client library (locally built at ../../zookeeper-client/zookeeper-client-c/target/c/.libs) >= 3.X.X
 3. Development build libraries (rpm packages):
   a. boost-devel >= 1.32.0
   b. libxml2-devel >= 2.7.3
@@ -60,7 +60,7 @@ versions.
 Testing  and usage of zktreeutil
 --------------------------------
 1.  Run Zookeeper server locally on port 2181
-2.  export LD_LIBRARY_PATH=../../c/.libs/:/usr/local/lib/
+2.  export LD_LIBRARY_PATH=../../zookeeper-client/zookeeper-client-c/target/c/.libs
 3.  ./src/zktreeutil --help # show help
 4.  ./src/zktreeutil --zookeeper=localhost:2181 --import --xmlfile=tests/zk_sample.xml 2>/dev/null                 # import sample ZK tree
 5.  ./src/zktreeutil --zookeeper=localhost:2181 --dump --path=/myapp/version-1.0 2>/dev/null                         # dump Zk subtree 
@@ -71,4 +71,4 @@ Testing  and usage of zktreeutil
 9.  ./src/zktreeutil -z localhost:2181 -E 2>/dev/null > zk_sample2.xml                                                         # export the mofied ZK tree
 10. ./src/zktreeutil -z localhost:2181 -U -x zk_sample.xml -p /myapp/version-1.0/distributions 2>/dev/null        # update with incr. changes
 11. ./src/zktreeutil --zookeeper=localhost:2181 --import --force --xmlfile=zk_sample2.xml 2>/dev/null             # re-prime the ZK tree
-
+12. ./src/zktreeutil --zookeeper=localhost:2188 --dump --ssl=/path/certs/root_ca.pem,/path/certs/node.crt,/path/certs/node.key   # connect with ssl params to the secureClientPort
diff --git a/zookeeper-contrib/zookeeper-contrib-zktreeutil/configure.ac b/zookeeper-contrib/zookeeper-contrib-zktreeutil/configure.ac
index b4a82a76af8..43867482ff6 100644
--- a/zookeeper-contrib/zookeeper-contrib-zktreeutil/configure.ac
+++ b/zookeeper-contrib/zookeeper-contrib-zktreeutil/configure.ac
@@ -26,8 +26,8 @@ XML2_INCLUDE="/usr/include/libxml2"
 AC_SUBST(XML2_INCLUDE)
 
 # Zookeeper C client
-ZOOKEEPER_PATH=${BUILD_PATH}/../../c
-AC_CHECK_LIB(zookeeper_mt, main, [ZOOKEEPER="-L${ZOOKEEPER_PATH}/.libs -lzookeeper_mt"],,["-L${ZOOKEEPER_PATH}/.libs"])
+ZOOKEEPER_PATH=${BUILD_PATH}/../../zookeeper-client/zookeeper-client-c
+AC_CHECK_LIB(zookeeper_mt, main, [ZOOKEEPER="-L${ZOOKEEPER_PATH}/target/c/.libs -lzookeeper_mt"],,["-L${ZOOKEEPER_PATH}/target/c/.libs"])
 if test -z "${ZOOKEEPER}"; then
       AC_ERROR("... zookeeper C client not found!")
 fi
@@ -45,6 +45,35 @@ if test -z "${LOG4CXX}"; then
       AC_ERROR("... log4cxx not found!")
 fi
 
+dnl OpenSSL
+AC_ARG_WITH(openssl,
+ [AC_HELP_STRING([--with-openssl[=DIR]], [build with openssl (autodetect openssl library by default) )])],
+ [], [with_openssl=yes])
+AC_MSG_NOTICE([configuring SSL using --with-openssl=$with_openssl])
+saved_CPPFLAGS="$CPPFLAGS"
+saved_LDFLAGS="$LDFLAGS"
+if test "x$with_openssl" != "xno" && test "x$with_openssl" != "xyes" ; then
+        CPPFLAGS="$CPPFLAGS -I$with_openssl/include"
+        LDFLAGS="$LDFLAGS -L$with_openssl/lib"
+fi
+have_openssl=no
+AC_CHECK_HEADER(openssl/ssl.h, [ AC_CHECK_LIB(ssl, SSL_CTX_new, [have_openssl=yes]) ])
+if test "x$with_openssl" != "xno" && test "x$with_openssl" != "xyes" && test "x$have_openssl" != "xyes"; then
+    CPPFLAGS="$saved_CPPFLAGS"
+    LDFLAGS="$saved_LDFLAGS"
+fi
+if test "x$with_openssl" != xno && test "x$have_openssl" = xno; then
+    AC_MSG_WARN([cannot build SSL support -- openssl not found])
+    with_openssl=no
+fi
+if test "x$with_openssl" != xno; then
+    AC_MSG_NOTICE([building with SSL support])
+else
+    AC_MSG_NOTICE([building without SSL support])
+fi
+AM_CONDITIONAL([WANT_OPENSSL],[test "x$with_openssl" != xno])
+
+
 AC_SUBST(LOG4CXX)
 AC_SUBST(LOG4CXX_VERSION)
 AC_SUBST(LOG4CXX_INCLUDE)
diff --git a/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/Makefile.am b/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/Makefile.am
index 641077a88e4..7d665d079c9 100644
--- a/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/Makefile.am
+++ b/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/Makefile.am
@@ -14,9 +14,13 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+if WANT_OPENSSL
+  OPENSSL_CPPFLAGS = -DHAVE_OPENSSL_H
+endif
+
 AM_CXXFLAGS = -I${ZOOKEEPER_PATH}/include -I${ZOOKEEPER_PATH}/generated \
     -I$(top_srcdir)/include -I${LOG4CXX_INCLUDE} -I/usr/include \
-      -I${XML2_INCLUDE}
+      -I${XML2_INCLUDE} -DTHREADED $(OPENSSL_CPPFLAGS)
 
 bin_PROGRAMS = zktreeutil
 
diff --git a/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkAdaptor.cc b/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkAdaptor.cc
index 1df175a9bac..c1f65916a37 100644
--- a/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkAdaptor.cc
+++ b/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkAdaptor.cc
@@ -18,6 +18,7 @@
 
 #include "ZkAdaptor.h"
 #include <string.h>
+#include <unistd.h>
 #include <sstream>
 #include <iostream>
 #include <algorithm>
@@ -172,12 +173,36 @@ namespace zktreeutil
         disconnect();
 
         // Establish a new connection to ZooKeeper
-        mp_zkHandle = zookeeper_init( m_zkConfig.getHosts().c_str(), 
-                NULL, 
+#ifdef HAVE_OPENSSL_H
+        if (!m_zkConfig.getSslParams().empty())
+        {
+            mp_zkHandle = zookeeper_init_ssl( m_zkConfig.getHosts().c_str(),
+                m_zkConfig.getSslParams().c_str(),
+                NULL,
                 m_zkConfig.getLeaseTimeout(),
                 0,
                 NULL,
                 0);
+
+        }
+        else
+        {
+            mp_zkHandle = zookeeper_init( m_zkConfig.getHosts().c_str(),
+                NULL,
+                m_zkConfig.getLeaseTimeout(),
+                0,
+                NULL,
+                0);
+        }
+#else
+        mp_zkHandle = zookeeper_init( m_zkConfig.getHosts().c_str(),
+            NULL,
+            m_zkConfig.getLeaseTimeout(),
+            0,
+            NULL,
+            0);
+#endif
+
         if (mp_zkHandle == NULL)
         {
             // Invalid handle returned
@@ -201,7 +226,7 @@ namespace zktreeutil
                     << std::endl; 
                 return;
             }
-            else if ( state && state != ZOO_CONNECTING_STATE)
+            else if ( state && state != ZOO_NOTCONNECTED_STATE && state != ZOO_CONNECTING_STATE)
             {
                 // Not connecting any more... some other issue
                 std::ostringstream oss;
@@ -475,7 +500,7 @@ namespace zktreeutil
                     0,
                     buffer, &len, stat );
         } while (rc != ZOK && rh.handleRC(rc));
-        if (rc != ZOK) // checl return code
+        if (rc != ZOK) // check return code
         {
             std::cerr << "[zktreeutil] Error in fetching value of " << path << std::endl;
             throw ZooKeeperException( string("Unable to get data of node ") + path, rc );
diff --git a/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkAdaptor.h b/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkAdaptor.h
index 4b68e28db1f..ffefb28a7da 100644
--- a/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkAdaptor.h
+++ b/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkAdaptor.h
@@ -110,15 +110,18 @@ namespace zktreeutil
              * @param leaseTimeout the lease timeout (heartbeat)
              * @param autoReconnect whether to allow for auto-reconnect
              * @param connectTimeout the connect timeout, in milliseconds;
+             * @param certs ssl parameters to initiate SSL connection;
              */
             ZooKeeperConfig(const string &hosts, 
                     int leaseTimeout, 
                     bool autoReconnect = true, 
-                    long long int connectTimeout = 15000)
+                    long long int connectTimeout = 15000,
+                    const string &sslParams = "")
                 : m_hosts(hosts),
                 m_leaseTimeout(leaseTimeout), 
                 m_autoReconnect(autoReconnect),
-                m_connectTimeout(connectTimeout) {}
+                m_connectTimeout(connectTimeout),
+                m_sslParams(sslParams) {}
 
             /**
              * \brief Returns the list of ZK hosts to connect to.
@@ -143,6 +146,11 @@ namespace zktreeutil
              */
             long long int getConnectTimeout() const { return m_connectTimeout; }
 
+            /**
+             * \brief Returns the ssl params
+             */
+            string getSslParams() const { return m_sslParams; }
+
         private:
 
             /**
@@ -156,7 +164,7 @@ namespace zktreeutil
             const int m_leaseTimeout;
 
             /**
-             * True if this adapater should attempt to autoreconnect in case 
+             * True if this adapter should attempt to autoreconnect in case
              * the current session has been dropped.
              */
             const bool m_autoReconnect;
@@ -166,6 +174,11 @@ namespace zktreeutil
              * is established to ZK.
              */
             const long long int m_connectTimeout;
+
+            /**
+             * comma separated ssl parameters to initiate SSL connection.
+             */
+             const string m_sslParams;
     };
 
     /**
diff --git a/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkTreeUtil.cc b/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkTreeUtil.cc
index 270bf3105c7..77fdd96d024 100644
--- a/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkTreeUtil.cc
+++ b/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkTreeUtil.cc
@@ -296,12 +296,12 @@ namespace zktreeutil
         return zkRootSptr;
     }
 
-    ZooKeeperAdapterSptr ZkTreeUtil::get_zkHandle (const string& zkHosts)
+    ZooKeeperAdapterSptr ZkTreeUtil::get_zkHandle (const string& zkHosts, const string& cert)
     {
         try
         {
             // Create an instance of ZK adapter.
-            ZooKeeperConfig config (zkHosts, 10000);
+            ZooKeeperConfig config (zkHosts, 10000, true, 15000, cert);
             ZooKeeperAdapterSptr zkHandleSptr =
                 ZooKeeperAdapterSptr (new ZooKeeperAdapter (config));
             return zkHandleSptr;
@@ -343,7 +343,7 @@ namespace zktreeutil
         }
 
         // Connect to ZK server
-        ZooKeeperAdapterSptr zkHandle = get_zkHandle (zkHosts);
+        ZooKeeperAdapterSptr zkHandle = get_zkHandle (zkHosts, getSslParams());
         std::cerr << "[zktreeutil] connected to ZK serverfor reading"
             << std::endl;
 
@@ -424,7 +424,7 @@ namespace zktreeutil
             bool force) const
     {
         // Connect to ZK server
-        ZooKeeperAdapterSptr zkHandle = get_zkHandle (zkHosts);
+        ZooKeeperAdapterSptr zkHandle = get_zkHandle (zkHosts, getSslParams());
         std::cerr << "[zktreeutil] connected to ZK server for writing"
             << std::endl;
 
@@ -517,7 +517,7 @@ namespace zktreeutil
         }
 
         // Load the rooted subtree from zookeeper
-        ZooKeeperAdapterSptr zkHandle = get_zkHandle (zkHosts);
+        ZooKeeperAdapterSptr zkHandle = get_zkHandle (zkHosts, getSslParams());
         std::cerr << "[zktreeutil] connected to ZK server for reading"
             << std::endl;
         ZkTreeNodeSptr zkLiveRootSptr = loadZkTree_ (zkHandle, path);
@@ -630,7 +630,7 @@ namespace zktreeutil
             if ((execFlags & EXECUTE)
                     || (execFlags & INTERACTIVE))
             {
-                zkHandleSptr = get_zkHandle (zkHosts);
+                zkHandleSptr = get_zkHandle (zkHosts, getSslParams());
                 std::cerr << "[zktreeutil] connected to ZK server for writing"
                     << std::endl;
             }
diff --git a/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkTreeUtil.h b/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkTreeUtil.h
index 0a9be03f842..872bebecbdf 100644
--- a/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkTreeUtil.h
+++ b/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkTreeUtil.h
@@ -185,9 +185,10 @@ namespace zktreeutil
              * \brief Connects to zookeeper and returns a valid ZK handle
              *
              * @param zkHosts comma separated list of host:port forming ZK quorum
+             * @param cert certificate file path
              * @param a valid ZK handle
              */
-            static ZooKeeperAdapterSptr get_zkHandle (const string& zkHosts);
+            static ZooKeeperAdapterSptr get_zkHandle (const string& zkHosts, const string& cert="");
 
 
         public:
@@ -252,10 +253,26 @@ namespace zktreeutil
                     const vector< ZkAction >& zkActions,
                     int execFlags) const;
 
+            /**
+             * \brief Sets the ssl params to be used for SSL connection
+             * @param cert ssl params
+             */
+             void setSslParams(const string& cert)
+             {
+                 sslParams_ = cert;
+             }
+
+            /**
+             * \brief Gets the ssl params
+             * @return the cert
+             */
+             string getSslParams() const { return sslParams_; }
+
         private:
 
             ZkTreeNodeSptr zkRootSptr_;     // ZK tree root node
-            bool loaded_;                        // Falg indicating whether ZK tree loaded into memory
+            bool loaded_;                        // Flag indicating whether ZK tree loaded into memory
+            string sslParams_;              // Comma separated parameters to initiate SSL connection
     };
 }
 
diff --git a/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkTreeUtilMain.cc b/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkTreeUtilMain.cc
index 8afebf6e2f7..28157506247 100644
--- a/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkTreeUtilMain.cc
+++ b/zookeeper-contrib/zookeeper-contrib-zktreeutil/src/ZkTreeUtilMain.cc
@@ -43,9 +43,10 @@ static struct option long_options[] = {
     {"path",         required_argument,     0, 'p'},
     {"depth",         required_argument,     0, 'd'},
     {"zookeeper", required_argument,     0, 'z'},
+    {"ssl", required_argument,     0, 's'},
     {0, 0, 0, 0}
 };
-static char *short_options = "IEUFDfx:p:d:hz:";
+static char *short_options = "IEUFDfx:p:d:hz:s:";
 
 static void usage(int argc, char *argv[])
 {
@@ -128,6 +129,13 @@ static void usage(int argc, char *argv[])
         << std::endl
         << "\t  specifies information to connect to zookeeper."
         << std::endl;
+    std::cout
+        << "\t--ssl=<ssl params> or -s <ssl params>: "
+        << std::endl
+        << "\t  Comma separated parameters to initiate SSL connection."
+        << std::endl
+        << "\t  e.g.: server_cert.crt,client_cert.crt,client_priv_key.pem,passwd"
+        << std::endl;
 }
 
 int main(int argc, char **argv)
@@ -143,6 +151,7 @@ int main(int argc, char **argv)
      string zkHosts;
      string xmlFile;
      string path = "/";
+     string cert;
      int depth = 0;
      while (1)
      {
@@ -171,12 +180,16 @@ int main(int argc, char **argv)
                           break;
              case 'z': zkHosts = optarg;
                           break;
+             case 's': cert = optarg;
+                    break;
              case 'h': usage (argc, argv);
                           exit(0);
          }
      }
 
      ZkTreeUtil zkTreeUtil;
+     if (!cert.empty()) zkTreeUtil.setSslParams(cert);
+
      switch (op)
      {
          case 'I':    {
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/README.txt b/zookeeper-contrib/zookeeper-contrib-zooinspector/README.txt
index 3c2a58f42e4..937579fb4f5 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/README.txt
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/README.txt
@@ -18,20 +18,28 @@ Features
 --------
 	Below is a list of features in the current release of ZooInspector.
 	- Load connection settings from a zookeeper properties file
-	- Plugable DataEncryptionManagers to specify how data should be encrypted and decrypted in the Zookeeper instance
-	- Browseable tree view of the ZooKeeper instance
+	- Pluggable DataEncryptionManagers to specify how data should be encrypted and decrypted in the Zookeeper instance
+	- Browsable tree view of the ZooKeeper instance
 	- View the data in a node
-	- View the ACL's currently applied to a node
-	- View the metadata for a node (Version, Number of Children, Last modified Tiem, etc.)
-	- Plugable NodeViewers interface
+	- View the ACLs currently applied to a node
+	- View the metadata for a node (Version, Number of Children, Last modified Time, etc.)
+	- Pluggable NodeViewers interface
 	- Ability to save/load and set default Node Viewers
-	
-Pre-requisites
---------------
-	- The main zookeeper build script must have been run before building this module
-	
-Build Instructions
-------------------
+
+Maven Build Instructions
+-------------------------
+  0. Pre-requisites
+     - Run "mvn install" in the root directory of the Zookeeper project
+  1. Open a command line
+  2. cd into this directory
+  3. mvn install
+  4. To run ZooInspector run zooInspector.cmd (on Windows) or zooInspector.sh (on Linux) (these scripts will
+     find the built JAR automatically in the "target" directory as long as you don't move it)
+
+Ant Build Instructions
+-----------------------
+  0. Pre-requisites
+	   - The main zookeeper build script must have been run before building this module
 	1. Open a command line.
 	2. cd into this directory
 	3. Run command: ant
@@ -40,55 +48,55 @@ Build Instructions
        copied to this directory during the build
 	6. By default the zookeeper.cmd and zookeeper.sh files expect zookeeper-3.3.0.jar.  If you are using another version
 	   you will need to change these files to point to the zookeeper-3.x.x.jar you copied to the lib directory
-	7. To run ZooInspector run zooInspector.cmd (on Windows) or zooInspector.sh (on Linux).  If you are using 
+	7. To run ZooInspector run zooInspector.cmd (on Windows) or zooInspector.sh (on Linux).  If you are using
 	   zookeeper-3.3.0.jar and do not require any classpath changes you can run the zookeeper-dev-ZooInspector.jar
 	   directly
 
 Using ZooInspector
 ------------------
-	To start ZooInspector run zooInspector.cmd (on Windows) or zooInspector.sh (on Linux).  If you are using 
+	To start ZooInspector run zooInspector.cmd (on Windows) or zooInspector.sh (on Linux).  If you are using
 	zookeeper-3.3.0.jar and do not require any classpath changes you can run the zookeeper-dev-ZooInspector.jar
 	directly.
-	
-	Click the play button on the toolbar to bring up the connection dialog.  From here you can enter connection 
-	information for your zookeeper instance.  You can also load the connection properties from a file.  This file can 
+
+	Click the play button on the toolbar to bring up the connection dialog.  From here you can enter connection
+	information for your zookeeper instance.  You can also load the connection properties from a file.  This file can
 	have the format as a normal zookeeper properties file (i.e. hosts and timeout key-value pairs) and van optional have
-	an encryptionManager key-value pair to specify the DataEncryptionManager to use for this connection 
+	an encryptionManager key-value pair to specify the DataEncryptionManager to use for this connection
 	(DataEncryptionManagers are explained in further detail in the 'Creating and Using Plugins' section below).  You can
-	also set the entered information as the defaults so that when you first start ZooInspector these settings are 
+	also set the entered information as the defaults so that when you first start ZooInspector these settings are
 	automatically loaded into this dialog.  Pressing the OK button with connect to your ZooKeeper instance and show the
 	current node tree on the left of the main panel.
-	
-	Clicking a node in the node tree will load the data for that node into the node viewers.  Three node viewers are 
+
+	Clicking a node in the node tree will load the data for that node into the node viewers.  Three node viewers are
 	currently distributed with ZooInspector:
-		1. Node Data - This enables you to see the data current stored on that node.  This data can be modified and 
-		   saved.  The data is decrypted and encrypted using the DataEncryptionManager specified on the connection 
+		1. Node Data - This enables you to see the data current stored on that node.  This data can be modified and
+		   saved.  The data is decrypted and encrypted using the DataEncryptionManager specified on the connection
 		   dialog.
-		2. Node Metadata - This enables you to see the metadata associiated with this node.  This is Essentially the data
+		2. Node Metadata - This enables you to see the metadata associated with this node.  This is essentially the data
 		   obtained from the Stat object for this node.
 		3. Node ACLs - This allows you to see the ACLs currently applied to this node.  Currently there is no ability
 		   to change the ACLs on a node, but it is a feature I would like to add.
 	Other custom Node Viewers can be added, this is explained in the 'Creating and Using Plugins' section below.
-	
+
 
 Creating and Using Plugins
 --------------------------
 	There are two types of plugin which can be used with ZooInspector:
-		1. DataEncryptionManager - This specifies how data should be encrypted and decrypted when working with a 
+		1. DataEncryptionManager - This specifies how data should be encrypted and decrypted when working with a
 		   zookeeper instance.
 		2. ZooInspectorNodeViewer - This is a GUI panel which provides a view of visualisation on a node.
 	More information on these interfaces can be found in the javadocs for this module.
-	
-	To use a plugin in ZooInspector, build the plugin to a jar and copy the jar to the lib sub-directory.  Edit the 
+
+	To use a plugin in ZooInspector, build the plugin to a jar and copy the jar to the lib sub-directory.  Edit the
 	zooInspector.cmd and/or zooInspector.sh files to include your new jar on the classpath and run ZooInspector.
-	
-	For DataEncryptionManagers, click the play button to open the connection dialog and enter the full class name of 
-	your DataEncryptionManager in the 'Data Encryption Manager' field.  You can make this Data Encryption Manager the 
+
+	For DataEncryptionManagers, click the play button to open the connection dialog and enter the full class name of
+	your DataEncryptionManager in the 'Data Encryption Manager' field.  You can make this Data Encryption Manager the
 	default by clicking 'Set As Default'.  Click the 'OK' button to instantiate and use your plugin.
-	
+
 	For ZooInspectorNodeViewers, Click the 'Change Node Viewers' button on the toolbar (looks like a tree with a pencil)
-	and enter the full classname for your Node Viewer in the field left of the 'Add' button, then click the 'Add' 
-	button.  The Node Viewer will be instantiated and should appear in the list.  You can change the order of the Node 
-	viewers by clicking the up and dpwn buttons and delete a Node Viewer by clicking the delete button.  You can save 
+	and enter the full classname for your Node Viewer in the field left of the 'Add' button, then click the 'Add'
+	button.  The Node Viewer will be instantiated and should appear in the list.  You can change the order of the Node
+	viewers by clicking the up and down buttons and delete a Node Viewer by clicking the delete button.  You can save
 	to configuration to a file or set it as the default if necessary. Then click the 'OK' button and your Node Viewer 
 	should appear in the tabs on the right of the main panel.
\ No newline at end of file
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/TODO b/zookeeper-contrib/zookeeper-contrib-zooinspector/TODO
index 404d5c9c699..eb6e1a15042 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/TODO
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/TODO
@@ -10,7 +10,7 @@
   http://standards.freedesktop.org/basedir-spec/basedir-spec-latest.html
   http://standards.freedesktop.org/icon-theme-spec/icon-theme-spec-latest.html
 
-- Rename classes to avoid redundand "ZooInspector" prefix.
+- Rename classes to avoid redundant "ZooInspector" prefix.
 
 - Ant build file has hard coded log4j dependency. (ZK will move to maven anyways...)
 
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/ivy.xml b/zookeeper-contrib/zookeeper-contrib-zooinspector/ivy.xml
index d841d18b2ce..dfa57dc84b1 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/ivy.xml
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/ivy.xml
@@ -39,12 +39,7 @@
             
     <dependency org="log4j" name="log4j" rev="1.2.17" transitive="false"/>
     <dependency org="junit" name="junit" rev="4.12" conf="test->default"/>
-    <dependency org="org.apache.rat" name="apache-rat-tasks" 
-                rev="0.6" conf="releaseaudit->default"/>
-    <dependency org="commons-lang" name="commons-lang" 
-                rev="2.4" conf="releaseaudit->default"/>
-    <dependency org="commons-collections" name="commons-collections" 
-                rev="3.2.2" conf="releaseaudit->default"/>
+    <dependency org="org.apache.rat" name="apache-rat-tasks" rev="0.6" conf="releaseaudit->default"/>
   </dependencies>
 
 </ivy-module>
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml b/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
old mode 100755
new mode 100644
index 6d474608c4b..b4185ebce44
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-contrib</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-contrib-zooinspector</artifactId>
@@ -35,10 +35,50 @@
 
   <properties>
     <rat.version>0.6</rat.version>
-    <commons-lang.version>2.4</commons-lang.version>
-    <guava.version>18.0</guava.version>
+    <guava.version>32.1.3-jre</guava.version>
   </properties>
 
+  <build>
+    <!-- Ensure "icons" directory is available in built JAR -->
+    <resources>
+      <resource>
+        <directory>src/main/resources</directory>
+        <includes>
+          <include>**/*</include>
+        </includes>
+      </resource>
+    </resources>
+    <!-- Allow building of standalone single "fat" jar with all dependencies that allows
+     ZooInspector to build and run standalone. -->
+    <plugins>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-assembly-plugin</artifactId>
+        <version>3.1.1</version>
+        <configuration>
+          <descriptorRefs>
+            <descriptorRef>jar-with-dependencies</descriptorRef>
+          </descriptorRefs>
+          <!-- Make the JAR executable via java -jar -->
+          <archive>
+            <manifest>
+              <mainClass>org.apache.zookeeper.inspector.ZooInspector</mainClass>
+            </manifest>
+          </archive>
+        </configuration>
+        <executions>
+          <execution>
+            <id>make-assembly</id>
+            <phase>package</phase>
+            <goals>
+              <goal>single</goal>
+            </goals>
+          </execution>
+        </executions>
+      </plugin>
+    </plugins>
+  </build>
+
   <dependencies>
     <dependency>
       <groupId>org.apache.zookeeper</groupId>
@@ -50,28 +90,14 @@
       <artifactId>slf4j-api</artifactId>
     </dependency>
     <dependency>
-      <groupId>org.slf4j</groupId>
-      <artifactId>slf4j-log4j12</artifactId>
-      <exclusions>
-        <exclusion>
-          <groupId>*</groupId>
-          <artifactId>*</artifactId>
-        </exclusion>
-      </exclusions>
+      <groupId>ch.qos.logback</groupId>
+      <artifactId>logback-classic</artifactId>
+      <scope>runtime</scope>
+      <optional>true</optional>
     </dependency>
     <dependency>
-      <groupId>log4j</groupId>
-      <artifactId>log4j</artifactId>
-      <exclusions>
-        <exclusion>
-          <groupId>*</groupId>
-          <artifactId>*</artifactId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>junit</groupId>
-      <artifactId>junit</artifactId>
+      <groupId>org.junit.vintage</groupId>
+      <artifactId>junit-vintage-engine</artifactId>
       <scope>test</scope>
     </dependency>
     <dependency>
@@ -84,15 +110,11 @@
       <artifactId>apache-rat-tasks</artifactId>
       <version>${rat.version}</version>
     </dependency>
+
     <dependency>
-      <groupId>commons-lang</groupId>
-      <artifactId>commons-lang</artifactId>
-      <version>${commons-lang.version}</version>
-    </dependency>
-    <dependency>
-      <groupId>commons-collections</groupId>
-      <artifactId>commons-collections</artifactId>
+      <groupId>org.mockito</groupId>
+      <artifactId>mockito-core</artifactId>
+      <scope>test</scope>
     </dependency>
   </dependencies>
-
-</project>
\ No newline at end of file
+</project>
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/com/nitido/utils/toaster/Toaster.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/com/nitido/utils/toaster/Toaster.java
index 0a4fe94b0b3..126fd65c64c 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/com/nitido/utils/toaster/Toaster.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/com/nitido/utils/toaster/Toaster.java
@@ -18,9 +18,6 @@
  *
  * This is a simple example of utilization:
  *
- * import com.nitido.utils.toaster.*;
- * import javax.swing.*;
- *
  * public class ToasterTest
  * {
  *
@@ -36,10 +33,20 @@
  */
 package com.nitido.utils.toaster;
 
-import java.awt.*;
 
-import javax.swing.*;
-import javax.swing.border.*;
+import javax.swing.BorderFactory;
+import javax.swing.Icon;
+import javax.swing.JLabel;
+import javax.swing.JPanel;
+import javax.swing.JTextArea;
+import javax.swing.JWindow;
+import javax.swing.border.EtchedBorder;
+import java.awt.BorderLayout;
+import java.awt.Color;
+import java.awt.Font;
+import java.awt.GraphicsEnvironment;
+import java.awt.Insets;
+import java.awt.Rectangle;
 
 /**
  * Class to show tosters in multiplatform
@@ -135,7 +142,7 @@ class SingleToaster extends javax.swing.JWindow
 
 
 		/***
-		 * Simple costructor that initialized components...
+		 * Simple constructor that initialized components...
 		 */
 		public SingleToaster()
 		{
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/encryption/BasicDataEncryptionManager.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/encryption/BasicDataEncryptionManager.java
index a9e5ac477cf..c8662db62d1 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/encryption/BasicDataEncryptionManager.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/encryption/BasicDataEncryptionManager.java
@@ -30,6 +30,9 @@ public class BasicDataEncryptionManager implements DataEncryptionManager {
      * (byte[])
      */
     public String decryptData(byte[] encrypted) throws Exception {
+        if(encrypted == null) {
+            return "";
+        }
         return new String(encrypted);
     }
 
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/IconResource.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/IconResource.java
index 411900a9a54..46ffb0c4f1a 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/IconResource.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/IconResource.java
@@ -27,12 +27,15 @@
 import org.apache.zookeeper.inspector.logger.LoggerFactory;
 
 /**
- * @see http://standards.freedesktop.org/icon-naming-spec/icon-naming-spec-latest.html
- * I tried to take icons that are available in the Tango icon set
+ * @link http://standards.freedesktop.org/icon-naming-spec/icon-naming-spec-latest.html
+ * I tried to take icons that are available in the Tango icon set.
+ *
+ * @link http://tango.freedesktop.org/Tango_Icon_Library
+ * The Tango icon set can be found under the "Download" section.
  */
 public class IconResource {
 
-    public static final String ICON_ChangeNodeViewers = "";
+    public static final String ICON_CHANGE_NODE_VIEWERS = "categories/applications-system";
     public static final String ICON_TREE_LEAF = "mimetypes/text-x-generic";
     public static final String ICON_TREE_OPEN = "places/folder";
     public static final String ICON_TREE_CLOSE = "places/folder";
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/Toolbar.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/Toolbar.java
index 06e80a80806..99c780d8d08 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/Toolbar.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/Toolbar.java
@@ -64,13 +64,13 @@ private void init() {
     }
 
     public static enum Button {
-        connect("Connect",IconResource.ICON_START,true),
-        disconnect("Disconnect",IconResource.ICON_STOP,false),
-        refresh("Refresh",IconResource.ICON_REFRESH,false),
-        addNode("Add Node",IconResource.ICON_DOCUMENT_ADD,false),
-        deleteNode("Delete Node",IconResource.ICON_TRASH,false),
-        nodeViewers("Change Node Viewers",IconResource.ICON_ChangeNodeViewers,true),
-        about("About ZooInspector",IconResource.ICON_HELP_ABOUT,true);
+        connect("Connect", IconResource.ICON_START, true),
+        disconnect("Disconnect", IconResource.ICON_STOP, false),
+        refresh("Refresh All", IconResource.ICON_REFRESH, false),
+        addNode("Add Node", IconResource.ICON_DOCUMENT_ADD, false),
+        deleteNode("Delete Node", IconResource.ICON_TRASH, false),
+        nodeViewers("Change Node Viewers", IconResource.ICON_CHANGE_NODE_VIEWERS, true),
+        about("About ZooInspector", IconResource.ICON_HELP_ABOUT, true);
 
         private String toolTip;
         private String icon;
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorAboutDialog.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorAboutDialog.java
index 58096b26ecf..b6cdf4bf4eb 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorAboutDialog.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorAboutDialog.java
@@ -23,6 +23,7 @@
 import java.awt.Frame;
 import java.awt.event.ActionEvent;
 import java.awt.event.ActionListener;
+import java.io.File;
 import java.io.IOException;
 
 import javax.swing.JButton;
@@ -36,6 +37,9 @@
  * The About Dialog for the application
  */
 public class ZooInspectorAboutDialog extends JDialog {
+
+    private static final File aboutHtmlFile = new File("./src/main/resources/about.html");
+
     /**
      * @param frame
      *            - the Frame from which the dialog is displayed
@@ -53,13 +57,10 @@ public ZooInspectorAboutDialog(Frame frame, IconResource iconResource) {
         JEditorPane aboutPane = new JEditorPane();
         aboutPane.setEditable(false);
         aboutPane.setOpaque(false);
-        java.net.URL aboutURL = ZooInspectorAboutDialog.class
-                .getResource("about.html");
         try {
-            aboutPane.setPage(aboutURL);
+            aboutPane.setPage(aboutHtmlFile.toURI().toURL());
         } catch (IOException e) {
-            LoggerFactory.getLogger().error(
-                    "Error loading about.html, file may be corrupt", e);
+            LoggerFactory.getLogger().error("Error loading about.html, file may be corrupt", e);
         }
         panel.add(aboutPane, BorderLayout.CENTER);
         panel.setPreferredSize(new Dimension(600, 200));
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorConnectionPropertiesDialog.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorConnectionPropertiesDialog.java
index 1647021f513..da847294ec5 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorConnectionPropertiesDialog.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorConnectionPropertiesDialog.java
@@ -56,7 +56,7 @@ public class ZooInspectorConnectionPropertiesDialog extends JDialog {
     /**
      * @param lastConnectionProps
      *            - the last connection properties used. if this is the first
-     *            conneciton since starting the applications this will be the
+     *            connection since starting the applications this will be the
      *            default settings
      * @param connectionPropertiesTemplateAndLabels
      *            - the connection properties and labels to show in this dialog
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorNodeViewersDialog.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorNodeViewersDialog.java
index e3cc7b12bcc..5c4485de5f4 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorNodeViewersDialog.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorNodeViewersDialog.java
@@ -54,7 +54,6 @@
 import javax.swing.event.ListSelectionEvent;
 import javax.swing.event.ListSelectionListener;
 
-import org.apache.zookeeper.inspector.gui.Toolbar.Button;
 import org.apache.zookeeper.inspector.gui.nodeviewer.ZooInspectorNodeViewer;
 import org.apache.zookeeper.inspector.logger.LoggerFactory;
 import org.apache.zookeeper.inspector.manager.ZooInspectorManager;
@@ -90,9 +89,9 @@ public ZooInspectorNodeViewersDialog(Frame frame,
         final List<ZooInspectorNodeViewer> newViewers = new ArrayList<ZooInspectorNodeViewer>(
                 currentViewers);
         this.setLayout(new BorderLayout());
-        this.setIconImage(iconResource.get(IconResource.ICON_ChangeNodeViewers,"")
+        this.setIconImage(iconResource.get(IconResource.ICON_CHANGE_NODE_VIEWERS,"Change Node Viewers")
                 .getImage());
-        this.setTitle("About ZooInspector");
+        this.setTitle("Change Node Viewers");
         this.setModal(true);
         this.setAlwaysOnTop(true);
         this.setResizable(true);
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorNodeViewersPanel.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorNodeViewersPanel.java
index 05c256b5a85..9c3beb15ecb 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorNodeViewersPanel.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorNodeViewersPanel.java
@@ -25,10 +25,8 @@
 import javax.swing.JTabbedPane;
 import javax.swing.event.ChangeEvent;
 import javax.swing.event.ChangeListener;
-import javax.swing.event.TreeSelectionEvent;
-import javax.swing.event.TreeSelectionListener;
-import javax.swing.tree.TreePath;
 
+import org.apache.zookeeper.inspector.gui.nodeviewer.NodeSelectionListener;
 import org.apache.zookeeper.inspector.gui.nodeviewer.ZooInspectorNodeViewer;
 import org.apache.zookeeper.inspector.manager.ZooInspectorManager;
 import org.apache.zookeeper.inspector.manager.ZooInspectorNodeManager;
@@ -36,10 +34,9 @@
 /**
  * This is the {@link JPanel} which contains the {@link ZooInspectorNodeViewer}s
  */
-public class ZooInspectorNodeViewersPanel extends JPanel implements
-        TreeSelectionListener, ChangeListener {
+public class ZooInspectorNodeViewersPanel extends JPanel implements ChangeListener, NodeSelectionListener {
 
-    private final List<ZooInspectorNodeViewer> nodeVeiwers = new ArrayList<ZooInspectorNodeViewer>();
+    private final List<ZooInspectorNodeViewer> nodeViewers = new ArrayList<>();
     private final List<Boolean> needsReload = new ArrayList<Boolean>();
     private final JTabbedPane tabbedPane;
     private final List<String> selectedNodes = new ArrayList<String>();
@@ -48,17 +45,17 @@ public class ZooInspectorNodeViewersPanel extends JPanel implements
     /**
      * @param zooInspectorManager
      *            - the {@link ZooInspectorManager} for the application
-     * @param nodeVeiwers
+     * @param nodeViewers
      *            - the {@link ZooInspectorNodeViewer}s to show
      */
     public ZooInspectorNodeViewersPanel(
             ZooInspectorNodeManager zooInspectorManager,
-            List<ZooInspectorNodeViewer> nodeVeiwers) {
+            List<ZooInspectorNodeViewer> nodeViewers) {
         this.zooInspectorManager = zooInspectorManager;
         this.setLayout(new BorderLayout());
         tabbedPane = new JTabbedPane(JTabbedPane.TOP,
                 JTabbedPane.WRAP_TAB_LAYOUT);
-        setNodeViewers(nodeVeiwers);
+        setNodeViewers(nodeViewers);
         tabbedPane.addChangeListener(this);
         this.add(tabbedPane, BorderLayout.CENTER);
         reloadSelectedViewer();
@@ -69,11 +66,11 @@ public ZooInspectorNodeViewersPanel(
      *            - the {@link ZooInspectorNodeViewer}s to show
      */
     public void setNodeViewers(List<ZooInspectorNodeViewer> nodeViewers) {
-        this.nodeVeiwers.clear();
-        this.nodeVeiwers.addAll(nodeViewers);
+        this.nodeViewers.clear();
+        this.nodeViewers.addAll(nodeViewers);
         needsReload.clear();
         tabbedPane.removeAll();
-        for (ZooInspectorNodeViewer nodeViewer : nodeVeiwers) {
+        for (ZooInspectorNodeViewer nodeViewer : nodeViewers) {
             nodeViewer.setZooInspectorManager(zooInspectorManager);
             needsReload.add(true);
             tabbedPane.add(nodeViewer.getTitle(), nodeViewer);
@@ -85,42 +82,19 @@ public void setNodeViewers(List<ZooInspectorNodeViewer> nodeViewers) {
     private void reloadSelectedViewer() {
         int index = this.tabbedPane.getSelectedIndex();
         if (index != -1 && this.needsReload.get(index)) {
-            ZooInspectorNodeViewer viewer = this.nodeVeiwers.get(index);
+            ZooInspectorNodeViewer viewer = this.nodeViewers.get(index);
             viewer.nodeSelectionChanged(selectedNodes);
             this.needsReload.set(index, false);
         }
     }
 
-    /*
-     * (non-Javadoc)
-     * 
-     * @see
-     * javax.swing.event.TreeSelectionListener#valueChanged(javax.swing.event
-     * .TreeSelectionEvent)
+    /**
+     * @see org.apache.zookeeper.inspector.gui.nodeviewer.NodeSelectionListener#nodePathSelected(String)
      */
-    public void valueChanged(TreeSelectionEvent e) {
-        TreePath[] paths = e.getPaths();
+    @Override
+    public void nodePathSelected(String nodePath) {
         selectedNodes.clear();
-        for (TreePath path : paths) {
-            boolean appended = false;
-            StringBuilder sb = new StringBuilder();
-            Object[] pathArray = path.getPath();
-            for (Object o : pathArray) {
-                if (o != null) {
-                    String nodeName = o.toString();
-                    if (nodeName != null) {
-                        if (nodeName.length() > 0) {
-                            appended = true;
-                            sb.append("/"); //$NON-NLS-1$
-                            sb.append(o.toString());
-                        }
-                    }
-                }
-            }
-            if (appended) {
-                selectedNodes.add(sb.toString());
-            }
-        }
+        selectedNodes.add(nodePath);
         for (int i = 0; i < needsReload.size(); i++) {
             this.needsReload.set(i, true);
         }
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorPanel.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorPanel.java
index e816ceb4b60..eb08e722d84 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorPanel.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorPanel.java
@@ -26,16 +26,12 @@
 import java.util.Properties;
 import java.util.concurrent.ExecutionException;
 
-import javax.swing.JButton;
 import javax.swing.JOptionPane;
 import javax.swing.JPanel;
 import javax.swing.JScrollPane;
 import javax.swing.JSplitPane;
-import javax.swing.JToolBar;
 import javax.swing.SwingWorker;
 
-import org.apache.zookeeper.inspector.gui.actions.AddNodeAction;
-import org.apache.zookeeper.inspector.gui.actions.DeleteNodeAction;
 import org.apache.zookeeper.inspector.gui.nodeviewer.ZooInspectorNodeViewer;
 import org.apache.zookeeper.inspector.logger.LoggerFactory;
 import org.apache.zookeeper.inspector.manager.ZooInspectorManager;
@@ -45,10 +41,14 @@
  */
 public class ZooInspectorPanel extends JPanel implements
         NodeViewersChangeListener {
+
+    /** Control how fast the scroll bar in the tree view window moves */
+    private static final int TREE_SCROLL_UNIT_INCREMENT = 16;
+
     private final IconResource iconResource;
     private final Toolbar toolbar;
     private final ZooInspectorNodeViewersPanel nodeViewersPanel;
-    private final ZooInspectorTreeViewer treeViewer;
+    private final ZooInspectorTreeView treeViewer;
     private final ZooInspectorManager zooInspectorManager;
 
     private final List<NodeViewersChangeListener> listeners = new ArrayList<NodeViewersChangeListener>();
@@ -81,10 +81,10 @@ public ZooInspectorPanel(final ZooInspectorManager zooInspectorManager, final Ic
         }
         nodeViewersPanel = new ZooInspectorNodeViewersPanel(
                 zooInspectorManager, nodeViewers);
-        treeViewer = new ZooInspectorTreeViewer(zooInspectorManager,
-                nodeViewersPanel, iconResource);
+        this.treeViewer = new ZooInspectorTreeView(zooInspectorManager, iconResource);
+        this.treeViewer.addNodeSelectionListener(this.nodeViewersPanel);
         this.setLayout(new BorderLayout());
-        
+
         toolbar.addActionListener(Toolbar.Button.connect, new ActionListener() {
             public void actionPerformed(ActionEvent e) {
                 ZooInspectorConnectionPropertiesDialog zicpd = new ZooInspectorConnectionPropertiesDialog(
@@ -101,17 +101,20 @@ public void actionPerformed(ActionEvent e) {
         });
         toolbar.addActionListener(Toolbar.Button.refresh, new ActionListener() {
             public void actionPerformed(ActionEvent e) {
-                treeViewer.refreshView();
+                treeViewer.initialize();
+            }
+        });
+        toolbar.addActionListener(Toolbar.Button.addNode, new ActionListener() {
+            public void actionPerformed(ActionEvent e) {
+                treeViewer.createNode();
+            }
+        });
+        toolbar.addActionListener(Toolbar.Button.deleteNode, new ActionListener() {
+            public void actionPerformed(ActionEvent e) {
+                treeViewer.deleteNode();
             }
         });
-
-        toolbar.addActionListener(Toolbar.Button.addNode,
-                    new AddNodeAction(this, treeViewer, zooInspectorManager));
-        toolbar.addActionListener(Toolbar.Button.deleteNode,
-                    new DeleteNodeAction(this, treeViewer, zooInspectorManager));
-
         toolbar.addActionListener(Toolbar.Button.nodeViewers, new ActionListener() {
-
             public void actionPerformed(ActionEvent e) {
                 ZooInspectorNodeViewersDialog nvd = new ZooInspectorNodeViewersDialog(
                         JOptionPane.getRootFrame(), nodeViewers, listeners,
@@ -127,6 +130,7 @@ public void actionPerformed(ActionEvent e) {
             }
         });
         JScrollPane treeScroller = new JScrollPane(treeViewer);
+        treeScroller.getVerticalScrollBar().setUnitIncrement(TREE_SCROLL_UNIT_INCREMENT);
         JSplitPane splitPane = new JSplitPane(JSplitPane.HORIZONTAL_SPLIT,
                 treeScroller, nodeViewersPanel);
         splitPane.setResizeWeight(0.25);
@@ -152,20 +156,14 @@ protected Boolean doInBackground() throws Exception {
             protected void done() {
                 try {
                     if (get()) {
-                        treeViewer.refreshView();
+                        treeViewer.initialize();
                         toolbar.toggleButtons(true);
                     } else {
                         JOptionPane.showMessageDialog(ZooInspectorPanel.this,
                                 "Unable to connect to zookeeper", "Error",
                                 JOptionPane.ERROR_MESSAGE);
                     }
-                } catch (InterruptedException e) {
-                    LoggerFactory
-                            .getLogger()
-                            .error(
-                                    "Error occurred while connecting to ZooKeeper server",
-                                    e);
-                } catch (ExecutionException e) {
+                } catch (InterruptedException | ExecutionException e) {
                     LoggerFactory
                             .getLogger()
                             .error(
@@ -178,9 +176,6 @@ protected void done() {
         worker.execute();
     }
 
-    /**
-	 * 
-	 */
     public void disconnect() {
         disconnect(false);
     }
@@ -202,16 +197,10 @@ protected Boolean doInBackground() throws Exception {
             protected void done() {
                 try {
                     if (get()) {
-                        treeViewer.clearView();
+                        treeViewer.clear();
                         toolbar.toggleButtons(false);
                     }
-                } catch (InterruptedException e) {
-                    LoggerFactory
-                            .getLogger()
-                            .error(
-                                    "Error occurred while disconnecting from ZooKeeper server",
-                                    e);
-                } catch (ExecutionException e) {
+                } catch (InterruptedException | ExecutionException e) {
                     LoggerFactory
                             .getLogger()
                             .error(
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorTreeView.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorTreeView.java
new file mode 100644
index 00000000000..86422a3009e
--- /dev/null
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorTreeView.java
@@ -0,0 +1,642 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.inspector.gui;
+
+import com.nitido.utils.toaster.Toaster;
+import org.apache.zookeeper.inspector.gui.nodeviewer.NodeSelectionListener;
+import org.apache.zookeeper.inspector.logger.LoggerFactory;
+import org.apache.zookeeper.inspector.manager.NodeListener;
+import org.apache.zookeeper.inspector.manager.Pair;
+import org.apache.zookeeper.inspector.manager.ZooInspectorManager;
+
+import javax.swing.ImageIcon;
+import javax.swing.JMenuItem;
+import javax.swing.JOptionPane;
+import javax.swing.JPanel;
+import javax.swing.JPopupMenu;
+import javax.swing.JTree;
+import javax.swing.SwingUtilities;
+import javax.swing.SwingWorker;
+import javax.swing.event.TreeExpansionEvent;
+import javax.swing.event.TreeExpansionListener;
+import javax.swing.event.TreeSelectionEvent;
+import javax.swing.event.TreeSelectionListener;
+import javax.swing.tree.DefaultMutableTreeNode;
+import javax.swing.tree.DefaultTreeCellRenderer;
+import javax.swing.tree.DefaultTreeModel;
+import javax.swing.tree.TreePath;
+import javax.swing.tree.TreeSelectionModel;
+import java.awt.BorderLayout;
+import java.awt.Color;
+import java.awt.Component;
+import java.awt.Cursor;
+import java.awt.event.ActionEvent;
+import java.awt.event.ActionListener;
+import java.awt.event.KeyAdapter;
+import java.awt.event.KeyEvent;
+import java.awt.event.MouseAdapter;
+import java.awt.event.MouseEvent;
+import java.util.Collections;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Map;
+
+public class ZooInspectorTreeView extends JPanel {
+    private static final String PATH_SEPARATOR = "/";
+    private static final String ROOT_PATH = PATH_SEPARATOR;
+
+    private final JTree tree;
+    private final ZooInspectorTreeModel treeModel;
+
+    private final JPopupMenu rightClickMenu;
+    private final JMenuItem createChildNodeMenuItem;
+    private final JMenuItem deleteNodeMenuItem;
+    private final JMenuItem refreshNodeMenuItem;
+    private final JMenuItem addWatchMenuItem;
+    private final JMenuItem removeWatchMenuItem;
+
+    private final Toaster toasterManager;
+    private final ImageIcon toasterIcon;
+
+    private final List<NodeSelectionListener> nodeSelectionListeners = new LinkedList<>();
+
+    public ZooInspectorTreeView(final ZooInspectorManager manager, IconResource iconResource) {
+        this.toasterManager = new Toaster();
+        this.toasterManager.setBorderColor(Color.BLACK);
+        this.toasterManager.setMessageColor(Color.BLACK);
+        this.toasterManager.setToasterColor(Color.WHITE);
+        this.toasterIcon = iconResource.get(IconResource.ICON_INFORMATION, "");
+
+        // Set up tree to display all ZNodes
+        this.treeModel = new ZooInspectorTreeModel(manager);
+        this.tree = new JTree();
+        this.tree.setEditable(false);
+        this.tree.setFocusable(true);
+        this.tree.getSelectionModel().setSelectionMode(TreeSelectionModel.SINGLE_TREE_SELECTION);
+        this.tree.setModel(this.treeModel);
+        this.tree.setCellRenderer(new ZooInspectorTreeCellRenderer(iconResource));
+
+        // Set up right click menu for individual ZNodes
+        this.rightClickMenu = new JPopupMenu();
+        this.createChildNodeMenuItem = new JMenuItem("Create Child Node");
+        this.deleteNodeMenuItem = new JMenuItem("Delete Node");
+        this.refreshNodeMenuItem = new JMenuItem("Refresh Node");
+        this.addWatchMenuItem = new JMenuItem("Add Watch");
+        this.removeWatchMenuItem = new JMenuItem("Remove Watch");
+
+        // Add various event listeners (all implemented as inner classes on this class)
+        TreeEventHandler treeHandler = new TreeEventHandler();
+        MouseEventHandler mouseHandler = new MouseEventHandler();
+        KeyEventHandler keyHandler = new KeyEventHandler();
+        ActionEventHandler actionHandler = new ActionEventHandler();
+
+        this.tree.addKeyListener(keyHandler);
+        this.tree.addTreeExpansionListener(treeHandler);
+        this.tree.getSelectionModel().addTreeSelectionListener(treeHandler);
+        this.tree.addMouseListener(mouseHandler);
+        this.rightClickMenu.add(this.createChildNodeMenuItem).addActionListener(actionHandler);
+        this.rightClickMenu.add(this.deleteNodeMenuItem).addActionListener(actionHandler);
+        this.rightClickMenu.add(this.refreshNodeMenuItem).addActionListener(actionHandler);
+        this.rightClickMenu.add(this.addWatchMenuItem).addActionListener(actionHandler);
+        this.rightClickMenu.add(this.removeWatchMenuItem).addActionListener(actionHandler);
+
+        setLayout(new BorderLayout());
+        add(this.tree, BorderLayout.CENTER);
+    }
+
+    public void addNodeSelectionListener(NodeSelectionListener l) {
+        if (!this.nodeSelectionListeners.contains(l)) {
+            this.nodeSelectionListeners.add(l);
+        }
+    }
+
+    @SuppressWarnings("unused")
+    public void removeNodeSelectionListener(NodeSelectionListener l) {
+        this.nodeSelectionListeners.remove(l);
+    }
+
+    ///////////////////////////////// EVENT HANDLERS /////////////////////////////////
+
+    private class NodeEventHandler implements NodeListener {
+        @Override
+        public void processEvent(String nodePath, String eventType, Map<String, String> eventInfo) {
+            StringBuilder sb = new StringBuilder(256);
+            sb.append("Node: ");
+            sb.append(nodePath);
+            sb.append("\nEvent: ");
+            sb.append(eventType);
+            if (eventInfo != null) {
+                for (Map.Entry<String, String> entry : eventInfo.entrySet()) {
+                    sb.append("\n");
+                    sb.append(entry.getKey());
+                    sb.append(": ");
+                    sb.append(entry.getValue());
+                }
+            }
+            toasterManager.showToaster(toasterIcon, sb.toString());
+        }
+    }
+
+    public class TreeEventHandler implements TreeExpansionListener, TreeSelectionListener {
+        @Override
+        public void treeExpanded(TreeExpansionEvent event) {
+            ZooInspectorTreeNode expandingNode = (ZooInspectorTreeNode) event.getPath().getLastPathComponent();
+
+            // This whole chunk of code before the "refreshNode" call is to deal with the fact that when lazy-loading a
+            // node, we first give it a single "placeholder" empty child node to mark it as having children, but we don't
+            // actually load those children until the user decides to expand it.  These "if" statements figure out if the
+            // node has a single placeholder child or not.
+
+            if (expandingNode.isLeaf() || expandingNode.getChildCount() != 1) {
+                return;
+            }
+
+            ZooInspectorTreeNode onlyChild = ((ZooInspectorTreeNode) expandingNode.getChildAt(0));
+            if (!onlyChild.isPlaceholder()) {
+                return;
+            }
+
+            treeModel.refreshNode(expandingNode);
+        }
+
+        @Override
+        public void treeCollapsed(TreeExpansionEvent event) {
+        }
+
+        @Override
+        public void valueChanged(TreeSelectionEvent e) {
+            ZooInspectorTreeNode node = (ZooInspectorTreeNode) e.getPath().getLastPathComponent();
+            String selectedPath = node.getPathString();
+            for (NodeSelectionListener listener : nodeSelectionListeners) {
+                listener.nodePathSelected(selectedPath);
+            }
+        }
+    }
+
+    private class KeyEventHandler extends KeyAdapter {
+        @Override
+        public void keyReleased(KeyEvent e) {
+            if (!tree.hasFocus()) {
+                return;
+            }
+
+            switch (e.getKeyCode()) {
+                case KeyEvent.VK_D:
+                    deleteNode();
+                    break;
+                case KeyEvent.VK_N:
+                    createNode();
+                    break;
+                case KeyEvent.VK_R:
+                    refreshNode();
+                    break;
+                default:
+                    break;
+            }
+        }
+    }
+
+    private class ActionEventHandler implements ActionListener {
+        @Override
+        public void actionPerformed(ActionEvent e) {
+            if (e.getSource() == createChildNodeMenuItem) {
+                createNode();
+            } else if (e.getSource() == deleteNodeMenuItem) {
+                deleteNode();
+            } else if (e.getSource() == refreshNodeMenuItem) {
+                refreshNode();
+            } else if (e.getSource() == addWatchMenuItem) {
+                addWatch();
+            } else if (e.getSource() == removeWatchMenuItem) {
+                removeWatch();
+            }
+        }
+    }
+
+    private class MouseEventHandler extends MouseAdapter {
+
+        @Override
+        public void mouseClicked(MouseEvent e) {
+            ZooInspectorTreeNode selectedNode = getSelectedNode();
+            if (selectedNode == null) {
+                //If there's no node currently selected, see if the mouse is on top of one and select it
+                int selectedRow = tree.getRowForLocation(e.getX(), e.getY());
+                if (selectedRow == -1) {
+                    return;
+                }
+                tree.setSelectionRow(selectedRow);
+
+                TreePath selectedPath = tree.getPathForLocation(e.getX(), e.getY());
+                tree.setSelectionPath(selectedPath);
+            }
+
+            boolean shouldShowPopup = e.isPopupTrigger() || SwingUtilities.isRightMouseButton(e);
+            if (shouldShowPopup) {
+                rightClickMenu.show(ZooInspectorTreeView.this, e.getX(), e.getY());
+            }
+        }
+    }
+
+    ///////////////////////////////// BUSINESS LOGIC /////////////////////////////////
+
+    /**
+     * Initialize the view by creating a completely new tree by removing and refreshing all nodes.
+     */
+    public void initialize() {
+        this.treeModel.init();
+    }
+
+    /**
+     * Clear all the existing nodes from the tree view.
+     */
+    public void clear() {
+        this.treeModel.clear();
+    }
+
+    /**
+     * Start the UI workflow for creating a new ZNode as a child of the selected node.
+     */
+    public void createNode() {
+        ZooInspectorTreeNode parentNode = getSelectedNode();
+        if (parentNode == null) {
+            return;
+        }
+
+        final String newNodeName = JOptionPane.showInputDialog(
+                this,
+                "Please enter a name for the new node: ",
+                "Create Child Node",
+                JOptionPane.INFORMATION_MESSAGE);
+
+        if (newNodeName == null || newNodeName.trim().isEmpty()) {
+            return;
+        }
+
+        this.treeModel.createNode(parentNode, newNodeName);
+    }
+
+    /**
+     * Start the UI workflow for deleting the selected node.
+     */
+    public void deleteNode() {
+        ZooInspectorTreeNode nodeToDelete = getSelectedNode();
+        if (nodeToDelete == null) {
+            return;
+        }
+
+        int answer = JOptionPane.showConfirmDialog(
+                this,
+                "Are you sure you want to delete the selected node '" + nodeToDelete.getPathString() + "'?\n" +
+                        "(This action cannot be reverted)",
+                "Confirm Delete",
+                JOptionPane.YES_NO_OPTION,
+                JOptionPane.WARNING_MESSAGE
+        );
+
+        if (answer != JOptionPane.YES_OPTION) {
+            return;
+        }
+
+        this.treeModel.deleteNode(nodeToDelete);
+    }
+
+    /**
+     * Refresh the selected node (i.e. deleting all children and re-fetch them from Zookeeper).
+     */
+    public void refreshNode() {
+        ZooInspectorTreeNode nodeToRefresh = getSelectedNode();
+        if (nodeToRefresh == null) {
+            return;
+        }
+        this.treeModel.refreshNode(nodeToRefresh);
+    }
+
+    /**
+     * Add a Zookeeper watch to the selected node.
+     */
+    public void addWatch() {
+        ZooInspectorTreeNode nodeToWatch = getSelectedNode();
+        if (nodeToWatch == null) {
+            return;
+        }
+        this.treeModel.addWatch(nodeToWatch);
+    }
+
+    /**
+     * Remove a Zookeeper watch from the selected node (has no effect if the node does not have an existing watch).
+     */
+    public void removeWatch() {
+        ZooInspectorTreeNode nodeToUnwatch = getSelectedNode();
+        if (nodeToUnwatch == null) {
+            return;
+        }
+        this.treeModel.removeWatch(nodeToUnwatch);
+    }
+
+    /**
+     * @return The node object corresponding to the selected node or null if there is no node selected.
+     */
+    private ZooInspectorTreeNode getSelectedNode() {
+        TreePath selected = this.tree.getSelectionPath();
+        return selected != null ? ((ZooInspectorTreeNode) selected.getLastPathComponent()) : null;
+    }
+
+    private void showWarnDialog(String message){
+        JOptionPane.showMessageDialog(this,
+                message, "Error",
+                JOptionPane.ERROR_MESSAGE);
+    }
+
+    ///////////////////////////////// BACKING DATA MODEL /////////////////////////////////
+
+    /**
+     * An implement of the backing TreeModel data for the JTree in the user interface.  Controls what data is actually
+     * available to be rendered in the UI.
+     */
+    private class ZooInspectorTreeModel extends DefaultTreeModel {
+        private final ZooInspectorManager manager;
+
+        public ZooInspectorTreeModel(ZooInspectorManager manager) {
+            super(new ZooInspectorTreeNode(ROOT_PATH, ROOT_PATH, 0));
+            this.manager = manager;
+        }
+
+        /**
+         * Create a new ZNode in Zookeeper as a child of the given parent node.
+         *
+         * @param parentNode  The parent node to create a new child ZNode underneath
+         * @param newNodeName The name of the new child ZNode to create
+         */
+        public void createNode(ZooInspectorTreeNode parentNode, String newNodeName) {
+            SwingWorker<Boolean, Void> worker = new SwingWorker<Boolean, Void>() {
+                @Override
+                protected Boolean doInBackground() {
+                    //runs on a background non-UI thread
+                    return manager.createNode(parentNode.getPathString(), newNodeName);
+                }
+
+                @Override
+                protected void done() {
+                    //runs on the UI event thread
+                    boolean success;
+                    try {
+                        success = get();
+                    } catch (Exception e) {
+                        success = false;
+                        LoggerFactory.getLogger().error("create fail for {} {}", parentNode, newNodeName, e);
+                        showWarnDialog("create " + newNodeName + " in " + parentNode + " fail, exception is " + e.getMessage());
+                    }
+
+                    if (!success) {
+                        showWarnDialog("create " + newNodeName + " in " + parentNode + " fail, see log for more detail");
+                    }
+                    else {
+                        //extra logic to find the correct spot alphabetically to insert the new node in the tree`
+                        int i = 0;
+                        for (; i < parentNode.getChildCount(); i++) {
+                            ZooInspectorTreeNode existingChild = (ZooInspectorTreeNode) parentNode.getChildAt(i);
+                            if (newNodeName.compareTo(existingChild.getName()) < 0) {
+                                break;
+                            }
+                        }
+                        insertNodeInto(new ZooInspectorTreeNode(newNodeName, parentNode, 0), parentNode, i);
+                        parentNode.setNumDisplayChildren(parentNode.getNumDisplayChildren() + 1);
+                    }
+                    getRootPane().setCursor(Cursor.getPredefinedCursor(Cursor.DEFAULT_CURSOR));
+                }
+            };
+            getRootPane().setCursor(Cursor.getPredefinedCursor(Cursor.WAIT_CURSOR));
+            worker.execute();
+        }
+
+        /**
+         * Delete the specified ZNode in Zookeeper.
+         *
+         * @param nodeToDelete The node to delete.
+         */
+        public void deleteNode(ZooInspectorTreeNode nodeToDelete) {
+            SwingWorker<Boolean, Void> worker = new SwingWorker<Boolean, Void>() {
+                @Override
+                protected Boolean doInBackground() {
+                    //runs on a background non-UI thread
+                    return manager.deleteNode(nodeToDelete.getPathString());
+                }
+
+                @Override
+                protected void done() {
+                    //runs on the UI event thread
+                    ZooInspectorTreeNode parent = (ZooInspectorTreeNode) nodeToDelete.getParent();
+                    parent.setNumDisplayChildren(parent.getNumDisplayChildren() - 1);
+                    removeNodeFromParent(nodeToDelete);
+                    getRootPane().setCursor(Cursor.getPredefinedCursor(Cursor.DEFAULT_CURSOR));
+                }
+            };
+            getRootPane().setCursor(Cursor.getPredefinedCursor(Cursor.WAIT_CURSOR));
+            worker.execute();
+        }
+
+        /**
+         * Refresh the specified node in the UI. Refresh is equivalent to removing all existing children from the UI
+         * view and re-fetching them from Zookeeper.
+         *
+         * @param nodeToRefresh The node whose subtree should be refreshed.
+         */
+        public void refreshNode(ZooInspectorTreeNode nodeToRefresh) {
+            SwingWorker<Boolean, Void> worker = new SwingWorker<Boolean, Void>() {
+                final LinkedList<Pair<String, Integer>> childrenToAdd = new LinkedList<>();
+
+                @Override
+                protected Boolean doInBackground() {
+                    //runs on a background non-UI thread
+                    //Make all the network calls here (to get children and their child counts) and collect the children,
+                    //but we can't add them to the UI until we're back on the event thread in done()
+                    List<String> children = manager.getChildren(nodeToRefresh.getPathString());
+                    if (children == null) {
+                        return false;
+                    }
+                    nodeToRefresh.setNumDisplayChildren(children.size());
+
+                    for (String childName : children) {
+                        ZooInspectorTreeNode childNode = new ZooInspectorTreeNode(childName, nodeToRefresh, 0);
+                        int numChildren = manager.getNumChildren(childNode.getPathString());
+                        childrenToAdd.add(new Pair<>(childName, numChildren));
+                    }
+                    return true;
+                }
+
+                @Override
+                protected void done() {
+                    //runs on the UI event thread
+                    nodeToRefresh.removeAllChildren();
+
+                    for (Pair<String, Integer> childPair : childrenToAdd) {
+                        ZooInspectorTreeNode childNode = new ZooInspectorTreeNode(childPair.getKey(),
+                                nodeToRefresh,
+                                childPair.getValue());
+
+                        if (childPair.getValue() > 0) {
+                            // add a placeholder child so the UI renders this node like it has children
+                            childNode.add(new ZooInspectorTreeNode());
+                        }
+                        nodeToRefresh.add(childNode);
+                    }
+
+                    reload(nodeToRefresh);
+                    getRootPane().setCursor(Cursor.getPredefinedCursor(Cursor.DEFAULT_CURSOR));
+                }
+            };
+            getRootPane().setCursor(Cursor.getPredefinedCursor(Cursor.WAIT_CURSOR));
+            worker.execute();
+        }
+
+        /**
+         * Add a Zookeeper watch to the specified node (which will display updates in a Toast)
+         *
+         * @param nodeToWatch A reference to the node to place a watch on
+         */
+        public void addWatch(ZooInspectorTreeNode nodeToWatch) {
+            this.manager.addWatchers(Collections.singletonList(nodeToWatch.getPathString()), new NodeEventHandler());
+        }
+
+        /**
+         * Remove a Zookeeper watch from the specified node (has no effect if this node has no existing watch)
+         *
+         * @param nodeToUnwatch A reference to the node to remove a watch from
+         */
+        public void removeWatch(ZooInspectorTreeNode nodeToUnwatch) {
+            this.manager.removeWatchers(Collections.singletonList(nodeToUnwatch.getPathString()));
+        }
+
+        /**
+         * Reinitialize the entire tree by refreshing the root node.
+         */
+        public void init() {
+            refreshNode((ZooInspectorTreeNode) getRoot());
+        }
+
+        /**
+         * Clear the tree by removing all children from the root node.
+         */
+        public void clear() {
+            ZooInspectorTreeNode root = (ZooInspectorTreeNode) getRoot();
+            root.setNumDisplayChildren(0);
+            root.removeAllChildren();
+            reload();
+        }
+    }
+
+    /**
+     * A representation of a single node in the TreeModel.  Keeps track of a node's name, the number of children
+     * it has and its full Zookeeper path.
+     */
+    private static class ZooInspectorTreeNode extends DefaultMutableTreeNode {
+        private final String name;
+        private final String pathString;
+        private int numDisplayChildren;
+
+        public ZooInspectorTreeNode() {
+            this("", "", 0);
+        }
+
+        public ZooInspectorTreeNode(String name, ZooInspectorTreeNode parent, int numDisplayChildren) {
+            this(name, (PATH_SEPARATOR.equals(parent.getName()) ? "" : parent.getPathString()) + PATH_SEPARATOR + name, numDisplayChildren);
+        }
+
+        public ZooInspectorTreeNode(String name, String pathString, int numDisplayChildren) {
+            this.name = name;
+            this.pathString = pathString;
+            this.numDisplayChildren = numDisplayChildren;
+        }
+
+        @Override
+        public boolean equals(Object o) {
+            if (this == o) {
+                return true;
+            }
+
+            if (o == null || getClass() != o.getClass()) {
+                return false;
+            }
+
+            ZooInspectorTreeNode that = (ZooInspectorTreeNode) o;
+            return this.pathString.equals(that.pathString);
+        }
+
+        @Override
+        public int hashCode() {
+            return this.pathString.hashCode();
+        }
+
+        public boolean isPlaceholder() {
+            //A placeholder node renders as "Loading..." on the UI and is identified by having an empty name and path
+            return this.name.isEmpty() && this.getPathString().isEmpty();
+        }
+
+        public String getName() {
+            return this.name;
+        }
+
+        public String getPathString() {
+            return this.pathString;
+        }
+
+        public int getNumDisplayChildren() {
+            return this.numDisplayChildren;
+        }
+
+        public void setNumDisplayChildren(int numDisplayChildren) {
+            this.numDisplayChildren = numDisplayChildren;
+        }
+
+        @Override
+        public String toString() {
+            //NOTE: Don't mess with this; it's actually used to construct the TreePath entries; if you want to
+            //change the name on the UI display, use the TreeCellRenderer below
+            return this.name;
+        }
+    }
+
+    /**
+     * A class that controls how a given tree node is rendered in the tree on the UI (this is what's responsible for
+     * drawing "Loading..." for a placeholder node or render the # of children for a node).
+     */
+    private static class ZooInspectorTreeCellRenderer extends DefaultTreeCellRenderer {
+        public ZooInspectorTreeCellRenderer(IconResource iconResource) {
+            setLeafIcon(iconResource.get(IconResource.ICON_TREE_LEAF, ""));
+            setOpenIcon(iconResource.get(IconResource.ICON_TREE_OPEN, ""));
+            setClosedIcon(iconResource.get(IconResource.ICON_TREE_CLOSE, ""));
+        }
+
+        @Override
+        public Component getTreeCellRendererComponent(JTree tree, Object value, boolean sel, boolean expanded,
+                                                      boolean leaf, int row, boolean hasFocus) {
+            ZooInspectorTreeNode node = (ZooInspectorTreeNode) value;
+            String text = node.getName();
+
+            if (node.isPlaceholder()) {
+                text = "Loading...";
+            }
+
+            if (node.getNumDisplayChildren() > 0) {
+                text += " (" + node.getNumDisplayChildren() + ")";
+            }
+
+            return super.getTreeCellRendererComponent(tree, text, sel, expanded, leaf, row, hasFocus);
+        }
+    }
+}
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorTreeViewer.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorTreeViewer.java
deleted file mode 100644
index e08f2d3b753..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/ZooInspectorTreeViewer.java
+++ /dev/null
@@ -1,384 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.inspector.gui;
-
-import java.awt.BorderLayout;
-import java.awt.Color;
-import java.awt.event.ActionEvent;
-import java.awt.event.ActionListener;
-import java.awt.event.InputEvent;
-import java.awt.event.KeyEvent;
-import java.awt.event.MouseAdapter;
-import java.awt.event.MouseEvent;
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.Enumeration;
-import java.util.LinkedHashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-
-import javax.swing.ImageIcon;
-import javax.swing.JMenuItem;
-import javax.swing.JPanel;
-import javax.swing.JPopupMenu;
-import javax.swing.JComponent;
-import javax.swing.JTree;
-import javax.swing.SwingWorker;
-import javax.swing.event.TreeSelectionListener;
-import javax.swing.tree.DefaultMutableTreeNode;
-import javax.swing.tree.DefaultTreeCellRenderer;
-import javax.swing.tree.DefaultTreeModel;
-import javax.swing.tree.TreeNode;
-import javax.swing.tree.TreePath;
-
-import org.apache.zookeeper.inspector.gui.actions.AddNodeAction;
-import org.apache.zookeeper.inspector.gui.actions.DeleteNodeAction;
-import org.apache.zookeeper.inspector.manager.NodeListener;
-import org.apache.zookeeper.inspector.manager.ZooInspectorManager;
-
-import com.nitido.utils.toaster.Toaster;
-import static javax.swing.KeyStroke.getKeyStroke;
-
-/**
- * A {@link JPanel} for showing the tree view of all the nodes in the zookeeper
- * instance
- */
-public class ZooInspectorTreeViewer extends JPanel implements NodeListener {
-    private final ZooInspectorManager zooInspectorManager;
-    private final JTree tree;
-    private final Toaster toasterManager;
-    private final ImageIcon toasterIcon;
-
-    /**
-     * @param zooInspectorManager
-     *            - the {@link ZooInspectorManager} for the application
-     * @param listener
-     *            - the {@link TreeSelectionListener} to listen for changes in
-     *            the selected node on the node tree
-     */
-    public ZooInspectorTreeViewer(
-            final ZooInspectorManager zooInspectorManager,
-            TreeSelectionListener listener, IconResource iconResource) {
-
-        this.getInputMap(JComponent.WHEN_IN_FOCUSED_WINDOW)
-                .put(getKeyStroke(KeyEvent.VK_D, InputEvent.CTRL_MASK), "deleteNode");
-
-        this.getActionMap().put("deleteNode",
-                new DeleteNodeAction(this, this, zooInspectorManager));
-
-        this.getInputMap(JComponent.WHEN_IN_FOCUSED_WINDOW)
-                .put(getKeyStroke(KeyEvent.VK_N, InputEvent.CTRL_MASK), "addNode");
-
-        this.getActionMap().put("addNode",
-                new AddNodeAction(this, this, zooInspectorManager));
-
-        this.zooInspectorManager = zooInspectorManager;
-        this.setLayout(new BorderLayout());
-        final JPopupMenu popupMenu = new JPopupMenu();
-
-        final JMenuItem addNode = new JMenuItem("Add Node");
-        addNode.addActionListener(new AddNodeAction(this, this, zooInspectorManager));
-
-        final JMenuItem deleteNode = new JMenuItem("Delete Node");
-        deleteNode.addActionListener(new DeleteNodeAction(this, this, zooInspectorManager));
-
-        final JMenuItem addNotify = new JMenuItem("Add Change Notification");
-        this.toasterManager = new Toaster();
-        this.toasterManager.setBorderColor(Color.BLACK);
-        this.toasterManager.setMessageColor(Color.BLACK);
-        this.toasterManager.setToasterColor(Color.WHITE);
-        toasterIcon = iconResource.get(IconResource.ICON_INFORMATION,"");
-        addNotify.addActionListener(new ActionListener() {
-            public void actionPerformed(ActionEvent e) {
-                List<String> selectedNodes = getSelectedNodes();
-                zooInspectorManager.addWatchers(selectedNodes,
-                        ZooInspectorTreeViewer.this);
-            }
-        });
-        final JMenuItem removeNotify = new JMenuItem(
-                "Remove Change Notification");
-        removeNotify.addActionListener(new ActionListener() {
-            public void actionPerformed(ActionEvent e) {
-                List<String> selectedNodes = getSelectedNodes();
-                zooInspectorManager.removeWatchers(selectedNodes);
-            }
-        });
-        tree = new JTree(new DefaultMutableTreeNode());
-        tree.setCellRenderer(new ZooInspectorTreeCellRenderer(iconResource));
-        tree.setEditable(false);
-        tree.getSelectionModel().addTreeSelectionListener(listener);
-        tree.addMouseListener(new MouseAdapter() {
-            @Override
-            public void mouseClicked(MouseEvent e) {
-                if (e.isPopupTrigger() || e.getButton() == MouseEvent.BUTTON3) {
-                    // TODO only show add if a selected node isn't being
-                    // watched, and only show remove if a selected node is being
-                    // watched
-                    popupMenu.removeAll();
-                    popupMenu.add(addNode);
-                    popupMenu.add(deleteNode);
-                    popupMenu.add(addNotify);
-                    popupMenu.add(removeNotify);
-                    popupMenu.show(ZooInspectorTreeViewer.this, e.getX(), e
-                            .getY());
-                }
-            }
-        });
-        this.add(tree, BorderLayout.CENTER);
-    }
-
-    /**
-     * Refresh the tree view
-     */
-    public void refreshView() {
-        final Set<TreePath> expandedNodes = new LinkedHashSet<TreePath>();
-        int rowCount = tree.getRowCount();
-        for (int i = 0; i < rowCount; i++) {
-            TreePath path = tree.getPathForRow(i);
-            if (tree.isExpanded(path)) {
-                expandedNodes.add(path);
-            }
-        }
-        final TreePath[] selectedNodes = tree.getSelectionPaths();
-        SwingWorker<Boolean, Void> worker = new SwingWorker<Boolean, Void>() {
-
-            @Override
-            protected Boolean doInBackground() throws Exception {
-                tree.setModel(new DefaultTreeModel(new ZooInspectorTreeNode(
-                        "/", null)));
-                return true;
-            }
-
-            @Override
-            protected void done() {
-                for (TreePath path : expandedNodes) {
-                    tree.expandPath(path);
-                }
-                tree.getSelectionModel().setSelectionPaths(selectedNodes);
-            }
-        };
-        worker.execute();
-    }
-
-    /**
-     * clear the tree view of all nodes
-     */
-    public void clearView() {
-        tree.setModel(new DefaultTreeModel(new DefaultMutableTreeNode()));
-    }
-
-    private static class ZooInspectorTreeCellRenderer extends
-            DefaultTreeCellRenderer {
-        public ZooInspectorTreeCellRenderer(IconResource iconResource) {
-            setLeafIcon(iconResource.get(IconResource.ICON_TREE_LEAF,""));
-            setOpenIcon(iconResource.get(IconResource.ICON_TREE_OPEN,""));
-            setClosedIcon(iconResource.get(IconResource.ICON_TREE_CLOSE,""));
-        }
-    }
-
-    private class ZooInspectorTreeNode implements TreeNode {
-        private final String nodePath;
-        private final String nodeName;
-        private final ZooInspectorTreeNode parent;
-
-        public ZooInspectorTreeNode(String nodePath, ZooInspectorTreeNode parent) {
-            this.parent = parent;
-            this.nodePath = nodePath;
-            int index = nodePath.lastIndexOf("/");
-            if (index == -1) {
-                throw new IllegalArgumentException("Invalid node path"
-                        + nodePath);
-            }
-            this.nodeName = nodePath.substring(index + 1);
-        }
-
-        /*
-         * (non-Javadoc)
-         * 
-         * @see javax.swing.tree.TreeNode#children()
-         */
-        public Enumeration<TreeNode> children() {
-            List<String> children = zooInspectorManager
-                    .getChildren(this.nodePath);
-            Collections.sort(children);
-            List<TreeNode> returnChildren = new ArrayList<TreeNode>();
-            for (String child : children) {
-                returnChildren.add(new ZooInspectorTreeNode((this.nodePath
-                        .equals("/") ? "" : this.nodePath)
-                        + "/" + child, this));
-            }
-            return Collections.enumeration(returnChildren);
-        }
-
-        /*
-         * (non-Javadoc)
-         * 
-         * @see javax.swing.tree.TreeNode#getAllowsChildren()
-         */
-        public boolean getAllowsChildren() {
-            return zooInspectorManager.isAllowsChildren(this.nodePath);
-        }
-
-        /*
-         * (non-Javadoc)
-         * 
-         * @see javax.swing.tree.TreeNode#getChildAt(int)
-         */
-        public TreeNode getChildAt(int childIndex) {
-            String child = zooInspectorManager.getNodeChild(this.nodePath,
-                    childIndex);
-            if (child != null) {
-                return new ZooInspectorTreeNode((this.nodePath.equals("/") ? ""
-                        : this.nodePath)
-                        + "/" + child, this);
-            }
-            return null;
-        }
-
-        /*
-         * (non-Javadoc)
-         * 
-         * @see javax.swing.tree.TreeNode#getChildCount()
-         */
-        public int getChildCount() {
-            return zooInspectorManager.getNumChildren(this.nodePath);
-        }
-
-        /*
-         * (non-Javadoc)
-         * 
-         * @see javax.swing.tree.TreeNode#getIndex(javax.swing.tree.TreeNode)
-         */
-        public int getIndex(TreeNode node) {
-            return zooInspectorManager.getNodeIndex(this.nodePath);
-        }
-
-        /*
-         * (non-Javadoc)
-         * 
-         * @see javax.swing.tree.TreeNode#getParent()
-         */
-        public TreeNode getParent() {
-            return this.parent;
-        }
-
-        /*
-         * (non-Javadoc)
-         * 
-         * @see javax.swing.tree.TreeNode#isLeaf()
-         */
-        public boolean isLeaf() {
-            return !zooInspectorManager.hasChildren(this.nodePath);
-        }
-
-        @Override
-        public String toString() {
-            return this.nodeName;
-        }
-
-        @Override
-        public int hashCode() {
-            final int prime = 31;
-            int result = 1;
-            result = prime * result + getOuterType().hashCode();
-            result = prime * result
-                    + ((nodePath == null) ? 0 : nodePath.hashCode());
-            result = prime * result
-                    + ((parent == null) ? 0 : parent.hashCode());
-            return result;
-        }
-
-        @Override
-        public boolean equals(Object obj) {
-            if (this == obj)
-                return true;
-            if (obj == null)
-                return false;
-            if (getClass() != obj.getClass())
-                return false;
-            ZooInspectorTreeNode other = (ZooInspectorTreeNode) obj;
-            if (!getOuterType().equals(other.getOuterType()))
-                return false;
-            if (nodePath == null) {
-                if (other.nodePath != null)
-                    return false;
-            } else if (!nodePath.equals(other.nodePath))
-                return false;
-            if (parent == null) {
-                if (other.parent != null)
-                    return false;
-            } else if (!parent.equals(other.parent))
-                return false;
-            return true;
-        }
-
-        private ZooInspectorTreeViewer getOuterType() {
-            return ZooInspectorTreeViewer.this;
-        }
-
-    }
-
-    /**
-     * @return {@link List} of the currently selected nodes
-     */
-    public List<String> getSelectedNodes() {
-        TreePath[] paths = tree.getSelectionPaths();
-        List<String> selectedNodes = new ArrayList<String>();
-        if (paths != null) {
-            for (TreePath path : paths) {
-                StringBuilder sb = new StringBuilder();
-                Object[] pathArray = path.getPath();
-                for (Object o : pathArray) {
-                    String nodeName = o.toString();
-                    if (nodeName.length() > 0) {
-                        sb.append("/");
-                        sb.append(o.toString());
-                    }
-                }
-                selectedNodes.add(sb.toString());
-            }
-        }
-        return selectedNodes;
-    }
-
-    /*
-     * (non-Javadoc)
-     * 
-     * @see
-     * org.apache.zookeeper.inspector.manager.NodeListener#processEvent(java
-     * .lang.String, java.lang.String, java.util.Map)
-     */
-    public void processEvent(String nodePath, String eventType,
-            Map<String, String> eventInfo) {
-        StringBuilder sb = new StringBuilder();
-        sb.append("Node: ");
-        sb.append(nodePath);
-        sb.append("\nEvent: ");
-        sb.append(eventType);
-        if (eventInfo != null) {
-            for (Map.Entry<String, String> entry : eventInfo.entrySet()) {
-                sb.append("\n");
-                sb.append(entry.getKey());
-                sb.append(": ");
-                sb.append(entry.getValue());
-            }
-        }
-        this.toasterManager.showToaster(toasterIcon, sb.toString());
-    }
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/actions/AddNodeAction.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/actions/AddNodeAction.java
deleted file mode 100644
index 30916112a2f..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/actions/AddNodeAction.java
+++ /dev/null
@@ -1,74 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.inspector.gui.actions;
-
-import org.apache.zookeeper.inspector.gui.ZooInspectorPanel;
-import org.apache.zookeeper.inspector.gui.ZooInspectorTreeViewer;
-import org.apache.zookeeper.inspector.manager.ZooInspectorManager;
-
-import javax.swing.*;
-import java.awt.event.ActionEvent;
-import java.awt.event.ActionListener;
-import java.util.List;
-import java.awt.event.KeyEvent;
-
-public class AddNodeAction extends AbstractAction {
-
-    private JPanel panel;
-    private ZooInspectorTreeViewer treeViewer;
-    private ZooInspectorManager zooInspectorManager;
-
-    public AddNodeAction(JPanel parentPanel,
-                         ZooInspectorTreeViewer treeViewer,
-                         ZooInspectorManager zooInspectorManager) {
-        this.panel = parentPanel;
-        this.treeViewer = treeViewer;
-        this.zooInspectorManager = zooInspectorManager;
-    }
-
-    public void actionPerformed(ActionEvent e) {
-        final List<String> selectedNodes = treeViewer
-                .getSelectedNodes();
-        if (selectedNodes.size() == 1) {
-            final String nodeName = JOptionPane.showInputDialog(
-                    panel,
-                    "Please Enter a name for the new node",
-                    "Create Node", JOptionPane.INFORMATION_MESSAGE);
-            if (nodeName != null && nodeName.length() > 0) {
-                SwingWorker<Boolean, Void> worker = new SwingWorker<Boolean, Void>() {
-
-                    @Override
-                    protected Boolean doInBackground() throws Exception {
-                        return zooInspectorManager
-                                .createNode(selectedNodes.get(0),
-                                        nodeName);
-                    }
-
-                    @Override
-                    protected void done() {
-                        treeViewer.refreshView();
-                    }
-                };
-                worker.execute();
-            }
-        } else {
-            JOptionPane.showMessageDialog(panel,
-                    "Please select 1 parent node for the new node.");
-        }
-    }
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/actions/DeleteNodeAction.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/actions/DeleteNodeAction.java
deleted file mode 100644
index 90016701e68..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/actions/DeleteNodeAction.java
+++ /dev/null
@@ -1,79 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.zookeeper.inspector.gui.actions;
-
-import org.apache.zookeeper.inspector.gui.ZooInspectorTreeViewer;
-import org.apache.zookeeper.inspector.manager.ZooInspectorManager;
-
-import javax.swing.*;
-import java.awt.event.ActionEvent;
-import java.awt.event.ActionListener;
-import java.util.List;
-import java.awt.event.KeyEvent;
-
-public class DeleteNodeAction extends AbstractAction {
-
-    private JPanel parentPanel;
-    private ZooInspectorTreeViewer treeViewer;
-    private ZooInspectorManager zooInspectorManager;
-
-    public DeleteNodeAction(JPanel parentPanel,
-                            ZooInspectorTreeViewer treeViewer,
-                            ZooInspectorManager zooInspectorManager) {
-        this.parentPanel = parentPanel;
-        this.treeViewer = treeViewer;
-        this.zooInspectorManager = zooInspectorManager;
-    }
-
-
-    public void actionPerformed(ActionEvent e) {
-        final List<String> selectedNodes = treeViewer
-                .getSelectedNodes();
-        if (selectedNodes.size() == 0) {
-            JOptionPane.showMessageDialog(parentPanel,
-                    "Please select at least 1 node to be deleted");
-        } else {
-            int answer = JOptionPane.showConfirmDialog(
-                    parentPanel,
-                    "Are you sure you want to delete the selected nodes?"
-                            + "(This action cannot be reverted)",
-                    "Confirm Delete", JOptionPane.YES_NO_OPTION,
-                    JOptionPane.WARNING_MESSAGE
-            );
-            if (answer == JOptionPane.YES_OPTION) {
-                SwingWorker<Boolean, Void> worker = new SwingWorker<Boolean, Void>() {
-
-                    @Override
-                    protected Boolean doInBackground() throws Exception {
-                        for (String nodePath : selectedNodes) {
-                            zooInspectorManager
-                                    .deleteNode(nodePath);
-                        }
-                        return true;
-                    }
-
-                    @Override
-                    protected void done() {
-                        treeViewer.refreshView();
-                    }
-                };
-                worker.execute();
-            }
-        }
-    }
-}
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/nodeviewer/NodeSelectionListener.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/nodeviewer/NodeSelectionListener.java
new file mode 100644
index 00000000000..8a3a8dcb735
--- /dev/null
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/nodeviewer/NodeSelectionListener.java
@@ -0,0 +1,26 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.inspector.gui.nodeviewer;
+
+/**
+ * An interface to be implemented by any component that needs notification when a new element
+ * is selected in the UI JTree representing the set of available ZNodes.
+ */
+public interface NodeSelectionListener {
+    void nodePathSelected(String nodePath);
+}
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/nodeviewer/NodeViewerData.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/nodeviewer/NodeViewerData.java
index 6061e17bf8c..32e269ca090 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/nodeviewer/NodeViewerData.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/nodeviewer/NodeViewerData.java
@@ -60,7 +60,7 @@ public NodeViewerData() {
             public void actionPerformed(ActionEvent e) {
                 if (selectedNode != null) {
                     if (JOptionPane.showConfirmDialog(NodeViewerData.this,
-                            "Are you sure you want to save this node?"
+                            "Are you sure you want to save the node '" + selectedNode + "'?\n"
                                     + " (this action cannot be reverted)",
                             "Confirm Save", JOptionPane.YES_NO_OPTION,
                             JOptionPane.WARNING_MESSAGE) == JOptionPane.YES_OPTION) {
@@ -110,11 +110,7 @@ protected void done() {
                     String data = "";
                     try {
                         data = get();
-                    } catch (InterruptedException e) {
-                        LoggerFactory.getLogger().error(
-                                "Error retrieving data for node: "
-                                        + NodeViewerData.this.selectedNode, e);
-                    } catch (ExecutionException e) {
+                    } catch (InterruptedException | ExecutionException e) {
                         LoggerFactory.getLogger().error(
                                 "Error retrieving data for node: "
                                         + NodeViewerData.this.selectedNode, e);
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/nodeviewer/NodeViewerMetaData.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/nodeviewer/NodeViewerMetaData.java
index 5c2df8d88c5..4523740daf5 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/nodeviewer/NodeViewerMetaData.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/gui/nodeviewer/NodeViewerMetaData.java
@@ -118,7 +118,7 @@ protected void done() {
                     for (Map.Entry<String, String> entry : data.entrySet()) {
                         rowPos = 2 * i + 1;
                         JLabel label = new JLabel(entry.getKey());
-                        JTextField text = new JTextField(entry.getValue());
+                        JTextField text = new JTextField(formatValByKeyType(entry.getKey(),entry.getValue()));
                         text.setEditable(false);
                         GridBagConstraints c1 = new GridBagConstraints();
                         c1.gridx = 0;
@@ -164,6 +164,21 @@ protected void done() {
                     NodeViewerMetaData.this.metaDataPanel.revalidate();
                     NodeViewerMetaData.this.metaDataPanel.repaint();
                 }
+
+                private String formatValByKeyType(String key, String value) {
+                    if(key==null) return value;
+                    String formattedVal=value;
+                    switch (key){
+                        case "Ephemeral Owner":
+                            try{
+                                formattedVal = String.format("0x%x", Long.parseLong(value));
+                            }catch (NumberFormatException e){
+                                LoggerFactory.getLogger().warn("parse {}'s value {} to hex fail",key,value,e);
+                            }
+                            break;
+                    }
+                    return formattedVal;
+                }
             };
             worker.execute();
         }
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/logger/LoggerFactory.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/logger/LoggerFactory.java
index e4fae41698b..c775d643e4c 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/logger/LoggerFactory.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/logger/LoggerFactory.java
@@ -18,19 +18,19 @@
 package org.apache.zookeeper.inspector.logger;
 
 /**
- * Provides a {@link Logger} for use across the entire application
+ * Provides a {@link org.slf4j.Logger} for use across the entire application
  * 
  */
 public class LoggerFactory
 {
-	private static final org.slf4j.Logger logger = org.slf4j.LoggerFactory.getLogger("org.apache.zookeeper.inspector"); //$NON-NLS-1$
+    private static final org.slf4j.Logger logger = org.slf4j.LoggerFactory.getLogger("org.apache.zookeeper.inspector"); //$NON-NLS-1$
 
-	/**
-	 * @return {@link Logger} for ZooInspector
-	 */
-	public static org.slf4j.Logger getLogger()
-	{
-		return logger;
-	}
+    /**
+     * @return {@link org.slf4j.Logger} for ZooInspector
+     */
+    public static org.slf4j.Logger getLogger()
+    {
+        return logger;
+    }
 
 }
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/NodesCache.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/NodesCache.java
index 45c5a275272..da30596a6f8 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/NodesCache.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/NodesCache.java
@@ -26,14 +26,17 @@
 
 import java.util.Collections;
 import java.util.List;
-import java.util.concurrent.ExecutionException;
 import java.util.concurrent.TimeUnit;
 
+/**
+ * A local cache of ZNodes in front of the Zookeeper server(s) to help cut down on network calls.  This class will
+ * return results from the cache first, if available, and then fetch results remotely from Zookeeper if not.
+ */
 public class NodesCache {
 
     public static final int CACHE_SIZE = 40000;
 
-    public static final int EXPIRATION_TIME = 100;
+    public static final int ENTRY_EXPIRATION_TIME_MILLIS = 10000;
 
     private final LoadingCache<String, List<String>> nodes;
 
@@ -43,18 +46,26 @@ public NodesCache(ZooKeeper zooKeeper) {
         this.zooKeeper = zooKeeper;
         this.nodes = CacheBuilder.newBuilder()
                 .maximumSize(CACHE_SIZE)
-                .expireAfterWrite(EXPIRATION_TIME, TimeUnit.MILLISECONDS)
-                .build(
-                        new CacheLoader<String, List<String>>() {
-                            @Override
-                            public List<String> load(String nodePath) throws Exception {
-                                return getChildren(nodePath);
-                            }
-                        }
+                .expireAfterWrite(ENTRY_EXPIRATION_TIME_MILLIS, TimeUnit.MILLISECONDS)
+                .build(new CacheLoader<String, List<String>>() {
+                           @Override
+                           public List<String> load(String nodePath) {
+                               return getChildrenRemote(nodePath);
+                           }
+                       }
                 );
     }
 
-    public List<String> getChildren(String nodePath) {
+    /**
+     * Whereas getChildren hits the cache first, getChildrenRemote goes straight (over the network) to Zookeeper to
+     * get the answer.  This is the function used by the cache to insert entries that are requested, but don't exist
+     * in the cache yet.
+     *
+     * @param nodePath The full path to the parent whose children are to be fetched.
+     * @return The list of children of the given node as a list of full ZNode path strings or null if an
+     * error occurred.
+     */
+    private List<String> getChildrenRemote(String nodePath) {
         try {
             Stat s = zooKeeper.exists(nodePath, false);
             if (s != null) {
@@ -64,23 +75,25 @@ public List<String> getChildren(String nodePath) {
             }
         } catch (Exception e) {
             LoggerFactory.getLogger().error(
-                    "Error occurred retrieving child of node: " + nodePath, e
+                    "Error occurred retrieving children of node: " + nodePath, e
             );
         }
         return null;
     }
 
-    public String getNodeChild(String nodePath, int index) {
-        List<String> childNodes = null;
+    /**
+     * Fetch the children of the given node from the cache.
+     *
+     * @param nodePath The full path to the parent whose children are to be fetched.
+     * @return The list of children of the given node as a list of full ZNode path strings or null if an
+     * error occurred.
+     */
+    public List<String> getChildren(String nodePath) {
         try {
-            childNodes = nodes.get(nodePath);
-            return childNodes.get(index);
-        } catch (ExecutionException e) {
-            LoggerFactory.getLogger().error(
-                    "Error occurred retrieving child " + index + "of node: " + nodePath, e
-            );
+            return nodes.get(nodePath);
+        } catch (Exception e) {
+            LoggerFactory.getLogger().error("Error occurred retrieving children of node: " + nodePath, e);
         }
         return null;
     }
-
 }
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorManager.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorManager.java
index 74c3cb20e88..9e89adf3499 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorManager.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorManager.java
@@ -55,7 +55,7 @@ public interface ZooInspectorManager extends ZooInspectorNodeManager,
      *         {@link JComboBox} with the first selected as default.</li>
      *         <li>a {@link Map} of property keys to the label to show on the UI
      *         </li>
-     *         <ul>
+     *         </ul>
      * 
      */
     public Pair<Map<String, List<String>>, Map<String, String>> getConnectionPropertiesTemplate();
@@ -118,13 +118,13 @@ public void setDefaultNodeViewerConfiguration(
     /**
      * @param connectionProps
      *            - the connection properties last used to connect to the
-     *            zookeeeper instance
+     *            zookeeper instance
      */
     public void setLastConnectionProps(Properties connectionProps);
 
     /**
      * @return last connection Properties - the connection properties last used
-     *         to connect to the zookeeeper instance
+     *         to connect to the zookeeper instance
      */
     public Properties getLastConnectionProps();
 
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorManagerImpl.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorManagerImpl.java
index 2c5790746ad..0897bac9eed 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorManagerImpl.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorManagerImpl.java
@@ -20,9 +20,12 @@
 import java.io.BufferedReader;
 import java.io.BufferedWriter;
 import java.io.File;
+import java.io.FileNotFoundException;
 import java.io.FileReader;
 import java.io.FileWriter;
 import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collection;
@@ -91,16 +94,25 @@ public class ZooInspectorManagerImpl implements ZooInspectorManager {
      */
     public static final String AUTH_DATA_KEY = "authData";
 
+    private static final String DEFAULT_ENCRYPTION_MANAGER =
+        BasicDataEncryptionManager.class.getName();
+    private static final int DEFAULT_TIMEOUT = 5000;
+    private static final String DEFAULT_HOSTS = "localhost:2181";
+    private static final String DEFAULT_AUTH_SCHEME = "";
+    private static final String DEFAULT_AUTH_VALUE = "";
 
     private static final File defaultNodeViewersFile = new File(
             "./src/main/resources/defaultNodeViewers.cfg");
     private static final File defaultConnectionFile = new File(
             "./src/main/resources/defaultConnectionSettings.cfg");
 
-    private DataEncryptionManager encryptionManager;
+    //package visible for test
+    DataEncryptionManager encryptionManager;
     private String connectString;
     private int sessionTimeout;
-    private ZooKeeper zooKeeper;
+
+    //package visible for test
+    ZooKeeper zooKeeper;
     private final Map<String, NodeWatcher> watchers = new HashMap<String, NodeWatcher>();
     protected boolean connected = true;
     private Properties lastConnectionProps;
@@ -181,7 +193,7 @@ public void process(WatchedEvent event) {
             e.printStackTrace();
         }
         if (!connected){
-        	disconnect();
+            disconnect();
         } else {
             this.nodesCache = new NodesCache(zooKeeper);
         }
@@ -214,7 +226,7 @@ public boolean disconnect() {
     /*
      * (non-Javadoc)
      * 
-     * @seeorg.apache.zookeeper.inspector.manager.ZooInspectorReadOnlyManager#
+     * @see org.apache.zookeeper.inspector.manager.ZooInspectorReadOnlyManager#
      * getChildren(java.lang.String)
      */
     public List<String> getChildren(String nodePath) {
@@ -251,46 +263,6 @@ public String getData(String nodePath) {
         return null;
     }
 
-    /*
-     * (non-Javadoc)
-     * 
-     * @seeorg.apache.zookeeper.inspector.manager.ZooInspectorReadOnlyManager#
-     * getNodeChild(java.lang.String, int)
-     */
-    public String getNodeChild(String nodePath, int childIndex) {
-        if (connected) {
-             return this.nodesCache.getNodeChild(nodePath, childIndex);
-        }
-        return null;
-    }
-
-    /*
-     * (non-Javadoc)
-     * 
-     * @seeorg.apache.zookeeper.inspector.manager.ZooInspectorReadOnlyManager#
-     * getNodeIndex(java.lang.String)
-     */
-    public int getNodeIndex(String nodePath) {
-        if (connected) {
-            int index = nodePath.lastIndexOf("/");
-            if (index == -1
-                    || (!nodePath.equals("/") && nodePath.charAt(nodePath
-                            .length() - 1) == '/')) {
-                throw new IllegalArgumentException("Invalid node path: "
-                        + nodePath);
-            }
-            String parentPath = nodePath.substring(0, index);
-            String child = nodePath.substring(index + 1);
-            if (parentPath != null && parentPath.length() > 0) {
-                List<String> children = this.nodesCache.getChildren(parentPath);
-                if (children != null) {
-                    return children.indexOf(child);
-                }
-            }
-        }
-        return -1;
-    }
-
     /*
      * (non-Javadoc)
      * 
@@ -351,11 +323,7 @@ public List<Map<String, String>> getACLs(String nodePath) {
                         returnACLs.add(aclMap);
                     }
                 }
-            } catch (InterruptedException e) {
-                LoggerFactory.getLogger().error(
-                        "Error occurred retrieving ACLs of node: " + nodePath,
-                        e);
-            } catch (KeeperException e) {
+            } catch (InterruptedException | KeeperException e) {
                 LoggerFactory.getLogger().error(
                         "Error occurred retrieving ACLs of node: " + nodePath,
                         e);
@@ -367,7 +335,7 @@ public List<Map<String, String>> getACLs(String nodePath) {
     /*
      * (non-Javadoc)
      * 
-     * @seeorg.apache.zookeeper.inspector.manager.ZooInspectorReadOnlyManager#
+     * @see org.apache.zookeeper.inspector.manager.ZooInspectorReadOnlyManager#
      * getNodeMeta(java.lang.String)
      */
     public Map<String, String> getNodeMeta(String nodePath) {
@@ -406,81 +374,11 @@ public Map<String, String> getNodeMeta(String nodePath) {
     /*
      * (non-Javadoc)
      * 
-     * @seeorg.apache.zookeeper.inspector.manager.ZooInspectorReadOnlyManager#
+     * @see org.apache.zookeeper.inspector.manager.ZooInspectorReadOnlyManager#
      * getNumChildren(java.lang.String)
      */
     public int getNumChildren(String nodePath) {
-        if (connected) {
-            try {
-                Stat s = zooKeeper.exists(nodePath, false);
-                if (s != null) {
-                    return s.getNumChildren();
-                }
-            } catch (Exception e) {
-                LoggerFactory.getLogger().error(
-                        "Error occurred getting the number of children of node: "
-                                + nodePath, e);
-            }
-        }
-        return -1;
-    }
-
-    /*
-     * (non-Javadoc)
-     * 
-     * @seeorg.apache.zookeeper.inspector.manager.ZooInspectorReadOnlyManager#
-     * hasChildren(java.lang.String)
-     */
-    public boolean hasChildren(String nodePath) {
-        return getNumChildren(nodePath) > 0;
-    }
-
-    /*
-     * (non-Javadoc)
-     * 
-     * @seeorg.apache.zookeeper.inspector.manager.ZooInspectorReadOnlyManager#
-     * isAllowsChildren(java.lang.String)
-     */
-    public boolean isAllowsChildren(String nodePath) {
-        if (connected) {
-            try {
-                Stat s = zooKeeper.exists(nodePath, false);
-                if (s != null) {
-                    return s.getEphemeralOwner() == 0;
-                }
-            } catch (Exception e) {
-                LoggerFactory.getLogger().error(
-                        "Error occurred determining whether node is allowed children: "
-                                + nodePath, e);
-            }
-        }
-        return false;
-    }
-
-    /*
-     * (non-Javadoc)
-     * 
-     * @seeorg.apache.zookeeper.inspector.manager.ZooInspectorReadOnlyManager#
-     * getSessionMeta()
-     */
-    public Map<String, String> getSessionMeta() {
-        Map<String, String> sessionMeta = new LinkedHashMap<String, String>();
-        try {
-            if (zooKeeper != null) {
-
-                sessionMeta.put(SESSION_ID, String.valueOf(zooKeeper
-                        .getSessionId()));
-                sessionMeta.put(SESSION_STATE, String.valueOf(zooKeeper
-                        .getState().toString()));
-                sessionMeta.put(CONNECT_STRING, this.connectString);
-                sessionMeta.put(SESSION_TIMEOUT, String
-                        .valueOf(this.sessionTimeout));
-            }
-        } catch (Exception e) {
-            LoggerFactory.getLogger().error(
-                    "Error occurred retrieving session meta data.", e);
-        }
-        return sessionMeta;
+        return connected ? getChildren(nodePath).size() : -1;
     }
 
     /*
@@ -495,7 +393,14 @@ public boolean createNode(String parent, String nodeName) {
             try {
                 String[] nodeElements = nodeName.split("/");
                 for (String nodeElement : nodeElements) {
-                    String node = parent + "/" + nodeElement;
+                    String node;
+                    //for case parent is "/" and maybe other cases
+                    if (parent.endsWith("/")) {
+                        node = parent + nodeElement;
+                    }
+                    else {
+                        node = parent + "/" + nodeElement;
+                    }
                     Stat s = zooKeeper.exists(node, false);
                     if (s == null) {
                         zooKeeper.create(node, this.encryptionManager
@@ -567,7 +472,7 @@ public boolean setData(String nodePath, String data) {
     /*
      * (non-Javadoc)
      * 
-     * @seeorg.apache.zookeeper.inspector.manager.ZooInspectorManager#
+     * @see org.apache.zookeeper.inspector.manager.ZooInspectorManager#
      * getConnectionPropertiesTemplate()
      */
     public Pair<Map<String, List<String>>, Map<String, String>> getConnectionPropertiesTemplate() {
@@ -687,7 +592,7 @@ public void process(WatchedEvent event) {
                     }
                 } catch (Exception e) {
                     LoggerFactory.getLogger().error(
-                            "Error occurred re-adding node watcherfor node "
+                            "Error occurred re-adding node watcher for node "
                                     + nodePath, e);
                 }
                 nodeListener.processEvent(event.getPath(), event.getType()
@@ -695,9 +600,6 @@ public void process(WatchedEvent event) {
             }
         }
 
-        /**
-		 * 
-		 */
         public void stop() {
             this.closed = true;
         }
@@ -707,67 +609,59 @@ public void stop() {
     /*
      * (non-Javadoc)
      * 
-     * @seeorg.apache.zookeeper.inspector.manager.ZooInspectorManager#
+     * @see org.apache.zookeeper.inspector.manager.ZooInspectorManager#
      * loadNodeViewersFile(java.io.File)
      */
     public List<String> loadNodeViewersFile(File selectedFile)
             throws IOException {
         List<String> result = new ArrayList<String>();
-        if (defaultNodeViewersFile.exists()) {
-            FileReader reader = new FileReader(selectedFile);
-            try {
-                BufferedReader buff = new BufferedReader(reader);
-                try {
-                    while (buff.ready()) {
-                        String line = buff.readLine();
-                        if (line != null && line.length() > 0 && !line.startsWith("#")) {
-                            result.add(line);
-                        }
+
+        try(BufferedReader reader = getReaderForFile(selectedFile)) {
+            if(reader == null) {
+                return result;
+            }
+
+            String line = "";
+            while (line != null) {
+                line = reader.readLine();
+                if(line != null) {
+                    line = line.trim();
+                    if (!line.isEmpty() && !line.startsWith("#")) {
+                        result.add(line);
                     }
-                } finally {
-                    buff.close();
                 }
-            } finally {
-                reader.close();
             }
         }
+
         return result;
     }
 
     private void loadDefaultConnectionFile() throws IOException {
-        if (defaultConnectionFile.exists()) {
-            Properties props = new Properties();
+        Properties props = new Properties();
 
-            FileReader reader = new FileReader(defaultConnectionFile);
-            try {
+        try(BufferedReader reader = getReaderForFile(defaultConnectionFile)) {
+            //If reader is null, it's OK.  Default values will get set below.
+            if(reader != null) {
                 props.load(reader);
-            } finally {
-                reader.close();
             }
-            defaultEncryptionManager = props
-                    .getProperty(DATA_ENCRYPTION_MANAGER) == null ? "org.apache.zookeeper.inspector.encryption.BasicDataEncryptionManager"
-                    : props.getProperty(DATA_ENCRYPTION_MANAGER);
-            defaultTimeout = props.getProperty(SESSION_TIMEOUT) == null ? "5000"
-                    : props.getProperty(SESSION_TIMEOUT);
-            defaultHosts = props.getProperty(CONNECT_STRING) == null ? "localhost:2181"
-                    : props.getProperty(CONNECT_STRING);
-            defaultAuthScheme = props.getProperty(AUTH_SCHEME_KEY) == null ? ""
-                    : props.getProperty(AUTH_SCHEME_KEY);
-            defaultAuthValue = props.getProperty(AUTH_DATA_KEY) == null ? ""
-                    : props.getProperty(AUTH_DATA_KEY);
-        } else {
-            defaultEncryptionManager = "org.apache.zookeeper.inspector.encryption.BasicDataEncryptionManager";
-            defaultTimeout = "5000";
-            defaultHosts = "localhost:2181";
-            defaultAuthScheme = "";
-            defaultAuthValue = "";
         }
+
+        defaultEncryptionManager = props.getProperty(DATA_ENCRYPTION_MANAGER) == null ?
+            DEFAULT_ENCRYPTION_MANAGER : props.getProperty(DATA_ENCRYPTION_MANAGER);
+        defaultTimeout = props.getProperty(SESSION_TIMEOUT) == null ?
+            Integer.toString(DEFAULT_TIMEOUT) : props.getProperty(SESSION_TIMEOUT);
+        defaultHosts = props.getProperty(CONNECT_STRING) == null ?
+            DEFAULT_HOSTS : props.getProperty(CONNECT_STRING);
+        defaultAuthScheme = props.getProperty(AUTH_SCHEME_KEY) == null ?
+            DEFAULT_AUTH_SCHEME : props.getProperty(AUTH_SCHEME_KEY);
+        defaultAuthValue = props.getProperty(AUTH_DATA_KEY) == null ?
+            DEFAULT_AUTH_VALUE : props.getProperty(AUTH_DATA_KEY);
     }
 
     /*
      * (non-Javadoc)
      * 
-     * @seeorg.apache.zookeeper.inspector.manager.ZooInspectorManager#
+     * @see org.apache.zookeeper.inspector.manager.ZooInspectorManager#
      * saveDefaultConnectionFile(java.util.Properties)
      */
     public void saveDefaultConnectionFile(Properties props) throws IOException {
@@ -797,7 +691,7 @@ public void saveDefaultConnectionFile(Properties props) throws IOException {
     /*
      * (non-Javadoc)
      * 
-     * @seeorg.apache.zookeeper.inspector.manager.ZooInspectorManager#
+     * @see org.apache.zookeeper.inspector.manager.ZooInspectorManager#
      * saveNodeViewersFile(java.io.File, java.util.List)
      */
     public void saveNodeViewersFile(File selectedFile,
@@ -829,7 +723,7 @@ public void saveNodeViewersFile(File selectedFile,
     /*
      * (non-Javadoc)
      * 
-     * @seeorg.apache.zookeeper.inspector.manager.ZooInspectorManager#
+     * @see org.apache.zookeeper.inspector.manager.ZooInspectorManager#
      * setDefaultNodeViewerConfiguration(java.io.File, java.util.List)
      */
     public void setDefaultNodeViewerConfiguration(
@@ -856,7 +750,7 @@ public List<String> getDefaultNodeViewerConfiguration() throws IOException {
     /*
      * (non-Javadoc)
      * 
-     * @seeorg.apache.zookeeper.inspector.manager.ZooInspectorManager#
+     * @see org.apache.zookeeper.inspector.manager.ZooInspectorManager#
      * getLastConnectionProps()
      */
     public Properties getLastConnectionProps() {
@@ -872,4 +766,26 @@ public Properties getLastConnectionProps() {
     public void setLastConnectionProps(Properties connectionProps) {
         this.lastConnectionProps = connectionProps;
     }
+
+    private static BufferedReader getReaderForFile(File file) {
+        //check the filesystem first
+        if (file.exists()) {
+            try {
+                return new BufferedReader(new FileReader(file));
+            } catch (FileNotFoundException e) {
+                return null;
+            }
+        }
+
+        //fall back to checking the CLASSPATH with only the filename
+        //(for cases where the file exists in src/main/resources)
+        InputStream classpathStream = ZooInspectorManagerImpl.class.getClassLoader()
+            .getResourceAsStream(file.getName());
+        if (classpathStream != null) {
+            return new BufferedReader(new InputStreamReader(classpathStream));
+        }
+
+        //couldn't find the file anywhere
+        return null;
+    }
 }
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorReadOnlyManager.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorReadOnlyManager.java
index d9fdf5c4a08..69ce842a1cb 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorReadOnlyManager.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/inspector/manager/ZooInspectorReadOnlyManager.java
@@ -28,72 +28,36 @@ public interface ZooInspectorReadOnlyManager {
 
     /**
      * @param nodePath
-     *            - the path to the node to delete
+     *            - the path to the node whose data is to be retrieved
      * @return the data for the node
      */
     public abstract String getData(String nodePath);
 
     /**
      * @param nodePath
-     *            - the path to the node to delete
+     *            - the path to the node whose metadata is to be retrieved
      * @return the metaData for the node
      */
     public abstract Map<String, String> getNodeMeta(String nodePath);
 
     /**
      * @param nodePath
-     *            - the path to the node to delete
+     *            - the path to the node whose ACLs are to be retrieved
      * @return the ACLs set on the node
      */
     public abstract List<Map<String, String>> getACLs(String nodePath);
 
-    /**
-     * @return the metaData for the current session
-     */
-    public abstract Map<String, String> getSessionMeta();
-
-    /**
-     * @param nodePath
-     *            - the path to the node to delete
-     * @return true if the node has children
-     */
-    public abstract boolean hasChildren(String nodePath);
-
-    /**
-     * @param nodePath
-     *            - the path to the node to delete
-     * @return the index of the node within its siblings
-     */
-    public abstract int getNodeIndex(String nodePath);
-
     /**
      * @param nodePath
-     *            - the path to the node to delete
+     *            - the path to the node to parent node
      * @return the number of children of the node
      */
     public abstract int getNumChildren(String nodePath);
 
     /**
      * @param nodePath
-     *            - the path to the node to delete
-     * @param childIndex
-     *            - the index to the node in the list of node children
-     * @return the path to the node for the child of the nodePath at childIndex
-     */
-    public abstract String getNodeChild(String nodePath, int childIndex);
-
-    /**
-     * @param nodePath
-     *            - the path to the node to delete
-     * @return true if the node allows children nodes
-     */
-    public abstract boolean isAllowsChildren(String nodePath);
-
-    /**
-     * @param nodePath
-     *            - the path to the node to delete
+     *            - the path to the node whose children to retrieve
      * @return a {@link List} of the children of the node
      */
     public abstract List<String> getChildren(String nodePath);
-
 }
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/retry/ZooKeeperRetry.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/retry/ZooKeeperRetry.java
index ce959a1a0c2..dff8f24dcf2 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/retry/ZooKeeperRetry.java
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/java/org/apache/zookeeper/retry/ZooKeeperRetry.java
@@ -31,7 +31,7 @@
 
 /**
  * A Class which extends {@link ZooKeeper} and will automatically retry calls to
- * zookeeper if a {@link KeeperException.ConnectionLossException} occurs
+ * zookeeper if a {@link org.apache.zookeeper.KeeperException.ConnectionLossException} occurs.
  */
 public class ZooKeeperRetry extends ZooKeeper {
 
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/about.html b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/about.html
new file mode 100644
index 00000000000..17fb3dca20b
--- /dev/null
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/about.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
+<html>
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
+<title>ZooInspector v0.1</title>
+</head>
+<body>
+<p>ZooInspector was developed by Colin Goodheart-Smithe and is
+available under the Apache Software Licence v2.0.</p>
+<p>The Icons used were sourced from the Eclipse project (<a
+	href="http://www.eclipse.org">http://www.eclipse.org</a>) and licensed
+under the Eclipse Public Licence v1.0. [<a
+	href="http://www.eclipse.org/org/documents/epl-v10.php">http://www.eclipse.org/org/documents/epl-v10.php</a>]
+</p>
+<p>ZooKeeper is available from <a
+	href="http://zookeeper.apache.org/">http://zookeeper.apache.org/</a>
+and is licensed under an Apache Software Licence v2.0</p>
+<p>The ApacheSoftware Licence v2.0 can be found at <a
+	href="http://www.apache.org/licenses/LICENSE-2.0">http://www.apache.org/licenses/LICENSE-2.0</a></p>
+</body>
+</html>
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/icons/Tango/16x16/categories/applications-system.png b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/icons/Tango/16x16/categories/applications-system.png
new file mode 100644
index 00000000000..d90ab661cbb
Binary files /dev/null and b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/icons/Tango/16x16/categories/applications-system.png differ
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/icons/Tango/22x22/categories/applications-system.png b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/icons/Tango/22x22/categories/applications-system.png
new file mode 100644
index 00000000000..4decc893f84
Binary files /dev/null and b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/icons/Tango/22x22/categories/applications-system.png differ
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/icons/Tango/24x24/categories/applications-system.png b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/icons/Tango/24x24/categories/applications-system.png
new file mode 100644
index 00000000000..9c8833865b5
Binary files /dev/null and b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/icons/Tango/24x24/categories/applications-system.png differ
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/icons/Tango/32x32/categories/applications-system.png b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/icons/Tango/32x32/categories/applications-system.png
new file mode 100644
index 00000000000..565f406dd14
Binary files /dev/null and b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/icons/Tango/32x32/categories/applications-system.png differ
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/log4j.properties b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/log4j.properties
deleted file mode 100644
index db05af4d533..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/log4j.properties
+++ /dev/null
@@ -1,9 +0,0 @@
-# ***** Set root logger level to INFO and it appender to stdout.
-log4j.rootLogger=INFO,stdout
-
-# ***** stdout is set to be a ConsoleAppender.
-log4j.appender.stdout=org.apache.log4j.ConsoleAppender
-# ***** stdout uses PatternLayout.
-log4j.appender.stdout.layout=org.apache.log4j.PatternLayout
-# ***** Pattern to output the caller's file name and line number.
-log4j.appender.stdout.layout.ConversionPattern=%5p [%t] (%F:%L) - %m%n
\ No newline at end of file
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/logback.xml b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/logback.xml
new file mode 100644
index 00000000000..6f813039d1c
--- /dev/null
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/main/resources/logback.xml
@@ -0,0 +1,31 @@
+<!--
+ Copyright 2022 The Apache Software Foundation
+
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements.  See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership.  The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+ Define some default values that can be overridden by system properties
+-->
+<configuration>
+  <appender name="stdout" class="ch.qos.logback.core.ConsoleAppender">
+    <encoder>
+      <pattern>%5p [%t] \(%F:%L\) - %m%n</pattern>
+    </encoder>
+  </appender>
+  <root level="INFO">
+    <appender-ref ref="stdout"/>
+  </root>
+</configuration>
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/test/java/org/apache/zookeeper/inspector/LoggerTest.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/test/java/org/apache/zookeeper/inspector/LoggerTest.java
new file mode 100644
index 00000000000..310e3320133
--- /dev/null
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/test/java/org/apache/zookeeper/inspector/LoggerTest.java
@@ -0,0 +1,48 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.inspector;
+
+import org.junit.Assert;
+import org.junit.Test;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.ByteArrayOutputStream;
+import java.io.PrintStream;
+import java.nio.charset.StandardCharsets;
+
+public class LoggerTest {
+    Logger LOG = LoggerFactory.getLogger(LoggerTest.class);
+    String testMessage = "a test message";
+
+    @Test
+    public void testLogStdOutConfig() {
+        ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
+        PrintStream realStdOut = System.out;
+        System.setOut(new PrintStream(byteArrayOutputStream));
+        LOG.info(testMessage);
+        System.setOut(realStdOut);
+
+        //log to stdout for debug
+        LOG.info(testMessage);
+        String bufferMessage = new String(byteArrayOutputStream.toByteArray(), StandardCharsets.UTF_8);
+        LOG.info(bufferMessage);
+
+        Assert.assertTrue(bufferMessage.contains(testMessage));
+    }
+}
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/src/test/java/org/apache/zookeeper/inspector/manager/ZooInspectorManagerImplTest.java b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/test/java/org/apache/zookeeper/inspector/manager/ZooInspectorManagerImplTest.java
new file mode 100644
index 00000000000..5057d543cba
--- /dev/null
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/src/test/java/org/apache/zookeeper/inspector/manager/ZooInspectorManagerImplTest.java
@@ -0,0 +1,113 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.inspector.manager;
+
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.common.PathUtils;
+import org.apache.zookeeper.data.Stat;
+import org.apache.zookeeper.inspector.encryption.BasicDataEncryptionManager;
+import org.apache.zookeeper.retry.ZooKeeperRetry;
+import org.junit.Assert;
+import org.junit.Test;
+import org.mockito.Mockito;
+import org.mockito.invocation.InvocationOnMock;
+import org.mockito.stubbing.Answer;
+
+import java.io.IOException;
+
+public class ZooInspectorManagerImplTest {
+
+    /**
+     * test create zookeeper node operation,
+     * no easy way to create a real zk server so use a mocked client that only validate path
+     *
+     * @throws IOException
+     * @throws KeeperException
+     * @throws InterruptedException
+     */
+    @Test
+    public void testNodeCreateRoot() throws IOException, KeeperException, InterruptedException {
+        ZooKeeper mockedZk = getMockedZk();
+
+        ZooInspectorManagerImpl manager = getInspectorManagerImpl(mockedZk);
+
+        boolean createSuccess = manager.createNode("/", "test");
+        Assert.assertTrue(createSuccess);
+    }
+
+    /**
+     * test create a normal child node
+     *
+     * @throws IOException
+     * @throws KeeperException
+     * @throws InterruptedException
+     */
+
+    @Test
+    public void testNodeCreateNormal() throws IOException, KeeperException, InterruptedException {
+        ZooKeeper mockedZk = getMockedZk();
+
+        ZooInspectorManagerImpl manager = getInspectorManagerImpl(mockedZk);
+
+        boolean createSuccess = manager.createNode("/parent", "test");
+        Assert.assertTrue(createSuccess);
+    }
+
+
+    /**
+     * create a mocked zk client only check path validate
+     *
+     * @return
+     * @throws KeeperException
+     * @throws InterruptedException
+     */
+    private ZooKeeper getMockedZk() throws KeeperException, InterruptedException {
+        ZooKeeper mockZk = Mockito.mock(ZooKeeperRetry.class);
+        Mockito.when(mockZk.exists(Mockito.anyString(), Mockito.anyBoolean())).then((Answer<Stat>) invocation -> {
+            String path = invocation.getArgument(0);
+            PathUtils.validatePath(path);
+            return null;
+        });
+        Mockito.when(mockZk.create(Mockito.anyString(), Mockito.any(), Mockito.any(),
+                Mockito.any())).then(new Answer<String>() {
+            @Override
+            public String answer(InvocationOnMock invocation) throws Throwable {
+                String path = invocation.getArgument(0);
+                PathUtils.validatePath(path);
+                return path;
+            }
+        });
+        return mockZk;
+    }
+
+    /**
+     * create a inspector manager instance from zk
+     *
+     * @param zooKeeper
+     * @return
+     * @throws IOException
+     */
+    private ZooInspectorManagerImpl getInspectorManagerImpl(ZooKeeper zooKeeper) throws IOException {
+        ZooInspectorManagerImpl manager = new ZooInspectorManagerImpl();
+        manager.zooKeeper = zooKeeper;
+        manager.connected = true;
+        manager.encryptionManager = new BasicDataEncryptionManager();
+        return manager;
+    }
+}
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/zooInspector-dev.sh b/zookeeper-contrib/zookeeper-contrib-zooinspector/zooInspector-dev.sh
index 9be0b0a238b..4b947bdfa45 100755
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/zooInspector-dev.sh
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/zooInspector-dev.sh
@@ -1,18 +1,22 @@
-#!/bin/sh
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+#   https://www.apache.org/licenses/LICENSE-2.0
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-         
-java -cp ../../build/contrib/ZooInspector/*:../../../build/*:../../../build/lib/*:lib org.apache.zookeeper.inspector.ZooInspector
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+export CLASSPATH="../../build/contrib/ZooInspector/*:../../../build/*:../../../build/lib/*:lib"
+java org.apache.zookeeper.inspector.ZooInspector
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/zooInspector.cmd b/zookeeper-contrib/zookeeper-contrib-zooinspector/zooInspector.cmd
index 0b9dcf85098..579a27e865f 100644
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/zooInspector.cmd
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/zooInspector.cmd
@@ -14,8 +14,13 @@
 @rem See the License for the specific language governing permissions and
 @rem limitations under the License.
 
-set CLASSPATH=lib\*;lib
-for /F %%f in ('dir /b "%~dp0%\*.jar" 2^>nul') do (
-   set CLASSPATH=%%f;%CLASSPATH%
+@rem Get the path to the directory containing this script
+SET SCRIPT_DIR=%~dp0
+
+@rem Get the path to the uber jar for this tool
+@rem (Requires "mvn install" or "mvn package" be run first)
+set JAVA_LIB=
+for /F %%f in ('dir /b "%SCRIPT_DIR%\target\zookeeper-contrib-zooinspector-*-jar-with-dependencies.jar" 2^>nul') do (
+   set JAVA_LIB=%SCRIPT_DIR%target\%%f
 )
-java -cp "%CLASSPATH%" org.apache.zookeeper.inspector.ZooInspector
+java -jar %JAVA_LIB%
diff --git a/zookeeper-contrib/zookeeper-contrib-zooinspector/zooInspector.sh b/zookeeper-contrib/zookeeper-contrib-zooinspector/zooInspector.sh
index 5e3ebb67d4d..a009d91b617 100755
--- a/zookeeper-contrib/zookeeper-contrib-zooinspector/zooInspector.sh
+++ b/zookeeper-contrib/zookeeper-contrib-zooinspector/zooInspector.sh
@@ -1,18 +1,26 @@
-#!/bin/sh
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
+#! /usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+#   https://www.apache.org/licenses/LICENSE-2.0
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+# Get the path to the directory containing this script
+SCRIPT_DIR=$(dirname "$0")
 
-java -cp "zookeeper-dev-ZooInspector.jar:lib/*:lib" org.apache.zookeeper.inspector.ZooInspector
+# Get the path to the uber jar for this tool
+# (Requires "mvn install" or "mvn package" be run first)
+java -jar "$SCRIPT_DIR"/target/zookeeper-contrib-zooinspector-*-jar-with-dependencies.jar
diff --git a/zookeeper-docs/pom.xml b/zookeeper-docs/pom.xml
index a46b880dbc6..9fd096092b5 100644
--- a/zookeeper-docs/pom.xml
+++ b/zookeeper-docs/pom.xml
@@ -23,13 +23,13 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
-    <relativePath>..</relativePath>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-docs</artifactId>
   <name>Apache ZooKeeper - Documentation</name>
   <description>Documentation</description>
+  <packaging>pom</packaging>
 
   <build>
     <plugins>
@@ -49,6 +49,7 @@
           <headerHtmlFile>${project.basedir}/src/main/resources/markdown/html/header.html</headerHtmlFile>
           <footerHtmlFile>${project.basedir}/src/main/resources/markdown/html/footer.html</footerHtmlFile>
           <copyDirectories>images,skin</copyDirectories>
+          <pegdownExtensions>TABLES,FENCED_CODE_BLOCKS</pegdownExtensions>
         </configuration>
       </plugin>
       <plugin>
@@ -58,13 +59,6 @@
           <skip>true</skip>
         </configuration>
       </plugin>
-      <plugin>
-        <groupId>org.apache.maven.plugins</groupId>
-        <artifactId>maven-javadoc-plugin</artifactId>
-        <configuration>
-          <skip>true</skip>
-        </configuration>
-      </plugin>
     </plugins>
   </build>
 </project>
diff --git a/zookeeper-docs/src/main/resources/markdown/html/header.html b/zookeeper-docs/src/main/resources/markdown/html/header.html
index ef07e99b325..c308b2d8894 100644
--- a/zookeeper-docs/src/main/resources/markdown/html/header.html
+++ b/zookeeper-docs/src/main/resources/markdown/html/header.html
@@ -36,7 +36,7 @@
                 <a class="unselected" href="https://cwiki.apache.org/confluence/display/ZOOKEEPER/">Wiki</a>
             </li>
             <li class="current">
-                <a class="selected" href="index.html">ZooKeeper 3.6 Documentation</a>
+                <a class="selected" href="index.html">ZooKeeper 3.8 Documentation</a>
             </li>
         </ul>
     </div>
@@ -70,11 +70,14 @@
         <div onclick="SwitchMenu('menu_2', 'skin/')" id="menu_2Title" class="menutitle">Developer</div>
         <div id="menu_2" class="menuitemgroup">
             <div class="menuitem">
-                <a href="api/index.html">API Docs</a>
+                <a href="apidocs/zookeeper-server/index.html">API Docs</a>
             </div>
             <div class="menuitem">
                 <a href="zookeeperProgrammers.html">Programmer's Guide</a>
             </div>
+            <div class="menuitem">
+                <a href="zookeeperUseCases.html">Use Cases</a>
+            </div>
             <div class="menuitem">
                 <a href="javaExample.html">Java Example</a>
             </div>
@@ -93,14 +96,32 @@
             <div class="menuitem">
                 <a href="zookeeperQuotas.html">Quota Guide</a>
             </div>
+            <div class="menuitem">
+                <a href="zookeeperSnapshotAndRestore.html">Snapshot and Restore Guide</a>
+            </div>
             <div class="menuitem">
                 <a href="zookeeperJMX.html">JMX</a>
             </div>
+            <div class="menuitem">
+                <a href="zookeeperHierarchicalQuorums.html">Hierarchical Quorums</a>
+            </div>
+            <div class="menuitem">
+                <a href="zookeeperOracleQuorums.html">Oracle Quorum</a>
+            </div>
             <div class="menuitem">
                 <a href="zookeeperObservers.html">Observers Guide</a>
             </div>
             <div class="menuitem">
                 <a href="zookeeperReconfig.html">Dynamic Reconfiguration</a>
+            </div>
+            <div class="menuitem">
+                <a href="zookeeperCLI.html">ZooKeeper CLI</a>
+            </div>
+            <div class="menuitem">
+                <a href="zookeeperTools.html">ZooKeeper Tools</a>
+            </div>
+            <div class="menuitem">
+                <a href="zookeeperMonitor.html">ZooKeeper Monitor</a>
             </div>
 			<div class="menuitem">
                 <a href="zookeeperAuditLogs.html">Audit Logs</a>
diff --git a/zookeeper-docs/src/main/resources/markdown/images/2pc.jpg b/zookeeper-docs/src/main/resources/markdown/images/2pc.jpg
old mode 100755
new mode 100644
index fe4488fd9d8..fcf341699bd
Binary files a/zookeeper-docs/src/main/resources/markdown/images/2pc.jpg and b/zookeeper-docs/src/main/resources/markdown/images/2pc.jpg differ
diff --git a/zookeeper-docs/src/main/resources/markdown/images/state_dia.dia b/zookeeper-docs/src/main/resources/markdown/images/state_dia.dia
old mode 100755
new mode 100644
diff --git a/zookeeper-docs/src/main/resources/markdown/images/state_dia.jpg b/zookeeper-docs/src/main/resources/markdown/images/state_dia.jpg
old mode 100755
new mode 100644
diff --git a/zookeeper-docs/src/main/resources/markdown/index.md b/zookeeper-docs/src/main/resources/markdown/index.md
index 41dc260aed2..d3e3864f342 100644
--- a/zookeeper-docs/src/main/resources/markdown/index.md
+++ b/zookeeper-docs/src/main/resources/markdown/index.md
@@ -36,7 +36,7 @@ archives.
     + [Release Notes](releasenotes.html) - new developer and user facing features, improvements, and incompatibilities
 + **Developers**
     Documents for Developers using the ZooKeeper Client API
-    + [API Docs](api/index.html) - the technical reference to ZooKeeper Client APIs
+    + [API Docs](apidocs/zookeeper-server/index.html) - the technical reference to ZooKeeper Client APIs
     + [Programmer's Guide](zookeeperProgrammers.html) - a client application developer's guide to ZooKeeper
     + [ZooKeeper Use Cases](zookeeperUseCases.html) - a series of use cases using the ZooKeeper.
     + [ZooKeeper Java Example](javaExample.html) - a simple Zookeeper client application, written in Java
@@ -46,8 +46,10 @@ archives.
     Documents for Administrators and Operations Engineers of ZooKeeper Deployments
     + [Administrator's Guide](zookeeperAdmin.html) - a guide for system administrators and anyone else who might deploy ZooKeeper
     + [Quota Guide](zookeeperQuotas.html) - a guide for system administrators on Quotas in ZooKeeper.
+    + [Snapshot and Restore Guide](zookeeperSnapshotAndRestore.html) - a guide for system administrators on take snapshot and restore ZooKeeper.
     + [JMX](zookeeperJMX.html) - how to enable JMX in ZooKeeper
-    + [Hierarchical quorums](zookeeperHierarchicalQuorums.html)
+    + [Hierarchical Quorums](zookeeperHierarchicalQuorums.html) - a guide on how to use hierarchical quorums
+    + [Oracle Quorum](zookeeperOracleQuorums.html) - the introduction to Oracle Quorum increases the availability of a cluster of 2 ZooKeeper instances with a failure detector.
     + [Observers](zookeeperObservers.html) - non-voting ensemble members that easily improve ZooKeeper's scalability
     + [Dynamic Reconfiguration](zookeeperReconfig.html) - a guide on how to use dynamic reconfiguration in ZooKeeper
     + [ZooKeeper CLI](zookeeperCLI.html) - a guide on how to use the ZooKeeper command line interface
diff --git a/zookeeper-docs/src/main/resources/markdown/recipes.md b/zookeeper-docs/src/main/resources/markdown/recipes.md
index ceb2e7133dc..9d3dec55c62 100644
--- a/zookeeper-docs/src/main/resources/markdown/recipes.md
+++ b/zookeeper-docs/src/main/resources/markdown/recipes.md
@@ -171,14 +171,14 @@ the queue node. The distributed clients put something into the queue by
 calling create() with a pathname ending in "queue-", with the
 _sequence_ and _ephemeral_ flags in
 the create() call set to true. Because the _sequence_
-flag is set, the new pathnames will have the form
+flag is set, the new pathname will have the form
 _path-to-queue-node_/queue-X, where X is a monotonic increasing number. A
 client that wants to be removed from the queue calls ZooKeeper's **getChildren( )** function, with
 _watch_ set to true on the queue node, and begins
 processing nodes with the lowest number. The client does not need to issue
 another **getChildren( )** until it exhausts
 the list obtained from the first **getChildren(
-)** call. If there are are no children in the queue node, the
+)** call. If there are no children in the queue node, the
 reader waits for a watch notification to check the queue again.
 
 ###### Note
@@ -205,7 +205,7 @@ notification triggers for the queue node.
 
 Fully distributed locks that are globally synchronous, meaning at
 any snapshot in time no two clients think they hold the same lock. These
-can be implemented using ZooKeeeper. As with priority queues, first define
+can be implemented using ZooKeeper. As with priority queues, first define
 a lock node.
 
 ###### Note
@@ -347,7 +347,7 @@ the site create the node.
 To solve the first problem, you can have only the coordinator
 notified of changes to the transaction nodes, and then notify the sites
 once coordinator reaches a decision. Note that this approach is scalable,
-but it's is slower too, as it requires all communication to go through the
+but it is slower too, as it requires all communication to go through the
 coordinator.
 
 To address the second problem, you can have the coordinator
@@ -363,7 +363,7 @@ A simple way of doing leader election with ZooKeeper is to use the
 znodes that represent "proposals" of clients. The idea is to have a znode,
 say "/election", such that each znode creates a child znode "/election/guid-n_"
 with both flags SEQUENCE|EPHEMERAL. With the sequence flag, ZooKeeper
-automatically appends a sequence number that is greater than any one
+automatically appends a sequence number that is greater than anyone
 previously appended to a child of "/election". The process that created
 the znode with the smallest appended sequence number is the leader.
 
@@ -391,7 +391,7 @@ be a leader:
 
 1. Create znode z with path "ELECTION/guid-n_" with both SEQUENCE and
   EPHEMERAL flags;
-1. Let C be the children of "ELECTION", and i be the sequence
+1. Let C be the children of "ELECTION", and i is the sequence
   number of z;
 1. Watch for changes on "ELECTION/guid-n_j", where j is the largest
   sequence number such that j < i and n_j is a znode in C;
diff --git a/zookeeper-docs/src/main/resources/markdown/releasenotes.md b/zookeeper-docs/src/main/resources/markdown/releasenotes.md
index 67dd47ab1a6..a27b6ffdd12 100644
--- a/zookeeper-docs/src/main/resources/markdown/releasenotes.md
+++ b/zookeeper-docs/src/main/resources/markdown/releasenotes.md
@@ -75,7 +75,7 @@ Call specific watch functions receive all session events for as long as they are
 1. A number of constants used in the client ZooKeeper API were re-specified using enums (rather than ints). See [ZOOKEEPER-7](https://issues.apache.org/jira/browse/ZOOKEEPER-7), [ZOOKEEPER-132](https://issues.apache.org/jira/browse/ZOOKEEPER-132) and [ZOOKEEPER-139](https://issues.apache.org/jira/browse/ZOOKEEPER-139) for full details
 1. [ZOOKEEPER-18](https://issues.apache.org/jira/browse/ZOOKEEPER-18) removed KeeperStateChanged, use KeeperStateDisconnected instead
 
-Also see [the current Java API](http://zookeeper.apache.org/docs/current/api/index.html)
+Also see [the current Java API](http://zookeeper.apache.org/docs/current/apidocs/zookeeper-server/index.html)
 
 <a name="C+API"></a>
 #### C API
@@ -184,7 +184,7 @@ Version 2.2.1 code, documentation, binaries, etc... are still accessible on [Sou
 |[ZOOKEEPER-189](https://issues.apache.org/jira/browse/ZOOKEEPER-189)|forrest build not validated xml of input documents|
 |[ZOOKEEPER-188](https://issues.apache.org/jira/browse/ZOOKEEPER-188)|Check that election port is present for all servers|
 |[ZOOKEEPER-185](https://issues.apache.org/jira/browse/ZOOKEEPER-185)|Improved version of FLETest|
-|[ZOOKEEPER-184](https://issues.apache.org/jira/browse/ZOOKEEPER-184)|tests: An explicit include derective is needed for the usage of memcpy functions|
+|[ZOOKEEPER-184](https://issues.apache.org/jira/browse/ZOOKEEPER-184)|tests: An explicit include directive is needed for the usage of memcpy functions|
 |[ZOOKEEPER-183](https://issues.apache.org/jira/browse/ZOOKEEPER-183)|Array subscript is above array bounds in od_completion, src/cli.c.|
 |[ZOOKEEPER-182](https://issues.apache.org/jira/browse/ZOOKEEPER-182)|zookeeper_init accepts empty host-port string and returns valid pointer to zhandle_t.|
 |[ZOOKEEPER-17](https://issues.apache.org/jira/browse/ZOOKEEPER-17)|zookeeper_init doc needs clarification|
@@ -228,7 +228,7 @@ Version 2.2.1 code, documentation, binaries, etc... are still accessible on [Sou
 |[ZOOKEEPER-56](https://issues.apache.org/jira/browse/ZOOKEEPER-56)|Add clover support to build.xml.|
 |[ZOOKEEPER-75](https://issues.apache.org/jira/browse/ZOOKEEPER-75)|register the ZooKeeper mailing lists with nabble.com|
 |[ZOOKEEPER-54](https://issues.apache.org/jira/browse/ZOOKEEPER-54)|remove sleeps in the tests.|
-|[ZOOKEEPER-55](https://issues.apache.org/jira/browse/ZOOKEEPER-55)|build.xml failes to retrieve a release number from SVN and the ant target "dist" fails|
+|[ZOOKEEPER-55](https://issues.apache.org/jira/browse/ZOOKEEPER-55)|build.xml fails to retrieve a release number from SVN and the ant target "dist" fails|
 |[ZOOKEEPER-89](https://issues.apache.org/jira/browse/ZOOKEEPER-89)|invoke WhenOwnerListener.whenNotOwner when the ZK connection fails|
 |[ZOOKEEPER-90](https://issues.apache.org/jira/browse/ZOOKEEPER-90)|invoke WhenOwnerListener.whenNotOwner when the ZK session expires and the znode is the leader|
 |[ZOOKEEPER-82](https://issues.apache.org/jira/browse/ZOOKEEPER-82)|Make the ZooKeeperServer more DI friendly.|
diff --git a/zookeeper-docs/src/main/resources/markdown/skin/init.js b/zookeeper-docs/src/main/resources/markdown/skin/init.js
index f94eda1a630..fa40beb7545 100644
--- a/zookeeper-docs/src/main/resources/markdown/skin/init.js
+++ b/zookeeper-docs/src/main/resources/markdown/skin/init.js
@@ -43,7 +43,7 @@ function init(){
                     var linkItem = menuItem[j].firstElementChild;
                     if('a' === linkItem.localName){
                         var linkFile = getFileName(linkItem.href);
-                        if(fileName === linkFile && linkItem.href.lastIndexOf("api/index.html")<0){
+                        if(fileName === linkFile && linkItem.href.lastIndexOf("apidocs/zookeeper-server/index.html")<0){
                             linkItem.className = "selected";
                             linkItem.parentNode.parentNode.className = "selectedmenuitemgroup";
                             var title = document.getElementById(linkItem.parentNode.parentNode.id+"Title");
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
index 8d460462b1d..1889faee341 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md
@@ -1,5 +1,5 @@
 <!--
-Copyright 2002-2004 The Apache Software Foundation
+Copyright 2002-2022 The Apache Software Foundation
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -33,7 +33,7 @@ limitations under the License.
     * [Administering](#sc_administering)
     * [Maintenance](#sc_maintenance)
         * [Ongoing Data Directory Cleanup](#Ongoing+Data+Directory+Cleanup)
-        * [Debug Log Cleanup (log4j)](#Debug+Log+Cleanup+%28log4j%29)
+        * [Debug Log Cleanup (logback)](#Debug+Log+Cleanup+Logback)
     * [Supervision](#sc_supervision)
     * [Monitoring](#sc_monitoring)
     * [Logging](#sc_logging)
@@ -43,6 +43,7 @@ limitations under the License.
         * [Advanced Configuration](#sc_advancedConfiguration)
         * [Cluster Options](#sc_clusterOptions)
         * [Encryption, Authentication, Authorization Options](#sc_authOptions)
+            * [TLS Cipher Suites](#sc_tls_cipher_suites)
         * [Experimental Options/Features](#Experimental+Options%2FFeatures)
         * [Unsafe Options](#Unsafe+Options)
         * [Disabling data directory autocreation](#Disabling+data+directory+autocreation)
@@ -199,14 +200,14 @@ ensemble:
 
      You can find the meanings of these and other configuration
   settings in the section [Configuration Parameters](#sc_configuration). A word
-  though about a few here:
+  thought about a few here:
   Every machine that is part of the ZooKeeper ensemble should know
   about every other machine in the ensemble. You accomplish this with
-  the series of lines of the form **server.id=host:port:port**. 
-  (The parameters **host** and **port** are straightforward, for each server 
+  the series of lines of the form **server.id=host:port:port**.
+  (The parameters **host** and **port** are straightforward, for each server
   you need to specify first a Quorum port then a dedicated port for ZooKeeper leader
-  election). Since ZooKeeper 3.6.0 you can also [specify multiple addresses](#id_multi_address) 
-  for each ZooKeeper server instance (this can increase availability when multiple physical 
+  election). Since ZooKeeper 3.6.0 you can also [specify multiple addresses](#id_multi_address)
+  for each ZooKeeper server instance (this can increase availability when multiple physical
   network interfaces can be used parallel in the cluster).
   You attribute the
   server id to each machine by creating a file named
@@ -233,7 +234,7 @@ ensemble:
   ensemble.
 
 7. If your configuration file is set up, you can start a
-  ZooKeeper server:  
+  ZooKeeper server:
 
         $ java -cp zookeeper.jar:lib/*:conf org.apache.zookeeper.server.quorum.QuorumPeerMain zoo.conf
 
@@ -256,8 +257,8 @@ ensemble:
 
 ### Single Server and Developer Setup
 
-If you want to setup ZooKeeper for development purposes, you will
-probably want to setup a single server instance of ZooKeeper, and then
+If you want to set up ZooKeeper for development purposes, you will
+probably want to set up a single server instance of ZooKeeper, and then
 install either the Java or C client-side libraries and bindings on your
 development machine.
 
@@ -321,14 +322,27 @@ machine in your deployment.
 
 For the ZooKeeper service to be active, there must be a
 majority of non-failing machines that can communicate with
-each other. To create a deployment that can tolerate the
-failure of F machines, you should count on deploying 2xF+1
-machines.  Thus, a deployment that consists of three machines
-can handle one failure, and a deployment of five machines can
-handle two failures. Note that a deployment of six machines
-can only handle two failures since three machines is not a
-majority.  For this reason, ZooKeeper deployments are usually
-made up of an odd number of machines.
+each other. For a ZooKeeper ensemble with N servers,
+if N is odd, the ensemble is able to tolerate up to N/2
+server failures without losing any znode data;
+if N is even, the ensemble is able to tolerate up to N/2-1
+server failures.
+
+For example, if we have a ZooKeeper ensemble with 3 servers,
+the ensemble is able to tolerate up to 1 (3/2) server failures.
+If we have a ZooKeeper ensemble with 5 servers,
+the ensemble is able to tolerate up to 2 (5/2) server failures.
+If the ZooKeeper ensemble with 6 servers, the ensemble
+is also able to tolerate up to 2 (6/2-1) server failures
+without losing data and prevent the "brain split" issue.
+
+ZooKeeper ensemble is usually has odd number of servers.
+This is because with the even number of servers,
+the capacity of failure tolerance is the same as
+the ensemble with one less server
+(2 failures for both 5-node ensemble and 6-node ensemble),
+but the ensemble has to maintain extra connections and
+data transfers for one more server.
 
 To achieve the highest probability of tolerating a failure
 you should try to make machine failures independent. For
@@ -423,7 +437,7 @@ in the unlikely event a recent log has become corrupted). This
 can be run as a cron job on the ZooKeeper server machines to
 clean up the logs daily.
 
-    java -cp zookeeper.jar:lib/slf4j-api-1.7.5.jar:lib/slf4j-log4j12-1.7.5.jar:lib/log4j-1.2.17.jar:conf org.apache.zookeeper.server.PurgeTxnLog <dataDir> <snapDir> -n <count>
+    CLASSPATH='lib/*:conf' java org.apache.zookeeper.server.PurgeTxnLog <dataDir> <snapDir> -n <count>
 
 
 Automatic purging of the snapshots and corresponding
@@ -432,14 +446,14 @@ enabled via the following configuration parameters **autopurge.snapRetainCount**
 this, see [Advanced Configuration](#sc_advancedConfiguration)
 below.
 
-<a name="Debug+Log+Cleanup+%28log4j%29"></a>
+<a name="Debug+Log+Cleanup+Logback"></a>
 
-#### Debug Log Cleanup (log4j)
+#### Debug Log Cleanup (logback)
 
 See the section on [logging](#sc_logging) in this document. It is
 expected that you will setup a rolling file appender using the
-in-built log4j feature. The sample configuration file in the
-release tar's conf/log4j.properties provides an example of
+in-built logback feature. The sample configuration file in the
+release tar's `conf/logback.xml` provides an example of
 this.
 
 <a name="sc_supervision"></a>
@@ -448,7 +462,7 @@ this.
 
 You will want to have a supervisory process that manages
 each of your ZooKeeper server processes (JVM). The ZK server is
-designed to be "fail fast" meaning that it will shutdown
+designed to be "fail fast" meaning that it will shut down
 (process exit) if an error occurs that it cannot recover
 from. As a ZooKeeper serving cluster is highly reliable, this
 means that while the server may go down the cluster as a whole
@@ -480,31 +494,31 @@ these options.
 
 ### Monitoring
 
-The ZooKeeper service can be monitored in one of two
-primary ways; 1) the command port through the use of [4 letter words](#sc_zkCommands) and 2) [JMX](zookeeperJMX.html). See the appropriate section for
-your environment/requirements.
+The ZooKeeper service can be monitored in one of three primary ways:
+
+* the command port through the use of [4 letter words](#sc_zkCommands)
+* with [JMX](zookeeperJMX.html)
+* using the [`zkServer.sh status` command](zookeeperTools.html#zkServer)
 
 <a name="sc_logging"></a>
 
 ### Logging
 
 ZooKeeper uses **[SLF4J](http://www.slf4j.org)**
-version 1.7.5 as its logging infrastructure. For backward compatibility it is bound to
-**LOG4J** but you can use
-**[LOGBack](http://logback.qos.ch/)**
-or any other supported logging framework of your choice.
-
-The ZooKeeper default *log4j.properties*
-file resides in the *conf* directory. Log4j requires that
-*log4j.properties* either be in the working directory
+version 1.7 as its logging infrastructure. By default ZooKeeper is shipped with
+**[LOGBack](http://logback.qos.ch/)** as the logging backend, but you can use
+any other supported logging framework of your choice.
+
+The ZooKeeper default *logback.xml*
+file resides in the *conf* directory. Logback requires that
+*logback.xml* either be in the working directory
 (the directory from which ZooKeeper is run) or be accessible from the classpath.
 
 For more information about SLF4J, see
 [its manual](http://www.slf4j.org/manual.html).
 
-For more information about LOG4J, see
-[Log4j Default Initialization Procedure](http://logging.apache.org/log4j/1.2/manual.html#defaultInit)
-of the log4j manual.
+For more information about Logback, see
+[Logback website](http://logback.qos.ch/).
 
 <a name="sc_troubleshooting"></a>
 
@@ -598,8 +612,7 @@ property, when available, is noted below.
     and snapshots.
     ###### Note
     >Having a dedicated log device has a large impact on
-    throughput and stable latencies. It is highly recommended to
-    dedicate a log device and set **dataLogDir** to point to a directory on
+    throughput and stable latencies. It is highly recommended dedicating a log device and set **dataLogDir** to point to a directory on
     that device, and then make sure to point **dataDir** to a directory
     _not_ residing on that device.
 
@@ -608,9 +621,11 @@ property, when available, is noted below.
     Clients can submit requests faster than ZooKeeper can
     process them, especially if there are a lot of clients. To
     prevent ZooKeeper from running out of memory due to queued
-    requests, ZooKeeper will throttle clients so that there is no
-    more than globalOutstandingLimit outstanding requests in the
-    system. The default limit is 1,000.
+    requests, ZooKeeper will throttle clients so that there are no
+    more than globalOutstandingLimit outstanding requests across
+    entire ensemble, equally divided. The default limit is 1,000
+    and, for example, with 3 members each of them will have
+    1000 / 2 = 500 individual limit.
 
 * *preAllocSize* :
     (Java system property: **zookeeper.preAllocSize**)
@@ -623,21 +638,20 @@ property, when available, is noted below.
 * *snapCount* :
     (Java system property: **zookeeper.snapCount**)
     ZooKeeper records its transactions using snapshots and
-    a transaction log (think write-ahead log).The number of
+    a transaction log (think write-ahead log). The number of
     transactions recorded in the transaction log before a snapshot
     can be taken (and the transaction log rolled) is determined
     by snapCount. In order to prevent all of the machines in the quorum
     from taking a snapshot at the same time, each ZooKeeper server
     will take a snapshot when the number of transactions in the transaction log
     reaches a runtime generated random value in the \[snapCount/2+1, snapCount]
-    range.The default snapCount is 100,000.
+    range. The default snapCount is 100,000.
 
 * *commitLogCount* * :
     (Java system property: **zookeeper.commitLogCount**)
     Zookeeper maintains an in-memory list of last committed requests for fast synchronization with
     followers when the followers are not too behind. This improves sync performance in case when your
-    snapshots are large (>100,000).
-    The default commitLogCount value is 500.
+    snapshots are large (>100,000). The default value is 500 which is the recommended minimum.
 
 * *snapSizeLimitInKb* :
     (Java system property: **zookeeper.snapSizeLimitInKb**)
@@ -759,6 +773,10 @@ property, when available, is noted below.
     time interval in hours for which the purge task has to
     be triggered. Set to a positive integer (1 and above)
     to enable the auto purging. Defaults to 0.
+    **Suffix support added in 3.10.0:** The interval is specified as an integer with an optional suffix to indicate the time unit.
+    Supported suffixes are: `ms` for milliseconds, `s` for seconds, `m` for minutes, `h` for hours, and `d` for days.
+    For example, "10m" represents 10 minutes, and "5h" represents 5 hours.
+    If no suffix is provided, the default unit is hours.
 
 * *syncEnabled* :
     (Java system property: **zookeeper.observer.syncEnabled**)
@@ -786,7 +804,7 @@ property, when available, is noted below.
    must be 127 or less. Additionally, the maximum support TTL value is `1099511627775` which is smaller
    than what was allowed in 3.5.3 (`1152921504606846975`)
 
-* *watchManaggerName* :
+* *watchManagerName* :
   (Java system property only: **zookeeper.watchManagerName**)
   **New in 3.6.0:** Added in [ZOOKEEPER-1179](https://issues.apache.org/jira/browse/ZOOKEEPER-1179)
    New watcher manager WatchManagerOptimized is added to optimize the memory overhead in heavy watch use cases. This
@@ -803,7 +821,7 @@ property, when available, is noted below.
 * *watcherCleanThreshold* :
   (Java system property only: **zookeeper.watcherCleanThreshold**)
   **New in 3.6.0:** Added in [ZOOKEEPER-1179](https://issues.apache.org/jira/browse/ZOOKEEPER-1179)
-  The new watcher manager WatchManagerOptimized will clean up the dead watchers lazily, the clean up process is relatively
+  The new watcher manager WatchManagerOptimized will clean up the dead watchers lazily, the cleanup process is relatively
   heavy, batch processing will reduce the cost and improve the performance. This setting is used to decide
   the batch size. The default one is 1000, we don't need to change it if there is no memory or clean up
   speed issue.
@@ -811,7 +829,7 @@ property, when available, is noted below.
 * *watcherCleanIntervalInSeconds* :
   (Java system property only:**zookeeper.watcherCleanIntervalInSeconds**)
   **New in 3.6.0:** Added in [ZOOKEEPER-1179](https://issues.apache.org/jira/browse/ZOOKEEPER-1179)
-  The new watcher manager WatchManagerOptimized will clean up the dead watchers lazily, the clean up process is relatively
+  The new watcher manager WatchManagerOptimized will clean up the dead watchers lazily, the cleanup process is relatively
   heavy, batch processing will reduce the cost and improve the performance. Besides watcherCleanThreshold,
   this setting is used to clean up the dead watchers after certain time even the dead watchers are not larger
   than watcherCleanThreshold, so that we won't leave the dead watchers there for too long. The default setting
@@ -976,6 +994,12 @@ property, when available, is noted below.
     Does not affect the limit defined by *flushDelay*.
     Default is 1000.
 
+* *enforceQuota* :
+    (Java system property: **zookeeper.enforceQuota**)
+    **New in 3.7.0:**
+    Enforce the quota check. When enabled and the client exceeds the total bytes or children count hard quota under a znode, the server will reject the request and reply the client a `QuotaExceededException` by force.
+    The default value is: false. Exploring [quota feature](http://zookeeper.apache.org/doc/current/zookeeperQuotas.html) for more details.
+
 * *requestThrottleLimit* :
     (Java system property: **zookeeper.request_throttle_max_requests**)
     **New in 3.6.0:**
@@ -1004,7 +1028,7 @@ property, when available, is noted below.
 * *zookeeper.request_throttler.shutdownTimeout* :
     (Java system property only)
     **New in 3.6.0:**
-    The time (in milliseconds) the RequestThrottler waits for the request queue to drain during shutdown before it shuts down forcefully. The default is 10000.  
+    The time (in milliseconds) the RequestThrottler waits for the request queue to drain during shutdown before it shuts down forcefully. The default is 10000.
 
 * *advancedFlowControlEnabled* :
     (Java system property: **zookeeper.netty.advancedFlowControl.enabled**)
@@ -1032,62 +1056,72 @@ property, when available, is noted below.
     **New in 3.6.0:**
     The digest feature is added to detect the data inconsistency inside
     ZooKeeper when loading database from disk, catching up and following
-    leader, its doing incrementally hash check for the DataTree based on 
+    leader, its doing incrementally hash check for the DataTree based on
     the adHash paper mentioned in
 
         https://cseweb.ucsd.edu/~daniele/papers/IncHash.pdf
 
-    The idea is simple, the hash value of DataTree will be updated incrementally 
-    based on the changes to the set of data. When the leader is preparing the txn, 
-    it will pre-calculate the hash of the tree based on the changes happened with 
+    The idea is simple, the hash value of DataTree will be updated incrementally
+    based on the changes to the set of data. When the leader is preparing the txn,
+    it will pre-calculate the hash of the tree based on the changes happened with
     formula:
 
         current_hash = current_hash + hash(new node data) - hash(old node data)
 
-    If it’s creating a new node, the hash(old node data) will be 0, and if it’s a 
+    If it’s creating a new node, the hash(old node data) will be 0, and if it’s a
     delete node op, the hash(new node data) will be 0.
 
-    This hash will be associated with each txn to represent the expected hash value 
-    after applying the txn to the data tree, it will be sent to followers with 
-    original proposals. Learner will compare the actual hash value with the one in 
-    the txn after applying the txn to the data tree, and report mismatch if it’s not 
+    This hash will be associated with each txn to represent the expected hash value
+    after applying the txn to the data tree, it will be sent to followers with
+    original proposals. Learner will compare the actual hash value with the one in
+    the txn after applying the txn to the data tree, and report mismatch if it’s not
     the same.
 
-    These digest value will also be persisted with each txn and snapshot on the disk, 
-    so when servers restarted and load data from disk, it will compare and see if 
+    These digest value will also be persisted with each txn and snapshot on the disk,
+    so when servers restarted and load data from disk, it will compare and see if
     there is hash mismatch, which will help detect data loss issue on disk.
 
-    For the actual hash function, we’re using CRC internally, it’s not a collisionless 
-    hash function, but it’s more efficient compared to collisionless hash, and the 
+    For the actual hash function, we’re using CRC internally, it’s not a collisionless
+    hash function, but it’s more efficient compared to collisionless hash, and the
     collision possibility is really really rare and can already meet our needs here.
 
-    This feature is backward and forward compatible, so it can safely rolling upgrade, 
-    downgrade, enabled and later disabled without any compatible issue. Here are the 
+    This feature is backward and forward compatible, so it can safely roll upgrade,
+    downgrade, enabled and later disabled without any compatible issue. Here are the
     scenarios have been covered and tested:
 
-    1. When leader runs with new code while follower runs with old one, the digest will 
-       be append to the end of each txn, follower will only read header and txn data, 
-       digest value in the txn will be ignored. It won't affect the follower reads and 
+    1. When leader runs with new code while follower runs with old one, the digest will
+       be appended to the end of each txn, follower will only read header and txn data,
+       digest value in the txn will be ignored. It won't affect the follower reads and
        processes the next txn.
     2. When leader runs with old code while follower runs with new one, the digest won't
-       be sent with txn, when follower tries to read the digest, it will throw EOF which 
+       be sent with txn, when follower tries to read the digest, it will throw EOF which
        is caught and handled gracefully with digest value set to null.
     3. When loading old snapshot with new code, it will throw IOException when trying to
        read the non-exist digest value, and the exception will be caught and digest will
-       be set to null, which means we won't compare digest when loading this snapshot, 
+       be set to null, which means we won't compare digest when loading this snapshot,
        which is expected to happen during rolling upgrade
-    4. When loading new snapshot with old code, it will finish successfully after deserialzing 
+    4. When loading new snapshot with old code, it will finish successfully after deserializing
        the data tree, the digest value at the end of snapshot file will be ignored
-    5. The scenarios of rolling restart with flags change are similar to the 1st and 2nd 
+    5. The scenarios of rolling restart with flags change are similar to the 1st and 2nd
        scenarios discussed above, if the leader enabled but follower not, digest value will
        be ignored, and follower won't compare the digest during runtime; if leader disabled
        but follower enabled, follower will get EOF exception which is handled gracefully.
 
-    Note: the current digest calculation excluded nodes under /zookeeper 
-    due to the potential inconsistency in the /zookeeper/quota stat node, 
+    Note: the current digest calculation excluded nodes under /zookeeper
+    due to the potential inconsistency in the /zookeeper/quota stat node,
     we can include that after that issue is fixed.
 
-    By default, this feautre is disabled, set "true" to enable it.
+    By default, this feature is enabled, set "false" to disable it.
+
+* *snapshot.compression.method* :
+    (Java system property: **zookeeper.snapshot.compression.method**)
+    **New in 3.6.0:**
+    This property controls whether or not ZooKeeper should compress snapshots
+    before storing them on disk (see [ZOOKEEPER-3179](https://issues.apache.org/jira/browse/ZOOKEEPER-3179)).
+    Possible values are:
+    - "": Disabled (no snapshot compression). This is the default behavior.
+    - "gz": See [gzip compression](https://en.wikipedia.org/wiki/Gzip).
+    - "snappy": See [Snappy compression](https://en.wikipedia.org/wiki/Snappy_(compression)).
 
 * *snapshot.trust.empty* :
     (Java system property: **zookeeper.snapshot.trust.empty**)
@@ -1098,21 +1132,22 @@ property, when available, is noted below.
     files. This should only be set during upgrading from old versions of
     ZooKeeper (3.4.x, pre 3.5.3) where ZooKeeper might only have transaction
     log files but without presence of snapshot files. If the value is set
-    during upgrade, we recommend to set the value back to false after upgrading
+    during upgrade, we recommend setting the value back to false after upgrading
     and restart ZooKeeper process so ZooKeeper can continue normal data
     consistency check during recovery process.
     Default value is false.
+
 * *audit.enable* :
     (Java system property: **zookeeper.audit.enable**)
     **New in 3.6.0:**
     By default audit logs are disabled. Set to "true" to enable it. Default value is "false".
     See the [ZooKeeper audit logs](zookeeperAuditLogs.html) for more information.
-    
+
 * *audit.impl.class* :
     (Java system property: **zookeeper.audit.impl.class**)
     **New in 3.6.0:**
-    Class to implement the audit logger. By default log4j based audit logger org.apache.zookeeper.audit
-    .Log4jAuditLogger is used.
+    Class to implement the audit logger. By default logback based audit logger org.apache.zookeeper.audit
+    .Slf4jAuditLogger is used.
     See the [ZooKeeper audit logs](zookeeperAuditLogs.html) for more information.
 
 * *largeRequestMaxBytes* :
@@ -1125,14 +1160,87 @@ property, when available, is noted below.
     **New in 3.6.0:**
     The size threshold after which a request is considered a large request. If it is -1, then all requests are considered small, effectively turning off large request throttling. The default is -1.
 
-* *outstandingHandshake.limit* 
-    (Jave system property only: **zookeeper.netty.server.outstandingHandshake.limit**)
-    The maximum in-flight TLS handshake connections could have in ZooKeeper, 
-    the connections exceed this limit will be rejected before starting handshake. 
-    This setting doesn't limit the max TLS concurrency, but helps avoid herd 
-    effect due to TLS handshake timeout when there are too many in-flight TLS 
+* *outstandingHandshake.limit*
+    (Java system property only: **zookeeper.netty.server.outstandingHandshake.limit**)
+    The maximum in-flight TLS handshake connections could have in ZooKeeper,
+    the connections exceed this limit will be rejected before starting handshake.
+    This setting doesn't limit the max TLS concurrency, but helps avoid herd
+    effect due to TLS handshake timeout when there are too many in-flight TLS
     handshakes. Set it to something like 250 is good enough to avoid herd effect.
 
+* *netty.server.earlyDropSecureConnectionHandshakes*
+  (Java system property: **zookeeper.netty.server.earlyDropSecureConnectionHandshakes**)
+    If the ZooKeeper server is not fully started, drop TCP connections before performing the TLS handshake.
+    This is useful in order to prevent flooding the server with many concurrent TLS handshakes after a restart.
+    Please note that if you enable this flag the server won't answer to 'ruok' commands if it is not fully started.
+
+    The behaviour of dropping the connection has been introduced in ZooKeeper 3.7 and it was not possible to disable it.
+    Since 3.7.1 and 3.8.0 this feature is disabled by default.
+
+* *throttledOpWaitTime*
+    (Java system property: **zookeeper.throttled_op_wait_time**)
+    The time in the RequestThrottler queue longer than which a request will be marked as throttled.
+    A throttled requests will not be processed other than being fed down the pipeline of the server it belongs 
+    to preserve the order of all requests.
+    The FinalProcessor will issue an error response (new error code: ZTHROTTLEDOP) for these undigested requests.
+    The intent is for the clients not to retry them immediately.
+    When set to 0, no requests will be throttled. The default is 0.
+
+* *learner.closeSocketAsync*
+  (Java system property: **zookeeper.learner.closeSocketAsync**)
+  (Java system property: **learner.closeSocketAsync**)(Added for backward compatibility)
+    **New in 3.7.0:**
+    When enabled, a learner will close the quorum socket asynchronously. This is useful for TLS connections where closing a socket might take a long time, block the shutdown process, potentially delay a new leader election, and leave the quorum unavailable. Closing the socket asynchronously avoids blocking the shutdown process despite the long socket closing time and a new leader election can be started while the socket being closed. 
+    The default is false.
+
+* *leader.closeSocketAsync*
+  (Java system property: **zookeeper.leader.closeSocketAsync**)
+  (Java system property: **leader.closeSocketAsync**)(Added for backward compatibility)
+   **New in 3.7.0:**
+   When enabled, the leader will close a quorum socket asynchronously. This is useful for TLS connections where closing a socket might take a long time. If disconnecting a follower is initiated in ping() because of a failed SyncLimitCheck then the long socket closing time will block the sending of pings to other followers. Without receiving pings, the other followers will not send session information to the leader, which causes sessions to expire. Setting this flag to true ensures that pings will be sent regularly.
+   The default is false.
+
+* *learner.asyncSending*
+  (Java system property: **zookeeper.learner.asyncSending**)
+  (Java system property: **learner.asyncSending**)(Added for backward compatibility)
+  **New in 3.7.0:**
+  The sending and receiving packets in Learner were done synchronously in a critical section. An untimely network issue could cause the followers to hang (see [ZOOKEEPER-3575](https://issues.apache.org/jira/browse/ZOOKEEPER-3575) and [ZOOKEEPER-4074](https://issues.apache.org/jira/browse/ZOOKEEPER-4074)). The new design moves sending packets in Learner to a separate thread and sends the packets asynchronously. The new design is enabled with this parameter (learner.asyncSending).
+  The default is false.
+
+* *forward_learner_requests_to_commit_processor_disabled*
+    (Java system property: **zookeeper.forward_learner_requests_to_commit_processor_disabled**)
+    When this property is set, the requests from learners won't be enqueued to
+    CommitProcessor queue, which will help save the resources and GC time on 
+    leader.
+
+    The default value is false.
+
+* *serializeLastProcessedZxid.enabled*
+  (Java system property: **zookeeper.serializeLastProcessedZxid.enabled**)
+  **New in 3.9.0:**
+  If enabled, ZooKeeper serializes the lastProcessedZxid when snapshot and deserializes it
+  when restore. Defaults to true. Needs to be enabled for performing snapshot and restore
+  via admin server commands, as there is no snapshot file name to extract the lastProcessedZxid.
+  
+  This feature is backward and forward compatible. Here are the different scenarios.
+
+    1. Snapshot triggered by server internally
+       a. When loading old snapshot with new code, it will throw EOFException when trying to
+       read the non-exist lastProcessedZxid value, and the exception will be caught. 
+       The lastProcessedZxid will be set using the snapshot file name.
+       
+       b. When loading new snapshot with old code, it will finish successfully after deserializing the 
+       digest value, the lastProcessedZxid at the end of snapshot file will be ignored.
+       The lastProcessedZxid will be set using the snapshot file name.
+    
+    2. Sync up between leader and follower
+       The lastProcessedZxid will not be serialized by leader and deserialized by follower
+       in both new and old code. It will be set to the lastProcessedZxid sent from leader
+       via QuorumPacket.  
+
+   3. Snapshot triggered via admin server APIs
+      The feature flag need to be enabled for the snapshot command to work. 
+     
 <a name="sc_clusterOptions"></a>
 
 #### Cluster Options
@@ -1146,20 +1254,20 @@ of servers -- that is, when deploying clusters of servers.
     non-authenticated UDP-based version of fast leader election, "2"
     corresponds to the authenticated UDP-based version of fast
     leader election, and "3" corresponds to TCP-based version of
-    fast leader election. Algorithm 3 was made default in 3.2.0 and 
+    fast leader election. Algorithm 3 was made default in 3.2.0 and
     prior versions (3.0.0 and 3.1.0) were using algorithm 1 and 2 as well.
     ###### Note
-    >The implementations of leader election 1, and 2 were 
-    **deprecated** in 3.4.0. Since 3.6.0 only FastLeaderElection is available, 
-    in case of upgrade you have to shutdown all of your servers and 
-    restart them with electionAlg=3 (or by removing the line from the configuration file).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        >                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     
+    >The implementations of leader election 1, and 2 were
+    **deprecated** in 3.4.0. Since 3.6.0 only FastLeaderElection is available,
+    in case of upgrade you have to shut down all of your servers and
+    restart them with electionAlg=3 (or by removing the line from the configuration file).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        >
 
 * *maxTimeToWaitForEpoch* :
   (Java system property: **zookeeper.leader.maxTimeToWaitForEpoch**)
   **New in 3.6.0:**
       The maximum time to wait for epoch from voters when activating
       leader. If leader received a LOOKING notification from one of
-      it's voters, and it hasn't received epoch packets from majority
+      its voters, and it hasn't received epoch packets from majority
       within maxTimeToWaitForEpoch, then it will goto LOOKING and
       elect leader again.
       This can be tuned to reduce the quorum or server unavailable
@@ -1203,18 +1311,18 @@ of servers -- that is, when deploying clusters of servers.
     used by the clients must match the list of ZooKeeper servers
     that each ZooKeeper server has.
     There are two port numbers **nnnnn**.
-    The first followers use to connect to the leader, and the second is for
+    The first followers used to connect to the leader, and the second is for
     leader election. If you want to test multiple servers on a single machine, then
     different ports can be used for each server.
-    
+
 
     <a name="id_multi_address"></a>
     Since ZooKeeper 3.6.0 it is possible to specify **multiple addresses** for each
     ZooKeeper server (see [ZOOKEEPER-3188](https://issues.apache.org/jira/projects/ZOOKEEPER/issues/ZOOKEEPER-3188)).
     To enable this feature, you must set the *multiAddress.enabled* configuration property
-    to *true*. This helps to increase availability and adds network level 
-    resiliency to ZooKeeper. When multiple physical network interfaces are used 
-    for the servers, ZooKeeper is able to bind on all interfaces and runtime switching 
+    to *true*. This helps to increase availability and adds network level
+    resiliency to ZooKeeper. When multiple physical network interfaces are used
+    for the servers, ZooKeeper is able to bind on all interfaces and runtime switching
     to a working interface in case a network error. The different addresses can be specified
     in the config using a pipe ('|') character. A valid configuration using multiple addresses looks like:
 
@@ -1306,7 +1414,7 @@ of servers -- that is, when deploying clusters of servers.
     **"reconfigEnabled=true"**, then the ensemble
     will have reconfig feature enabled. If the leader has a setting of
     **"reconfigEnabled=false"**, then the ensemble
-    will have reconfig feature disabled. It is thus recommended to have a consistent
+    will have reconfig feature disabled. It is thus recommended having a consistent
     value for **"reconfigEnabled"** across servers
     in the ensemble.
 
@@ -1318,17 +1426,20 @@ of servers -- that is, when deploying clusters of servers.
     command must be put in this list else ZooKeeper server will
     not enable the command.
     By default the whitelist only contains "srvr" command
-    which zkServer.sh uses. The rest of four letter word commands are disabled
-    by default.
+    which zkServer.sh uses. Additionally, if Read Only Mode is enabled by setting
+    Java system property **readonlymode.enabled**, then the "isro" command is
+    added to the whitelist. The rest of four-letter word commands are disabled
+    by default: attempting to use them will gain a response
+    ".... is not executed because it is not in the whitelist."
     Here's an example of the configuration that enables stat, ruok, conf, and isro
     command while disabling the rest of Four Letter Words command:
 
         4lw.commands.whitelist=stat, ruok, conf, isro
 
 
-If you really need enable all four letter word commands by default, you can use
+If you really need enable all four-letter word commands by default, you can use
 the asterisk option so you don't have to include every command one by one in the list.
-As an example, this will enable all four letter word commands:
+As an example, this will enable all four-letter word commands:
 
 
     4lw.commands.whitelist=*
@@ -1342,7 +1453,7 @@ As an example, this will enable all four letter word commands:
     This will allow for connections between quorum members to
     remain up when there is network infrastructure that may
     otherwise break them. Some NATs and firewalls may terminate
-    or lose state for long running or idle connections.
+    or lose state for long-running or idle connections.
     Enabling this option relies on OS level settings to work
     properly, check your operating system's options regarding TCP
     keepalive for more information.  Defaults to
@@ -1366,16 +1477,16 @@ As an example, this will enable all four letter word commands:
 
 * *electionPortBindRetry* :
     (Java system property only: **zookeeper.electionPortBindRetry**)
-    Property set max retry count when Zookeeper server fails to bind 
-    leader election port. Such errors can be temporary and recoverable, 
+    Property set max retry count when Zookeeper server fails to bind
+    leader election port. Such errors can be temporary and recoverable,
     such as DNS issue described in [ZOOKEEPER-3320](https://issues.apache.org/jira/projects/ZOOKEEPER/issues/ZOOKEEPER-3320),
-    or non-retryable, such as port already in use.  
-    In case of transient errors, this property can improve availability 
-    of Zookeeper server and help it to self recover. 
-    Default value 3. In container environment, especially in Kubernetes, 
-    this value should be increased or set to 0(infinite retry) to overcome issues 
+    or non-retryable, such as port already in use.
+    In case of transient errors, this property can improve availability
+    of Zookeeper server and help it to self recover.
+    Default value 3. In container environment, especially in Kubernetes,
+    this value should be increased or set to 0(infinite retry) to overcome issues
     related to DNS name resolving.
-    
+
 
 * *observer.reconnectDelayMs* :
     (Java system property: **zookeeper.observer.reconnectDelayMs**)
@@ -1405,11 +1516,21 @@ As an example, this will enable all four letter word commands:
 The options in this section allow control over
 encryption/authentication/authorization performed by the service.
 
-Beside this page, you can also find useful information about client side configuration in the 
-[Programmers Guide](zookeeperProgrammers.html#sc_java_client_configuration). 
-The ZooKeeper Wiki also has useful pages about [ZooKeeper SSL support](https://cwiki.apache.org/confluence/display/ZOOKEEPER/ZooKeeper+SSL+User+Guide), 
+Beside this page, you can also find useful information about client side configuration in the
+[Programmers Guide](zookeeperProgrammers.html#sc_java_client_configuration).
+The ZooKeeper Wiki also has useful pages about [ZooKeeper SSL support](https://cwiki.apache.org/confluence/display/ZOOKEEPER/ZooKeeper+SSL+User+Guide),
 and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/display/ZOOKEEPER/ZooKeeper+and+SASL).
 
+* *DigestAuthenticationProvider.enabled* :
+    (Java system property: **zookeeper.DigestAuthenticationProvider.enabled**)
+    **New in 3.7:**
+    Determines whether the `digest` authentication provider is
+    enabled.  The default value is **true** for backwards
+    compatibility, but it may be a good idea to disable this provider
+    if not used, as it can result in misleading entries appearing in
+    audit logs
+    (see [ZOOKEEPER-3979](https://issues.apache.org/jira/browse/ZOOKEEPER-3979))
+
 * *DigestAuthenticationProvider.superDigest* :
     (Java system property: **zookeeper.DigestAuthenticationProvider.superDigest**)
     By default this feature is **disabled**
@@ -1431,6 +1552,44 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     localhost (not over the network) or over an encrypted
     connection.
 
+* *DigestAuthenticationProvider.digestAlg* :
+    (Java system property: **zookeeper.DigestAuthenticationProvider.digestAlg**)
+     **New in 3.7.0:**
+    Set ACL digest algorithm. The default value is: `SHA1` which will be deprecated in the future for security issues.
+    Set this property the same value in all the servers.
+
+    - How to support other more algorithms?
+        - modify the `java.security` configuration file under `$JAVA_HOME/jre/lib/security/java.security` by specifying:
+             `security.provider.<n>=<provider class name>`.
+
+             ```
+             For example:
+             set zookeeper.DigestAuthenticationProvider.digestAlg=RipeMD160
+             security.provider.3=org.bouncycastle.jce.provider.BouncyCastleProvider
+             ```
+
+        - copy the jar file to `$JAVA_HOME/jre/lib/ext/`.
+
+             ```
+             For example:
+             copy bcprov-jdk18on-1.60.jar to $JAVA_HOME/jre/lib/ext/
+             ```
+
+    - How to migrate from one digest algorithm to another?
+        - 1. Regenerate `superDigest` when migrating to new algorithm.
+        - 2. `SetAcl` for a znode which already had a digest auth of old algorithm.
+
+* *IPAuthenticationProvider.usexforwardedfor* :
+    (Java system property: **zookeeper.IPAuthenticationProvider.usexforwardedfor**)
+    **New in 3.9.3:**
+    IPAuthenticationProvider uses the client IP address to authenticate the user. By 
+    default it reads the **Host** HTTP header to detect client IP address. In some 
+    proxy configurations the proxy server adds the **X-Forwarded-For** header to
+    the request in order to provide the IP address of the original client request. 
+    By enabling **usexforwardedfor** ZooKeeper setting, **X-Forwarded-For** will be preferred
+    over the standard **Host** header.
+    Default value is **false**.
+
 * *X509AuthenticationProvider.superUser* :
     (Java system property: **zookeeper.X509AuthenticationProvider.superUser**)
     The SSL-backed way to enable a ZooKeeper ensemble
@@ -1444,6 +1603,9 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     Similar to **zookeeper.X509AuthenticationProvider.superUser**
     but is generic for SASL based logins. It stores the name of
     a user that can access the znode hierarchy as a "super" user.
+    You can specify multiple SASL super users using the
+    **zookeeper.superUser.[suffix]** notation, e.g.:
+    `zookeeper.superUser.1=...`.
 
 * *ssl.authProvider* :
     (Java system property: **zookeeper.ssl.authProvider**)
@@ -1468,8 +1630,8 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     If the credential is not in the list, the connection request will be refused.
     This prevents a client accidentally connecting to a wrong ensemble.
 
-* *zookeeper.sessionRequireClientSASLAuth* :
-    (Java system property only: **zookeeper.sessionRequireClientSASLAuth**)
+* *sessionRequireClientSASLAuth* :
+    (Java system property: **zookeeper.sessionRequireClientSASLAuth**)
     **New in 3.6.0:**
     When set to **true**, ZooKeeper server will only accept connections and requests from clients
     that have authenticated with server via SASL. Clients that are not configured with SASL
@@ -1478,17 +1640,46 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     in such case, both Java and C client will close the session with server thereafter,
     without further attempts on retrying to reconnect.
 
+    This configuration is shorthand for **enforce.auth.enabled=true** and **enforce.auth.scheme=sasl**
+
     By default, this feature is disabled. Users who would like to opt-in can enable the feature
-    by setting **zookeeper.sessionRequireClientSASLAuth** to **true**.
+    by setting **sessionRequireClientSASLAuth** to **true**.
 
     This feature overrules the <emphasis role="bold">zookeeper.allowSaslFailedClients</emphasis> option, so even if server is
     configured to allow clients that fail SASL authentication to login, client will not be able to
     establish a session with server if this feature is enabled.
 
+* *enforce.auth.enabled* :
+    (Java system property : **zookeeper.enforce.auth.enabled**)
+    **New in 3.7.0:**
+    When set to **true**, ZooKeeper server will only accept connections and requests from clients
+    that have authenticated with server via configured auth scheme. Authentication schemes
+    can be configured using property enforce.auth.schemes. Clients that are not
+    configured with the any of the auth scheme configured at server or configured but failed authentication (i.e. with invalid credential)
+    will not be able to establish a session with server. A typed error code (-124) will be delivered
+    in such case, both Java and C client will close the session with server thereafter,
+    without further attempts on retrying to reconnect.
+
+    By default, this feature is disabled. Users who would like to opt-in can enable the feature
+    by setting **enforce.auth.enabled** to **true**.
+
+    When **enforce.auth.enabled=true** and **enforce.auth.schemes=sasl** then 
+    <emphasis role="bold">zookeeper.allowSaslFailedClients</emphasis> configuration is overruled. So even if server is
+    configured to allow clients that fail SASL authentication to login, client will not be able to
+    establish a session with server if this feature is enabled with sasl as authentication scheme.
+
+* *enforce.auth.schemes* :
+    (Java system property : **zookeeper.enforce.auth.schemes**)
+    **New in 3.7.0:**
+    Comma separated list of authentication schemes. Clients must be authenticated with at least one
+    authentication scheme before doing any zookeeper operations. 
+    This property is used only when **enforce.auth.enabled** is to **true**.
+
 * *sslQuorum* :
     (Java system property: **zookeeper.sslQuorum**)
     **New in 3.5.5:**
-    Enables encrypted quorum communication. Default is `false`.
+    Enables encrypted quorum communication. Default is `false`. When enabling this feature, please also consider enabling *leader.closeSocketAsync*
+    and *learner.closeSocketAsync* to avoid issues associated with the potentially long socket closing time when shutting down an SSL connection.
 
 * *ssl.keyStore.location and ssl.keyStore.password* and *ssl.quorum.keyStore.location* and *ssl.quorum.keyStore.password* :
     (Java system properties: **zookeeper.ssl.keyStore.location** and **zookeeper.ssl.keyStore.password** and **zookeeper.ssl.quorum.keyStore.location** and **zookeeper.ssl.quorum.keyStore.password**)
@@ -1496,12 +1687,20 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     Specifies the file path to a Java keystore containing the local
     credentials to be used for client and quorum TLS connections, and the
     password to unlock the file.
+    
+* *ssl.keyStore.passwordPath* and *ssl.quorum.keyStore.passwordPath* :
+    (Java system properties: **zookeeper.ssl.keyStore.passwordPath** and **zookeeper.ssl.quorum.keyStore.passwordPath**)
+    **New in 3.8.0:**
+    Specifies the file path that contains the keystore password. Reading the password from a file takes precedence over 
+    the explicit password property.
 
 * *ssl.keyStore.type* and *ssl.quorum.keyStore.type* :
     (Java system properties: **zookeeper.ssl.keyStore.type** and **zookeeper.ssl.quorum.keyStore.type**)
     **New in 3.5.5:**
-    Specifies the file format of client and quorum keystores. Values: JKS, PEM, PKCS12 or null (detect by filename).    
-    Default: null     
+    Specifies the file format of client and quorum keystores. Values: JKS, PEM, PKCS12 or null (detect by filename).
+    Default: null.
+    **New in 3.5.10, 3.6.3, 3.7.0:**
+    The format BCFKS was added.
 
 * *ssl.trustStore.location* and *ssl.trustStore.password* and *ssl.quorum.trustStore.location* and *ssl.quorum.trustStore.password* :
     (Java system properties: **zookeeper.ssl.trustStore.location** and **zookeeper.ssl.trustStore.password** and **zookeeper.ssl.quorum.trustStore.location** and **zookeeper.ssl.quorum.trustStore.password**)
@@ -1510,29 +1709,37 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     credentials to be used for client and quorum TLS connections, and the
     password to unlock the file.
 
+* *ssl.trustStore.passwordPath* and *ssl.quorum.trustStore.passwordPath* :
+    (Java system properties: **zookeeper.ssl.trustStore.passwordPath** and **zookeeper.ssl.quorum.trustStore.passwordPath**)
+    **New in 3.8.0:**
+    Specifies the file path that contains the truststore password. Reading the password from a file takes precedence over 
+    the explicit password property.
+   
 * *ssl.trustStore.type* and *ssl.quorum.trustStore.type* :
     (Java system properties: **zookeeper.ssl.trustStore.type** and **zookeeper.ssl.quorum.trustStore.type**)
     **New in 3.5.5:**
-    Specifies the file format of client and quorum trustStores. Values: JKS, PEM, PKCS12 or null (detect by filename).    
-    Default: null     
+    Specifies the file format of client and quorum trustStores. Values: JKS, PEM, PKCS12 or null (detect by filename).
+    Default: null.
+    **New in 3.5.10, 3.6.3, 3.7.0:**
+    The format BCFKS was added.
 
 * *ssl.protocol* and *ssl.quorum.protocol* :
     (Java system properties: **zookeeper.ssl.protocol** and **zookeeper.ssl.quorum.protocol**)
     **New in 3.5.5:**
     Specifies to protocol to be used in client and quorum TLS negotiation.
-    Default: TLSv1.2
+    Default: TLSv1.3 or TLSv1.2 depending on Java runtime version being used.
 
 * *ssl.enabledProtocols* and *ssl.quorum.enabledProtocols* :
     (Java system properties: **zookeeper.ssl.enabledProtocols** and **zookeeper.ssl.quorum.enabledProtocols**)
     **New in 3.5.5:**
     Specifies the enabled protocols in client and quorum TLS negotiation.
-    Default: value of `protocol` property
+    Default: TLSv1.3, TLSv1.2 if value of `protocol` property is TLSv1.3. TLSv1.2 if `protocol` is TLSv1.2.
 
 * *ssl.ciphersuites* and *ssl.quorum.ciphersuites* :
     (Java system properties: **zookeeper.ssl.ciphersuites** and **zookeeper.ssl.quorum.ciphersuites**)
     **New in 3.5.5:**
     Specifies the enabled cipher suites to be used in client and quorum TLS negotiation.
-    Default: Enabled cipher suites depend on the Java runtime version being used.    
+    Default: JDK defaults since 3.10.0, and hard coded cipher suites for 3.9 and earlier versions. See [TLS Cipher Suites](#sc_tls_cipher_suites).
 
 * *ssl.context.supplier.class* and *ssl.quorum.context.supplier.class* :
     (Java system properties: **zookeeper.ssl.context.supplier.class** and **zookeeper.ssl.quorum.context.supplier.class**)
@@ -1550,58 +1757,110 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     Disabling it only recommended for testing purposes.
     Default: true
 
+* *ssl.clientHostnameVerification* and *ssl.quorum.clientHostnameVerification* :
+    (Java system properties: **zookeeper.ssl.clientHostnameVerification** and **zookeeper.ssl.quorum.clientHostnameVerification**)
+    **New in 3.9.4:**
+    Specifies whether the client's hostname verification is enabled in client and quorum TLS negotiation process.
+    This option requires the corresponding *hostnameVerification* option to be `true`, or it will be ignored.
+    Default: true for quorum, false for clients
+
+* *ssl.allowReverseDnsLookup* and *ssl.quorum.allowReverseDnsLookup* :
+    (Java system properties: **zookeeper.ssl.allowReverseDnsLookup** and **zookeeper.ssl.quorum.allowReverseDnsLookup**)
+    **New in 3.9.5:**
+    Allow reverse DNS lookup in both server- and client hostname verifications if the hostname verification is enabled in
+    `ZKTrustManager`. Supported in both quorum and client TLS protocols. Not supported in FIPS mode. Reverse DNS lookups are
+    expensive and unnecessary in most cases. Make sure that certificates are created with all required Subject Alternative
+    Names (SAN) for successful identity verification. It's recommended to add SAN:IP entries for identity verification
+    of client certificates.
+    Default: false
+
 * *ssl.crl* and *ssl.quorum.crl* :
     (Java system properties: **zookeeper.ssl.crl** and **zookeeper.ssl.quorum.crl**)
     **New in 3.5.5:**
     Specifies whether Certificate Revocation List is enabled in client and quorum TLS protocols.
-    Default: false
+    Default: jvm property "com.sun.net.ssl.checkRevocation" since 3.10.0, false otherwise
 
 * *ssl.ocsp* and *ssl.quorum.ocsp* :
     (Java system properties: **zookeeper.ssl.ocsp** and **zookeeper.ssl.quorum.ocsp**)
     **New in 3.5.5:**
     Specifies whether Online Certificate Status Protocol is enabled in client and quorum TLS protocols.
-    Default: false
+    **Changed in 3.10.0:**
+    Before 3.10.0, *ssl.ocsp* and *ssl.quorum.ocsp* implies *ssl.crl* and *ssl.quorum.crl* correspondingly.
+    After 3.10.0, one has to setup both *ssl.crl* and *ssl.ocsp* (or *ssl.quorum.crl* and *ssl.quorum.ocsp*)
+    to enable OCSP. This is consistent with jdk's method of [Setting up a Java Client to use Client-Driven OCSP](https://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/ocsp.html#setting-up-a-java-client-to-use-client-driven-ocsp).
+    Default: jvm security property "ocsp.enable" since 3.10.0, false otherwise
 
 * *ssl.clientAuth* and *ssl.quorum.clientAuth* :
     (Java system properties: **zookeeper.ssl.clientAuth** and **zookeeper.ssl.quorum.clientAuth**)
-    **New in 3.5.5:**
-    TBD
+    **Added in 3.5.5, but broken until 3.5.7:**
+    Specifies options to authenticate ssl connections from clients. Valid values are
+ 
+     * "none": server will not request client authentication 
+     * "want": server will "request" client authentication 
+     * "need": server will "require" client authentication
+
+     Default: "need"
 
 * *ssl.handshakeDetectionTimeoutMillis* and *ssl.quorum.handshakeDetectionTimeoutMillis* :
     (Java system properties: **zookeeper.ssl.handshakeDetectionTimeoutMillis** and **zookeeper.ssl.quorum.handshakeDetectionTimeoutMillis**)
     **New in 3.5.5:**
     TBD
 
+* *ssl.sslProvider* :
+    (Java system property: **zookeeper.ssl.sslProvider**)
+    **New in 3.9.0:**
+    Allows to select SSL provider in the client-server communication when TLS is enabled. Netty-tcnative native library
+    has been added to ZooKeeper in version 3.9.0 which allows us to use native SSL libraries like OpenSSL on supported
+    platforms. See the available options in Netty-tcnative documentation. Default value is "JDK".
+
+* *sslQuorumReloadCertFiles* :
+    (No Java system property)
+    **New in  3.5.5, 3.6.0:**
+    Allows Quorum SSL keyStore and trustStore reloading when the certificates on the filesystem change without having to restart the ZK process. Default: false
+
+* *client.certReload* :
+    (Java system property: **zookeeper.client.certReload**)
+    **New in 3.7.2, 3.8.1, 3.9.0:**
+    Allows client SSL keyStore and trustStore reloading when the certificates on the filesystem change without having to restart the ZK process. Default: false
+
 * *client.portUnification*:
     (Java system property: **zookeeper.client.portUnification**)
     Specifies that the client port should accept SSL connections
     (using the same configuration as the secure client port).
     Default: false
-    
+
 * *authProvider*:
     (Java system property: **zookeeper.authProvider**)
     You can specify multiple authentication provider classes for ZooKeeper.
     Usually you use this parameter to specify the SASL authentication provider
     like: `authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider`
-    
+
 * *kerberos.removeHostFromPrincipal*
     (Java system property: **zookeeper.kerberos.removeHostFromPrincipal**)
     You can instruct ZooKeeper to remove the host from the client principal name during authentication.
     (e.g. the zk/myhost@EXAMPLE.COM client principal will be authenticated in ZooKeeper as zk@EXAMPLE.COM)
     Default: false
-    
+
 * *kerberos.removeRealmFromPrincipal*
     (Java system property: **zookeeper.kerberos.removeRealmFromPrincipal**)
     You can instruct ZooKeeper to remove the realm from the client principal name during authentication.
     (e.g. the zk/myhost@EXAMPLE.COM client principal will be authenticated in ZooKeeper as zk/myhost)
     Default: false
 
+* *kerberos.canonicalizeHostNames*
+    (Java system property: **zookeeper.kerberos.canonicalizeHostNames**)
+    **New in 3.7.0:**
+    Instructs ZooKeeper to canonicalize server host names extracted from *server.x* lines.
+    This allows using e.g. `CNAME` records to reference servers in configuration files, while still enabling SASL Kerberos authentication between quorum members.
+    It is essentially the quorum equivalent of the *zookeeper.sasl.client.canonicalize.hostname* property for clients.
+    The default value is **false** for backwards compatibility.
+
 * *multiAddress.enabled* :
     (Java system property: **zookeeper.multiAddress.enabled**)
     **New in 3.6.0:**
-    Since ZooKeeper 3.6.0 you can also [specify multiple addresses](#id_multi_address) 
-    for each ZooKeeper server instance (this can increase availability when multiple physical 
-    network interfaces can be used parallel in the cluster). Setting this parameter to 
+    Since ZooKeeper 3.6.0 you can also [specify multiple addresses](#id_multi_address)
+    for each ZooKeeper server instance (this can increase availability when multiple physical
+    network interfaces can be used parallel in the cluster). Setting this parameter to
     **true** will enable this feature. Please note, that you can not enable this feature
     during a rolling upgrade if the version of the old ZooKeeper cluster is prior to 3.6.0.
     The default value is **false**.
@@ -1609,17 +1868,42 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
 * *multiAddress.reachabilityCheckTimeoutMs* :
     (Java system property: **zookeeper.multiAddress.reachabilityCheckTimeoutMs**)
     **New in 3.6.0:**
-    Since ZooKeeper 3.6.0 you can also [specify multiple addresses](#id_multi_address) 
-    for each ZooKeeper server instance (this can increase availability when multiple physical 
+    Since ZooKeeper 3.6.0 you can also [specify multiple addresses](#id_multi_address)
+    for each ZooKeeper server instance (this can increase availability when multiple physical
     network interfaces can be used parallel in the cluster). ZooKeeper will perform ICMP ECHO requests
-    or try to establish a TCP connection on port 7 (Echo) of the destination host in order to find 
+    or try to establish a TCP connection on port 7 (Echo) of the destination host in order to find
     the reachable addresses. This happens only if you provide multiple addresses in the configuration.
-    In this property you can set the timeout in millisecs for the reachability check. The check happens 
+    In this property you can set the timeout in milliseconds for the reachability check. The check happens
     in parallel for the different addresses, so the timeout you set here is the maximum time will be taken
     by checking the reachability of all addresses.
     The default value is **1000**.
 
-    This parameter has no effect, unless you enable the MultiAddress feature by setting *multiAddress.enabled=true*.    
+    This parameter has no effect, unless you enable the MultiAddress feature by setting *multiAddress.enabled=true*.
+
+* *fips-mode* :
+    (Java system property: **zookeeper.fips-mode**)
+    **New in 3.8.2:**
+    Enable FIPS compatibility mode in ZooKeeper. If enabled, the following things will be changed in order to comply 
+    with FIPS requirements:
+    * Custom trust manager (`ZKTrustManager`) that is used for hostname verification will be disabled. As a consequence, 
+      hostname verification is not available in the Quorum protocol, but still can be set in client-server communication. 
+    * DIGEST-MD5 Sasl auth mechanism will be disabled in Quorum and ZooKeeper Sasl clients. Only GSSAPI (Kerberos)
+      can be used.
+    
+    Default: **true** (3.9.0+), **false** (3.8.x)
+
+<a name="sc_tls_cipher_suites"></a>
+
+##### TLS Cipher Suites
+
+From 3.5.5 to 3.9 a hard coded default cipher list was used, with the ordering
+dependent on whether it is run Java 8 or a later version.
+
+The list on Java 8 includes TLSv1.2 CBC, GCM and TLSv1.3 ciphers in ordering: *TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256, TLS_CHACHA20_POLY1305_SHA256*
+
+The list on Java 9+ includes TLSv1.2 GCM, CBC and TLSv1.3 ciphers in ordering: *TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256, TLS_CHACHA20_POLY1305_SHA256*
+
+Since 3.10 there is no hardcoded list, and the JDK defaults are used.
 
 <a name="Experimental+Options%2FFeatures"></a>
 
@@ -1631,14 +1915,25 @@ New features that are currently considered experimental.
     (Java system property: **readonlymode.enabled**)
     **New in 3.4.0:**
     Setting this value to true enables Read Only Mode server
-    support (disabled by default). ROM allows clients
-    sessions which requested ROM support to connect to the
+    support (disabled by default).
+    *localSessionsEnabled* has to be activated to serve clients.
+    A downgrade of an existing connections is currently not supported.
+    ROM allows clients sessions which requested ROM support to connect to the
     server even when the server might be partitioned from
     the quorum. In this mode ROM clients can still read
     values from the ZK service, but will be unable to write
     values and see changes from other clients. See
     ZOOKEEPER-784 for more details.
 
+* *zookeeper.follower.skipLearnerRequestToNextProcessor* :
+    (Java system property: **zookeeper.follower.skipLearnerRequestToNextProcessor**)
+    When our cluster has observers which are connected with ObserverMaster, then turning on this flag might help
+    you reduce some memory pressure on the Observer Master. If your cluster doesn't have any observers or
+    they are not connected with ObserverMaster or your Observer's don't make much writes, then using this flag
+    won't help you.
+    Currently the change here is guarded behind the flag to help us get more confidence around the memory gains.
+    In Long run, we might want to remove this flag and set its behavior as the default codepath.
+
 <a name="Unsafe+Options"></a>
 
 #### Unsafe Options
@@ -1675,11 +1970,11 @@ the variable does.
 * *jute.maxbuffer.extrasize*:
     (Java system property: **zookeeper.jute.maxbuffer.extrasize**)
     **New in 3.5.7:**
-    While processing client requests ZooKeeper server adds some additional information into 
-    the requests before persisting it as a transaction. Earlier this additional information size 
+    While processing client requests ZooKeeper server adds some additional information into
+    the requests before persisting it as a transaction. Earlier this additional information size
     was fixed to 1024 bytes. For many scenarios, specially scenarios where jute.maxbuffer value
     is more than 1 MB and request type is multi, this fixed size was insufficient.
-    To handle all the scenarios additional information size is increased from 1024 byte 
+    To handle all the scenarios additional information size is increased from 1024 byte
     to same as jute.maxbuffer size and also it is made configurable through jute.maxbuffer.extrasize.
     Generally this property is not required to be configured as default value is the most optimal value.
 
@@ -1699,17 +1994,17 @@ the variable does.
 * *multiAddress.reachabilityCheckEnabled* :
     (Java system property: **zookeeper.multiAddress.reachabilityCheckEnabled**)
     **New in 3.6.0:**
-    Since ZooKeeper 3.6.0 you can also [specify multiple addresses](#id_multi_address) 
-    for each ZooKeeper server instance (this can increase availability when multiple physical 
+    Since ZooKeeper 3.6.0 you can also [specify multiple addresses](#id_multi_address)
+    for each ZooKeeper server instance (this can increase availability when multiple physical
     network interfaces can be used parallel in the cluster). ZooKeeper will perform ICMP ECHO requests
-    or try to establish a TCP connection on port 7 (Echo) of the destination host in order to find 
+    or try to establish a TCP connection on port 7 (Echo) of the destination host in order to find
     the reachable addresses. This happens only if you provide multiple addresses in the configuration.
-    The reachable check can fail if you hit some ICMP rate-limitation, (e.g. on MacOS) when you try to 
-    start a large (e.g. 11+) ensemble members cluster on a single machine for testing. 
-    
-    Default value is **true**. By setting this parameter to 'false' you can disable the reachability checks. 
-    Please note, disabling the reachability check will cause the cluster not to be able to reconfigure 
-    itself properly during network problems, so the disabling is advised only during testing. 
+    The reachable check can fail if you hit some ICMP rate-limitation, (e.g. on macOS) when you try to
+    start a large (e.g. 11+) ensemble members cluster on a single machine for testing.
+
+    Default value is **true**. By setting this parameter to 'false' you can disable the reachability checks.
+    Please note, disabling the reachability check will cause the cluster not to be able to reconfigure
+    itself properly during network problems, so the disabling is advised only during testing.
 
     This parameter has no effect, unless you enable the MultiAddress feature by setting *multiAddress.enabled=true*.
 
@@ -1752,7 +2047,7 @@ necessary for the user to first install ZooKeeper, then create
 the data directory (and potentially txnlog directory), and
 then start the server. Otherwise as mentioned in the previous
 paragraph the server will not start. Running **zkServer-initialize.sh** will create the
-required directories, and optionally setup the myid file
+required directories, and optionally set up the myid file
 (optional command line parameter). This script can be used
 even if the autocreate feature itself is not used, and will
 likely be of use to users as this (setup, including creation
@@ -1865,8 +2160,9 @@ Both subsystems need to have sufficient amount of threads to achieve peak read t
     maximum interval in milliseconds that a container that has never had
     any children is retained. Should be long enough for your client to
     create the container, do any needed work and then create children.
-    Default is "0" which is used to indicate that containers
-    that have never had any children are never deleted.
+    Default is "300000"(a.k.a. 5 minutes) since 3.10.0, for earlier versions,
+    it is "0" which is used to indicate that containers that have never had
+    any children are never deleted.
 
 <a name="sc_debug_observability_config"></a>
 
@@ -1892,6 +2188,50 @@ Both subsystems need to have sufficient amount of threads to achieve peak read t
 
 #### AdminServer configuration
 
+**New in 3.10.0:** [AdminServer](#sc_adminserver) will use the following existing properties:
+
+* *ssl.quorum.ciphersuites* :
+  (Java system property: **zookeeper.ssl.quorum.ciphersuites**)
+  The enabled cipher suites to be used in TLS negotiation for AdminServer.
+  Default: Jetty default.
+
+* *ssl.quorum.enabledProtocols* :
+  (Java system property: **zookeeper.ssl.quorum.enabledProtocols**)
+  The enabled protocols to be used in TLS negotiation for AdminServer.
+  Default: Jetty default.
+
+**New in 3.9.0:** The following
+options are used to configure the [AdminServer](#sc_adminserver).
+
+* *admin.rateLimiterIntervalInMS* :
+  (Java system property: **zookeeper.admin.rateLimiterIntervalInMS**)
+  The time interval for rate limiting admin command to protect the server.
+  Defaults to 5 mins.
+
+* *admin.snapshot.enabled* :
+  (Java system property: **zookeeper.admin.snapshot.enabled**)
+  The flag for enabling the snapshot command. Defaults to true. 
+
+  
+* *admin.restore.enabled* :
+  (Java system property: **zookeeper.admin.restore.enabled**)
+  The flag for enabling the restore command. Defaults to true.
+
+
+* *admin.needClientAuth* :
+  (Java system property: **zookeeper.admin.needClientAuth**)
+  The flag to control whether client auth is needed. Using x509 auth requires true.
+  Defaults to false.
+
+**New in 3.7.1:** The following
+options are used to configure the [AdminServer](#sc_adminserver).
+
+* *admin.forceHttps* :
+  (Java system property: **zookeeper.admin.forceHttps**)
+  Force AdminServer to use SSL, thus allowing only HTTPS traffic.
+  Defaults to disabled.
+  Overwrites **admin.portUnification** settings.
+
 **New in 3.6.0:** The following
 options are used to configure the [AdminServer](#sc_adminserver).
 
@@ -1942,13 +2282,85 @@ options are used to configure the [AdminServer](#sc_adminserver).
     Set to "org.apache.zookeeper.metrics.prometheus.PrometheusMetricsProvider" to
     enable Prometheus.io exporter.
 
+* *metricsProvider.httpHost* :
+    **New in 3.8.0:** Prometheus.io exporter will start a Jetty server and listen this address, default is "0.0.0.0"
+  
 * *metricsProvider.httpPort* :
-    Prometheus.io exporter will start a Jetty server and bind to this port, it default to 7000.
-    Prometheus end point will be http://hostname:httPort/metrics.
+    Prometheus.io exporter will start a Jetty server and bind to this port.
+    Prometheus end point will be `http://hostname:httpPort/metrics`.
+    If omitted no HTTP port will be opened.
+    * Note: Either HTTP or HTTPS port has to be specified or both.
+
+* *metricsProvider.httpsPort* :
+   **New in 3.10.0:**
+   Prometheus.io exporter will start a Jetty server and bind to this port.
+   Prometheus end point will be `https://hostname:httpsPort/metrics`.
+   If omitted no HTTPS port will be opened.
+    * Note: Either HTTP or HTTPS port has to be specified or both.
 
 * *metricsProvider.exportJvmInfo* :
     If this property is set to **true** Prometheus.io will export useful metrics about the JVM.
     The default is true.
+    
+* *metricsProvider.numWorkerThreads* :
+   **New in 3.7.1:**
+   Number of worker threads for reporting Prometheus summary metrics. 
+   Default value is 1. 
+   If the number is less than 1, the main thread will be used.
+    
+* *metricsProvider.maxQueueSize* :
+   **New in 3.7.1:**
+   The max queue size for Prometheus summary metrics reporting task.
+   Default value is 10000.
+   
+* *metricsProvider.workerShutdownTimeoutMs* :
+   **New in 3.7.1:**
+   The timeout in ms for Prometheus worker threads shutdown.
+   Default value is 1000ms.
+
+* *metricsProvider.ssl.keyStore.location* and *metricsProvider.ssl.keyStore.password*:
+   **New in 3.10.0:**
+   Specifies the file path to a Java keystore containing the local
+   credentials to be used for PrometheusMetricsProvider TLS connections and the
+   password to unlock the file.
+
+*  *metricsProvider.ssl.keyStore.type*:
+   **New in 3.10.0:**
+   Specifies the file format of the PrometheusMetricsProvider keystore. Values: JKS, PEM, PKCS12, BCFKS or null (detect by filename).
+   Default: null.
+
+* *metricsProvider.ssl.trustStore.location* and *metricsProvider.ssl.trustStore.password*:
+   **New in 3.10.0:**
+   Specifies the file path to a Java truststore containing the remote
+   credentials to be used for PrometheusMetricsProvider TLS connections and the
+   password to unlock the file.
+
+* *metricsProvider.ssl.trustStore.type*:
+   **New in 3.10.0:**
+   Specifies the file format of the PrometheusMetricsProvider truststore. Values: JKS, PEM, PKCS12, BCFKS or null (detect by filename).
+   Default: null.
+
+* *metricsProvider.ssl.need.client.auth*:
+   **New in 3.10.0:**
+   Specifies options to authenticate SSL connections from clients.
+   When set to true, PrometheusMetricsProvider will "require" client authentication.
+   Default: true
+
+* *metricsProvider.ssl.want.client.auth*:
+   **New in 3.10.0:**
+   Specifies options to authenticate SSL connections from clients.
+   When set to true, PrometheusMetricsProvider will "request" client authentication.
+   Default: true
+
+* *metricsProvider.ssl.ciphersuites* :
+   **New in 3.10.0:**
+   The enabled cipher suites to be used in TLS negotiation for PrometheusMetricsProvider.
+   Default value is Jetty default.
+
+* *metricsProvider.ssl.enabledProtocols* :
+   **New in 3.10.0:**
+   The enabled protocols to be used in TLS negotiation for PrometheusMetricsProvider.
+   Default value is Jetty default.
 
 <a name="Communication+using+the+Netty+framework"></a>
 
@@ -2073,7 +2485,7 @@ INFO  [main:QuorumPeer@1797] - Port unification enabled
 INFO  [QuorumPeerListener:QuorumCnxManager$Listener@874] - Creating TLS-enabled quorum server socket
 ```
 
-You should also double check after each node restart that the quorum become healthy again.
+You should also double-check after each node restart that the quorum become healthy again.
 
 4. Enable Quorum TLS on each node and do rolling restart:
 
@@ -2110,7 +2522,7 @@ connections respectively.
 
 **New in 3.5.3:**
 Four Letter Words need to be explicitly white listed before using.
-Please refer **4lw.commands.whitelist**
+Please refer to **4lw.commands.whitelist**
 described in [cluster configuration section](#sc_clusterOptions) for details.
 Moving forward, Four Letter Words will be deprecated, please use
 [AdminServer](#sc_adminserver) instead.
@@ -2137,9 +2549,11 @@ Moving forward, Four Letter Words will be deprecated, please use
     Print details about serving environment
 
 * *ruok* :
-    Tests if server is running in a non-error state. The server
-    will respond with imok if it is running. Otherwise it will not
-    respond at all.
+    Tests if the server is running in a non-error state.
+    When the whitelist enables ruok, the server will respond with `imok`
+    if it is running, otherwise it will not respond at all.
+    When ruok is disabled, the server responds with:
+    "ruok is not executed because it is not in the whitelist."
     A response of "imok" does not necessarily indicate that the
     server has joined the quorum, just that the server process is active
     and bound to the specified client port. Use "stat" for details on
@@ -2198,7 +2612,7 @@ Moving forward, Four Letter Words will be deprecated, please use
                   zk_watch_count  0
                   zk_ephemerals_count 0
                   zk_approximate_data_size    27
-                  zk_followers    4                   - only exposed by the Leader
+                  zk_learners    4                    - only exposed by the Leader
                   zk_synced_followers 4               - only exposed by the Leader
                   zk_pending_syncs    0               - only exposed by the Leader
                   zk_open_file_descriptor_count 23    - only available on Unix platforms
@@ -2231,7 +2645,7 @@ The output contains multiple lines with the following format:
 * *stmk* :
     Sets the current trace mask.  The trace mask is 64 bits,
     where each bit enables or disables a specific category of trace
-    logging on the server.  Log4J must be configured to enable
+    logging on the server. Logback must be configured to enable
     `TRACE` level first in order to see trace logging
     messages.  The bits of the trace mask correspond to the following
     trace logging categories.
@@ -2283,8 +2697,8 @@ command:
 #### The AdminServer
 
 **New in 3.5.0:** The AdminServer is
-an embedded Jetty server that provides an HTTP interface to the four
-letter word commands.  By default, the server is started on port 8080,
+an embedded Jetty server that provides an HTTP interface to the four-letter
+word commands.  By default, the server is started on port 8080,
 and commands are issued by going to the URL "/commands/\[command name]",
 e.g., http://localhost:8080/commands/stat.  The command response is
 returned as JSON.  Unlike the original protocol, commands are not
@@ -2302,9 +2716,50 @@ The AdminServer is enabled by default, but can be disabled by either:
   useful if you would like to override ZooKeeper's jetty
   dependency.)
 
-Note that the TCP four letter word interface is still available if
+Note that the TCP four-letter word interface is still available if
 the AdminServer is disabled.
 
+##### Configuring AdminServer for SSL/TLS
+- Generating the **keystore.jks** and **truststore.jks** which can be found in the [Quorum TLS](http://zookeeper.apache.org/doc/current/zookeeperAdmin.html#Quorum+TLS).
+- Add the following configuration settings to the `zoo.cfg` config file:
+
+```
+admin.portUnification=true
+ssl.quorum.keyStore.location=/path/to/keystore.jks
+ssl.quorum.keyStore.password=password
+ssl.quorum.trustStore.location=/path/to/truststore.jks
+ssl.quorum.trustStore.password=password
+```
+- Verify that the following entries in the logs can be seen:
+
+```
+2019-08-03 15:44:55,213 [myid:] - INFO  [main:JettyAdminServer@123] - Successfully loaded private key from /data/software/cert/keystore.jks
+2019-08-03 15:44:55,213 [myid:] - INFO  [main:JettyAdminServer@124] - Successfully loaded certificate authority from /data/software/cert/truststore.jks
+
+2019-08-03 15:44:55,403 [myid:] - INFO  [main:JettyAdminServer@170] - Started AdminServer on address 0.0.0.0, port 8080 and command URL /commands
+```
+
+###### Restrict TLS protocols and cipher suites for SSL/TLS negotiation in AdminServer
+
+From 3.10.0 AdminServer uses the following already existing properties:
+
+* **ssl.quorum.enabledProtocols** to specify the enabled protocols,
+* **ssl.quorum.ciphersuites** to specify the enabled cipher suites.
+
+Add the following configuration settings to the `zoo.cfg` config file:
+
+```
+ssl.quorum.enabledProtocols=TLSv1.2,TLSv1.3
+ssl.quorum.ciphersuites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+```
+
+To verify raise the log level of JettyAdminServer to DEBUG and check that the following entries can be seen in the logs:
+
+```
+2026-03-11 11:38:01,102 [myid:] - DEBUG  [main:o.a.z.s.a.JettyAdminServer@159] - Setting enabled protocols: 'TLSv1.2,TLSv1.3'
+2026-03-11 11:38:01,102 [myid:] - DEBUG  [main:o.a.z.s.a.JettyAdminServer@166] - Setting enabled cipherSuites: 'TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384'
+```
+
 Available commands include:
 
 * *connection_stat_reset/crst*:
@@ -2377,6 +2832,13 @@ Available commands include:
     Reset all observer connection statistics. Companion command to *observers*.
     No new fields returned.
 
+* *restore/rest* :
+  Restore database from snapshot input stream on the current server.
+  Returns the following data in response payload:
+  "last_zxid": String
+  Note: this API is rate-limited (once every 5 mins by default) to protect the server
+  from being over-loaded.  
+
 * *ruok* :
     No-op command, check if the server is running.
     A response does not necessarily indicate that the
@@ -2395,6 +2857,21 @@ Available commands include:
     Server information.
     Returns multiple fields giving a brief overview of server state.
 
+* *shed_connections/shed* :
+  Attempts to shed approximately the specified percentage of connections.
+  Requires "percentage": (int)
+  Returns "connections_shed" (int) and "percentage_requested" (int)
+
+* *snapshot/snap* :
+  Takes a snapshot of the current server in the datadir and stream out data.
+  Optional query parameter:
+  "streaming": Boolean (defaults to true if the parameter is not present)
+  Returns the following via Http headers:
+  "last_zxid": String
+  "snapshot_size": String
+  Note: this API is rate-limited (once every 5 mins by default) to protect the server
+  from being over-loaded.
+
 * *stats/stat* :
     Same as *server_stats* but also returns the "connections" field (see *connections*
     for details).
@@ -2586,7 +3063,7 @@ ZooKeeper correctly:
 
 * *Publicly accessible deployment* :
     A ZooKeeper ensemble is expected to operate in a trusted computing environment.
-    It is thus recommended to deploy ZooKeeper behind a firewall.
+    It is thus recommended deploying ZooKeeper behind a firewall.
 
 <a name="sc_bestPractices"></a>
 
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperAuditLogs.md b/zookeeper-docs/src/main/resources/markdown/zookeeperAuditLogs.md
index 957980dcc54..b3954ad676d 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperAuditLogs.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperAuditLogs.md
@@ -1,5 +1,5 @@
 <!--
-Copyright 2002-2004 The Apache Software Foundation
+Copyright 2002-2022 The Apache Software Foundation
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -66,25 +66,36 @@ Below are sample audit logs for all operations, where client is connected from 1
 
 ## ZooKeeper Audit Log Configuration
 
-By default audit logs are disabled. To enable audit logs configure audit.enable=true in conf/zoo.cfg. Audit logging is done using log4j. Following is the default log4j configuration for audit logs in conf/log4j.properties
-
-    #
-    # zk audit logging
-    #
-    zookeeper.auditlog.file=zookeeper_audit.log
-    zookeeper.auditlog.threshold=INFO
-    audit.logger=INFO, RFAAUDIT
-    log4j.logger.org.apache.zookeeper.audit.Log4jAuditLogger=${audit.logger}
-    log4j.additivity.org.apache.zookeeper.audit.Log4jAuditLogger=false
-    log4j.appender.RFAAUDIT=org.apache.log4j.RollingFileAppender
-    log4j.appender.RFAAUDIT.File=${zookeeper.log.dir}/${zookeeper.auditlog.file}
-    log4j.appender.RFAAUDIT.layout=org.apache.log4j.PatternLayout
-    log4j.appender.RFAAUDIT.layout.ConversionPattern=%d{ISO8601} %p %c{2}: %m%n
-    log4j.appender.RFAAUDIT.Threshold=${zookeeper.auditlog.threshold}
+By default audit logs are disabled. To enable audit logs configure `audit.enable=true` in _conf/zoo.cfg_. 
+Audit logging is done using logback. Following is the default logback configuration for audit logs in `conf/logback.xml`
+
+    <!--
+      zk audit logging
+    -->
+    <!--property name="zookeeper.auditlog.file" value="zookeeper_audit.log" />
+    <property name="zookeeper.auditlog.threshold" value="INFO" />
+    <property name="audit.logger" value="INFO, RFAAUDIT" />
+    
+    <appender name="RFAAUDIT" class="ch.qos.logback.core.rolling.RollingFileAppender">
+      <File>${zookeeper.log.dir}/${zookeeper.auditlog.file}</File>
+      <encoder>
+        <pattern>%d{ISO8601} %p %c{2}: %m%n</pattern>
+      </encoder>
+      <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
+        <level>${zookeeper.auditlog.threshold}</level>
+      </filter>
+      <rollingPolicy class="ch.qos.logback.core.rolling.FixedWindowRollingPolicy">
+        <maxIndex>10</maxIndex>
+        <FileNamePattern>${zookeeper.log.dir}/${zookeeper.auditlog.file}.%i</FileNamePattern>
+      </rollingPolicy>
+      <triggeringPolicy class="ch.qos.logback.core.rolling.SizeBasedTriggeringPolicy">
+        <MaxFileSize>10MB</MaxFileSize>
+      </triggeringPolicy>
+    </appender>
     
-    # Max log file size of 10MB
-    log4j.appender.RFAAUDIT.MaxFileSize=10MB
-    log4j.appender.RFAAUDIT.MaxBackupIndex=10
+    <logger name="org.apache.zookeeper.audit.Slf4jAuditLogger" additivity="false" level="${audit.logger}">
+      <appender-ref ref="RFAAUDIT" />
+    </logger-->
 
 Change above configuration to customize the auditlog file, number of backups, max file size, custom audit logger etc.
 
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md b/zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md
index 637e6b4596a..aeccf1dcfce 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperCLI.md
@@ -1,5 +1,5 @@
 <!--
-Copyright 2002-2020 The Apache Software Foundation
+Copyright 2002-2021 The Apache Software Foundation
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -24,6 +24,10 @@ Enter into the ZooKeeper-cli
 bin/zkCli.sh
 # connect to the remote host with timeout:3s
 bin/zkCli.sh -timeout 3000 -server remoteIP:2181
+# connect to the remote host with -waitforconnection option to wait for connection success before executing commands
+bin/zkCli.sh -waitforconnection -timeout 3000 -server remoteIP:2181
+# connect with a custom client configuration properties file
+bin/zkCli.sh -client-configuration /path/to/client.properties
 ```
 ## help
 Showing helps about ZooKeeper commands
@@ -40,7 +44,8 @@ ZooKeeper -server host:port cmd args
 	create [-s] [-e] [-c] [-t ttl] path [data] [acl]
 	delete [-v version] path
 	deleteall path
-	delquota [-n|-b] path
+	delquota [-n|-b|-N|-B] path
+	exit
 	get [-s] [-w] path
 	getAcl [-s] path
 	getAllChildrenNumber path
@@ -55,7 +60,7 @@ ZooKeeper -server host:port cmd args
 	removewatches path [-c|-d|-a] [-l]
 	set [-s] [-v version] path data
 	setAcl [-s] [-v version] [-R] path acl
-	setquota -n|-b val path
+	setquota -n|-b|-N|-B val path
 	stat [-w] path
 	sync path
 	version
@@ -66,7 +71,7 @@ Add a authorized user for ACL
 
 ```bash
 [zkshell: 9] getAcl /acl_digest_test
-    Authentication is not valid : /acl_digest_test
+    Insufficient permission : /acl_digest_test
 [zkshell: 10] addauth digest user1:12345
 [zkshell: 11] getAcl /acl_digest_test
     'digest,'user1:+owfoSBn/am19roBPzR1/MfCblE=
@@ -185,6 +190,11 @@ Delete the quota under a path
 [zkshell: 2] listquota /quota_test
 	absolute path is /zookeeper/quota/quota_test/zookeeper_limits
 	quota for /quota_test does not exist.
+[zkshell: 3] delquota -n /c1
+[zkshell: 4] delquota -N /c2
+[zkshell: 5] delquota -b /c3
+[zkshell: 6] delquota -B /c4
+
 ```
 ## get
 Get the data of the specific path
@@ -279,10 +289,10 @@ Showing the history about the recent 11 commands that you have executed
 Listing the quota of one path
 
 ```bash
-[zkshell: 1] listquota /quota_test
-	absolute path is /zookeeper/quota/quota_test/zookeeper_limits
-	Output quota for /quota_test count=2,bytes=-1
-	Output stat for /quota_test count=4,bytes=0
+[zkshell: 1] listquota /c1
+             absolute path is /zookeeper/quota/c1/zookeeper_limits
+             Output quota for /c1 count=-1,bytes=-1=;byteHardLimit=-1;countHardLimit=2
+             Output stat for /c1 count=4,bytes=0
 ```
 
 ## ls
@@ -336,8 +346,8 @@ A switch to turn on/off whether printing watches or not.
 	printwatches is on
 ```
 
-## quit
-Quit the CLI windows.
+## quit (or exit)
+The `quit` or `exit` command can be used to quit the CLI windows.
 
 ```bash
 [zkshell: 1] quit
@@ -352,7 +362,7 @@ Pre-requisites:
 
 1. set reconfigEnabled=true in the zoo.cfg
 
-2. add a super user or skipAcl,otherwise will get “Authentication is not valid�. e.g. addauth digest zookeeper:admin
+2. add a super user or skipAcl,otherwise will get “Insufficient permission�. e.g. addauth digest zookeeper:admin
 
 ```bash
 # Change follower 2 to an observer and change its port from 2182 to 12182
@@ -495,6 +505,26 @@ Set the quota in one path.
 [zkshell: 23] set /brokers "I_love_zookeeper"
 # Notice:don't have a hard constraint,just log the warning info
 	WARN  [CommitProcWorkThread-7:DataTree@379] - Quota exceeded: /brokers bytes=4206 limit=5
+
+# -N count Hard quota
+[zkshell: 3] create /c1
+Created /c1
+[zkshell: 4] setquota -N 2 /c1
+[zkshell: 5] listquota /c1
+absolute path is /zookeeper/quota/c1/zookeeper_limits
+Output quota for /c1 count=-1,bytes=-1=;byteHardLimit=-1;countHardLimit=2
+Output stat for /c1 count=2,bytes=0
+[zkshell: 6] create /c1/ch-3
+Count Quota has exceeded : /c1/ch-3
+
+# -B byte Hard quota
+[zkshell: 3] create /c2
+[zkshell: 4] setquota -B 4 /c2
+[zkshell: 5] set /c2 "foo"
+[zkshell: 6] set /c2 "foo-bar"
+Bytes Quota has exceeded : /c2
+[zkshell: 7] get /c2
+foo
 ```
 
 ## stat
@@ -530,3 +560,15 @@ Show the version of the ZooKeeper client/CLI
 [zkshell: 1] version
 ZooKeeper CLI version: 3.6.0-SNAPSHOT-29f9b2c1c0e832081f94d59a6b88709c5f1bb3ca, built on 05/30/2019 09:26 GMT
 ```
+
+## whoami
+Gives all authentication information added into the current session.
+
+    [zkshell: 1] whoami
+    Auth scheme: User
+    ip: 127.0.0.1
+    [zkshell: 2] addauth digest user1:12345
+    [zkshell: 3] whoami
+    Auth scheme: User
+    ip: 127.0.0.1
+    digest: user1
\ No newline at end of file
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperInternals.md b/zookeeper-docs/src/main/resources/markdown/zookeeperInternals.md
index 0505807e187..171f33ddb4c 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperInternals.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperInternals.md
@@ -1,5 +1,5 @@
 <!--
-Copyright 2002-2004 The Apache Software Foundation
+Copyright 2002-2022 The Apache Software Foundation
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -312,11 +312,12 @@ hierarchy of groups.
 
 ## Logging
 
-Zookeeper uses [slf4j](http://www.slf4j.org/index.html) as an abstraction layer for logging. [log4j](http://logging.apache.org/log4j) in version 1.2 is chosen as the final logging implementation for now.
+Zookeeper uses [slf4j](http://www.slf4j.org/index.html) as an abstraction layer for logging. 
+[Logback](https://logback.qos.ch/) is chosen the logging backend since ZooKeeper version 3.8.0.
 For better embedding support, it is planned in the future to leave the decision of choosing the final logging implementation to the end user.
-Therefore, always use the slf4j api to write log statements in the code, but configure log4j for how to log at runtime.
+Therefore, always use the slf4j api to write log statements in the code, but configure logback for how to log at runtime.
 Note that slf4j has no FATAL level, former messages at FATAL level have been moved to ERROR level.
-For information on configuring log4j for
+For information on configuring logback for
 ZooKeeper, see the [Logging](zookeeperAdmin.html#sc_logging) section
 of the [ZooKeeper Administrator's Guide.](zookeeperAdmin.html)
 
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperJMX.md b/zookeeper-docs/src/main/resources/markdown/zookeeperJMX.md
index 368540f4f5d..99b366f2265 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperJMX.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperJMX.md
@@ -1,5 +1,5 @@
 <!--
-Copyright 2002-2004 The Apache Software Foundation
+Copyright 2002-2022 The Apache Software Foundation
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -77,8 +77,17 @@ on the left hand side. Expand this item and depending on how you've
 started the server you will be able to monitor and manage various
 service related features.
 
+#### Logback MBeans registration _(new in 3.8.0)_
+
+Logback is the default logging backend of ZooKeeper since version 3.8.0. 
+It can be configured to register JMX MBeans by adding `<jmxConfigurator />` to _logback.xml_. More
+information can be found on Logback's [website](https://logback.qos.ch/manual/jmxConfig.html).
+
+#### Log4j MBeans _(deprecated)_
+
 Also note that ZooKeeper will register log4j MBeans as
-well. In the same section along the left hand side you will see
+well if log4j1 is configured as the logging backend of SLF4j. 
+In the same section along the left hand side you will see
 "log4j". Expand that to manage log4j through JMX. Of particular
 interest is the ability to dynamically change the logging levels
 used by editing the appender and root thresholds. Log4j MBean
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md b/zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md
index 43a999e74e8..705b5eb049a 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperMonitor.md
@@ -1,5 +1,5 @@
 <!--
-Copyright 2002-2020 The Apache Software Foundation
+Copyright 2002-2021 The Apache Software Foundation
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -19,7 +19,9 @@ limitations under the License.
 * [New Metrics System](#Metrics-System)
     * [Metrics](#Metrics)
     * [Prometheus](#Prometheus)
+    * [Alerting with Prometheus](#Alerting)
     * [Grafana](#Grafana)
+    * [InfluxDB](#influxdb)
 
 * [JMX](#JMX)
 
@@ -39,11 +41,67 @@ All the metrics are included in the `ServerMetrics.java`.
 
 <a name="Prometheus"></a>
 
+
+### Pre-requisites:
+- Enable the `Prometheus MetricsProvider` by setting the following in `zoo.cfg`:
+  ```conf
+  metricsProvider.className=org.apache.zookeeper.metrics.prometheus.PrometheusMetricsProvider
+  ```
+
+- The port for Prometheus metrics can be configured using:
+  ```conf
+  metricsProvider.httpPort=7000  # Default port is 7000
+  ```
+
+#### Enabling HTTPS for Prometheus Metrics:
+
+ZooKeeper also supports SSL for Prometheus metrics, which provides secure data transmission. To enable this, configure an HTTPS port and set up SSL certificates as follows:
+
+- Define the HTTPS port:
+  ```conf
+  metricsProvider.httpsPort=4443
+  ```
+
+- Configure the SSL key store (holds the server’s private key and certificates):
+  ```conf
+  metricsProvider.ssl.keyStore.location=/path/to/keystore.jks
+  metricsProvider.ssl.keyStore.password=your_keystore_password
+  metricsProvider.ssl.keyStore.type=jks  # Default is JKS
+  ```
+
+- Configure the SSL trust store (used to verify client certificates):
+  ```conf
+  metricsProvider.ssl.trustStore.location=/path/to/truststore.jks
+  metricsProvider.ssl.trustStore.password=your_truststore_password
+  metricsProvider.ssl.trustStore.type=jks  # Default is JKS
+  ```
+
+- **Note**: You can enable both HTTP and HTTPS simultaneously by defining both ports:
+  ```conf
+  metricsProvider.httpPort=7000
+  metricsProvider.httpsPort=4443
+  ```
+
+#### Configure TLS protocols and cipher suites for SSL/TLS negotiation in Prometheus Metrics:
+
+It is also possible to restrict TLS versions and cipher suites for PrometheusMetricsProvider.
+Add the following configuration settings to the `zoo.cfg` config file:
+
+```
+metricsProvider.ssl.enabledProtocols=TLSv1.2,TLSv1.3
+metricsProvider.ssl.ciphersuites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+```
+
+To verify raise the log level of PrometheusMetricsProvider to DEBUG and check that the following entries can be seen in the logs:
+
+```
+2026-03-11 15:46:36,997 [myid:] - INFO  [main:o.a.z.m.p.PrometheusMetricsProvider@245] - Setting enabled protocols: 'TLSv1.2,TLSv1.3'
+2026-03-11 15:46:36,997 [myid:] - INFO  [main:o.a.z.m.p.PrometheusMetricsProvider@251] - Setting enabled cipherSuites: 'TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384'
+```
+
 ### Prometheus
 - Running a [Prometheus](https://prometheus.io/) monitoring service is the easiest way to ingest and record ZooKeeper's metrics.
-- Pre-requisites:
-  - enable the `Prometheus MetricsProvider` by setting `metricsProvider.className=org.apache.zookeeper.metrics.prometheus.PrometheusMetricsProvider` in the zoo.cfg.
-  - the Port is also configurable by setting `metricsProvider.httpPort`（the default value:7000）
+
 - Install Prometheus:
   Go to the official website download [page](https://prometheus.io/download/), download the latest release.
   
@@ -65,13 +123,132 @@ All the metrics are included in the `ServerMetrics.java`.
 
     ```bash
     nohup /tmp/prometheus \
-        -config.file /tmp/test-zk.yaml \
-        -web.listen-address ":9090" \
-        -storage.local.path "test-zk.data" >> /tmp/test-zk.log  2>&1 &
+        --config.file /tmp/test-zk.yaml \
+        --web.listen-address ":9090" \
+        --storage.tsdb.path "/tmp/test-zk.data" >> /tmp/test-zk.log  2>&1 &
     ```
 
 - Now Prometheus will scrape zk metrics every 10 seconds.
 
+<a name="Alerting"></a>
+
+### Alerting with Prometheus
+- We recommend that you read [Prometheus Official Alerting Page](https://prometheus.io/docs/practices/alerting/) to explore
+  some principles of alerting
+
+- We recommend that you use [Prometheus Alertmanager](https://www.prometheus.io/docs/alerting/latest/alertmanager/) which can
+  help users to receive alerting email or instant message(by webhook) in a more convenient way
+
+- We provide an alerting example where these metrics should be taken a special attention. Note: this is for your reference only,
+  and you need to adjust them according to your actual situation and resource environment
+
+
+        use ./promtool check rules rules/zk.yml to check the correctness of the config file
+        cat rules/zk.yml
+
+        groups:
+        - name: zk-alert-example
+          rules:
+          - alert: ZooKeeper server is down
+            expr:  up == 0
+            for: 1m
+            labels:
+              severity: critical
+            annotations:
+              summary: "Instance {{ $labels.instance }} ZooKeeper server is down"
+              description: "{{ $labels.instance }} of job {{$labels.job}} ZooKeeper server is down: [{{ $value }}]."
+
+          - alert: create too many znodes
+            expr: znode_count > 1000000
+            for: 1m
+            labels:
+              severity: warning
+            annotations:
+              summary: "Instance {{ $labels.instance }} create too many znodes"
+              description: "{{ $labels.instance }} of job {{$labels.job}} create too many znodes: [{{ $value }}]."
+
+          - alert: create too many connections
+            expr: num_alive_connections > 50 # suppose we use the default maxClientCnxns: 60
+            for: 1m
+            labels:
+              severity: warning
+            annotations:
+              summary: "Instance {{ $labels.instance }} create too many connections"
+              description: "{{ $labels.instance }} of job {{$labels.job}} create too many connections: [{{ $value }}]."
+
+          - alert: znode total occupied memory is too big
+            expr: approximate_data_size /1024 /1024 > 1 * 1024 # more than 1024 MB(1 GB)
+            for: 1m
+            labels:
+              severity: warning
+            annotations:
+              summary: "Instance {{ $labels.instance }} znode total occupied memory is too big"
+              description: "{{ $labels.instance }} of job {{$labels.job}} znode total occupied memory is too big: [{{ $value }}] MB."
+
+          - alert: set too many watch
+            expr: watch_count > 10000
+            for: 1m
+            labels:
+              severity: warning
+            annotations:
+              summary: "Instance {{ $labels.instance }} set too many watch"
+              description: "{{ $labels.instance }} of job {{$labels.job}} set too many watch: [{{ $value }}]."
+
+          - alert: a leader election happens
+            expr: increase(election_time_count[5m]) > 0
+            for: 1m
+            labels:
+              severity: warning
+            annotations:
+              summary: "Instance {{ $labels.instance }} a leader election happens"
+              description: "{{ $labels.instance }} of job {{$labels.job}} a leader election happens: [{{ $value }}]."
+
+          - alert: open too many files
+            expr: open_file_descriptor_count > 300
+            for: 1m
+            labels:
+              severity: warning
+            annotations:
+              summary: "Instance {{ $labels.instance }} open too many files"
+              description: "{{ $labels.instance }} of job {{$labels.job}} open too many files: [{{ $value }}]."
+
+          - alert: fsync time is too long
+            expr: rate(fsynctime_sum[1m]) > 100
+            for: 1m
+            labels:
+              severity: warning
+            annotations:
+              summary: "Instance {{ $labels.instance }} fsync time is too long"
+              description: "{{ $labels.instance }} of job {{$labels.job}} fsync time is too long: [{{ $value }}]."
+
+          - alert: take snapshot time is too long
+            expr: rate(snapshottime_sum[5m]) > 100
+            for: 1m
+            labels:
+              severity: warning
+            annotations:
+              summary: "Instance {{ $labels.instance }} take snapshot time is too long"
+              description: "{{ $labels.instance }} of job {{$labels.job}} take snapshot time is too long: [{{ $value }}]."
+
+          - alert: avg latency is too high
+            expr: avg_latency > 100
+            for: 1m
+            labels:
+              severity: warning
+            annotations:
+              summary: "Instance {{ $labels.instance }} avg latency is too high"
+              description: "{{ $labels.instance }} of job {{$labels.job}} avg latency is too high: [{{ $value }}]."
+
+          - alert: JvmMemoryFillingUp
+            expr: jvm_memory_bytes_used / jvm_memory_bytes_max{area="heap"} > 0.8
+            for: 5m
+            labels:
+              severity: warning
+            annotations:
+              summary: "JVM memory filling up (instance {{ $labels.instance }})"
+              description: "JVM memory is filling up (> 80%)\n labels: {{ $labels }}  value = {{ $value }}\n"
+
+
 <a name="Grafana"></a>
 
 ### Grafana
@@ -83,9 +260,24 @@ All the metrics are included in the `ServerMetrics.java`.
     Url:    http://localhost:9090
     Access: proxy
     ```
-- Then download and import the default ZooKeeper dashboard [template](https://grafana.com/dashboards/10465) and customize.
+- Then download and import the default ZooKeeper dashboard [template](https://grafana.com/grafana/dashboards/10465) and customize.
 - Users can ask for Grafana dashboard account if having any good improvements by writing a email to **dev@zookeeper.apache.org**.
 
+<a name="influxdb"></a>
+
+### InfluxDB
+
+InfluxDB is an open source time series data that is often used to store metrics
+from Zookeeper. You can [download](https://portal.influxdata.com/downloads/) the
+open source version or create a [free](https://cloud2.influxdata.com/signup)
+account on InfluxDB Cloud. In either case, configure the [Apache Zookeeper
+Telegraf plugin](https://www.influxdata.com/integration/apache-zookeeper/) to
+start collecting and storing metrics from your Zookeeper clusters into your
+InfluxDB instance. There is also an [Apache Zookeeper InfluxDB
+template](https://www.influxdata.com/influxdb-templates/zookeeper-monitor/) that
+includes the Telegraf configurations and a dashboard to get you set up right
+away.
+
 <a name="JMX"></a>
 ## JMX
 More details can be found in [here](http://zookeeper.apache.org/doc/current/zookeeperJMX.html)
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperOracleQuorums.md b/zookeeper-docs/src/main/resources/markdown/zookeeperOracleQuorums.md
new file mode 100644
index 00000000000..0f72d6ee5cf
--- /dev/null
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperOracleQuorums.md
@@ -0,0 +1,202 @@
+<!--
+Copyright 2002-2004 The Apache Software Foundation
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+//-->
+
+# Introduction to Oracle Quorum
+The introduction to Oracle Quorum increases the availability of a cluster of 2 ZooKeeper instances with a failure detector as known as the Oracle.
+ The Oracle is designed to grant the permission to the instance which is the only remaining instance
+in a 2-instance configuration when the other instance is identified as faulty by the fail detector, the Oracle.
+
+## The implementation of the Oracle
+Every instance shall access to a file which contains either 0 or 1 to indicate whether this instance is authorized by the Oracle.
+However, this design can be changed since the fail detector algorithms vary from each other. Therefore, ones can override the method of _askOracle()_ in _QuorumOracleMaj_ to adapt the preferred way of deciphering the message from the Oracle.
+
+## The deployment contexts
+The Oracle is designed to increase the availability of a cluster of 2 ZooKeeper instances; thus, the size of the voting member is **2**.
+In other words, the Oracle solves the consensus problem of a possibility of faulty instance in a two-instance ensemble.
+
+In the case that the size of the voting members exceeds 2, the expected way to make the Oracle work correctly is to reconfigure the size of the cluster when a faulty machine is identified.
+For example, with a configuration of 5 instances, when a faulty machine breaks the connection with the Leader, it is expected to have a _reconfig_ client request to the cluster, which makes the cluster to re-form as the configuration of 4 instances.
+Therefore, once the size of the voting member equals to 2, the configuration falls into the problem domain which the Oracle is designed to address.
+
+## How to deploy the Oracle in _zoo.cfg_
+Regardless of the size of the cluster, the _oraclePath_ must be configured at the time of the initialization, which is like other static parameters.
+The below shows the correct way to specify and enable the Oracle.
+
+    oraclePath=/to/some/file
+    
+#### An example of zoo.cfg:
+
+    dataDir=/data
+    dataLogDir=/datalog
+    tickTime=2000
+    initLimit=5
+    syncLimit=2
+    autopurge.snapRetainCount=3
+    autopurge.purgeInterval=0
+    maxClientCnxns=60
+    standaloneEnabled=true
+    admin.enableServer=true
+    oraclePath=/chassis/mastership
+    server.1=0.0.0.0:2888:3888;2181
+    server.2=hw1:2888:3888;2181
+    
+The QuorumOracleMaj is designed to read the result of a failure detector, which is written on a text file, the oracle file.  
+The configuration in the zoo.cfg like the following:
+    
+    oraclePath=/to/some/file
+    
+Suppose you have the result of the failure detector written on /some/path/result.txt, and then the correct configuration is the following:
+
+    oraclePath=/some/path/result.txt
+    
+So, what is the correct content of the provided file? An example file can be created with the following command from the terminal:
+
+    $echo 1 > /some/path/result.txt
+    
+Any equivalent files are suitable for the current implementation of QuorumOracleMaj.
+The number of oracle files should be equal to the number of ZooKeeper instances configured to enable the Oracle.
+In other words, each ZooKeeper instance should have its oracle file, and the files shall not be shared; otherwise, the issues in the next section will arise.
+
+## What differs after the deployment of the Oracle enabled
+The _QuorumPeerConfig_ will create an instance of _QuorumOracleMaj_ instead of the default QuorumVerifier, _QuorumMaj_ when it reads the _zoo.cfg_ contains _oraclePath_.
+QuorumOracleMaj inheritances from QuorumMaj, and differs from its superclass by overriding the method of _containsQuorum()_.
+QuorumOracleMaj is designed to execute its version of _containsQuorum_ when the Leader loses all of its followers, and fails to maintain the quorum.
+In other cases, _QuorumOracleMaj_ shall execute as _QuorumMaj_.
+
+## What we should pay attention to the Oracle
+We consider an asynchronous distributed system which consists of **2** ZooKeeper instances and an Oracle.
+
+### Liveness Issue:
+When we consider the oracle satisfies the following property introduced by [CT]:
+
+    Strong Completeness: There is a time after which every process that crashes is permanently suspected by every correct processes
+
+The liveness of the system is ensured by the Oracle.
+However, when the introduced oracle fails to maintain this property, the lost of the liveness is expected as the following example,
+
+Suppose we have a Leader and a Follower, which are running in the broadcasting state,
+The system will lose its liveness when:
+
+    1. The Leader fails, but the Oracle does not detect the faulty Leader, which means the Oracle will not authorize the Follower to become a new Leader.
+    2. When a Follower fails, but the Oracle does not detect the faulty follower, which means the Oracle will authorize the Leader to move system forward.
+
+### Safety Issue:
+#### Lost of Progress
+The progress can lost when multiple failures occurs in the system at different time as the following example,
+
+Suppose we have a Leader(Ben) and a Follower(John) in the broadcasting state,
+
+    At T1 with zxid(0x1_1): L-Ben fails, and the F-John takes over the system under the authorization from the Oracle.
+    At T2 with zxid(0x2_1): The F-John becomes a new Leader, L-John, and starts a new epoch.
+    At T3 with zxid(0x2_A): L-John fails
+    At T4 with zxid(0x2_A): Ben recovers up and starts its leader election.
+    At T5 with zxid(0x3_1): Ben becomes the new leader, L-Ben, under the authorization from the Oracle.
+
+In this case, the system loses its progress after the L-Ben failed.
+
+
+However, the lost of progress can be prevented by making the Oracle is capable of referring the latest zxid. 
+When the Oracle could refer to the latest zxid,
+
+    At T5 with zxid(0x2_A): Ben will not end his leader election because the Oracle would not authorize although John is down.
+
+Nevertheless, we exchange the liveness for the safety.
+#### Split Brain Issue
+We consider the Oracle satisfies the following desired property introduced by [CT],
+
+    Accuracy: There is a time after which some correct processes is never suspected by any processes
+    
+Nevertheless, the decisions which the Oracle gives out should be mutual exclusive. 
+
+In other words,
+
+Suppose we have a Leader(Ben) and a Follower(John) in the broadcasting state,
+
+    - At any time, the Oracle will not authorize both Ben and John even though the failure detectors think each other is faulty.
+    Or
+    - At any time, for any two values in any two Oracle files respectively, the values are not both equal to 1.     
+
+The split brain is expected when the Oracle fails to maintain this property during the leader election phase of 
+
+    1. Start of the system 
+    2. A failed instance recovers from failures.
+    
+## Examples of Concepts for Implementation of a Failure Detector
+One should consider that the failure detector's outcome is to authorize the querying ZooKeeper instance whether it has the right to move the system forward without waiting for the faulty instance, which is identified by the failure detector.
+
+### An Implementation of Hardware
+Suppose two dedicated pieces of hardware, hw1 and hw2, can host ZooKeeper instances, zk1 and zk2, respectively, and form a cluster.
+A hardware device is attached to both of the hardware, and it is capable of determining whether the hardware is power on or not.
+So, when hw1 is not power on, the zk1 is undoubtedly faulty. 
+Therefore, the hardware device updates the oracle file on hw2 to 1, which indicates that zk1 is faulty and authorizes zk2 to move the system forwards.
+
+### An Implementation of Software
+Suppose two dedicated pieces of hardware, hw1 and hw2, can host ZooKeeper instances, zk1 and zk2, respectively, and form a cluster.
+One can have two more services, o1 and o2, on hw1 and hw2, respectively. The job of o1 and o2 are detecting the other hardware is alive or not.
+For example, o1 can constantly ping hw2 to determine if hw2 is power on or not.
+When o1 cannot ping hw2, o1 identifies that hw2 is faulty and then update the oracle file of zk1 to 1, which indicates that zk2 is faulty and authorizes zk1 to move the system forwards.
+  
+### Use USB devices as Oracle to Maintain Progress
+In macOS,10.15.7 (19H2), the external storage devices are mounted under `/Volumes`. 
+Thus, we can insert a USB device which contains the required information as the oracle.
+When the device is connected, the oracle authorizes the leader to move system forward, which also means the other instance fails.
+There are **SIX** steps to reproduce this stimulation.
+
+* Firstly, insert a USB device named `Oracle`, and then we can expect that  `/Volumes/Oracle` is accessible.
+* Secondly, we create a file contains `1` under `/Volumes/Oracle` named `mastership`.
+Now we can access `/Volumes/Oracle/mastership`, and so does the zookeeper instances to see whether it has the right to move the system forward.
+The file can easily be generated by the following command:
+
+
+    $echo 1 > mastership
+
+* Thirdly, you shall have a `zoo.cfg` like the example below:
+
+
+    dataDir=/data
+    dataLogDir=/datalog
+    tickTime=2000
+    initLimit=5
+    syncLimit=2
+    autopurge.snapRetainCount=3
+    autopurge.purgeInterval=0
+    maxClientCnxns=60
+    standaloneEnabled=true
+    admin.enableServer=true
+    oraclePath=/Volumes/Oracle/mastership
+    server.1=0.0.0.0:2888:3888;2181
+    server.2=hw1:2888:3888;2181
+    
+_(NOTE) The split brain issues will not occur because there is only a SINGLE USB device in this stimulation._
+_Additionally, `mastership` should not be shared by multiple instances._
+_Thus, only one ZooKeeper instance is configured with Oracle._
+_For more, please refer to Section Safety Issue._
+
+* Fourthly, start the cluster, and it is expected it forms a quorum normally.
+* Fifthly, terminate the instance either without attaching to a USB device or `mastership` contains 0.
+There are two scenarios to expect:
+  1. A leader failure occurs, and the remained instance finishes the leader election on its own due to the oracle.
+  2. The quorum is still maintained due to the oracle.
+  
+* Lastly, when the USB device is removed, `/Volumes/Oracle/mastership` becomes unavailable.
+Therefore, according to the current implementation, whenever the Leader queries the oracle, the oracle throws an exception and return `FALSE`.
+Repeat the fifth step, and then it is expected that either the system cannot recover from a leader failure ,or the leader loses the quorum.
+In either case, the service is interrupted.
+
+With these steps, we can show and practice how the oracle works with two-instance systems with ease.
+
+##REFERENCE
+[CT] Tushar Deepak Chandra and Sam Toueg. 1991. Unreliable failure detectors for asynchronous systems (preliminary version). In <i>Proceedings of the tenth annual ACM symposium on Principles of distributed computing</i> (<i>PODC '91</i>). Association for Computing Machinery, New York, NY, USA, 325–340. DOI:https://doi.org/10.1145/112600.112627
\ No newline at end of file
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md b/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
index 5d071590d8f..a9b7fd711c7 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperProgrammers.md
@@ -219,7 +219,7 @@ name "<path>-2147483648").
 
 #### Container Nodes
 
-**Added in 3.6.0**
+**Added in 3.5.3**
 
 ZooKeeper has the notion of container znodes. Container znodes are
 special purpose znodes useful for recipes such as leader, lock, etc.
@@ -236,7 +236,7 @@ znode when it occurs.
 
 #### TTL Nodes
 
-**Added in 3.6.0**
+**Added in 3.5.3**
 
 When creating PERSISTENT or PERSISTENT_SEQUENTIAL znodes,
 you can optionally set a TTL in milliseconds for the znode. If the znode
@@ -829,11 +829,15 @@ in order to retrieve ACLs of a znode user has to have _READ_ or _ADMIN_
  permission, but without _ADMIN_ permission, digest hash values will be 
 masked out.
 
+As of versions **3.9.2 / 3.8.4 / 3.7.3** the exists() call will now verify ACLs 
+on nodes that exist and the client must have READ permission otherwise
+'Insufficient permission' error will be raised.
+
 <a name="sc_BuiltinACLSchemes"></a>
 
 #### Builtin ACL Schemes
 
-ZooKeeeper has the following built in schemes:
+ZooKeeper has the following built in schemes:
 
 * **world** has a
   single id, _anyone_, that represents
@@ -1102,7 +1106,7 @@ _digest_. Additional plugins can adding using system properties. At
 startup the ZooKeeper server will look for system properties that start with
 "zookeeper.authProvider." and interpret the value of those properties as the class name
 of an authentication plugin. These properties can be set using the
-_-Dzookeeeper.authProvider.X=com.f.MyAuth_ or adding entries such as
+_-Dzookeeper.authProvider.X=com.f.MyAuth_ or adding entries such as
 the following in the server configuration file:
 
 
@@ -1111,7 +1115,7 @@ the following in the server configuration file:
 
 
 Care should be taking to ensure that the suffix on the property is unique. If there are
-duplicates such as _-Dzookeeeper.authProvider.X=com.f.MyAuth -Dzookeeper.authProvider.X=com.f.MyAuth2_,
+duplicates such as _-Dzookeeper.authProvider.X=com.f.MyAuth -Dzookeeper.authProvider.X=com.f.MyAuth2_,
 only one will be used. Also all servers must have the same plugins defined, otherwise clients using
 the authentication schemes provided by the plugins will have problems connecting to some servers.
 
@@ -1311,6 +1315,11 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     the fully qualified domain name belonging to the address. You can disable this 'canonicalization'
     by setting: zookeeper.sasl.client.canonicalize.hostname=false
 
+* *zookeeper.sasl.client.allowReverseDnsLookup* :
+    **New in 3.9.5:**
+    Controls whether reverse DNS lookup is enabled when constructing the server principal for the SASL client.
+    Default: false
+
 * *zookeeper.server.realm* :
     Realm part of the server principal. By default it is the client principal realm.
 
@@ -1320,6 +1329,7 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     this behavior by setting zookeeper.disableAutoWatchReset to **true**.
 
 * *zookeeper.client.secure* :
+    **New in 3.5.5:**
     If you want to connect to the server secure client port, you need to set this property to
     **true**
     on the client. This will connect to server using SSL with specified credentials. Note that
@@ -1337,12 +1347,29 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
     on client.
 
 * *zookeeper.ssl.keyStore.location and zookeeper.ssl.keyStore.password* :
+    **New in 3.5.5:**
     Specifies the file path to a JKS containing the local credentials to be used for SSL connections,
     and the password to unlock the file.
-
+    
+* *zookeeper.ssl.keyStore.passwordPath* :
+    **New in 3.8.0:**
+    Specifies the file path which contains the keystore password    
+    
 * *zookeeper.ssl.trustStore.location and zookeeper.ssl.trustStore.password* :
+    **New in 3.5.5:**
     Specifies the file path to a JKS containing the remote credentials to be used for SSL connections,
     and the password to unlock the file.
+    
+* *zookeeper.ssl.trustStore.passwordPath* :
+    **New in 3.8.0:**
+    Specifies the file path which contains the truststore password       
+
+* *zookeeper.ssl.keyStore.type* and *zookeeper.ssl.trustStore.type*:
+    **New in 3.5.5:**
+    Specifies the file format of keys/trust store files used to establish TLS connection to the ZooKeeper server. 
+    Values: JKS, PEM, PKCS12 or null (detect by filename). Default: null.
+    **New in 3.6.3, 3.7.0:**
+    The format BCFKS was added.
 
 * *jute.maxbuffer* :
     In the client side, it specifies the maximum size of the incoming data from the server. The default is 0xfffff(1048575) bytes,
@@ -1354,6 +1381,27 @@ and [SASL authentication for ZooKeeper](https://cwiki.apache.org/confluence/disp
 * *zookeeper.kinit* :
     Specifies path to kinit binary. Default is "/usr/bin/kinit".
 
+* *zookeeper.shuffleDnsResponse* :
+  **New in 3.10.0:**
+  Specifies whether ZooKeeper client should randomly pick an IP address from the DNS lookup query result when resolving 
+  server addresses or not. This is a feature flag in order to keep the old behavior of the default DNS resolver in 
+  `StaticHostProvider`, because we disabled it by default. The reason behind that is shuffling the response of DNS queries 
+  shadows JVM network property `java.net.preferIPv6Addresses` (default: false). This property controls whether JVM's built-in 
+  resolver should prioritize v4 (false value) or v6 (true value) addresses when putting together the list of IP addresses 
+  in the result. In other words the above Java system property was completely ineffective in the case of ZooKeeper server host 
+  resolution protocol and this must have been fixed. In a dual stack environment one might want to prefer one stack over 
+  the other which, in case of Java processes, should be controlled by JVM network properties and ZooKeeper must honor 
+  these settings. Since the old behavior has been with us since day zero, we introduced this feature flag in case you 
+  need it. Such case could be when you have a buggy DNS server which responds IP addresses always in the same order and 
+  you want to randomize that.
+  Default: false
+
+* *zookeeper.hostProvider.dnsSrvRefreshIntervalSeconds* :
+  **New in 3.10.0:**
+  Specifies the refresh interval in seconds for DNS SRV record lookups when using DnsSrvHostProvider.
+  A value of 0 disables periodic refresh.
+  Default: 60 seconds
+
 <a name="C+Binding"></a>
 
 ### C Binding
@@ -1383,8 +1431,7 @@ If you're building the client from a check-out from the Apache
 repository, follow the steps outlined below. If you're building from a
 project source package downloaded from apache, skip to step **3**.
 
-1. Run `ant compile_jute` from the ZooKeeper
-  top level directory (*.../trunk*).
+1. Run `mvn compile` in zookeeper-jute directory (*.../trunk/zookeeper-jute*).
   This will create a directory named "generated" under
   *.../trunk/zookeeper-client/zookeeper-client-c*.
 1. Change directory to the*.../trunk/zookeeper-client/zookeeper-client-c*
@@ -1600,7 +1647,7 @@ ZooKeeper users fall into:
 Outside the formal documentation, there're several other sources of
 information for ZooKeeper developers.
 
-* *[API Reference](https://zookeeper.apache.org/doc/current/api/index.html)* :
+* *[API Reference](https://zookeeper.apache.org/doc/current/apidocs/zookeeper-server/index.html)* :
     The complete reference to the ZooKeeper API
 
 * *[ZooKeeper Talk at the Hadoop Summit 2008](https://www.youtube.com/watch?v=rXI9xiesUV8)* :
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperQuotas.md b/zookeeper-docs/src/main/resources/markdown/zookeeperQuotas.md
index 11226c3be33..72864c37e4f 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperQuotas.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperQuotas.md
@@ -67,6 +67,9 @@ according to specific circumstances.
 
 - Users cannot set the quota on the path under **/zookeeper/quota**
 
+- The quota supports the soft and hard quota. The soft quota just logs the warning info when exceeding the quota, but the hard quota
+also throws a `QuotaExceededException`. When setting soft and hard quota on the same path, the hard quota has the priority.
+
 <a name="Listing+Quotas"></a>
 
 ### Listing Quotas
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperReconfig.md b/zookeeper-docs/src/main/resources/markdown/zookeeperReconfig.md
index afb85df0ad9..8b3e3dad799 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperReconfig.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperReconfig.md
@@ -88,27 +88,41 @@ feature is disabled by default, and has to be explicitly turned on via
 
 ### Specifying the client port
 
-A client port of a server is the port on which the server accepts
-client connection requests. Starting with 3.5.0 the
-_clientPort_ and _clientPortAddress_ configuration parameters should no longer be used. Instead,
-this information is now part of the server keyword specification, which
+A client port of a server is the port on which the server accepts plaintext (non-TLS) client connection requests 
+and secure client port is the port on which the server accepts TLS client connection requests. 
+
+Starting with 3.5.0 the
+_clientPort_ and _clientPortAddress_ configuration parameters should no longer be used in zoo.cfg. 
+
+Starting with 3.10.0 the
+_secureClientPort_ and _secureClientPortAddress_ configuration parameters should no longer be used in zoo.cfg.
+
+Instead, this information is now part of the server keyword specification, which
 becomes as follows:
 
-    server.<positive id> = <address1>:<port1>:<port2>[:role];[<client port address>:]<client port>**
+    server.<positive id> = <address1>:<quorum port>:<leader election port>[:role];[[<client port address>:]<client port>][;[<secure client port address>:]<secure client port>]
 
-The client port specification is to the right of the semicolon. The
-client port address is optional, and if not specified it defaults to
-"0.0.0.0". As usual, role is also optional, it can be
-_participant_ or _observer_
-(_participant_ by default).
+- [New in ZK 3.10.0] The client port specification is optional and is to the right of the
+  first semicolon. The secure client port specification is also optional and is to the right
+  of the second semicolon. However, both the client port and secure client port specification
+  cannot be omitted, at least one of them should be present. If the user intends to omit client
+  port specification and provide only secure client port specification (TLS-only server), a second
+  semicolon should still be specified to indicate an empty client port specification (see last 
+  example below). In either spec, the port address is optional, and if not specified it defaults 
+  to "0.0.0.0".
+- As usual, role is also optional, it can be _participant_ or _observer_ (_participant_ by default).
 
 Examples of legal server statements:
 
-    server.5 = 125.23.63.23:1234:1235;1236
-    server.5 = 125.23.63.23:1234:1235:participant;1236
-    server.5 = 125.23.63.23:1234:1235:observer;1236
-    server.5 = 125.23.63.23:1234:1235;125.23.63.24:1236
-    server.5 = 125.23.63.23:1234:1235:participant;125.23.63.23:1236
+    server.5 = 125.23.63.23:1234:1235;1236                                             (non-TLS server)
+    server.5 = 125.23.63.23:1234:1235;1236;1237                                        (non-TLS + TLS server)
+    server.5 = 125.23.63.23:1234:1235;;1237                                            (TLS-only server)
+    server.5 = 125.23.63.23:1234:1235:participant;1236                                 (non-TLS server)
+    server.5 = 125.23.63.23:1234:1235:observer;1236                                    (non-TLS server)
+    server.5 = 125.23.63.23:1234:1235;125.23.63.24:1236                                (non-TLS server)
+    server.5 = 125.23.63.23:1234:1235:participant;125.23.63.23:1236                    (non-TLS server)
+    server.5 = 125.23.63.23:1234:1235:participant;125.23.63.23:1236;125.23.63.23:1237  (non-TLS + TLS server)
+    server.5 = 125.23.63.23:1234:1235:participant;;125.23.63.23:1237                   (TLS-only server)
 
 
 <a name="sc_multiaddress"></a>
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperSnapshotAndRestore.md b/zookeeper-docs/src/main/resources/markdown/zookeeperSnapshotAndRestore.md
new file mode 100644
index 00000000000..576f18fdadd
--- /dev/null
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperSnapshotAndRestore.md
@@ -0,0 +1,68 @@
+<!--
+Copyright 2002-2004 The Apache Software Foundation
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+//-->
+
+# ZooKeeper Snapshot and Restore Guide
+
+Zookeeper is designed to withstand machine failures. A Zookeeper cluster can automatically recover 
+from temporary failures such as machine reboot. It can also tolerate up to (N-1)/2 permanent 
+failures for a cluster of N members due to hardware failures or disk corruption, etc. When a member 
+permanently fails, it loses access to the cluster. If the cluster permanently loses more than 
+(N-1)/2 members, it disastrously fails and loses quorum. Once the quorum is lost, the cluster 
+cannot reach consensus and therefore cannot continue to accept updates.
+
+To recover from such disastrous failures, Zookeeper provides snapshot and restore functionalities to
+restore a cluster from a snapshot.
+
+1. Snapshot and restore operate on the connected server via Admin Server APIs
+1. Snapshot and restore are rate limited to protect the server from being overloaded
+1. Snapshot and restore require authentication and authorization on the root path with ALL permission.
+The supported auth schemas are digest, x509 and IP.
+   
+* [Snapshot](#zookeeper_snapshot)
+* [Restore](#zookeeper_restore)  
+
+<a name="zookeeper_snapshot"></a>
+
+## Snapshot
+Recovering a cluster needs a snapshot from a ZooKeeper cluster. Users can periodically take
+snapshots from a live server which has the highest zxid and stream out data to a local 
+or external storage/file system (e.g., S3).
+
+ ```bash
+ # The snapshot command takes snapshot from the server it connects to and rate limited to once every 5 mins by default
+ curl -H 'Authorization: digest root:root_passwd' http://hostname:adminPort/commands/snapshot?streaming=true --output snapshotFileName
+ ```
+
+<a name="zookeeper_restore"></a>
+## Restore
+
+Restoring a cluster needs a single snapshot as input stream. Restore can be used for recovering a 
+cluster for quorum lost or building a brand-new cluster with seed data. 
+
+All members should restore using the same snapshot. The following are the recommended steps:
+ 
+- Blocking traffic on the client port or client secure port before restore starts
+- Take a snapshot of the latest database state using the snapshot admin server command if applicable
+- For each server
+  - Moving the files in dataDir and dataLogDir to different location to prevent the restored database 
+    from being overwritten when server restarts after restore
+  - Restore the server using restore admin server command
+- Unblocking traffic on the client port or client secure port after restore completes
+
+ ```bash
+ # The restore command takes a snapshot as input stream and restore the db of the server it connects. It is rate limited to once every 5 mins by default
+ curl -H 'Content-Type:application/octet-stream' -H 'Authorization: digest root:root_passwd' -POST http://hostname:adminPort/commands/restore --data-binary "@snapshotFileName" 
+ ```
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperStarted.md b/zookeeper-docs/src/main/resources/markdown/zookeeperStarted.md
index bb1e2f0c203..a33e83c33b4 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperStarted.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperStarted.md
@@ -1,5 +1,5 @@
 <!--
-Copyright 2002-2004 The Apache Software Foundation
+Copyright 2002-2022 The Apache Software Foundation
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -101,12 +101,12 @@ ZooKeeper:
     bin/zkServer.sh start
 
 
-ZooKeeper logs messages using log4j -- more detail
+ZooKeeper logs messages using _logback_ -- more detail
 available in the
 [Logging](zookeeperProgrammers.html#Logging)
 section of the Programmer's Guide. You will see log messages
 coming to the console (default) and/or a log file depending on
-the log4j configuration.
+the logback configuration.
 
 The steps outlined here run ZooKeeper in standalone mode. There is
 no replication, so if ZooKeeper process fails, the service will go down.
@@ -137,8 +137,7 @@ Once you have connected, you should see something like:
 
 
     Connecting to localhost:2181
-    log4j:WARN No appenders could be found for logger (org.apache.zookeeper.ZooKeeper).
-    log4j:WARN Please initialize the log4j system properly.
+    ...
     Welcome to ZooKeeper!
     JLine support is enabled
     [zkshell: 0]
@@ -163,13 +162,11 @@ From the shell, type `help` to get a listing of commands that can be executed fr
 	history
 	listquota path
 	ls [-s] [-w] [-R] path
-	ls2 path [watch]
 	printwatches on|off
 	quit
 	reconfig [-s] [-v version] [[-file path] | [-members serverID=host:port1:port2;port3[,...]*]] | [-add serverId=host:port1:port2;port3[,...]]* [-remove serverId[,...]*]
 	redo cmdno
 	removewatches path [-c|-d|-a] [-l]
-	rmr path
 	set [-s] [-v version] path data
 	setAcl [-s] [-v version] [-R] path acl
 	setquota -n|-b val path
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperTools.md b/zookeeper-docs/src/main/resources/markdown/zookeeperTools.md
index 09865f99d2a..d4abe385467 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperTools.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperTools.md
@@ -1,5 +1,5 @@
 <!--
-Copyright 2002-2020 The Apache Software Foundation
+Copyright 2002-2022 The Apache Software Foundation
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -23,9 +23,16 @@ limitations under the License.
     * [zkCleanup.sh](#zkCleanup)
     * [zkTxnLogToolkit.sh](#zkTxnLogToolkit)
     * [zkSnapShotToolkit.sh](#zkSnapShotToolkit)
+    * [zkSnapshotRecursiveSummaryToolkit.sh](#zkSnapshotRecursiveSummaryToolkit)
     * [zkSnapshotComparer.sh](#zkSnapshotComparer)
+
+* [Benchmark](#Benchmark)
+    * [YCSB](#YCSB)
+    * [zk-smoketest](#zk-smoketest)
     
 * [Testing](#Testing)
+    * [Fault Injection Framework](#fault-injection)
+        * [Byteman](#Byteman)
     * [Jepsen Test](#jepsen-test)
     
 <a name="Scripts"></a>
@@ -69,6 +76,14 @@ Apache ZooKeeper, version 3.6.0-SNAPSHOT 06/11/2019 05:39 GMT
 
 ```
 
+The `status` command establishes a client connection to the server to execute diagnostic commands. 
+When the ZooKeeper cluster is started in client SSL only mode (by omitting the clientPort
+from the zoo.cfg), then additional SSL related configuration has to be provided before using 
+the `./zkServer.sh status` command to find out if the ZooKeeper server is running. An example:
+
+    CLIENT_JVMFLAGS="-Dzookeeper.clientCnxnSocket=org.apache.zookeeper.ClientCnxnSocketNetty -Dzookeeper.ssl.trustStore.location=/tmp/clienttrust.jks -Dzookeeper.ssl.trustStore.password=password -Dzookeeper.ssl.keyStore.location=/tmp/client.jks -Dzookeeper.ssl.keyStore.password=password -Dzookeeper.client.secure=true" ./zkServer.sh status
+
+
 <a name="zkCli"></a>
 
 ### zkCli.sh
@@ -82,7 +97,6 @@ The environment setting for the ZooKeeper server
 ```bash
 # the setting of log property
 ZOO_LOG_DIR: the directory to store the logs
-ZOO_LOG4J_PROP: the level of logs to print
 ```
 
 <a name="zkCleanup"></a>
@@ -205,6 +219,43 @@ USAGE: SnapshotFormatter [-d|-json] snapshot_file
 ./zkSnapShotToolkit.sh -json /data/zkdata/version-2/snapshot.fa01000186d
 [[1,0,{"progname":"SnapshotFormatter.java","progver":"0.01","timestamp":1559788148637},[{"name":"\/","asize":0,"dsize":0,"dev":0,"ino":1001},[{"name":"zookeeper","asize":0,"dsize":0,"dev":0,"ino":1002},{"name":"config","asize":0,"dsize":0,"dev":0,"ino":1003},[{"name":"quota","asize":0,"dsize":0,"dev":0,"ino":1004},[{"name":"test","asize":0,"dsize":0,"dev":0,"ino":1005},{"name":"zookeeper_limits","asize":52,"dsize":52,"dev":0,"ino":1006},{"name":"zookeeper_stats","asize":15,"dsize":15,"dev":0,"ino":1007}]]],{"name":"test","asize":0,"dsize":0,"dev":0,"ino":1008}]]
 ```
+<a name="zkSnapshotRecursiveSummaryToolkit"></a>
+
+### zkSnapshotRecursiveSummaryToolkit.sh
+Recursively collect and display child count and data size for a selected node.
+
+    $./zkSnapshotRecursiveSummaryToolkit.sh
+    USAGE:
+    
+    SnapshotRecursiveSummary  <snapshot_file>  <starting_node>  <max_depth>
+    
+    snapshot_file:    path to the zookeeper snapshot
+    starting_node:    the path in the zookeeper tree where the traversal should begin
+    max_depth:        defines the depth where the tool still writes to the output. 0 means there is no depth limit, every non-leaf node's stats will be displayed, 1 means it will only contain the starting node's and it's children's stats, 2 ads another level and so on. This ONLY affects the level of details displayed, NOT the calculation.
+
+```bash
+# recursively collect and display child count and data for the root node and 2 levels below it
+./zkSnapshotRecursiveSummaryToolkit.sh /data/zkdata/version-2/snapshot.fa01000186d / 2
+
+/
+   children: 1250511
+   data: 1952186580
+-- /zookeeper
+--   children: 1
+--   data: 0
+-- /solr
+--   children: 1773
+--   data: 8419162
+---- /solr/configs
+----   children: 1640
+----   data: 8407643
+---- /solr/overseer
+----   children: 6
+----   data: 0
+---- /solr/live_nodes
+----   children: 3
+----   data: 0
+```
 
 <a name="zkSnapshotComparer"></a>
 
@@ -417,10 +468,184 @@ All layers compared.
 
 Or use `^c` to exit interactive mode anytime.
 
+
+<a name="Benchmark"></a>
+
+## Benchmark
+
+<a name="YCSB"></a>
+
+### YCSB
+
+#### Quick Start
+
+This section describes how to run YCSB on ZooKeeper.
+
+#### 1. Start ZooKeeper Server(s)
+
+#### 2. Install Java and Maven
+
+#### 3. Set Up YCSB
+
+Git clone YCSB and compile:
+
+    git clone http://github.com/brianfrankcooper/YCSB.git
+    # more details in the landing page for instructions on downloading YCSB(https://github.com/brianfrankcooper/YCSB#getting-started).
+    cd YCSB
+    mvn -pl site.ycsb:zookeeper-binding -am clean package -DskipTests
+
+#### 4. Provide ZooKeeper Connection Parameters
+
+Set connectString, sessionTimeout, watchFlag in the workload you plan to run.
+
+- `zookeeper.connectString`
+- `zookeeper.sessionTimeout`
+- `zookeeper.watchFlag`
+  * A parameter for enabling ZooKeeper's watch, optional values:true or false.the default value is false.
+  * This parameter cannot test the watch performance, but for testing what effect will take on the read/write requests when enabling the watch.
+
+      ```bash
+      ./bin/ycsb run zookeeper -s -P workloads/workloadb -p zookeeper.connectString=127.0.0.1:2181/benchmark -p zookeeper.watchFlag=true
+      ```
+
+Or, you can set configs with the shell command, EG:
+
+    # create a /benchmark namespace for sake of cleaning up the workspace after test.
+    # e.g the CLI:create /benchmark
+    ./bin/ycsb run zookeeper -s -P workloads/workloadb -p zookeeper.connectString=127.0.0.1:2181/benchmark -p zookeeper.sessionTimeout=30000
+
+#### 5. Load data and run tests
+
+Load the data:
+
+    # -p recordcount,the count of records/paths you want to insert
+    ./bin/ycsb load zookeeper -s -P workloads/workloadb -p zookeeper.connectString=127.0.0.1:2181/benchmark -p recordcount=10000 > outputLoad.txt
+
+Run the workload test:
+
+    # YCSB workloadb is the most suitable workload for read-heavy workload for the ZooKeeper in the real world.
+
+    # -p fieldlength, test the length of value/data-content took effect on performance
+    ./bin/ycsb run zookeeper -s -P workloads/workloadb -p zookeeper.connectString=127.0.0.1:2181/benchmark -p fieldlength=1000
+
+    # -p fieldcount
+    ./bin/ycsb run zookeeper -s -P workloads/workloadb -p zookeeper.connectString=127.0.0.1:2181/benchmark -p fieldcount=20
+
+    # -p hdrhistogram.percentiles,show the hdrhistogram benchmark result
+    ./bin/ycsb run zookeeper -threads 1 -P workloads/workloadb -p zookeeper.connectString=127.0.0.1:2181/benchmark -p hdrhistogram.percentiles=10,25,50,75,90,95,99,99.9 -p histogram.buckets=500
+
+    # -threads: multi-clients test, increase the **maxClientCnxns** in the zoo.cfg to handle more connections.
+    ./bin/ycsb run zookeeper -threads 10 -P workloads/workloadb -p zookeeper.connectString=127.0.0.1:2181/benchmark
+
+    # show the timeseries benchmark result
+    ./bin/ycsb run zookeeper -threads 1 -P workloads/workloadb -p zookeeper.connectString=127.0.0.1:2181/benchmark -p measurementtype=timeseries -p timeseries.granularity=50
+
+    # cluster test
+    ./bin/ycsb run zookeeper -P workloads/workloadb -p zookeeper.connectString=192.168.10.43:2181,192.168.10.45:2181,192.168.10.27:2181/benchmark
+
+    # test leader's read/write performance by setting zookeeper.connectString to leader's(192.168.10.43:2181)
+    ./bin/ycsb run zookeeper -P workloads/workloadb -p zookeeper.connectString=192.168.10.43:2181/benchmark
+
+    # test for large znode(by default: jute.maxbuffer is 1048575 bytes/1 MB ). Notice:jute.maxbuffer should also be set the same value in all the zk servers.
+    ./bin/ycsb run zookeeper -jvm-args="-Djute.maxbuffer=4194304" -s -P workloads/workloadc -p zookeeper.connectString=127.0.0.1:2181/benchmark
+
+    # Cleaning up the workspace after finishing the benchmark.
+    # e.g the CLI:deleteall /benchmark
+
+
+<a name="zk-smoketest"></a>
+
+### zk-smoketest
+
+**zk-smoketest** provides a simple smoketest client for a ZooKeeper ensemble. Useful for verifying new, updated,
+existing installations. More details are [here](https://github.com/phunt/zk-smoketest).
+
+
 <a name="Testing"></a>
 
 ## Testing
 
+<a name="fault-injection"></a>
+
+### Fault Injection Framework
+
+<a name="Byteman"></a>
+
+#### Byteman
+
+- **Byteman** is a tool which makes it easy to trace, monitor and test the behaviour of Java application and JDK runtime code.
+It injects Java code into your application methods or into Java runtime methods without the need for you to recompile, repackage or even redeploy your application.
+Injection can be performed at JVM startup or after startup while the application is still running.
+- Visit the official [website](https://byteman.jboss.org/) to download the latest release
+- A brief tutorial can be found [here](https://developer.jboss.org/wiki/ABytemanTutorial)
+
+    ```bash
+    Preparations:
+    # attach the byteman to 3 zk servers during runtime
+    # 55001,55002,55003 is byteman binding port; 714,740,758 is the zk server pid
+    ./bminstall.sh -b -Dorg.jboss.byteman.transform.all -Dorg.jboss.byteman.verbose -p 55001 714
+    ./bminstall.sh -b -Dorg.jboss.byteman.transform.all -Dorg.jboss.byteman.verbose -p 55002 740
+    ./bminstall.sh -b -Dorg.jboss.byteman.transform.all -Dorg.jboss.byteman.verbose -p 55003 758
+
+    # load the fault injection script
+    ./bmsubmit.sh -p 55002 -l my_zk_fault_injection.btm
+    # unload the fault injection script
+    ./bmsubmit.sh -p 55002 -u my_zk_fault_injectionr.btm
+    ```
+
+Look at the below examples to customize your byteman fault injection script
+
+Example 1: This script makes leader's zxid roll over, to force re-election.
+
+```bash
+cat zk_leader_zxid_roll_over.btm
+
+RULE trace zk_leader_zxid_roll_over
+CLASS org.apache.zookeeper.server.quorum.Leader
+METHOD propose
+IF true
+DO
+  traceln("*** Leader zxid has rolled over, forcing re-election ***");
+  $1.zxid = 4294967295L
+ENDRULE
+```
+
+Example 2: This script makes the leader drop the ping packet to a specific follower.
+The leader will close the **LearnerHandler** with that follower, and the follower will enter the state:LOOKING
+then re-enter the quorum with the state:FOLLOWING
+
+```bash
+cat zk_leader_drop_ping_packet.btm
+
+RULE trace zk_leader_drop_ping_packet
+CLASS org.apache.zookeeper.server.quorum.LearnerHandler
+METHOD ping
+AT ENTRY
+IF $0.sid == 2
+DO
+  traceln("*** Leader drops ping packet to sid: 2 ***");
+  return;
+ENDRULE
+```
+
+Example 3: This script makes one follower drop ACK packet which has no big effect in the broadcast phrase, since after receiving
+the majority of ACKs from the followers, the leader can commit that proposal
+
+```bash
+cat zk_leader_drop_ping_packet.btm
+
+RULE trace zk.follower_drop_ack_packet
+CLASS org.apache.zookeeper.server.quorum.SendAckRequestProcessor
+METHOD processRequest
+AT ENTRY
+IF true
+DO
+  traceln("*** Follower drops ACK packet ***");
+  return;
+ENDRULE
+```
+
+
 <a name="jepsen-test"></a>
 
 ### Jepsen Test
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperTutorial.md b/zookeeper-docs/src/main/resources/markdown/zookeeperTutorial.md
index 4057a389b66..366c0a9f081 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperTutorial.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperTutorial.md
@@ -156,7 +156,7 @@ a boolean flag that enables the process to set a watch. In the code the flag is
 
     boolean enter() throws KeeperException, InterruptedException{
         zk.create(root + "/" + name, new byte[0], Ids.OPEN_ACL_UNSAFE,
-                CreateMode.EPHEMERAL_SEQUENTIAL);
+                CreateMode.EPHEMERAL);
         while (true) {
             synchronized (mutex) {
                 List<String> list = zk.getChildren(root, true);
@@ -463,7 +463,7 @@ Start a barrier with 2 participants (start as many times as many participants yo
 
             boolean enter() throws KeeperException, InterruptedException{
                 zk.create(root + "/" + name, new byte[0], Ids.OPEN_ACL_UNSAFE,
-                        CreateMode.EPHEMERAL_SEQUENTIAL);
+                        CreateMode.EPHEMERAL);
                 while (true) {
                     synchronized (mutex) {
                         List<String> list = zk.getChildren(root, true);
diff --git a/zookeeper-docs/src/main/resources/markdown/zookeeperUseCases.md b/zookeeper-docs/src/main/resources/markdown/zookeeperUseCases.md
index 0b841c34c71..98045444457 100644
--- a/zookeeper-docs/src/main/resources/markdown/zookeeperUseCases.md
+++ b/zookeeper-docs/src/main/resources/markdown/zookeeperUseCases.md
@@ -1,5 +1,5 @@
 <!--
-Copyright 2002-2020 The Apache Software Foundation
+Copyright 2002-2021 The Apache Software Foundation
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -37,7 +37,7 @@ limitations under the License.
 
 ### [Eclipse Communication Framework](http://www.eclipse.org/ecf)
   - The Eclipse ECF project provides an implementation of its Abstract Discovery services using Zookeeper. ECF itself
-  is used in many projects providing base functionallity for communication, all based on OSGi [1].
+  is used in many projects providing base functionality for communication, all based on OSGi [1].
 
 ### [Eclipse Gyrex](http://www.eclipse.org/gyrex)
   - The Eclipse Gyrex project provides a platform for building your own Java OSGi based clouds. 
@@ -60,7 +60,7 @@ limitations under the License.
 
 ### [Neo4j](https://neo4j.com/)
   - Neo4j is a Graph Database. It's a disk based, ACID compliant transactional storage engine for big graphs and fast graph traversals,
-    using external indicies like Lucene/Solr for global searches.
+    using external indices like Lucene/Solr for global searches.
   - We use ZooKeeper in the Neo4j High Availability components for write-master election,
     read slave coordination and other cool stuff. ZooKeeper is a great and focused project - we like! [1].
 
@@ -121,9 +121,9 @@ limitations under the License.
   - ZooKeeper maintains ephemeral cluster membership information. The Drillbits use ZooKeeper to find other Drillbits in the cluster,
     and the client uses ZooKeeper to find Drillbits to submit a query [28].
 
-### [Apache Druid(Incubating)](https://druid.apache.org/)
-  - Apache Druid (incubating) is a high performance real-time analytics database.
-  - Apache Druid (incubating) uses Apache ZooKeeper (ZK) for management of current cluster state. The operations that happen over ZK are [27]:
+### [Apache Druid](https://druid.apache.org/)
+  - Apache Druid is a high performance real-time analytics database.
+  - Apache Druid uses Apache ZooKeeper (ZK) for management of current cluster state. The operations that happen over ZK are [27]:
     - Coordinator leader election
     - Segment "publishing" protocol from Historical and Realtime
     - Segment load/drop protocol between Coordinator and Historical
diff --git a/zookeeper-it/README.txt b/zookeeper-it/README.txt
index 8a2985c2eda..2c4b1cc4865 100644
--- a/zookeeper-it/README.txt
+++ b/zookeeper-it/README.txt
@@ -7,11 +7,12 @@ The easiest way to do all of this is to use the zookeeper fat jar.
 
 Steps to run system test
 ------------------------
-1) transfer the fatjar from the release directory to all systems
-   participating in the test. fatjar is in contrib/fatjar directory.
+1) build and transfer the fatjar from the `zookeeper-contrib/zookeeper-contrib-fatjar/target`
+   directory to all systems participating in the test
 
-   (developers can generate by running "ant jar compile-test"
-   targets in trunk, then compiling using "ant jar" in src/contrib/jarjar)
+   Command to build fatjar without executing the tests:
+
+   `mvn clean install -P fatjar -DskipTests`
 
 2) run a zookeeper standalone instance (cluster is ok too)
 
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml b/zookeeper-it/pom.xml
old mode 100755
new mode 100644
similarity index 54%
rename from zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml
rename to zookeeper-it/pom.xml
index bf6e6730f7d..0346bd90d64
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/pom.xml
+++ b/zookeeper-it/pom.xml
@@ -22,72 +22,65 @@
   <modelVersion>4.0.0</modelVersion>
   <parent>
     <groupId>org.apache.zookeeper</groupId>
-    <artifactId>zookeeper-contrib</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
+    <artifactId>parent</artifactId>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
-  <artifactId>zookeeper-contrib-loggraph</artifactId>
+  <artifactId>zookeeper-it</artifactId>
   <packaging>jar</packaging>
-  <name>Apache ZooKeeper - Contrib - Loggraph</name>
+  <name>Apache ZooKeeper - Tests</name>
   <description>
-    LogGraph is an application for viewing and filtering zookeeper logs. It can handle transaction logs and message logs.
+    ZooKeeper system tests
   </description>
 
+  <!-- (temporarily) disable quality checks in this module for known failures to be fixed later -->
+  <properties>
+    <skipTests>true</skipTests>
+    <spotbugs.skip>true</spotbugs.skip>
+    <checkstyle.skip>true</checkstyle.skip>
+  </properties>
+
   <dependencies>
     <dependency>
       <groupId>org.apache.zookeeper</groupId>
-      <artifactId>zookeeper-jute</artifactId>
+      <artifactId>zookeeper</artifactId>
       <version>${project.version}</version>
     </dependency>
     <dependency>
       <groupId>org.apache.zookeeper</groupId>
       <artifactId>zookeeper</artifactId>
+      <classifier>tests</classifier>
+      <type>test-jar</type>
       <version>${project.version}</version>
     </dependency>
     <dependency>
-      <groupId>org.slf4j</groupId>
-      <artifactId>slf4j-api</artifactId>
+      <groupId>org.junit.vintage</groupId>
+      <artifactId>junit-vintage-engine</artifactId>
     </dependency>
     <dependency>
-      <groupId>org.slf4j</groupId>
-      <artifactId>slf4j-log4j12</artifactId>
-      <exclusions>
-        <exclusion>
-          <groupId>*</groupId>
-          <artifactId>*</artifactId>
-        </exclusion>
-      </exclusions>
+      <groupId>org.openjdk.jmh</groupId>
+      <artifactId>jmh-core</artifactId>
+      <version>1.23</version>
     </dependency>
     <dependency>
-      <groupId>log4j</groupId>
-      <artifactId>log4j</artifactId>
-      <exclusions>
-        <exclusion>
-          <groupId>*</groupId>
-          <artifactId>*</artifactId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.eclipse.jetty</groupId>
-      <artifactId>jetty-server</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>org.eclipse.jetty</groupId>
-      <artifactId>jetty-servlet</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>com.googlecode.json-simple</groupId>
-      <artifactId>json-simple</artifactId>
+      <groupId>org.openjdk.jmh</groupId>
+      <artifactId>jmh-generator-annprocess</artifactId>
+      <version>1.23</version>
     </dependency>
   </dependencies>
 
   <build>
-    <resources>
-      <resource>
-        <directory>${project.basedir}/src/main/resources/webapp</directory>
-      </resource>
-    </resources>
+    <pluginManagement>
+      <plugins>
+        <plugin>
+          <groupId>org.apache.maven.plugins</groupId>
+          <artifactId>maven-surefire-plugin</artifactId>
+          <configuration>
+            <testSourceDirectory>${project.basedir}/src/main/java/</testSourceDirectory>
+            <testClassesDirectory>${project.build.directory}/classes/</testClassesDirectory>
+          </configuration>
+        </plugin>
+      </plugins>
+    </pluginManagement>
   </build>
-
-</project>
\ No newline at end of file
+</project>
diff --git a/zookeeper-it/src/test/bench/org/apache/zookeeper/BenchMain.java b/zookeeper-it/src/main/java/org/apache/zookeeper/BenchMain.java
similarity index 100%
rename from zookeeper-it/src/test/bench/org/apache/zookeeper/BenchMain.java
rename to zookeeper-it/src/main/java/org/apache/zookeeper/BenchMain.java
diff --git a/zookeeper-it/src/test/bench/org/apache/zookeeper/server/watch/WatchBench.java b/zookeeper-it/src/main/java/org/apache/zookeeper/server/watch/WatchBench.java
similarity index 96%
rename from zookeeper-it/src/test/bench/org/apache/zookeeper/server/watch/WatchBench.java
rename to zookeeper-it/src/main/java/org/apache/zookeeper/server/watch/WatchBench.java
index 0510df76ca6..9dea3ca3486 100644
--- a/zookeeper-it/src/test/bench/org/apache/zookeeper/server/watch/WatchBench.java
+++ b/zookeeper-it/src/main/java/org/apache/zookeeper/server/watch/WatchBench.java
@@ -35,9 +35,9 @@ public class WatchBench {
     static final EventType event = EventType.NodeDataChanged;
 
     static IWatchManager createWatchManager(String className) throws Exception {
-        Class clazz = Class.forName(
+        Class<?> clazz = Class.forName(
                 "org.apache.zookeeper.server.watch." + className);
-        return (IWatchManager) clazz.newInstance();
+        return (IWatchManager) clazz.getConstructor().newInstance();
     }
 
     static void forceGC() {
@@ -191,7 +191,7 @@ void prepare() {
     @Measurement(iterations = 3, time = 10, timeUnit = TimeUnit.SECONDS)
     public void testTriggerConcentrateWatch(InvocationState state) throws Exception {
         for (String path : state.paths) {
-            state.watchManager.triggerWatch(path, event);
+            state.watchManager.triggerWatch(path, event, WatchedEvent.NO_ZXID, null);
         }
     }
 
@@ -225,7 +225,7 @@ public void tearDown() {
 
             // clear all the watches
             for (String path : paths) {
-                watchManager.triggerWatch(path, event);
+                watchManager.triggerWatch(path, event, WatchedEvent.NO_ZXID, null);
             }
         }
     }
@@ -294,7 +294,7 @@ public void prepare() {
     @Measurement(iterations = 3, time = 10, timeUnit = TimeUnit.SECONDS)
     public void testTriggerSparseWatch(TriggerSparseWatchState state) throws Exception {
         for (String path : state.paths) {
-            state.watchManager.triggerWatch(path, event);
+            state.watchManager.triggerWatch(path, event, WatchedEvent.NO_ZXID, null);
         }
     }
 }
diff --git a/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/BaseSysTest.java b/zookeeper-it/src/main/java/org/apache/zookeeper/test/system/BaseSysTest.java
similarity index 96%
rename from zookeeper-it/src/test/java/org/apache/zookeeper/test/system/BaseSysTest.java
rename to zookeeper-it/src/main/java/org/apache/zookeeper/test/system/BaseSysTest.java
index 8856282e6dc..6816f2d80cf 100644
--- a/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/BaseSysTest.java
+++ b/zookeeper-it/src/main/java/org/apache/zookeeper/test/system/BaseSysTest.java
@@ -20,6 +20,7 @@
 
 import java.io.File;
 import java.io.IOException;
+import java.lang.reflect.InvocationTargetException;
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
 import java.net.UnknownHostException;
@@ -223,15 +224,15 @@ private void distributedConfigureClients(int count, Class<? extends Instance> cl
 
     }
     private Instance fakeBaseClients[];
-    private void fakeConfigureClients(int count, Class<? extends Instance> clazz, String params) throws IOException, ClassNotFoundException {
+    private void fakeConfigureClients(int count, Class<? extends Instance> clazz, String params) {
         fakeBaseClients = new Instance[count];
         for(int i = 0; i < count; i++) {
             try {
-                fakeBaseClients[i] = clazz.newInstance();
-            } catch (InstantiationException e) {
-                e.printStackTrace();
-                return;
-            } catch (IllegalAccessException e) {
+                fakeBaseClients[i] = clazz.getConstructor().newInstance();
+            } catch (InstantiationException
+                    | IllegalAccessException
+                    | NoSuchMethodException
+                    | InvocationTargetException e) {
                 e.printStackTrace();
                 return;
             }
diff --git a/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/DuplicateNameException.java b/zookeeper-it/src/main/java/org/apache/zookeeper/test/system/DuplicateNameException.java
similarity index 100%
rename from zookeeper-it/src/test/java/org/apache/zookeeper/test/system/DuplicateNameException.java
rename to zookeeper-it/src/main/java/org/apache/zookeeper/test/system/DuplicateNameException.java
diff --git a/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/GenerateLoad.java b/zookeeper-it/src/main/java/org/apache/zookeeper/test/system/GenerateLoad.java
similarity index 93%
rename from zookeeper-it/src/test/java/org/apache/zookeeper/test/system/GenerateLoad.java
rename to zookeeper-it/src/main/java/org/apache/zookeeper/test/system/GenerateLoad.java
index afcffc81622..18e9ea0cd40 100644
--- a/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/GenerateLoad.java
+++ b/zookeeper-it/src/main/java/org/apache/zookeeper/test/system/GenerateLoad.java
@@ -86,7 +86,7 @@ public class GenerateLoad {
     synchronized static void add(long time, int count, Socket s) {
         long interval = time / INTERVAL;
         if (currentInterval == 0 || currentInterval > interval) {
-            System.out.println(
+            LOG.info(
                 "Dropping " + count + " for " + new Date(time)
                     + " " + currentInterval + ">" + interval);
             return;
@@ -117,14 +117,14 @@ static class SlaveThread extends Thread {
 
         public void run() {
             try {
-                System.out.println("Connected to " + s);
+                LOG.info("Connected to " + s);
                 BufferedReader is = new BufferedReader(new InputStreamReader(s
                         .getInputStream()));
                 String result;
                 while ((result = is.readLine()) != null) {
                     String timePercentCount[] = result.split(" ");
                     if (timePercentCount.length != 5) {
-                        System.err.println("Got " + result + " from " + s
+                        LOG.error("Got " + result + " from " + s
                                 + " exitng.");
                         throw new IOException(result);
                     }
@@ -133,7 +133,7 @@ public void run() {
                     int count = Integer.parseInt(timePercentCount[2]);
                     int errs = Integer.parseInt(timePercentCount[3]);
                     if (errs > 0) {
-                        System.out.println(s + " Got an error! " + errs);
+                        LOG.error(s + " Got an error! " + errs);
                     }
                     add(time, count, s);
                 }
@@ -154,7 +154,7 @@ void send(int percentage) {
 
         void close() {
             try {
-                System.err.println("Closing " + s);
+                LOG.info("Closing " + s);
                 slaves.remove(this);
                 s.close();
             } catch (IOException e) {
@@ -173,7 +173,7 @@ public void run() {
             try {
                 while (true) {
                     Socket s = ss.accept();
-                    System.err.println("Accepted connection from " + s);
+                    LOG.info("Accepted connection from " + s);
                     slaves.add(new SlaveThread(s));
                 }
             } catch (IOException e) {
@@ -234,7 +234,7 @@ public void run() {
                                 + percentage + "% " + count + " " + min + " "
                                 + ((double) total / (double) number) + " "
                                 + max;
-                        System.err.println(report);
+                        LOG.info(report);
                         if (sf != null) {
                             sf.println(report);
                         }
@@ -262,7 +262,7 @@ synchronized static void sendChange(int percentage) {
         now = Time.currentElapsedTime();
         long delay = now - start;
         if (delay > 1000) {
-            System.out.println("Delay of " + delay + " to send new percentage");
+            LOG.info("Delay of " + delay + " to send new percentage");
         }
         lastChange = now;
     }
@@ -344,7 +344,7 @@ public void run() {
                         }
                     }
                     if (path == null) {
-                        System.err.println("Couldn't create a node in /!");
+                        LOG.error("Couldn't create a node in /!");
                         return;
                     }
                     while (alive) {
@@ -370,7 +370,7 @@ public void run() {
             }
 
             public void process(WatchedEvent event) {
-                System.err.println(event);
+                LOG.info(event.toString());
                 synchronized (this) {
                     if (event.getType() == EventType.None) {
                         connected = (event.getState() == KeeperState.SyncConnected);
@@ -387,7 +387,7 @@ public void processResult(int rc, String path, Object ctx, byte[] data,
                         return;
                     }
                     if (rc != 0) {
-                        System.err.println("Got rc = " + rc);
+                        LOG.info("Got rc = " + rc);
                         errors++;
                     } else {
                         finished++;
@@ -401,7 +401,7 @@ public void processResult(int rc, String path, Object ctx, Stat stat) {
                 decOutstanding();
                 synchronized (statSync) {
                     if (rc != 0) {
-                        System.err.println("Got rc = " + rc);
+                        LOG.info("Got rc = " + rc);
                         errors++;
                     } else {
                         finished++;
@@ -446,7 +446,6 @@ public void run() {
                             wlatency = 0;
                         }
                         os.write(report.getBytes());
-                        //System.out.println("Reporting " + report + "+" + subreport);
                     }
                 } catch (Exception e) {
                     e.printStackTrace();
@@ -461,7 +460,7 @@ public void run() {
         Reporter r;
 
         public void configure(final String params) {
-            System.err.println("Got " + params);
+            LOG.info("Got " + params);
             new Thread() {
                 public void run() {
                     try {
@@ -471,8 +470,8 @@ public void run() {
                         if (parts.length == 3) {
                             try {
                                 bytesSize = Integer.parseInt(parts[2]);
-                            } catch(Exception e) {
-                                System.err.println("Not an integer: " + parts[2]);
+                            } catch (Exception e) {
+                                LOG.error("Not an integer: " + parts[2]);
                             }
                         }
                         bytes = new byte[bytesSize];
@@ -591,7 +590,7 @@ public static void main(String[] args) throws InterruptedException,
                 StatusWatcher statusWatcher = new StatusWatcher();
                 ZooKeeper zk = new ZooKeeper(args[0], 15000, statusWatcher);
                 if (!statusWatcher.waitConnected(5000)) {
-                    System.err.println("Could not connect to " + args[0]);
+                    LOG.error("Could not connect to " + args[0]);
                     return;
                 }
                 InstanceManager im = new InstanceManager(zk, args[1]);
@@ -627,7 +626,7 @@ public static void main(String[] args) throws InterruptedException,
                                     String mode = getMode(parts[i]);
                                     if (mode.equals("leader")) {
                                         zkHostPort = new StringBuilder(parts[i]);
-                                        System.out.println("Connecting exclusively to " + zkHostPort.toString());
+                                        LOG.info("Connecting exclusively to " + zkHostPort.toString());
                                         break outer;
                                     }
                                 } catch(IOException e) {
@@ -671,14 +670,13 @@ public static void main(String[] args) throws InterruptedException,
                                 && cmdNumber.length > 1) {
                             sf = new PrintStream(cmdNumber[1]);
                         } else {
-                            System.err.println("Commands must be:");
-                            System.err
-                                    .println("\tpercentage new_write_percentage");
-                            System.err.println("\tsleep seconds_to_sleep");
-                            System.err.println("\tsave file_to_save_output");
+                            LOG.error("Commands must be:");
+                            LOG.error("\tpercentage new_write_percentage");
+                            LOG.error("\tsleep seconds_to_sleep");
+                            LOG.error("\tsave file_to_save_output");
                         }
                     } catch (NumberFormatException e) {
-                        System.out.println("Not a valid number: "
+                        LOG.error("Not a valid number: "
                                 + e.getMessage());
                     }
                 }
diff --git a/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/Instance.java b/zookeeper-it/src/main/java/org/apache/zookeeper/test/system/Instance.java
similarity index 100%
rename from zookeeper-it/src/test/java/org/apache/zookeeper/test/system/Instance.java
rename to zookeeper-it/src/main/java/org/apache/zookeeper/test/system/Instance.java
diff --git a/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/InstanceContainer.java b/zookeeper-it/src/main/java/org/apache/zookeeper/test/system/InstanceContainer.java
similarity index 99%
rename from zookeeper-it/src/test/java/org/apache/zookeeper/test/system/InstanceContainer.java
rename to zookeeper-it/src/main/java/org/apache/zookeeper/test/system/InstanceContainer.java
index 1cb7bc02edb..44f6531b94f 100644
--- a/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/InstanceContainer.java
+++ b/zookeeper-it/src/main/java/org/apache/zookeeper/test/system/InstanceContainer.java
@@ -271,7 +271,7 @@ public void processResult(int rc, String path, Object ctx, List<String> children
                     }
                     try {
                         Class<?> c = Class.forName(clazz);
-                        i = (Instance)c.newInstance();
+                        i = (Instance) c.getConstructor().newInstance();
                         Reporter reporter = new MyReporter(child);
                         i.setReporter(reporter);
                         i.configure(conf);
diff --git a/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/InstanceManager.java b/zookeeper-it/src/main/java/org/apache/zookeeper/test/system/InstanceManager.java
similarity index 100%
rename from zookeeper-it/src/test/java/org/apache/zookeeper/test/system/InstanceManager.java
rename to zookeeper-it/src/main/java/org/apache/zookeeper/test/system/InstanceManager.java
diff --git a/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/NoAssignmentException.java b/zookeeper-it/src/main/java/org/apache/zookeeper/test/system/NoAssignmentException.java
similarity index 100%
rename from zookeeper-it/src/test/java/org/apache/zookeeper/test/system/NoAssignmentException.java
rename to zookeeper-it/src/main/java/org/apache/zookeeper/test/system/NoAssignmentException.java
diff --git a/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/NoAvailableContainers.java b/zookeeper-it/src/main/java/org/apache/zookeeper/test/system/NoAvailableContainers.java
similarity index 100%
rename from zookeeper-it/src/test/java/org/apache/zookeeper/test/system/NoAvailableContainers.java
rename to zookeeper-it/src/main/java/org/apache/zookeeper/test/system/NoAvailableContainers.java
diff --git a/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/QuorumPeerInstance.java b/zookeeper-it/src/main/java/org/apache/zookeeper/test/system/QuorumPeerInstance.java
similarity index 100%
rename from zookeeper-it/src/test/java/org/apache/zookeeper/test/system/QuorumPeerInstance.java
rename to zookeeper-it/src/main/java/org/apache/zookeeper/test/system/QuorumPeerInstance.java
diff --git a/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/SimpleClient.java b/zookeeper-it/src/main/java/org/apache/zookeeper/test/system/SimpleClient.java
similarity index 100%
rename from zookeeper-it/src/test/java/org/apache/zookeeper/test/system/SimpleClient.java
rename to zookeeper-it/src/main/java/org/apache/zookeeper/test/system/SimpleClient.java
diff --git a/zookeeper-it/src/test/java/org/apache/zookeeper/test/system/SimpleSysTest.java b/zookeeper-it/src/main/java/org/apache/zookeeper/test/system/SimpleSysTest.java
similarity index 100%
rename from zookeeper-it/src/test/java/org/apache/zookeeper/test/system/SimpleSysTest.java
rename to zookeeper-it/src/main/java/org/apache/zookeeper/test/system/SimpleSysTest.java
diff --git a/zookeeper-jute/pom.xml b/zookeeper-jute/pom.xml
old mode 100755
new mode 100644
index 13fe7c80681..2be9787d530
--- a/zookeeper-jute/pom.xml
+++ b/zookeeper-jute/pom.xml
@@ -23,8 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
-    <relativePath>..</relativePath>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-jute</artifactId>
@@ -38,8 +37,8 @@
       <artifactId>audience-annotations</artifactId>
     </dependency>
     <dependency>
-      <groupId>junit</groupId>
-      <artifactId>junit</artifactId>
+      <groupId>org.junit.jupiter</groupId>
+      <artifactId>junit-jupiter-engine</artifactId>
       <scope>test</scope>
     </dependency>
   </dependencies>
@@ -151,6 +150,38 @@
             <skip>true</skip>
         </configuration>
       </plugin>
+      <plugin>
+        <groupId>org.apache.felix</groupId>
+        <artifactId>maven-bundle-plugin</artifactId>
+        <executions>
+          <execution>
+            <id>build bundle</id>
+            <phase>package</phase>
+            <goals>
+              <goal>bundle</goal>
+            </goals>
+          </execution>
+        </executions>
+        <configuration>
+          <instructions>
+            <Import-Package>
+              *;resolution:=optional
+            </Import-Package>
+            <Export-Package>
+              org.apache.zookeeper.data,
+              org.apache.zookeeper.proto,
+              org.apache.zookeeper.txn,
+              !org.apache.zookeeper*,
+              org.apache.jute*
+            </Export-Package>
+            <Bundle-Name>ZooKeeper Jute Bundle</Bundle-Name>
+            <Bundle-DocURL>https://zookeeper.apache.org/doc/current/</Bundle-DocURL>
+            <Implementation-Build>${mvngit.commit.id}</Implementation-Build>
+            <Merge-Headers>!Implementation-Build,*</Merge-Headers>
+          </instructions>
+          <classifier>osgi</classifier>
+        </configuration>
+      </plugin>
     </plugins>
   </build>
 
diff --git a/zookeeper-jute/src/main/java/org/apache/jute/BinaryInputArchive.java b/zookeeper-jute/src/main/java/org/apache/jute/BinaryInputArchive.java
index c4d1bbebf9d..277faf489bd 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/BinaryInputArchive.java
+++ b/zookeeper-jute/src/main/java/org/apache/jute/BinaryInputArchive.java
@@ -47,27 +47,26 @@ public class BinaryInputArchive implements InputArchive {
         }
     }
 
-    private DataInput in;
-    private int maxBufferSize;
-    private int extraMaxBufferSize;
+    private final DataInput in;
+    private final int totalBufferSize;
 
-    public static BinaryInputArchive getArchive(InputStream strm) {
-        return new BinaryInputArchive(new DataInputStream(strm));
+    public static BinaryInputArchive getArchive(InputStream stream) {
+        return new BinaryInputArchive(new DataInputStream(stream));
     }
 
     private static class BinaryIndex implements Index {
-        private int nelems;
+        private int n;
 
         BinaryIndex(int nelems) {
-            this.nelems = nelems;
+            this.n = nelems;
         }
 
         public boolean done() {
-            return (nelems <= 0);
+            return (n <= 0);
         }
 
         public void incr() {
-            nelems--;
+            n--;
         }
     }
 
@@ -80,8 +79,11 @@ public BinaryInputArchive(DataInput in) {
 
     public BinaryInputArchive(DataInput in, int maxBufferSize, int extraMaxBufferSize) {
         this.in = in;
-        this.maxBufferSize = maxBufferSize;
-        this.extraMaxBufferSize = extraMaxBufferSize;
+        if ((long) maxBufferSize + extraMaxBufferSize > Integer.MAX_VALUE) {
+            this.totalBufferSize = Integer.MAX_VALUE;
+        } else {
+            this.totalBufferSize = maxBufferSize + extraMaxBufferSize;
+        }
     }
 
     public byte readByte(String tag) throws IOException {
@@ -162,7 +164,7 @@ public void endMap(String tag) throws IOException {
     // make up for extra fields, etc. (otherwise e.g. clients may be able to
     // write buffers larger than we can read from disk!)
     private void checkLength(int len) throws IOException {
-        if (len < 0 || len > maxBufferSize + extraMaxBufferSize) {
+        if (len < 0 || len > totalBufferSize) {
             throw new IOException(UNREASONBLE_LENGTH + len);
         }
     }
diff --git a/zookeeper-jute/src/main/java/org/apache/jute/BinaryOutputArchive.java b/zookeeper-jute/src/main/java/org/apache/jute/BinaryOutputArchive.java
index 4752d8461ab..52db1bc3c45 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/BinaryOutputArchive.java
+++ b/zookeeper-jute/src/main/java/org/apache/jute/BinaryOutputArchive.java
@@ -34,6 +34,8 @@ public class BinaryOutputArchive implements OutputArchive {
 
     private DataOutput out;
 
+    private long dataSize;
+
     public static BinaryOutputArchive getArchive(OutputStream strm) {
         return new BinaryOutputArchive(new DataOutputStream(strm));
     }
@@ -47,26 +49,32 @@ public BinaryOutputArchive(DataOutput out) {
 
     public void writeByte(byte b, String tag) throws IOException {
         out.writeByte(b);
+        dataSize += 1;
     }
 
     public void writeBool(boolean b, String tag) throws IOException {
         out.writeBoolean(b);
+        dataSize += 1;
     }
 
     public void writeInt(int i, String tag) throws IOException {
         out.writeInt(i);
+        dataSize += 4;
     }
 
     public void writeLong(long l, String tag) throws IOException {
         out.writeLong(l);
+        dataSize += 8;
     }
 
     public void writeFloat(float f, String tag) throws IOException {
         out.writeFloat(f);
+        dataSize += 4;
     }
 
     public void writeDouble(double d, String tag) throws IOException {
         out.writeDouble(d);
+        dataSize += 8;
     }
 
     /**
@@ -108,18 +116,22 @@ public void writeString(String s, String tag) throws IOException {
             return;
         }
         ByteBuffer bb = stringToByteBuffer(s);
-        writeInt(bb.remaining(), "len");
+        int strLen = bb.remaining();
+        writeInt(strLen, "len");
         out.write(bb.array(), bb.position(), bb.limit());
+        dataSize += strLen;
     }
 
     public void writeBuffer(byte[] barr, String tag)
             throws IOException {
         if (barr == null) {
-            out.writeInt(-1);
+            writeInt(-1, "len");
             return;
         }
-        out.writeInt(barr.length);
+        int len = barr.length;
+        writeInt(len, "len");
         out.write(barr);
+        dataSize += len;
     }
 
     public void writeRecord(Record r, String tag) throws IOException {
@@ -150,4 +162,9 @@ public void startMap(TreeMap<?, ?> v, String tag) throws IOException {
     public void endMap(TreeMap<?, ?> v, String tag) throws IOException {
     }
 
+    @Override
+    public long getDataSize() {
+        return dataSize;
+    }
+
 }
diff --git a/zookeeper-jute/src/main/java/org/apache/jute/OutputArchive.java b/zookeeper-jute/src/main/java/org/apache/jute/OutputArchive.java
index b076ca18b2e..6a37d67cdfc 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/OutputArchive.java
+++ b/zookeeper-jute/src/main/java/org/apache/jute/OutputArchive.java
@@ -59,4 +59,6 @@ void writeBuffer(byte[] buf, String tag)
 
     void endMap(TreeMap<?, ?> v, String tag) throws IOException;
 
+    long getDataSize();
+
 }
diff --git a/zookeeper-jute/src/main/java/org/apache/jute/RecordReader.java b/zookeeper-jute/src/main/java/org/apache/jute/RecordReader.java
deleted file mode 100644
index 2c91d2e0a5b..00000000000
--- a/zookeeper-jute/src/main/java/org/apache/jute/RecordReader.java
+++ /dev/null
@@ -1,83 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.apache.jute;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.lang.reflect.InvocationTargetException;
-import java.lang.reflect.Method;
-import java.util.HashMap;
-
-/**
- * Front-end interface to deserializers. Also acts as a factory
- * for deserializers.
- */
-public class RecordReader {
-
-    private static  HashMap<String, Method> archiveFactory;
-
-    private InputArchive archive;
-
-    static {
-        archiveFactory = new HashMap<>();
-
-        try {
-            archiveFactory.put(
-                    "binary",
-                    BinaryInputArchive.class.getDeclaredMethod("getArchive", InputStream.class));
-        } catch (SecurityException | NoSuchMethodException ex) {
-            ex.printStackTrace();
-        }
-    }
-
-    private static InputArchive createArchive(InputStream in, String format) {
-        Method factory = archiveFactory.get(format);
-
-        if (factory != null) {
-            Object[] params = {in};
-            try {
-                return (InputArchive) factory.invoke(null, params);
-            } catch (IllegalArgumentException | InvocationTargetException | IllegalAccessException ex) {
-                ex.printStackTrace();
-            }
-        }
-
-        return null;
-    }
-
-    /**
-     * Creates a new instance of RecordReader.
-     *
-     * @param in     Stream from which to deserialize a record
-     * @param format Deserialization format ("binary", "xml", or "csv")
-     */
-    public RecordReader(InputStream in, String format) {
-        archive = createArchive(in, format);
-    }
-
-    /**
-     * Deserialize a record.
-     *
-     * @param r Record to be deserialized
-     */
-    public void read(Record r) throws IOException {
-        r.deserialize(archive, "");
-    }
-
-}
diff --git a/zookeeper-jute/src/main/java/org/apache/jute/RecordWriter.java b/zookeeper-jute/src/main/java/org/apache/jute/RecordWriter.java
deleted file mode 100644
index 259a683e0a9..00000000000
--- a/zookeeper-jute/src/main/java/org/apache/jute/RecordWriter.java
+++ /dev/null
@@ -1,81 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.apache.jute;
-
-import java.io.IOException;
-import java.io.OutputStream;
-import java.lang.reflect.InvocationTargetException;
-import java.lang.reflect.Method;
-import java.util.HashMap;
-
-/**
- * Front-end for serializers. Also serves as a factory for serializers.
- */
-public class RecordWriter {
-
-    private OutputArchive archive;
-
-    static HashMap<String, Method> constructFactory() {
-        HashMap<String, Method> factory = new HashMap<String, Method>();
-
-        try {
-            factory.put(
-                    "binary",
-                    BinaryOutputArchive.class.getDeclaredMethod("getArchive", OutputStream.class));
-        } catch (SecurityException | NoSuchMethodException ex) {
-            ex.printStackTrace();
-        }
-
-        return factory;
-    }
-
-    private static HashMap<String, Method> archiveFactory = constructFactory();
-
-    private static OutputArchive createArchive(OutputStream out, String format) {
-        Method factory = archiveFactory.get(format);
-        if (factory != null) {
-            Object[] params = {out};
-            try {
-                return (OutputArchive) factory.invoke(null, params);
-            } catch (IllegalArgumentException | InvocationTargetException | IllegalAccessException ex) {
-                ex.printStackTrace();
-            }
-        }
-        return null;
-    }
-
-    /**
-     * Creates a new instance of RecordWriter.
-     *
-     * @param out    Output stream where the records will be serialized
-     * @param format Serialization format ("binary", "xml", or "csv")
-     */
-    public RecordWriter(OutputStream out, String format) {
-        archive = createArchive(out, format);
-    }
-
-    /**
-     * Serialize a record.
-     *
-     * @param r record to be serialized
-     */
-    public void write(Record r) throws IOException {
-        r.serialize(archive, "");
-    }
-}
diff --git a/zookeeper-jute/src/main/java/org/apache/jute/ToStringOutputArchive.java b/zookeeper-jute/src/main/java/org/apache/jute/ToStringOutputArchive.java
index a144011d8df..91139727bd9 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/ToStringOutputArchive.java
+++ b/zookeeper-jute/src/main/java/org/apache/jute/ToStringOutputArchive.java
@@ -32,6 +32,7 @@ public class ToStringOutputArchive implements OutputArchive {
 
     private PrintStream stream;
     private boolean isFirst = true;
+    private long dataSize;
 
     private void throwExceptionOnError(String tag) throws IOException {
         if (stream.checkError()) {
@@ -42,6 +43,7 @@ private void throwExceptionOnError(String tag) throws IOException {
     private void printCommaUnlessFirst() {
         if (!isFirst) {
             stream.print(",");
+            dataSize += 1;
         }
         isFirst = false;
     }
@@ -61,6 +63,7 @@ public void writeBool(boolean b, String tag) throws IOException {
         printCommaUnlessFirst();
         String val = b ? "T" : "F";
         stream.print(val);
+        dataSize += 1;
         throwExceptionOnError(tag);
     }
 
@@ -70,7 +73,9 @@ public void writeInt(int i, String tag) throws IOException {
 
     public void writeLong(long l, String tag) throws IOException {
         printCommaUnlessFirst();
-        stream.print(l);
+        String strValue = String.valueOf(l);
+        stream.print(strValue);
+        dataSize += strValue.length();
         throwExceptionOnError(tag);
     }
 
@@ -80,20 +85,26 @@ public void writeFloat(float f, String tag) throws IOException {
 
     public void writeDouble(double d, String tag) throws IOException {
         printCommaUnlessFirst();
-        stream.print(d);
+        String strValue = String.valueOf(d);
+        stream.print(strValue);
+        dataSize += strValue.length();
         throwExceptionOnError(tag);
     }
 
     public void writeString(String s, String tag) throws IOException {
         printCommaUnlessFirst();
-        stream.print(escapeString(s));
+        String strValue = escapeString(s);
+        stream.print(strValue);
+        dataSize += strValue.length();
         throwExceptionOnError(tag);
     }
 
     public void writeBuffer(byte[] buf, String tag)
             throws IOException {
         printCommaUnlessFirst();
-        stream.print(escapeBuffer(buf));
+        String strValue = escapeBuffer(buf);
+        stream.print(strValue);
+        dataSize += strValue.length();
         throwExceptionOnError(tag);
     }
 
@@ -108,6 +119,7 @@ public void startRecord(Record r, String tag) throws IOException {
         if (tag != null && !"".equals(tag)) {
             printCommaUnlessFirst();
             stream.print("s{");
+            dataSize += 2;
             isFirst = true;
         }
     }
@@ -115,9 +127,11 @@ public void startRecord(Record r, String tag) throws IOException {
     public void endRecord(Record r, String tag) throws IOException {
         if (tag == null || "".equals(tag)) {
             stream.print("\n");
+            dataSize += 1;
             isFirst = true;
         } else {
             stream.print("}");
+            dataSize += 1;
             isFirst = false;
         }
     }
@@ -125,25 +139,34 @@ public void endRecord(Record r, String tag) throws IOException {
     public void startVector(List<?> v, String tag) throws IOException {
         printCommaUnlessFirst();
         stream.print("v{");
+        dataSize += 2;
         isFirst = true;
     }
 
     public void endVector(List<?> v, String tag) throws IOException {
         stream.print("}");
+        dataSize += 1;
         isFirst = false;
     }
 
     public void startMap(TreeMap<?, ?> v, String tag) throws IOException {
         printCommaUnlessFirst();
         stream.print("m{");
+        dataSize += 2;
         isFirst = true;
     }
 
     public void endMap(TreeMap<?, ?> v, String tag) throws IOException {
         stream.print("}");
+        dataSize += 1;
         isFirst = false;
     }
 
+    @Override
+    public long getDataSize() {
+        return dataSize;
+    }
+
     private static String escapeString(String s) {
         if (s == null) {
             return "";
diff --git a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JBoolean.java b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JBoolean.java
index 2d10ec4a611..508501f9abc 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JBoolean.java
+++ b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JBoolean.java
@@ -39,7 +39,7 @@ public String genJavaCompareTo(String fname) {
     }
 
     public String genJavaHashCode(String fname) {
-        return "     ret = (" + fname + ")?0:1;\n";
+        return "     ret = java.lang.Boolean.hashCode(" + fname + ");\n";
     }
 
     String genCsharpHashCode(String fname) {
diff --git a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JDouble.java b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JDouble.java
index 4e22ff3d368..b84270bfc8e 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JDouble.java
+++ b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JDouble.java
@@ -35,8 +35,7 @@ public String getSignature() {
     }
 
     public String genJavaHashCode(String fname) {
-        String tmp = "Double.doubleToLongBits(" + fname + ")";
-        return "    ret = (int)(" + tmp + "^(" + tmp + ">>>32));\n";
+        return "    ret = java.lang.Double.hashCode(" + fname + ");\n";
     }
 
 }
diff --git a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JField.java b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JField.java
index 395c0b6a966..0d8f35bd0e5 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JField.java
+++ b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JField.java
@@ -18,6 +18,9 @@
 
 package org.apache.jute.compiler;
 
+import org.apache.jute.compiler.generated.RccConstants;
+import org.apache.jute.compiler.generated.Token;
+
 /**
  *
  */
@@ -25,6 +28,21 @@ public class JField {
     private JType mType;
     private String mName;
 
+    /**
+     * {@link #mType} of token.
+     */
+    private Token mTypeToken;
+
+    private Token previousToken;
+
+    /**
+     * Since we can only get the comments before the token through the {@link Token#specialToken},
+     * we need to save the next token to get the end-of-line comment.
+     *
+     * <p>It may be the type of the next field, or it may be {@link RccConstants#RBRACE_TKN} of the class.
+     */
+    private Token nextToken;
+
     /**
      * Creates a new instance of JField.
      */
@@ -33,6 +51,30 @@ public JField(JType type, String name) {
         mName = name;
     }
 
+    public Token getTypeToken() {
+        return mTypeToken;
+    }
+
+    public void setTypeToken(Token typeToken) {
+        this.mTypeToken = typeToken;
+    }
+
+    public Token getNextToken() {
+        return nextToken;
+    }
+
+    public void setNextToken(Token nextToken) {
+        this.nextToken = nextToken;
+    }
+
+    public Token getPreviousToken() {
+        return previousToken;
+    }
+
+    public void setPreviousToken(Token previousToken) {
+        this.previousToken = previousToken;
+    }
+
     public String getSignature() {
         return mType.getSignature();
     }
diff --git a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JFile.java b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JFile.java
index 1d5ed4144fc..d5fb051dd3e 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JFile.java
+++ b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JFile.java
@@ -81,7 +81,7 @@ public void genCode(String language, File outputDirectory)
                     outputDirectory);
             gen.genCode();
         } else {
-            throw new IOException("Cannnot recognize language:" + language);
+            throw new IOException("Cannot recognize language:" + language);
         }
     }
 }
diff --git a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JFloat.java b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JFloat.java
index c4452f1fcc9..a90f1431d08 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JFloat.java
+++ b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JFloat.java
@@ -35,7 +35,7 @@ public String getSignature() {
     }
 
     public String genJavaHashCode(String fname) {
-        return "    ret = Float.floatToIntBits(" + fname + ");\n";
+        return "    ret = java.lang.Float.hashCode(" + fname + ");\n";
     }
 
 }
diff --git a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JLong.java b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JLong.java
index 45637892fb7..89c0684b6ad 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JLong.java
+++ b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JLong.java
@@ -35,6 +35,6 @@ public String getSignature() {
     }
 
     public String genJavaHashCode(String fname) {
-        return "    ret = (int) (" + fname + "^(" + fname + ">>>32));\n";
+        return "    ret = java.lang.Long.hashCode(" + fname + ");\n";
     }
 }
diff --git a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JRecord.java b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JRecord.java
index f53399add02..1fb90d55a01 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/compiler/JRecord.java
+++ b/zookeeper-jute/src/main/java/org/apache/jute/compiler/JRecord.java
@@ -22,10 +22,13 @@
 import java.io.FileWriter;
 import java.io.IOException;
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.HashMap;
 import java.util.Iterator;
 import java.util.List;
 import java.util.Map;
+import org.apache.jute.compiler.generated.RccConstants;
+import org.apache.jute.compiler.generated.Token;
 
 /**
  *
@@ -36,11 +39,12 @@ public class JRecord extends JCompType {
     private String mName;
     private String mModule;
     private List<JField> mFields;
+    private Token mRecordToken;
 
     /**
      * Creates a new instance of JRecord.
      */
-    public JRecord(String name, ArrayList<JField> flist) {
+    public JRecord(String name, ArrayList<JField> flist, Token recordToken) {
         super("struct " + name.substring(name.lastIndexOf('.') + 1),
                 name.replaceAll("\\.", "::"), getCsharpFQName(name), name, "Record", name, getCsharpFQName("IRecord"));
         mFQName = name;
@@ -48,12 +52,17 @@ public JRecord(String name, ArrayList<JField> flist) {
         mName = name.substring(idx + 1);
         mModule = name.substring(0, idx);
         mFields = flist;
+        mRecordToken = recordToken;
     }
 
     public String getName() {
         return mName;
     }
 
+    public Token getRecordToken() {
+        return mRecordToken;
+    }
+
     public String getCsharpName() {
         return "Id".equals(mName) ? "ZKId" : mName;
     }
@@ -143,7 +152,7 @@ public String genCsharpWriteWrapper(String fname, String tag) {
         return "    a_.WriteRecord(" + fname + ",\"" + tag + "\");\n";
     }
 
-    static Map<String, String> vectorStructs = new HashMap<String, String>();
+    static Map<String, String> vectorStructs = new HashMap<>();
 
     public void genCCode(FileWriter h, FileWriter c) throws IOException {
         for (JField f : mFields) {
@@ -208,8 +217,17 @@ public void genCCode(FileWriter h, FileWriter c) throws IOException {
             }
         }
         String recName = getName();
+
+        String recordComments = getRecordComments();
+        if (recordComments != null && !recordComments.isEmpty()) {
+            h.write(recordComments);
+        }
         h.write("struct " + recName + " {\n");
         for (JField f : mFields) {
+            String fieldComments = getCFieldComments(f);
+            if (fieldComments != null && !fieldComments.isEmpty()) {
+                h.write(fieldComments);
+            }
             h.write(f.genCDecl());
         }
         h.write("};\n");
@@ -407,7 +425,7 @@ public void genJavaCode(File outputDirectory) throws IOException {
         if (!pkgdir.exists()) {
             // create the pkg directory
             if (!pkgdir.mkdirs()) {
-                throw new IOException("Cannnot create directory: " + pkgpath);
+                throw new IOException("Cannot create directory: " + pkgpath);
             }
         } else if (!pkgdir.isDirectory()) {
             throw new IOException(pkgpath + " is not a directory.");
@@ -434,11 +452,20 @@ public void genJavaCode(File outputDirectory) throws IOException {
             jj.write("\n");
             jj.write("package " + getJavaPackage() + ";\n\n");
             jj.write("import org.apache.jute.*;\n");
+            jj.write("import org.apache.jute.Record; // JDK14 needs explicit import due to clash with java.lang.Record\n");
             jj.write("import org.apache.yetus.audience.InterfaceAudience;\n");
+            String recordComments = getRecordComments();
+            if (recordComments != null && !recordComments.isEmpty()) {
+                jj.write(recordComments);
+            }
             jj.write("@InterfaceAudience.Public\n");
             jj.write("public class " + getName() + " implements Record {\n");
             for (Iterator<JField> i = mFields.iterator(); i.hasNext(); ) {
                 JField jf = i.next();
+                String fieldComments = getJavaFieldComments(jf);
+                if (fieldComments != null && !fieldComments.isEmpty()) {
+                    jj.write(fieldComments);
+                }
                 jj.write(jf.genJavaDecl());
             }
             jj.write("  public " + getName() + "() {\n");
@@ -464,6 +491,16 @@ public void genJavaCode(File outputDirectory) throws IOException {
                 JField jf = i.next();
                 jj.write(jf.genJavaGetSet(fIdx));
             }
+
+            jj.write("\n");
+            jj.write("  public void copyFrom(" + getName() + " from) {\n");
+            fIdx = 0;
+            for (Iterator<JField> i = mFields.iterator(); i.hasNext(); fIdx++) {
+                JField jf = i.next();
+                jj.write("    " + jf.getName() + " = from." + jf.getName() + ";\n");
+            }
+            jj.write("  }\n");
+
             jj.write("  public void serialize(OutputArchive a_, String tag) throws java.io.IOException {\n");
             jj.write("    a_.startRecord(this,tag);\n");
             fIdx = 0;
@@ -497,7 +534,7 @@ public void genJavaCode(File outputDirectory) throws IOException {
                 jj.write(jf.genJavaWriteMethodName());
             }
             jj.write("      a_.endRecord(this,\"\");\n");
-            jj.write("      return new String(s.toByteArray(), \"UTF-8\");\n");
+            jj.write("      return new String(s.toByteArray(), java.nio.charset.StandardCharsets.UTF_8);\n");
             jj.write("    } catch (Throwable ex) {\n");
             jj.write("      ex.printStackTrace();\n");
             jj.write("    }\n");
@@ -579,7 +616,7 @@ public void genCsharpCode(File outputDirectory) throws IOException {
         if (!outputDirectory.exists()) {
             // create the pkg directory
             if (!outputDirectory.mkdirs()) {
-                throw new IOException("Cannnot create directory: " + outputDirectory);
+                throw new IOException("Cannot create directory: " + outputDirectory);
             }
         } else if (!outputDirectory.isDirectory()) {
             throw new IOException(outputDirectory + " is not a directory.");
@@ -766,4 +803,122 @@ public static String getCsharpFQName(String name) {
         }
         return fQName.toString();
     }
+
+    public String getJavaFieldComments(JField jField) {
+        return getFieldComments(jField, "  ");
+    }
+
+    public String getCFieldComments(JField jField) {
+        return getFieldComments(jField, "    ");
+    }
+
+    private String getFieldComments(JField jField, String indent) {
+        if (jField == null || jField.getTypeToken() == null || jField.getNextToken() == null) {
+            return "";
+        }
+
+        // get the comment before the line
+        Token beforeTheLineCommentToken = getCommentToken(jField.getTypeToken(), jField.getPreviousToken());
+        List<String> comments = extractComments(beforeTheLineCommentToken, Integer.MAX_VALUE);
+
+        Token endOfLineCommentToken = getCommentToken(jField.getNextToken(), null);
+        if (endOfLineCommentToken != null && jField.getTypeToken().beginLine == endOfLineCommentToken.beginLine) {
+
+            comments.addAll(extractComments(endOfLineCommentToken, endOfLineCommentToken.beginLine));
+        }
+
+        return formatComments(indent, comments);
+    }
+
+    private Token getCommentToken(Token token, Token previousToken) {
+        if (token == null || token.specialToken == null) {
+            return null;
+        }
+
+        Token commentToken = token.specialToken;
+        while (commentToken.specialToken != null) {
+            commentToken = commentToken.specialToken;
+        }
+        // Skip end of line comment belong to previous token.
+        while (previousToken != null && commentToken != null && commentToken.beginLine == previousToken.endLine) {
+            commentToken = commentToken.next;
+        }
+        return commentToken;
+    }
+
+    public String getRecordComments() {
+        if (getRecordToken() == null || getRecordToken().specialToken == null) {
+            return "";
+        }
+
+        // get the comments before the class
+        Token commentToken = getCommentToken(getRecordToken(), null);
+        return formatComments("", extractComments(commentToken, Integer.MAX_VALUE));
+    }
+
+    private static String formatComments(String indent, List<String> commentLines) {
+        if (commentLines == null || commentLines.isEmpty()) {
+            return "";
+        }
+
+        StringBuilder builder = new StringBuilder();
+        for (String line : commentLines) {
+            if (!line.isEmpty()) {
+                builder.append(indent).append(line);
+            }
+            builder.append(System.lineSeparator());
+        }
+
+        return builder.toString();
+    }
+
+    /**
+     * Extracts comments with indentation and line separator trimmed.
+     *
+     * <p>Empty line is represented as empty string.
+     */
+    private static List<String> extractComments(Token token, int endLine) {
+        List<String> comments = new ArrayList<>();
+
+        if (token == null) {
+            return comments;
+        }
+
+        int nextLine = token.beginLine;
+        while (token != null && token.beginLine <= endLine) {
+            while (nextLine < token.beginLine) {
+                comments.add("");
+                nextLine++;
+            }
+            nextLine = token.endLine + 1;
+            switch (token.kind) {
+                case RccConstants.ONE_LINE_COMMENT:
+                    comments.add(token.image);
+                    break;
+                case RccConstants.MULTI_LINE_COMMENT: {
+                    List<String> lines = Arrays.asList(token.image.split("\r|\n|\r\n"));
+                    // First line captures no indentation.
+                    comments.add(lines.get(0));
+                    int indentSpaces = token.beginColumn - 1;
+                    for (int i = 1; i < lines.size(); i++) {
+                        String line = lines.get(i);
+                        int j = 0;
+                        while (j < indentSpaces && j < line.length()) {
+                            if (line.charAt(j) != ' ') {
+                                break;
+                            }
+                            j++;
+                        }
+                        comments.add(line.substring(j));
+                    }
+                }
+                break;
+                default:
+                    throw new IllegalStateException("expect comment token, but get token kind " + token.kind);
+            }
+            token = token.next;
+        }
+
+        return comments;
+    }
 }
diff --git a/zookeeper-jute/src/main/java/org/apache/jute/compiler/generated/rcc.jj b/zookeeper-jute/src/main/java/org/apache/jute/compiler/generated/rcc.jj
index 94d4f42f6b3..f97ebc3c6c4 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/compiler/generated/rcc.jj
+++ b/zookeeper-jute/src/main/java/org/apache/jute/compiler/generated/rcc.jj
@@ -111,32 +111,8 @@ SKIP :
 
 SPECIAL_TOKEN :
 {
-  "//" : WithinOneLineComment
-}
-
-<WithinOneLineComment> SPECIAL_TOKEN :
-{
-  <("\n" | "\r" | "\r\n" )> : DEFAULT
-}
-
-<WithinOneLineComment> MORE :
-{
-  <~[]>
-}
-
-SPECIAL_TOKEN :
-{
-  "/*" : WithinMultiLineComment
-}
-
-<WithinMultiLineComment> SPECIAL_TOKEN :
-{
-  "*/" : DEFAULT
-}
-
-<WithinMultiLineComment> MORE :
-{
-  <~[]>
+    <ONE_LINE_COMMENT: "//" (~["\n","\r"])*>
+|   <MULTI_LINE_COMMENT: "/*" (~["*"])* "*" (~["*","/"] (~["*"])* "*" | "*")* "/">
 }
 
 TOKEN :
@@ -274,21 +250,32 @@ JRecord Record() :
     ArrayList<JField> flist = new ArrayList<JField>();
     Token t;
     JField f;
+    // Get the comments on the class token
+    Token recordTkn;
+    Token typeTkn;
+    Token previousToken = null;
 }
 {
-    <RECORD_TKN>
+    recordTkn = <RECORD_TKN>
     t = <IDENT_TKN>
     { rname = t.image; }
-    <LBRACE_TKN>
+    previousToken = <LBRACE_TKN>
     (
+        {typeTkn = getToken(1);}
         f = Field()
         { flist.add(f); }
         <SEMICOLON_TKN>
+        {
+            f.setTypeToken(typeTkn);
+            f.setPreviousToken(previousToken);
+            f.setNextToken(getToken(1));
+            previousToken = typeTkn;
+        }
     )+
     <RBRACE_TKN>
     {
         String fqn = curModuleName + "." + rname;
-        JRecord r = new JRecord(fqn, flist);
+        JRecord r = new JRecord(fqn, flist, recordTkn);
         recTab.put(fqn, r);
         return r;
     }
diff --git a/zookeeper-jute/src/main/java/org/apache/jute/compiler/package.html b/zookeeper-jute/src/main/java/org/apache/jute/compiler/package.html
index 03bdb1bbb01..7eb07105851 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/compiler/package.html
+++ b/zookeeper-jute/src/main/java/org/apache/jute/compiler/package.html
@@ -24,7 +24,7 @@
   This package contains classes needed for code generation
   from the hadoop record compiler. CppGenerator and JavaGenerator
   are the main entry points from the parser. There are classes
-  corrsponding to every primitive type and compound type
+  corresponding to every primitive type and compound type
   included in Hadoop record I/O syntax.
   </body>
 </html>
diff --git a/zookeeper-jute/src/main/java/org/apache/jute/package.html b/zookeeper-jute/src/main/java/org/apache/jute/package.html
index 64a030a6d7d..b00d97b18e5 100644
--- a/zookeeper-jute/src/main/java/org/apache/jute/package.html
+++ b/zookeeper-jute/src/main/java/org/apache/jute/package.html
@@ -16,7 +16,7 @@
    limitations under the License.
 -->
 
-<html>
+<html lang="en">
   <head>
     <title>Hadoop Record I/O</title>
   </head>
@@ -29,7 +29,7 @@ <h2>Introduction</h2>
   
   Software systems of any significant complexity require mechanisms for data 
 interchange with the outside world. These interchanges typically involve the
-marshaling and unmarshaling of logical units of data to and from data streams
+marshaling and unmarshalling of logical units of data to and from data streams
 (files, network connections, memory buffers etc.). Applications usually have
 some code for serializing and deserializing the data types that they manipulate
 embedded in them. The work of serialization has several features that make
@@ -49,7 +49,7 @@ <h2>Introduction</h2>
 <ul> 
 <li> enabling the specification of simple serializable data types (records) 
 <li> enabling the generation of code in multiple target languages for
-marshaling and unmarshaling such types
+marshaling and unmarshalling such types
 <li> providing target language specific support that will enable application 
 programmers to incorporate generated code into their applications
 </ul>
@@ -197,8 +197,8 @@ <h3>Hadoop DDL Syntax</h3>
 ptype := ("byte" / "boolean" / "int" |
           "long" / "float" / "double"
           "ustring" / "buffer")
-ctype := (("vector" "<" type ">") /
-          ("map" "<" type "," type ">" ) ) / name)
+ctype := (("vector" "&lt;" type "&gt;") /
+          ("map" "&lt;" type "," type "&gt;" ) ) / name)
 </code></pre>
 
 A DDL file describes one or more record types. It begins with zero or
@@ -248,7 +248,7 @@ <h3>Examples</h3>
 module outlinks {
     class OutLinks {
         ustring baseURL;
-        vector<links.Link> outLinks;
+        vector&lt;links.Link&gt; outLinks;
     };
 }
 </code></pre>
@@ -262,7 +262,7 @@ <h2>Code Generation</h2>
 optional language argument (the default is Java) --language or
 -l. Thus a typical invocation would look like:
 <pre><code>
-$ rcc -l C++ <filename> ...
+$ rcc -l C++ &lt;filename&gt; ...
 </code></pre>
 
 
@@ -299,7 +299,7 @@ <h3>C++</h3>
 
   class IOError : public runtime_error {
   public:
-    explicit IOError(const std::string& msg);
+    explicit IOError(const std::string&amp; msg);
   };
 
   class IArchive;
@@ -307,18 +307,18 @@ <h3>C++</h3>
 
   class RecordReader {
   public:
-    RecordReader(InStream& in, RecFormat fmt);
+    RecordReader(InStream&amp; in, RecFormat fmt);
     virtual ~RecordReader(void);
 
-    virtual void read(Record& rec);
+    virtual void read(Record&amp; rec);
   };
 
   class RecordWriter {
   public:
-    RecordWriter(OutStream& out, RecFormat fmt);
+    RecordWriter(OutStream&amp; out, RecFormat fmt);
     virtual ~RecordWriter(void);
 
-    virtual void write(Record& rec);
+    virtual void write(Record&amp; rec);
   };
 
 
@@ -330,10 +330,10 @@ <h3>C++</h3>
     virtual bool validate(void) const = 0;
 
     virtual void
-    serialize(OArchive& oa, const std::string& tag) const = 0;
+    serialize(OArchive&amp; oa, const std::string&amp; tag) const = 0;
 
     virtual void
-    deserialize(IArchive& ia, const std::string& tag) = 0;
+    deserialize(IArchive&amp; ia, const std::string&amp; tag) = 0;
   };
 }
 </code></pre>
@@ -397,7 +397,7 @@ <h3>C++</h3>
 
 Each field within the record will cause the generation of a private member
 declaration of the appropriate type in the class declaration, and one or more
-acccessor methods. The generated class will implement the serialize and
+accessor methods. The generated class will implement the serialize and
 deserialize methods defined in hadoop::Record+. It will also 
 implement the inspection methods type and signature from
 hadoop::Record. A default constructor and virtual destructor will also
@@ -408,7 +408,7 @@ <h3>C++</h3>
 either the member or a reference to the member. For members that are returned 
 by value, a setter method is also generated. This is true for primitive 
 data members of the types byte, int, long, boolean, float and 
-double. For example, for a int field called MyField the folowing
+double. For example, for a int field called MyField the following
 code is generated.
 
 <pre><code>
@@ -438,11 +438,11 @@ <h3>C++</h3>
   ...
 public:
 
-  std::string& getMyBuf() {
+  std::string&amp; getMyBuf() {
     return mMyBuf;
   };
 
-  const std::string& getMyBuf() const {
+  const std::string&amp; getMyBuf() const {
     return mMyBuf;
   };
   ...
@@ -467,7 +467,7 @@ <h4>Examples</h4>
 include "inclrec.jr"
 module testrec {
     class R {
-        vector<float> VF;
+        vector&lt;float&gt; VF;
         RI            Rec;
         buffer        Buf;
     };
@@ -504,8 +504,8 @@ <h4>Examples</h4>
     RI(void);
     virtual ~RI(void);
 
-    virtual bool operator==(const RI& peer) const;
-    virtual bool operator<(const RI& peer) const;
+    virtual bool operator==(const RI&amp; peer) const;
+    virtual bool operator&lt;(const RI&amp; peer) const;
 
     virtual int32_t getI32(void) const { return mI32; }
     virtual void setI32(int32_t v) { mI32 = v; }
@@ -513,16 +513,16 @@ <h4>Examples</h4>
     virtual double getD(void) const { return mD; }
     virtual void setD(double v) { mD = v; }
 
-    virtual std::string& getS(void) const { return mS; }
-    virtual const std::string& getS(void) const { return mS; }
+    virtual std::string&amp; getS(void) const { return mS; }
+    virtual const std::string&amp; getS(void) const { return mS; }
 
     virtual std::string type(void) const;
     virtual std::string signature(void) const;
 
   protected:
 
-    virtual void serialize(hadoop::OArchive& a) const;
-    virtual void deserialize(hadoop::IArchive& a);
+    virtual void serialize(hadoop::OArchive&amp; a) const;
+    virtual void deserialize(hadoop::IArchive&amp; a);
 
     virtual bool validate(void);
   };
@@ -547,7 +547,7 @@ <h4>Examples</h4>
 
   private:
 
-    std::vector<float> mVF;
+    std::vector&lt;float&gt; mVF;
     inclrec::RI        mRec;
     std::string        mBuf;
 
@@ -556,20 +556,20 @@ <h4>Examples</h4>
     R(void);
     virtual ~R(void);
 
-    virtual bool operator==(const R& peer) const;
-    virtual bool operator<(const R& peer) const;
+    virtual bool operator==(const R&amp; peer) const;
+    virtual bool operator&lt;(const R&amp; peer) const;
 
-    virtual std::vector<float>& getVF(void) const;
-    virtual const std::vector<float>& getVF(void) const;
+    virtual std::vector&lt;float&gt;&amp; getVF(void) const;
+    virtual const std::vector&lt;float&gt;&amp; getVF(void) const;
 
-    virtual std::string& getBuf(void) const ;
-    virtual const std::string& getBuf(void) const;
+    virtual std::string&amp; getBuf(void) const ;
+    virtual const std::string&amp; getBuf(void) const;
 
-    virtual inclrec::RI& getRec(void) const;
-    virtual const inclrec::RI& getRec(void) const;
+    virtual inclrec::RI&amp; getRec(void) const;
+    virtual const inclrec::RI&amp; getRec(void) const;
     
-    virtual bool serialize(hadoop::OutArchive& a) const;
-    virtual bool deserialize(hadoop::InArchive& a);
+    virtual bool serialize(hadoop::OutArchive&amp; a) const;
+    virtual bool deserialize(hadoop::InArchive&amp; a);
     
     virtual std::string type(void) const;
     virtual std::string signature(void) const;
@@ -614,8 +614,8 @@ <h2>Mapping Summary</h2>
 ustring         std::string         Text
 buffer          std::string         java.io.ByteArrayOutputStream
 class type      class type          class type
-vector<type>    std::vector<type>   java.util.ArrayList
-map<type,type>  std::map<type,type> java.util.TreeMap
+vector&lt;type&gt;    std::vector&lt;type&gt;   java.util.ArrayList
+map&lt;type,type&gt;  std::map&lt;type,type&gt; java.util.TreeMap
 </code></pre>
 
 <h2>Data encodings</h2>
@@ -646,7 +646,7 @@ <h3>Binary Serialization Format</h3>
 <li> byte: Represented by 1 byte, as is.
 <li> boolean: Represented by 1-byte (0 or 1)
 <li> int/long: Integers and longs are serialized zero compressed.
-Represented as 1-byte if -120 <= value < 128. Otherwise, serialized as a
+Represented as 1-byte if -120 &lt;= value &lt; 128. Otherwise, serialized as a
 sequence of 2-5 bytes for ints, 2-9 bytes for longs. The first byte represents
 the number of trailing bytes, N, as the negative number (-120-N). For example,
 the number 1024 (0x400) is represented by the byte sequence 'x86 x04 x00'.
diff --git a/zookeeper-jute/src/main/resources/zookeeper.jute b/zookeeper-jute/src/main/resources/zookeeper.jute
index 898838f62f6..d52b4afefe2 100644
--- a/zookeeper-jute/src/main/resources/zookeeper.jute
+++ b/zookeeper-jute/src/main/resources/zookeeper.jute
@@ -51,6 +51,11 @@ module org.apache.zookeeper.data {
         long ephemeralOwner; // owner id if ephemeral, 0 otw
         long pzxid;      // last modified children
     }
+
+    class ClientInfo {
+        ustring authScheme; // Authentication scheme
+        ustring user;       // user name or any other id(for example ip)
+    }
 }
 
 module org.apache.zookeeper.proto {
@@ -60,12 +65,14 @@ module org.apache.zookeeper.proto {
         int timeOut;
         long sessionId;
         buffer passwd;
+        boolean readOnly;
     }
     class ConnectResponse {
         int protocolVersion;
         int timeOut;
         long sessionId;
         buffer passwd;
+        boolean readOnly;
     }
     class SetWatches {
         long relativeZxid;
@@ -248,6 +255,11 @@ module org.apache.zookeeper.proto {
     class GetEphemeralsResponse {
         vector<ustring> ephemerals;
     }
+
+    class WhoAmIResponse {
+        vector<org.apache.zookeeper.data.ClientInfo> clientInfo;
+    }
+
 }
 
 module org.apache.zookeeper.server.quorum {
diff --git a/zookeeper-jute/src/test/java/org/apache/jute/BinaryInputArchiveTest.java b/zookeeper-jute/src/test/java/org/apache/jute/BinaryInputArchiveTest.java
index fe9124c7292..294a8b129ba 100644
--- a/zookeeper-jute/src/test/java/org/apache/jute/BinaryInputArchiveTest.java
+++ b/zookeeper-jute/src/test/java/org/apache/jute/BinaryInputArchiveTest.java
@@ -18,17 +18,17 @@
 
 package org.apache.jute;
 
-import static org.junit.Assert.assertArrayEquals;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.ByteArrayInputStream;
 import java.io.DataInputStream;
 import java.io.IOException;
 import java.nio.ByteBuffer;
 import java.nio.charset.StandardCharsets;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 // TODO: introduce JuteTestCase as in ZKTestCase
 
@@ -47,8 +47,8 @@ public void testReadStringCheckLength() {
             ia.readString("");
             fail("Should have thrown an IOException");
         } catch (IOException e) {
-            assertTrue("Not 'Unreasonable length' exception: " + e,
-                    e.getMessage().startsWith(BinaryInputArchive.UNREASONBLE_LENGTH));
+            assertTrue(e.getMessage().startsWith(BinaryInputArchive.UNREASONBLE_LENGTH),
+                    () -> "Not 'Unreasonable length' exception: " + e);
         }
     }
 
@@ -155,8 +155,8 @@ public void testReadStringForRecordsHavingLengthMoreThanMaxAllowedSize() {
       ia.readString("");
       fail("Should have thrown an IOException");
     } catch (IOException e) {
-      assertTrue("Not 'Unreasonable length' exception: " + e,
-          e.getMessage().startsWith(BinaryInputArchive.UNREASONBLE_LENGTH));
+      assertTrue(e.getMessage().startsWith(BinaryInputArchive.UNREASONBLE_LENGTH),
+              () -> "Not 'Unreasonable length' exception: " + e);
     }
   }
 
@@ -195,4 +195,17 @@ private byte[] getData(int recordSize) {
     return buf.array();
   }
 
+    @Test
+    public void testTotalBufferSizeShouldNotBeMoreThanIntegerMaxValue()
+            throws IOException {
+        int maxBufferSize = 1 * 1024 * 1024 * 1024; // buffer size 1GB
+        int extraMaxBufferSize = maxBufferSize;
+        int recordSize = 1000;
+        BinaryInputArchive ia =
+                getBinaryInputArchive(recordSize, maxBufferSize, extraMaxBufferSize);
+        String s = ia.readString("");
+        assertNotNull(s);
+        assertEquals(recordSize, s.getBytes().length);
+    }
+
 }
diff --git a/zookeeper-jute/src/test/java/org/apache/jute/BinaryOutputArchiveTest.java b/zookeeper-jute/src/test/java/org/apache/jute/BinaryOutputArchiveTest.java
new file mode 100644
index 00000000000..ed920652ef5
--- /dev/null
+++ b/zookeeper-jute/src/test/java/org/apache/jute/BinaryOutputArchiveTest.java
@@ -0,0 +1,104 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.jute;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.util.Arrays;
+import org.apache.zookeeper.data.ClientInfo;
+import org.apache.zookeeper.proto.WhoAmIResponse;
+import org.junit.jupiter.api.Test;
+
+public class BinaryOutputArchiveTest {
+
+    @Test
+    public void testDataSize() throws IOException {
+        ByteArrayOutputStream baos = new ByteArrayOutputStream(32);
+        BinaryOutputArchive outputArchive = BinaryOutputArchive.getArchive(baos);
+        int dataSize = 0;
+        checkDataSize(dataSize, baos, outputArchive);
+
+        int boolSize = 1;
+        dataSize += boolSize;
+        outputArchive.writeBool(true, "bool");
+        checkDataSize(dataSize, baos, outputArchive);
+
+        int byteSize = 1;
+        dataSize += byteSize;
+        outputArchive.writeByte(Byte.MAX_VALUE, "byte");
+        checkDataSize(dataSize, baos, outputArchive);
+
+        int intSize = 4;
+        dataSize += intSize;
+        outputArchive.writeInt(1, "int");
+        checkDataSize(dataSize, baos, outputArchive);
+
+        int longSize = 8;
+        dataSize += longSize;
+        outputArchive.writeLong(8L, "long");
+        checkDataSize(dataSize, baos, outputArchive);
+
+        int stringLengthSize = 4;
+        String str = "ab";
+        dataSize += stringLengthSize + str.length();
+        outputArchive.writeString(str, "string");
+        checkDataSize(dataSize, baos, outputArchive);
+
+        int floatSize = 4;
+        dataSize += floatSize;
+        outputArchive.writeFloat(12.0f, "float");
+        checkDataSize(dataSize, baos, outputArchive);
+
+        int doubleSize = 8;
+        dataSize += doubleSize;
+        outputArchive.writeDouble(12.44d, "double");
+        checkDataSize(dataSize, baos, outputArchive);
+
+        int bytesLengthSize = 4;
+        byte[] bytes = new byte[4];
+        bytes[0] = 'a';
+        bytes[1] = 'b';
+        bytes[2] = 'c';
+        bytes[3] = 'd';
+        dataSize += bytesLengthSize + bytes.length;
+        outputArchive.writeBuffer(bytes, "bytes");
+        checkDataSize(dataSize, baos, outputArchive);
+
+        String schema = "custom";
+        String user1 = "horizon";
+        String user2 = "zhao";
+        WhoAmIResponse whoAmIResponse = new WhoAmIResponse();
+        whoAmIResponse.setClientInfo(Arrays.asList(
+                new ClientInfo(schema, user1),
+                new ClientInfo(schema, user2)));
+
+        int listSizeLength = 4;
+        int clientInfo1Length = stringLengthSize + schema.length() + stringLengthSize + user1.length();
+        int clientInfo2Length = stringLengthSize + schema.length() + stringLengthSize + user2.length();
+        dataSize += listSizeLength + clientInfo1Length + clientInfo2Length;
+        outputArchive.writeRecord(whoAmIResponse, "record");
+        checkDataSize(dataSize, baos, outputArchive);
+    }
+
+    private void checkDataSize(int dataSize, ByteArrayOutputStream baos, OutputArchive outputArchive) {
+        assertEquals(dataSize, outputArchive.getDataSize());
+        assertEquals(baos.size(), outputArchive.getDataSize());
+    }
+
+}
diff --git a/zookeeper-jute/src/test/java/org/apache/jute/TestCheckWriterReader.java b/zookeeper-jute/src/test/java/org/apache/jute/TestCheckWriterReader.java
index 81067ce8e4d..9ae70fc023b 100644
--- a/zookeeper-jute/src/test/java/org/apache/jute/TestCheckWriterReader.java
+++ b/zookeeper-jute/src/test/java/org/apache/jute/TestCheckWriterReader.java
@@ -18,7 +18,7 @@
 
 package org.apache.jute;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
diff --git a/zookeeper-jute/src/test/java/org/apache/jute/ToStringOutputArchiveTest.java b/zookeeper-jute/src/test/java/org/apache/jute/ToStringOutputArchiveTest.java
new file mode 100644
index 00000000000..8000fc948c8
--- /dev/null
+++ b/zookeeper-jute/src/test/java/org/apache/jute/ToStringOutputArchiveTest.java
@@ -0,0 +1,117 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.jute;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.util.Arrays;
+import org.apache.zookeeper.data.ClientInfo;
+import org.apache.zookeeper.proto.WhoAmIResponse;
+import org.junit.jupiter.api.Test;
+
+public class ToStringOutputArchiveTest {
+
+    @Test
+    public void testDataSize() throws IOException {
+        ByteArrayOutputStream baos = new ByteArrayOutputStream(32);
+        ToStringOutputArchive outputArchive = new ToStringOutputArchive(baos);
+        int dataSize = 0;
+        assertEquals(dataSize, outputArchive.getDataSize());
+        assertEquals(dataSize, baos.size());
+
+        int boolSize = 1;
+        dataSize += boolSize;
+        outputArchive.writeBool(true, "bool");
+        checkDataSize(dataSize, baos, outputArchive);
+
+        String comma = ",";
+        byte b = Byte.MAX_VALUE;
+        int byteSize = String.valueOf(b).length();
+        dataSize += comma.length() + byteSize;
+        outputArchive.writeByte(b, "byte");
+        checkDataSize(dataSize, baos, outputArchive);
+
+        int i = 1;
+        int intSize = String.valueOf(i).length();
+        dataSize += comma.length() + intSize;
+        outputArchive.writeInt(i, "int");
+        checkDataSize(dataSize, baos, outputArchive);
+
+        long l = 8L;
+        int longSize = String.valueOf(l).length();
+        dataSize += comma.length() + longSize;
+        outputArchive.writeLong(l, "long");
+        checkDataSize(dataSize, baos, outputArchive);
+
+        String apostrophe = "'";
+        String str = "ab";
+        int strSize = str.length();
+        dataSize += comma.length() + apostrophe.length() + strSize;
+        outputArchive.writeString(str, "string");
+        checkDataSize(dataSize, baos, outputArchive);
+
+
+        float f = 12.0f;
+        int floatSize = String.valueOf(f).length();
+        dataSize += comma.length() + floatSize;
+        outputArchive.writeFloat(f, "float");
+        checkDataSize(dataSize, baos, outputArchive);
+
+        double d = 12.44d;
+        int doubleSize = String.valueOf(d).length();
+        dataSize += comma.length() + doubleSize;
+        outputArchive.writeDouble(d, "double");
+        checkDataSize(dataSize, baos, outputArchive);
+
+        byte[] bytes = new byte[4];
+        bytes[0] = 'a';
+        bytes[1] = 'b';
+        bytes[2] = 'c';
+        bytes[3] = 'd';
+        String poundSign = "#";
+        int bytesSize = Integer.toHexString(bytes[0]).length()
+                + Integer.toHexString(bytes[1]).length()
+                + Integer.toHexString(bytes[2]).length()
+                + Integer.toHexString(bytes[3]).length();
+        dataSize += comma.length() + poundSign.length() + bytesSize;
+        outputArchive.writeBuffer(bytes, "bytes");
+        checkDataSize(dataSize, baos, outputArchive);
+
+        String schema = "custom";
+        String user1 = "horizon";
+        String user2 = "zhao";
+        WhoAmIResponse whoAmIResponse = new WhoAmIResponse();
+        whoAmIResponse.setClientInfo(Arrays.asList(
+                new ClientInfo(schema, user1),
+                new ClientInfo(schema, user2)));
+        String whoAmIResponseStr = whoAmIResponse.toString().replace("\n", "");
+
+        String startRecordSign = "s{";
+        String endRecordSign = "}";
+        dataSize += comma.length() + startRecordSign.length() + whoAmIResponseStr.length() + endRecordSign.length();
+        outputArchive.writeRecord(whoAmIResponse, "record");
+        checkDataSize(dataSize, baos, outputArchive);
+
+    }
+
+    private void checkDataSize(int dataSize, ByteArrayOutputStream baos, OutputArchive outputArchive) {
+        assertEquals(dataSize, outputArchive.getDataSize());
+        assertEquals(baos.size(), outputArchive.getDataSize());
+    }
+}
diff --git a/zookeeper-jute/src/test/java/org/apache/jute/compiler/JRecordTest.java b/zookeeper-jute/src/test/java/org/apache/jute/compiler/JRecordTest.java
new file mode 100644
index 00000000000..91eece84e17
--- /dev/null
+++ b/zookeeper-jute/src/test/java/org/apache/jute/compiler/JRecordTest.java
@@ -0,0 +1,344 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.jute.compiler;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import java.io.StringReader;
+import java.lang.reflect.Field;
+import java.util.List;
+import org.apache.jute.compiler.generated.ParseException;
+import org.apache.jute.compiler.generated.Rcc;
+import org.junit.jupiter.api.Test;
+
+@SuppressWarnings({"unchecked", "SameParameterValue"})
+public class JRecordTest {
+
+    @Test
+    public void testEndOfLineComments() throws ParseException, NoSuchFieldException, IllegalAccessException {
+        String juteStr = "module org.apache.zookeeper.data {\n"
+                + "    // information explicitly stored by the server persistently\n"
+                + "    class StatPersisted {\n"
+                + "        long czxid;      // created zxid\n"
+                + "        long mzxid;      // last modified zxid\n"
+                + "        long ctime;      /* created */\n"
+                + "        long mtime;      /** last modified */\n"
+                + "        int version;     /* version */ /* testComment1 */\n"
+                + "        int cversion;    /* child version */ /* child versionComment2 */ /* child versionComment3 */\n"
+                + "        int aversion;    /** acl version */ /** acl versionComment2 */ /** acl version */\n"
+                + "        long ephemeralOwner;  /* A multi-line end of line comment. */ /* Another multi-line end of line comment. */ /* Yet another\n"
+                + "end of line comment. */ /* Comment belong to new field */\n"
+                + "        long pzxid;     /* A multi-line end of line comment. */ /* Another multi-line end of line comment. */ /* Yet another\n"
+                + "end of line comment. */ /* Comment belong to new field */\n"
+                + "    }\n"
+                + "}";
+
+        try (StringReader stringReader = new StringReader(juteStr)) {
+            Rcc parser = new Rcc(stringReader);
+            JFile jFile = parser.Input();
+            List<JRecord> mRecords = getField(jFile, "mRecords", List.class);
+            assertEquals(1, mRecords.size());
+
+            JRecord jRecord = mRecords.get(0);
+            assertEquals("StatPersisted", jRecord.getName());
+            List<JField> fields = jRecord.getFields();
+            assertFiled(fields);
+
+            assertEquals("// information explicitly stored by the server persistently\n", jRecord.getRecordComments());
+            assertEquals("  // created zxid\n", jRecord.getJavaFieldComments(fields.get(0)));
+            assertEquals("  // last modified zxid\n", jRecord.getJavaFieldComments(fields.get(1)));
+            assertEquals("  /* created */\n", jRecord.getJavaFieldComments(fields.get(2)));
+            assertEquals("  /** last modified */\n", jRecord.getJavaFieldComments(fields.get(3)));
+            assertEquals("  /* version */\n  /* testComment1 */\n", jRecord.getJavaFieldComments(fields.get(4)));
+            assertEquals("  /* child version */\n  /* child versionComment2 */\n  /* child versionComment3 */\n", jRecord.getJavaFieldComments(fields.get(5)));
+            assertEquals("  /** acl version */\n  /** acl versionComment2 */\n  /** acl version */\n", jRecord.getJavaFieldComments(fields.get(6)));
+            assertEquals(
+                    "  /* A multi-line end of line comment. */\n"
+                            + "  /* Another multi-line end of line comment. */\n"
+                            + "  /* Yet another\n"
+                            + "  end of line comment. */\n", jRecord.getJavaFieldComments(fields.get(7)));
+            assertEquals(
+                    "  /* Comment belong to new field */\n"
+                            + "  /* A multi-line end of line comment. */\n"
+                            + "  /* Another multi-line end of line comment. */\n"
+                            + "  /* Yet another\n"
+                            + "  end of line comment. */\n", jRecord.getJavaFieldComments(fields.get(8)));
+        }
+    }
+
+    @Test
+    public void testCommentBeforeLineAndEndOfLine() throws ParseException, NoSuchFieldException, IllegalAccessException {
+        String juteStr = "module org.apache.zookeeper.data {\n"
+                + "    /**\n"
+                + "      * information explicitly stored by the server persistently\n"
+                + "      */ \n"
+                + "    class StatPersisted {\n"
+                + "        // created zxid\n"
+                + "        long czxid; // created zxid comment2\n"
+                + "        /* last modified zxid */\n"
+                + "        long mzxid; // last modified zxid comment2\n"
+                + "        /* created */\n"
+                + "        long ctime; // created comment2\n"
+                + "        /* last modified */\n"
+                + "        /* last modified */\n"
+                + "        long mtime; // last modified comment2\n"
+                + "        // version comment\n "
+                + "        int version;     /* version comment1 */ /* version\n comment2 */\n"
+                + "        /** child version */\n"
+                + "        /** child version */\n"
+                + "        int cversion;  /** child version */  // child version\n"
+                + "        // acl version\n"
+                + "        // acl version\n"
+                + "        // acl version\n"
+                + "        int aversion;    // acl version\n"
+                + "        // ephemeralOwner comment\n"
+                + "        long ephemeralOwner;  /* A multi-line end of line comment. */ /* Another multi-line end of line comment. */ /* Yet another\n"
+                + "end of line comment. */ /* Comment belong to new field */\n"
+                + "        // pzxid comment\n"
+                + "        long pzxid;     /* A multi-line end of line comment. */ /* Another multi-line end of line comment. */ /* Yet another\n"
+                + "end of line comment. */ /* Comment belong to new field */\n"
+                + "    }\n"
+                + "}";
+        try (StringReader stringReader = new StringReader(juteStr)) {
+            Rcc parser = new Rcc(stringReader);
+            JFile jFile = parser.Input();
+            List<JRecord> mRecords = getField(jFile, "mRecords", List.class);
+            assertEquals(1, mRecords.size());
+
+            JRecord jRecord = mRecords.get(0);
+            assertEquals("StatPersisted", jRecord.getName());
+            List<JField> fields = jRecord.getFields();
+            assertFiled(fields);
+
+            assertEquals("/**\n  * information explicitly stored by the server persistently\n  */\n", jRecord.getRecordComments());
+            assertEquals("  // created zxid\n  // created zxid comment2\n", jRecord.getJavaFieldComments(fields.get(0)));
+            assertEquals("  /* last modified zxid */\n  // last modified zxid comment2\n", jRecord.getJavaFieldComments(fields.get(1)));
+            assertEquals("  /* created */\n  // created comment2\n", jRecord.getJavaFieldComments(fields.get(2)));
+            assertEquals("  /* last modified */\n  /* last modified */\n  // last modified comment2\n", jRecord.getJavaFieldComments(fields.get(3)));
+
+            assertEquals("  // version comment\n  /* version comment1 */\n  /* version\n  comment2 */\n", jRecord.getJavaFieldComments(fields.get(4)));
+            assertEquals("  /** child version */\n  /** child version */\n  /** child version */\n  // child version\n", jRecord.getJavaFieldComments(fields.get(5)));
+            assertEquals("  // acl version\n  // acl version\n  // acl version\n  // acl version\n", jRecord.getJavaFieldComments(fields.get(6)));
+            assertEquals(
+                    "  // ephemeralOwner comment\n"
+                            + "  /* A multi-line end of line comment. */\n"
+                            + "  /* Another multi-line end of line comment. */\n"
+                            + "  /* Yet another\n"
+                            + "  end of line comment. */\n", jRecord.getJavaFieldComments(fields.get(7)));
+            assertEquals(
+                    "  /* Comment belong to new field */\n"
+                            + "  // pzxid comment\n"
+                            + "  /* A multi-line end of line comment. */\n"
+                            + "  /* Another multi-line end of line comment. */\n"
+                            + "  /* Yet another\n"
+                            + "  end of line comment. */\n", jRecord.getJavaFieldComments(fields.get(8)));
+        }
+    }
+
+    @Test
+    public void testCommentBeforeLine() throws ParseException, NoSuchFieldException, IllegalAccessException {
+        String juteStr = "module org.apache.zookeeper.data {\n"
+                + "    // information explicitly stored by the server persistently\n"
+                + "    // StatPersisted Comment1\n"
+                + "    // StatPersisted Comment2\n"
+                + "    class StatPersisted {\n"
+                + "        // created zxid comment1\n"
+                + "        // created zxid comment2\n"
+                + "        // created zxid comment3\n"
+                + "        long czxid;\n"
+                + "        // last modified zxid\n"
+                + "     // last modified zxid\n"
+                + "             // last modified zxid\n"
+                + "        long mzxid;\n"
+                + "        /* created */\n"
+                + "           /* created */\n"
+                + "      /* created */\n"
+                + "        long ctime;\n"
+                + "        /** last modified */\n"
+                + "        /** last modified */\n"
+                + "        long mtime;\n"
+                + "        /** version */\n"
+                + "             /** version */\n"
+                + "        int version;\n"
+                + "        // child version\n"
+                + "        /** child version */\n"
+                + "        /** child version */\n"
+                + "        int cversion;\n"
+                + "        /* acl version */\n"
+                + "        // acl version\n"
+                + "        /* acl version */\n"
+                + "        int aversion;\n"
+                + "        // owner id if ephemeral, 0 otw\n"
+                + "        long ephemeralOwner;\n"
+                + "        // last modified children\n"
+                + "        long pzxid;\n"
+                + "    }\n"
+                + "}";
+        try (StringReader stringReader = new StringReader(juteStr)) {
+            Rcc parser = new Rcc(stringReader);
+            JFile jFile = parser.Input();
+            List<JRecord> mRecords = getField(jFile, "mRecords", List.class);
+            assertEquals(1, mRecords.size());
+
+            JRecord jRecord = mRecords.get(0);
+            assertEquals("StatPersisted", jRecord.getName());
+            List<JField> fields = jRecord.getFields();
+            assertFiled(fields);
+
+            assertEquals("// information explicitly stored by the server persistently\n// StatPersisted Comment1\n// StatPersisted Comment2\n", jRecord.getRecordComments());
+            assertEquals("  // created zxid comment1\n  // created zxid comment2\n  // created zxid comment3\n", jRecord.getJavaFieldComments(fields.get(0)));
+            assertEquals("  // last modified zxid\n  // last modified zxid\n  // last modified zxid\n", jRecord.getJavaFieldComments(fields.get(1)));
+            assertEquals("  /* created */\n  /* created */\n  /* created */\n", jRecord.getJavaFieldComments(fields.get(2)));
+            assertEquals("  /** last modified */\n  /** last modified */\n", jRecord.getJavaFieldComments(fields.get(3)));
+            assertEquals("  /** version */\n  /** version */\n", jRecord.getJavaFieldComments(fields.get(4)));
+            assertEquals("  // child version\n  /** child version */\n  /** child version */\n", jRecord.getJavaFieldComments(fields.get(5)));
+            assertEquals("  /* acl version */\n  // acl version\n  /* acl version */\n", jRecord.getJavaFieldComments(fields.get(6)));
+            assertEquals("  // owner id if ephemeral, 0 otw\n", jRecord.getJavaFieldComments(fields.get(7)));
+            assertEquals("  // last modified children\n", jRecord.getJavaFieldComments(fields.get(8)));
+        }
+    }
+
+    @Test
+    public void testMultiLineComments() throws ParseException, NoSuchFieldException, IllegalAccessException {
+        String juteStr = "module org.apache.zookeeper.data {\n"
+                + "    /**\n"
+                + "      * information explicitly stored by the server persistently\n"
+                + "      */\n"
+                + "     // StatPersisted Comment\n"
+                + "     /* StatPersisted Comment */\n"
+                + "    class StatPersisted {\n"
+                + "        /**\n"
+                + "         * created zxid\n"
+                + "         */\n"
+                + "        long czxid;\n"
+                + "        /**\n"
+                + "         * last modified zxid comment1\n"
+                + "         */\n"
+                + "        /**\n"
+                + "         * last modified zxid comment2\n"
+                + "         */\n"
+                + "        long mzxid;\n"
+                + "        /*\n"
+                + "         * created\n"
+                + "         */\n"
+                + "        long ctime; /* multi-line\n"
+                + "end of line */\n"
+                + "        /*\n"
+                + "         last modified\n"
+                + "         */"
+                + "        long mtime; /* A multi-line end of line comment. */ /* Another multi-line end of line comment. */ /* Yet another\n"
+                + "end of line comment. */ /* Comment belong to new field */\n"
+                + "        /* version comment */\n"
+                + "        int version;     // version\n"
+                + "        /**\n"
+                + "         * child version\n"
+                + "         */\n"
+                + "        /**\n"
+                + "         * child version comment2\n"
+                + "         */\n"
+                + "        int cversion;    // child version\n"
+                + "        /* acl version */\n"
+                + "        int aversion;  /* acl version */ /* acl version */  // acl version\n"
+                + "        /*\n"
+                + "        ephemeralOwner comment\n"
+                + "        */\n"
+                + "        // ephemeralOwner comment\n"
+                + "        /*\n"
+                + "        ephemeralOwner comment\n"
+                + "        */\n"
+                + "        long ephemeralOwner;  // owner id if ephemeral, 0 otw\n"
+                + "        /*\n"
+                + "        pzxid comment\n"
+                + "        */\n"
+                + "        long pzxid;      // last modified children\n"
+                + "    }\n"
+                + "}";
+        try (StringReader stringReader = new StringReader(juteStr)) {
+            Rcc parser = new Rcc(stringReader);
+            JFile jFile = parser.Input();
+            List<JRecord> mRecords = getField(jFile, "mRecords", List.class);
+            assertEquals(1, mRecords.size());
+
+            JRecord jRecord = mRecords.get(0);
+            assertEquals("StatPersisted", jRecord.getName());
+            List<JField> fields = jRecord.getFields();
+            assertFiled(fields);
+
+            assertEquals(
+                    "/**\n"
+                            + "  * information explicitly stored by the server persistently\n"
+                            + "  */\n"
+                            + "// StatPersisted Comment\n"
+                            + "/* StatPersisted Comment */\n", jRecord.getRecordComments());
+            assertEquals("  /**\n   * created zxid\n   */\n", jRecord.getJavaFieldComments(fields.get(0)));
+            assertEquals("  /**\n   * last modified zxid comment1\n   */\n  /**\n   * last modified zxid comment2\n   */\n",
+                    jRecord.getJavaFieldComments(fields.get(1)));
+            assertEquals("  /*\n   * created\n   */\n  /* multi-line\n  end of line */\n", jRecord.getJavaFieldComments(fields.get(2)));
+            assertEquals("  /*\n   last modified\n   */\n"
+                            + "  /* A multi-line end of line comment. */\n"
+                            + "  /* Another multi-line end of line comment. */\n"
+                            + "  /* Yet another\n"
+                            + "  end of line comment. */\n", jRecord.getJavaFieldComments(fields.get(3)));
+            assertEquals("  /* Comment belong to new field */\n  /* version comment */\n  // version\n",
+                    jRecord.getJavaFieldComments(fields.get(4)));
+            assertEquals("  /**\n   * child version\n   */\n  /**\n   * child version comment2\n   */\n  // child version\n",
+                    jRecord.getJavaFieldComments(fields.get(5)));
+            assertEquals("  /* acl version */\n  /* acl version */\n  /* acl version */\n  // acl version\n", jRecord.getJavaFieldComments(fields.get(6)));
+            assertEquals("  /*\n"
+                    + "  ephemeralOwner comment\n"
+                    + "  */\n"
+                    + "  // ephemeralOwner comment\n"
+                    + "  /*\n"
+                    + "  ephemeralOwner comment\n"
+                    + "  */\n"
+                    + "  // owner id if ephemeral, 0 otw\n", jRecord.getJavaFieldComments(fields.get(7)));
+            assertEquals("  /*\n  pzxid comment\n  */\n  // last modified children\n", jRecord.getJavaFieldComments(fields.get(8)));
+        }
+    }
+
+    private void assertFiled(List<JField> fields) {
+        assertEquals(9, fields.size());
+        assertEquals("long", fields.get(0).getType().getJavaType());
+        assertEquals("czxid", fields.get(0).getName());
+        assertEquals("long", fields.get(1).getType().getJavaType());
+        assertEquals("mzxid", fields.get(1).getName());
+        assertEquals("long", fields.get(2).getType().getJavaType());
+        assertEquals("ctime", fields.get(2).getName());
+        assertEquals("long", fields.get(3).getType().getJavaType());
+        assertEquals("mtime", fields.get(3).getName());
+        assertEquals("int", fields.get(4).getType().getJavaType());
+        assertEquals("version", fields.get(4).getName());
+        assertEquals("int", fields.get(5).getType().getJavaType());
+        assertEquals("cversion", fields.get(5).getName());
+        assertEquals("int", fields.get(6).getType().getJavaType());
+        assertEquals("aversion", fields.get(6).getName());
+        assertEquals("long", fields.get(7).getType().getJavaType());
+        assertEquals("ephemeralOwner", fields.get(7).getName());
+        assertEquals("long", fields.get(8).getType().getJavaType());
+        assertEquals("pzxid", fields.get(8).getName());
+    }
+
+    private <T> T getField(final Object target,
+                           final String fieldName,
+                           final Class<T> fieldClassType) throws NoSuchFieldException, IllegalAccessException {
+        Class<?> targetClazz = target.getClass();
+        Field field = targetClazz.getDeclaredField(fieldName);
+        field.setAccessible(true);
+        return fieldClassType.cast(field.get(target));
+    }
+}
diff --git a/zookeeper-metrics-providers/pom.xml b/zookeeper-metrics-providers/pom.xml
old mode 100755
new mode 100644
index f07551bd50b..054763d003a
--- a/zookeeper-metrics-providers/pom.xml
+++ b/zookeeper-metrics-providers/pom.xml
@@ -23,8 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
-    <relativePath>..</relativePath>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-metrics-providers</artifactId>
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
old mode 100755
new mode 100644
index c6b5f133a34..9cdb235c8fd
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml
@@ -23,8 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-metrics-providers</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
-    <relativePath>..</relativePath>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-prometheus-metrics</artifactId>
@@ -33,7 +32,8 @@
   <description>ZooKeeper Prometheus.io Metrics Provider implementation</description>
 
   <properties>
-      <prometheus.version>0.6.0</prometheus.version>
+      <prometheus.version>1.3.10</prometheus.version>
+      <jetty.version>9.4.58.v20250814</jetty.version>
   </properties>
   <dependencies>
     <dependency>
@@ -47,28 +47,62 @@
     </dependency>    
     <dependency>
       <groupId>io.prometheus</groupId>
-      <artifactId>simpleclient</artifactId>
+      <artifactId>prometheus-metrics-core</artifactId>
       <version>${prometheus.version}</version>
     </dependency>
     <dependency>
       <groupId>io.prometheus</groupId>
-      <artifactId>simpleclient_hotspot</artifactId>
+      <artifactId>prometheus-metrics-instrumentation-jvm</artifactId>
       <version>${prometheus.version}</version>
     </dependency>
     <dependency>
       <groupId>io.prometheus</groupId>
-      <artifactId>simpleclient_servlet</artifactId>
+      <artifactId>prometheus-metrics-exporter-servlet-javax</artifactId>
       <version>${prometheus.version}</version>
     </dependency>
     <dependency>
-      <groupId>org.eclipse.jetty</groupId>
-      <artifactId>jetty-server</artifactId>
-      <scope>provided</scope>
+      <groupId>io.prometheus</groupId>
+      <artifactId>prometheus-metrics-exporter-httpserver</artifactId>
+      <version>${prometheus.version}</version>
+    </dependency>
+    <dependency>
+        <groupId>io.prometheus</groupId>
+        <artifactId>prometheus-metrics-exposition-formats</artifactId>
+        <version>${prometheus.version}</version>
+    </dependency>
+    <dependency>
+      <groupId>io.prometheus</groupId>
+      <artifactId>prometheus-metrics-config</artifactId>
+      <version>${prometheus.version}</version>
+    </dependency>
+    <dependency>
+        <groupId>org.eclipse.jetty</groupId>
+        <artifactId>jetty-server</artifactId>
+        <version>${jetty.version}</version>
     </dependency>
     <dependency>
-      <groupId>org.eclipse.jetty</groupId>
-      <artifactId>jetty-servlet</artifactId>
-      <scope>provided</scope>
+        <groupId>org.eclipse.jetty</groupId>
+        <artifactId>jetty-servlet</artifactId>
+        <version>${jetty.version}</version>
+    </dependency>
+    <!-- You likely don't need this, but if you do, here's the correct syntax -->
+    <dependency>
+        <groupId>org.eclipse.jetty</groupId>
+        <artifactId>jetty-util</artifactId>
+        <version>${jetty.version}</version>
+        <!-- You could add a scope here if needed, e.g., <scope>provided</scope> -->
+    </dependency>
+    <dependency>
+        <groupId>javax.servlet</groupId>
+        <artifactId>javax.servlet-api</artifactId>
+        <version>3.1.0</version>
+        <scope>provided</scope>
+    </dependency>
+    <dependency>
+      <groupId>ch.qos.logback</groupId>
+      <artifactId>logback-classic</artifactId>
+      <scope>runtime</scope>
+      <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>org.mockito</groupId>
@@ -76,10 +110,38 @@
       <scope>test</scope>
     </dependency>
     <dependency>
-      <groupId>junit</groupId>
-      <artifactId>junit</artifactId>
+      <groupId>org.junit.jupiter</groupId>
+      <artifactId>junit-jupiter-engine</artifactId>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.junit.platform</groupId>
+      <artifactId>junit-platform-runner</artifactId>
       <scope>test</scope>
     </dependency>
   </dependencies>
 
+  <build>
+    <plugins>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-dependency-plugin</artifactId>
+        <executions>
+          <execution>
+            <id>copy-dependencies</id>
+            <phase>package</phase>
+            <goals>
+              <goal>copy-dependencies</goal>
+            </goals>
+            <configuration>
+              <outputDirectory>${project.build.directory}/lib</outputDirectory>
+              <overWriteReleases>false</overWriteReleases>
+              <overWriteSnapshots>true</overWriteSnapshots>
+              <excludeTransitive>false</excludeTransitive>
+            </configuration>
+          </execution>
+        </executions>
+      </plugin>
+    </plugins>
+  </build>
 </project>
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
index d3628a7c140..001b7f25dcd 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java
@@ -7,7 +7,7 @@
  * "License"); you may not use this file except in compliance
  * with the License.  You may obtain a copy of the License at
  *
- *     http://www.apache.org/licenses/LICENSE-2.0
+ * http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
@@ -18,12 +18,15 @@
 
 package org.apache.zookeeper.metrics.prometheus;
 
-import io.prometheus.client.Collector;
-import io.prometheus.client.CollectorRegistry;
-import io.prometheus.client.exporter.MetricsServlet;
-import io.prometheus.client.hotspot.DefaultExports;
+import static org.apache.zookeeper.common.LogRedactor.redactSensitiveValues;
+import io.prometheus.metrics.core.metrics.GaugeWithCallback;
+import io.prometheus.metrics.exporter.servlet.javax.PrometheusMetricsServlet;
+import io.prometheus.metrics.instrumentation.jvm.JvmMetrics;
+import io.prometheus.metrics.model.registry.PrometheusRegistry;
 import java.io.IOException;
-import java.util.Enumeration;
+import java.security.GeneralSecurityException;
+import java.security.KeyStore;
+import java.util.Map;
 import java.util.Objects;
 import java.util.Properties;
 import java.util.concurrent.ConcurrentHashMap;
@@ -32,378 +35,572 @@
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
+import org.apache.zookeeper.common.X509Util;
 import org.apache.zookeeper.metrics.Counter;
+import org.apache.zookeeper.metrics.CounterSet;
 import org.apache.zookeeper.metrics.Gauge;
+import org.apache.zookeeper.metrics.GaugeSet;
 import org.apache.zookeeper.metrics.MetricsContext;
 import org.apache.zookeeper.metrics.MetricsProvider;
 import org.apache.zookeeper.metrics.MetricsProviderLifeCycleException;
 import org.apache.zookeeper.metrics.Summary;
 import org.apache.zookeeper.metrics.SummarySet;
+import org.apache.zookeeper.server.admin.UnifiedConnectionFactory;
+import org.eclipse.jetty.http.HttpVersion;
+import org.eclipse.jetty.server.HttpConfiguration;
+import org.eclipse.jetty.server.HttpConnectionFactory;
+import org.eclipse.jetty.server.SecureRequestCustomizer;
 import org.eclipse.jetty.server.Server;
+import org.eclipse.jetty.server.ServerConnector;
 import org.eclipse.jetty.servlet.ServletContextHandler;
 import org.eclipse.jetty.servlet.ServletHolder;
+import org.eclipse.jetty.util.resource.Resource;
+import org.eclipse.jetty.util.ssl.KeyStoreScanner;
+import org.eclipse.jetty.util.ssl.SslContextFactory;
+import org.eclipse.jetty.util.thread.QueuedThreadPool;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 /**
  * A Metrics Provider implementation based on https://prometheus.io.
- *
+ * This implementation uses prometheus-metrics-core interfaces and exposes metrics via an embedded Jetty server
  * @since 3.6.0
  */
 public class PrometheusMetricsProvider implements MetricsProvider {
 
     private static final Logger LOG = LoggerFactory.getLogger(PrometheusMetricsProvider.class);
     private static final String LABEL = "key";
-    private static final String[] LABELS = {LABEL};
-    /**
-     * We are using the 'defaultRegistry'.
-     * <p>
-     * When you are running ZooKeeper (server or client) together with other
-     * libraries every metrics will be expected as a single view.
-     * </p>
-     */
-    private final CollectorRegistry collectorRegistry = CollectorRegistry.defaultRegistry;
-    private int port = 7000;
+
+    private final PrometheusRegistry registry = PrometheusRegistry.defaultRegistry;
+    private int httpPort = -1;
+    private int httpsPort = -1;
     private boolean exportJvmInfo = true;
-    private Server server;
-    private final MetricsServletImpl servlet = new MetricsServletImpl();
     private final Context rootContext = new Context();
+    private PrometheusRegistryDumper dumper;
+    private CustomPrometheusMetricsServlet servlet;
+
+    private Server server;
+    private int numWorkerThreads;
+    private String host;
+
+    // SSL Configuration fields
+    private String keyStorePath;
+    private String keyStorePassword;
+    private String keyStoreType;
+    private String trustStorePath;
+    private String trustStorePassword;
+    private String trustStoreType;
+    private boolean needClientAuth = true; // Secure default
+    private boolean wantClientAuth = true; // Secure default
+    private String enabledProtocols;
+    private String cipherSuites;
+    private int httpVersion;
+
+    // Constants for configuration
+    public static final String HTTP_HOST = "httpHost";
+    public static final String HTTP_PORT = "httpPort";
+    public static final String EXPORT_JVM_INFO = "exportJvmInfo";
+    public static final String HTTPS_PORT = "httpsPort";
+    public static final String NUM_WORKER_THREADS = "numWorkerThreads";
+    public static final String SSL_KEYSTORE_LOCATION = "ssl.keyStore.location";
+    public static final String SSL_KEYSTORE_PASSWORD = "ssl.keyStore.password";
+    public static final String SSL_KEYSTORE_TYPE = "ssl.keyStore.type";
+    public static final String SSL_TRUSTSTORE_LOCATION = "ssl.trustStore.location";
+    public static final String SSL_TRUSTSTORE_PASSWORD = "ssl.trustStore.password";
+    public static final String SSL_TRUSTSTORE_TYPE = "ssl.trustStore.type";
+    public static final String SSL_NEED_CLIENT_AUTH = "ssl.need.client.auth";
+    public static final String SSL_WANT_CLIENT_AUTH = "ssl.want.client.auth";
+    public static final String SSL_ENABLED_PROTOCOLS = "ssl.enabledProtocols";
+    public static final String SSL_ENABLED_CIPHERS = "ssl.ciphersuites";
+    public static final String HTTP_VERSION = "httpVersion";
+    public static final int SCAN_INTERVAL = 60 * 10; // 10 minutes
+    public static final int DEFAULT_HTTP_VERSION = 11;  // based on HttpVersion.java in jetty
+    /**
+     * The time, in seconds, that the browser should remember that a host is only to be accessed using HTTPS.
+     * Seconds in a day.
+     */
+    public static final int DEFAULT_STS_MAX_AGE = 1 * 24 * 60 * 60;
+
+    /**
+     * Custom servlet to disable the TRACE method for security reasons.
+     */
+    private static class CustomPrometheusMetricsServlet extends PrometheusMetricsServlet {
+        public CustomPrometheusMetricsServlet(PrometheusRegistry registry) {
+            super(registry);
+        }
+
+        @Override
+        protected void doTrace(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+            resp.sendError(HttpServletResponse.SC_METHOD_NOT_ALLOWED);
+        }
+    }
 
     @Override
     public void configure(Properties configuration) throws MetricsProviderLifeCycleException {
-        LOG.info("Initializing metrics, configuration: {}", configuration);
-        this.port = Integer.parseInt(configuration.getProperty("httpPort", "7000"));
-        this.exportJvmInfo = Boolean.parseBoolean(configuration.getProperty("exportJvmInfo", "true"));
+        LOG.info("Initializing Prometheus metrics with Jetty, configuration: {}", redactSensitiveValues(configuration));
+
+        this.host = configuration.getProperty(HTTP_HOST, "0.0.0.0");
+        this.httpPort = Integer.parseInt(configuration.getProperty(HTTP_PORT, "-1"));
+        this.httpsPort = Integer.parseInt(configuration.getProperty(HTTPS_PORT, "-1"));
+        this.exportJvmInfo = Boolean.parseBoolean(configuration.getProperty(EXPORT_JVM_INFO, "true"));
+        this.numWorkerThreads = Integer.parseInt(configuration.getProperty(NUM_WORKER_THREADS, "10"));
+
+        // If httpsPort is specified, parse all SSL properties
+        if (this.httpsPort != -1) {
+            this.keyStorePath = configuration.getProperty(SSL_KEYSTORE_LOCATION);
+            this.keyStorePassword = configuration.getProperty(SSL_KEYSTORE_PASSWORD);
+            this.keyStoreType = configuration.getProperty(SSL_KEYSTORE_TYPE);
+            this.trustStorePath = configuration.getProperty(SSL_TRUSTSTORE_LOCATION);
+            this.trustStorePassword = configuration.getProperty(SSL_TRUSTSTORE_PASSWORD);
+            this.trustStoreType = configuration.getProperty(SSL_TRUSTSTORE_TYPE);
+            this.needClientAuth = Boolean.parseBoolean(configuration.getProperty(SSL_NEED_CLIENT_AUTH, "true"));
+            this.wantClientAuth = Boolean.parseBoolean(configuration.getProperty(SSL_WANT_CLIENT_AUTH, "true"));
+            this.enabledProtocols = configuration.getProperty(SSL_ENABLED_PROTOCOLS);
+            this.cipherSuites = configuration.getProperty(SSL_ENABLED_CIPHERS);
+            this.httpVersion = Integer.getInteger(HTTP_VERSION, DEFAULT_HTTP_VERSION);
+        }
+
+        // Validate that at least one port is configured.
+        if (httpPort == -1 && httpsPort == -1) {
+            throw new MetricsProviderLifeCycleException(
+                    "Either httpPort or httpsPort must be configured for Prometheus exporter.");
+        }
+
+        this.dumper = new PrometheusRegistryDumper(this.registry);
+        this.servlet = new CustomPrometheusMetricsServlet(this.registry);
     }
 
     @Override
     public void start() throws MetricsProviderLifeCycleException {
+        // Register JVM metrics if enabled
+        if (exportJvmInfo) {
+            JvmMetrics.builder().register(this.registry);
+        }
         try {
-            LOG.info("Starting /metrics HTTP endpoint at port {} exportJvmInfo: {}", port, exportJvmInfo);
-            if (exportJvmInfo) {
-                DefaultExports.initialize();
+            LOG.info("Starting Prometheus Jetty server...");
+
+            // QueuedThreadPool needs a minimum of 4 threads for stable operation
+            QueuedThreadPool threadPool = new QueuedThreadPool(Math.max(this.numWorkerThreads + 3, 4));
+            threadPool.setReservedThreads(0);
+            threadPool.setName("prometheus-jetty-server");
+
+            this.server = new Server(threadPool);
+
+            // Define number of acceptors and selectors for connectors
+            int acceptors = 1;
+            int selectors = 1;
+
+            ServerConnector connector = null;
+
+            if (this.httpPort != -1 && this.httpsPort != -1 && this.httpPort == this.httpsPort) {
+                // Set Strict-Transport-Security HTTP response header.
+                SecureRequestCustomizer customizer = new SecureRequestCustomizer();
+                customizer.setStsMaxAge(DEFAULT_STS_MAX_AGE);
+                // Strict-Transport-Security HTTP header should apply to all subdomains of the host's domain as well.
+                customizer.setStsIncludeSubDomains(true);
+
+                HttpConfiguration config = new HttpConfiguration();
+                config.setSecureScheme("https");
+                config.addCustomizer(customizer);
+
+                SslContextFactory.Server sslContextFactory = createSslContextFactory();
+                setKeyStoreScanner(sslContextFactory);
+
+                String nextProtocol = HttpVersion.fromVersion(httpVersion).asString();
+                connector = new ServerConnector(server,
+                        new UnifiedConnectionFactory(sslContextFactory, nextProtocol),
+                        new HttpConnectionFactory(config));
+                connector.setPort(this.httpPort);
+                connector.setHost(this.host);
+                LOG.info("Created unified ServerConnector for host: {}, httpPort: {}", host, httpPort);
+            } else {
+                // Configure HTTP connector if enabled
+                if (this.httpPort != -1) {
+                    connector = new ServerConnector(server, acceptors, selectors);
+                    connector.setPort(this.httpPort);
+                    connector.setHost(this.host);
+                    LOG.info("Created HTTP ServerConnector for host: {}, httpPort: {}", host, httpPort);
+                }
+
+                // Configure HTTPS connector if enabled
+                if (this.httpsPort != -1) {
+                    SslContextFactory.Server sslContextFactory = createSslContextFactory();
+                    setKeyStoreScanner(sslContextFactory);
+                    connector = createSslConnector(server, acceptors, selectors, sslContextFactory);
+                    LOG.info("Created HTTPS ServerConnector for host: {}, httpsPort: {}", host, httpsPort);
+                }
             }
-            server = new Server(port);
+
+            server.addConnector(connector);
+
+            // Set up the servlet context handler
             ServletContextHandler context = new ServletContextHandler();
             context.setContextPath("/");
             server.setHandler(context);
             context.addServlet(new ServletHolder(servlet), "/metrics");
+
             server.start();
-        } catch (Exception err) {
-            LOG.error("Cannot start /metrics server", err);
-            if (server != null) {
-                try {
-                    server.stop();
-                } catch (Exception suppressed) {
-                    err.addSuppressed(suppressed);
-                } finally {
-                    server = null;
-                }
-            }
-            throw new MetricsProviderLifeCycleException(err);
+
+            LOG.info("Prometheus metrics provider with Jetty started. HTTP port: {}, HTTPS port: {}",
+                    httpPort != -1 ? httpPort : "disabled", httpsPort != -1 ? httpsPort : "disabled");
+
+        } catch (Exception e) {
+            LOG.error("Failed to start Prometheus Jetty server", e);
+            // Ensure server is stopped on startup failure
+            stop();
+            throw new MetricsProviderLifeCycleException("Failed to start Prometheus Jetty server", e);
         }
     }
 
-    // for tests
-    MetricsServletImpl getServlet() {
-        return servlet;
+    private void setKeyStoreScanner(SslContextFactory.Server sslContextFactory) {
+        KeyStoreScanner keystoreScanner = new KeyStoreScanner(sslContextFactory);
+        keystoreScanner.setScanInterval(SCAN_INTERVAL);
+        server.addBean(keystoreScanner);
     }
 
-    @Override
-    public MetricsContext getRootContext() {
-        return rootContext;
+    /**
+     * Creates and configures the SslContextFactory for the server.
+     *
+     * @return A configured SslContextFactory.Server instance.
+     */
+    private SslContextFactory.Server createSslContextFactory() throws GeneralSecurityException, IOException {
+        SslContextFactory.Server sslContextFactory = new SslContextFactory.Server();
+
+        // Validate and set KeyStore properties
+        if (this.keyStorePath == null || this.keyStorePath.isEmpty()) {
+            throw new IllegalArgumentException("SSL/TLS is enabled, but '" + SSL_KEYSTORE_LOCATION + "' is not set.");
+        }
+        KeyStore keyStore = X509Util.loadKeyStore(this.keyStorePath, this.keyStorePassword, this.keyStoreType);
+        LOG.debug("Successfully loaded private key from {}", this.keyStorePath);
+
+        sslContextFactory.setKeyStore(keyStore);
+        sslContextFactory.setKeyStorePassword(this.keyStorePassword);
+
+        // This is needed for KeyStoreScanner to work.
+        sslContextFactory.setKeyStoreResource(Resource.newResource(this.keyStorePath));
+
+        // Validate and set TrustStore properties (often needed for client auth)
+        if (this.needClientAuth && (this.trustStorePath == null || this.trustStorePath.isEmpty())) {
+            throw new IllegalArgumentException(
+                    "'" + SSL_NEED_CLIENT_AUTH + "' is true, but '" + SSL_TRUSTSTORE_LOCATION + "' is not set.");
+        }
+        if (this.trustStorePath != null) {
+            KeyStore trustStore = X509Util.loadTrustStore(this.trustStorePath, this.trustStorePassword,
+                    this.trustStoreType);
+            LOG.debug("Successfully loaded certificate authority from {}", this.trustStorePath);
+
+            sslContextFactory.setTrustStore(trustStore);
+            sslContextFactory.setTrustStorePassword(this.trustStorePassword);
+        }
+
+        sslContextFactory.setNeedClientAuth(this.needClientAuth);
+        sslContextFactory.setWantClientAuth(this.wantClientAuth);
+
+        if (enabledProtocols != null) {
+            LOG.debug("Setting enabled protocols: '{}'", enabledProtocols);
+            String[] enabledProtocolsArray = enabledProtocols.split(",");
+            sslContextFactory.setIncludeProtocols(enabledProtocolsArray);
+        }
+
+        if (cipherSuites != null) {
+            LOG.debug("Setting enabled cipherSuites: '{}'", cipherSuites);
+            String[] cipherSuitesArray = cipherSuites.split(",");
+            sslContextFactory.setIncludeCipherSuites(cipherSuitesArray);
+        }
+
+        return sslContextFactory;
+    }
+
+    /**
+     * Creates and configures an SSL/TLS connector for the Jetty server.
+     *
+     * @param server
+     *            The server instance.
+     * @param acceptors
+     *            The number of acceptor threads.
+     * @param selectors
+     *            The number of selector threads.
+     * @param sslContextFactory
+     *            The pre-configured SslContextFactory.
+     *
+     * @return A configured ServerConnector for HTTPS.
+     */
+    private ServerConnector createSslConnector(Server server, int acceptors, int selectors,
+            SslContextFactory.Server sslContextFactory) {
+        ServerConnector sslConnector = new ServerConnector(server, acceptors, selectors, sslContextFactory);
+        sslConnector.setPort(this.httpsPort);
+        sslConnector.setHost(this.host);
+        return sslConnector;
     }
 
     @Override
     public void stop() {
         if (server != null) {
             try {
+                LOG.info("Stopping Prometheus Jetty server.");
                 server.stop();
             } catch (Exception err) {
-                LOG.error("Cannot safely stop Jetty server", err);
+                LOG.error("Cannot safely stop Prometheus Jetty server", err);
             } finally {
                 server = null;
             }
         }
+        registry.clear();
     }
 
     /**
-     * Dump all values to the 4lw interface and to the Admin server.
-     * <p>
-     * This method is not expected to be used to serve metrics to Prometheus. We
-     * are using the MetricsServlet provided by Prometheus for that, leaving the
-     * real representation to the Prometheus Java client.
-     * </p>
-     *
-     * @param sink the receiver of data (4lw interface, Admin server or tests)
+     * Returns a Prometheus servlet for integration with existing web applications. This is primarily used for testing
+     * purposes.
      */
-    @Override
-    public void dump(BiConsumer<String, Object> sink) {
-        sampleGauges();
-        Enumeration<Collector.MetricFamilySamples> samplesFamilies = collectorRegistry.metricFamilySamples();
-        while (samplesFamilies.hasMoreElements()) {
-            Collector.MetricFamilySamples samples = samplesFamilies.nextElement();
-            samples.samples.forEach(sample -> {
-                String key = buildKeyForDump(sample);
-                sink.accept(key, sample.value);
-            });
-        }
+    public PrometheusMetricsServlet getServlet() {
+        return this.servlet;
     }
 
-    private static String buildKeyForDump(Collector.MetricFamilySamples.Sample sample) {
-        StringBuilder keyBuilder = new StringBuilder();
-        keyBuilder.append(sample.name);
-        if (sample.labelNames.size() > 0) {
-            keyBuilder.append('{');
-            for (int i = 0; i < sample.labelNames.size(); ++i) {
-                if (i > 0) {
-                    keyBuilder.append(',');
-                }
-                keyBuilder.append(sample.labelNames.get(i));
-                keyBuilder.append("=\"");
-                keyBuilder.append(sample.labelValues.get(i));
-                keyBuilder.append('"');
-            }
-            keyBuilder.append('}');
-        }
-        return keyBuilder.toString();
+    @Override
+    public MetricsContext getRootContext() {
+        return rootContext;
     }
 
-    /**
-     * Update Gauges. In ZooKeeper Metrics API Gauges are callbacks served by
-     * internal components and the value is not held by Prometheus structures.
-     */
-    private void sampleGauges() {
-        rootContext.gauges.values()
-                .forEach(PrometheusGaugeWrapper::sample);
+    @Override
+    public void dump(BiConsumer<String, Object> sink) {
+        dumper.dump().forEach(sink);
     }
 
     @Override
     public void resetAllValues() {
-        // not supported on Prometheus
+        // The new prometheus client does not support resetting metric values.
+        LOG.debug("resetAllValues is a no-op for PrometheusMetricsProvider");
     }
 
+    /**
+     * Inner class implementing the MetricsContext interface. It handles the creation and registration of different
+     * metric types.
+     */
     private class Context implements MetricsContext {
 
-        private final ConcurrentMap<String, PrometheusGaugeWrapper> gauges = new ConcurrentHashMap<>();
-        private final ConcurrentMap<String, PrometheusCounter> counters = new ConcurrentHashMap<>();
-        private final ConcurrentMap<String, PrometheusSummary> basicSummaries = new ConcurrentHashMap<>();
-        private final ConcurrentMap<String, PrometheusSummary> summaries = new ConcurrentHashMap<>();
-        private final ConcurrentMap<String, PrometheusLabelledSummary> basicSummarySets = new ConcurrentHashMap<>();
-        private final ConcurrentMap<String, PrometheusLabelledSummary> summarySets = new ConcurrentHashMap<>();
+        private final ConcurrentMap<String, PrometheusCounterWrapper> counters =
+            new ConcurrentHashMap<>();
+        private final ConcurrentMap<String, PrometheusLabelledCounterWrapper> counterSets =
+            new ConcurrentHashMap<>();
+        private final ConcurrentMap<String, GaugeWithCallback> registeredGauges =
+            new ConcurrentHashMap<>();
+        private final ConcurrentMap<String, PrometheusSummaryWrapper> basicSummaries =
+            new ConcurrentHashMap<>();
+        private final ConcurrentMap<String, PrometheusSummaryWrapper> advancedSummaries =
+            new ConcurrentHashMap<>();
+        private final ConcurrentMap<String, PrometheusLabelledSummaryWrapper> basicSummarySets =
+            new ConcurrentHashMap<>();
+        private final ConcurrentMap<String, PrometheusLabelledSummaryWrapper> advancedSummarySets =
+            new ConcurrentHashMap<>();
 
         @Override
         public MetricsContext getContext(String name) {
-            // no hierarchy yet
+            // This provider uses a flat namespace, so sub-contexts are not needed.
             return this;
         }
 
         @Override
         public Counter getCounter(String name) {
-            return counters.computeIfAbsent(name, PrometheusCounter::new);
+            return counters.computeIfAbsent(name, key -> {
+                io.prometheus.metrics.core.metrics.Counter prometheusCounter =
+                        io.prometheus.metrics.core.metrics.Counter
+                        .builder().name(key).help(key + " counter").register(registry);
+                return new PrometheusCounterWrapper(prometheusCounter);
+            });
         }
 
-        /**
-         * Gauges may go up and down, in ZooKeeper they are a way to export
-         * internal values with a callback.
-         *
-         * @param name  the name of the gauge
-         * @param gauge the callback
-         */
         @Override
-        public void registerGauge(String name, Gauge gauge) {
-            Objects.requireNonNull(name);
-            gauges.compute(name, (id, prev) ->
-                    new PrometheusGaugeWrapper(id, gauge, prev != null ? prev.inner : null));
+        public CounterSet getCounterSet(String name) {
+            return counterSets.computeIfAbsent(name, key -> {
+                Objects.requireNonNull(name, "Cannot register a CounterSet with null name");
+                io.prometheus.metrics.core.metrics.Counter prometheusCounter =
+                        io.prometheus.metrics.core.metrics.Counter
+                        .builder().name(key).help(key + " counter set").labelNames(LABEL).register(registry);
+                return new PrometheusLabelledCounterWrapper(prometheusCounter);
+            });
         }
 
         @Override
-        public void unregisterGauge(String name) {
-            PrometheusGaugeWrapper existing = gauges.remove(name);
-            if (existing != null) {
-                existing.unregister();
+        public void registerGaugeSet(final String name, final GaugeSet gaugeSet) {
+            Objects.requireNonNull(name, "Cannot register a GaugeSet with null name");
+            Objects.requireNonNull(gaugeSet, "Cannot register a null GaugeSet for " + name);
+
+            GaugeWithCallback oldGauge = registeredGauges.get(name);
+            if (oldGauge != null) {
+                registry.unregister(oldGauge);
             }
+
+            GaugeWithCallback newGauge = GaugeWithCallback.builder().name(name).help(name).labelNames(LABEL)
+                    .callback(callback -> {
+                        Map<String, Number> values = gaugeSet.values();
+                        if (values != null) {
+                            for (Map.Entry<String, Number> value : values.entrySet()) {
+                                if (value.getKey() == null) {
+                                    throw new IllegalArgumentException("GaugeSet key cannot be null.");
+                                }
+                                callback.call(value.getValue().doubleValue(), value.getKey());
+                            }
+                        }
+                    }).register(registry);
+            registeredGauges.put(name, newGauge);
         }
 
         @Override
-        public Summary getSummary(String name, DetailLevel detailLevel) {
-            if (detailLevel == DetailLevel.BASIC) {
-                return basicSummaries.computeIfAbsent(name, (n) -> {
-                    if (summaries.containsKey(n)) {
-                        throw new IllegalArgumentException("Already registered a non basic summary as " + n);
-                    }
-                    return new PrometheusSummary(name, detailLevel);
-                });
-            } else {
-                return summaries.computeIfAbsent(name, (n) -> {
-                    if (basicSummaries.containsKey(n)) {
-                        throw new IllegalArgumentException("Already registered a basic summary as " + n);
-                    }
-                    return new PrometheusSummary(name, detailLevel);
-                });
+        public void registerGauge(String name, Gauge gauge) {
+            if (name == null) {
+                throw new IllegalArgumentException("Gauge name cannot be null.");
+            }
+            if (gauge == null) {
+                throw new IllegalArgumentException("Cannot register a null Gauge for " + name);
+            }
+
+            GaugeWithCallback oldGauge = registeredGauges.get(name);
+            if (oldGauge != null) {
+                registry.unregister(oldGauge);
             }
+
+            GaugeWithCallback newGauge = GaugeWithCallback.builder().name(name).help(name).callback(callback -> {
+                Number value = gauge.get();
+                if (value != null) {
+                    callback.call(value.doubleValue());
+                }
+            }).register(registry);
+            registeredGauges.put(name, newGauge);
         }
 
         @Override
-        public SummarySet getSummarySet(String name, DetailLevel detailLevel) {
-            if (detailLevel == DetailLevel.BASIC) {
-                return basicSummarySets.computeIfAbsent(name, (n) -> {
-                    if (summarySets.containsKey(n)) {
-                        throw new IllegalArgumentException("Already registered a non basic summary set as " + n);
-                    }
-                    return new PrometheusLabelledSummary(name, detailLevel);
-                });
-            } else {
-                return summarySets.computeIfAbsent(name, (n) -> {
-                    if (basicSummarySets.containsKey(n)) {
-                        throw new IllegalArgumentException("Already registered a basic summary set as " + n);
-                    }
-                    return new PrometheusLabelledSummary(name, detailLevel);
-                });
+        public void unregisterGauge(String name) {
+            GaugeWithCallback gauge = registeredGauges.remove(name);
+            if (gauge != null) {
+                registry.unregister(gauge);
             }
         }
 
-    }
+        @Override
+        public void unregisterGaugeSet(final String name) {
+            Objects.requireNonNull(name, "Cannot unregister GaugeSet with null name");
+            unregisterGauge(name);
+        }
 
-    private class PrometheusCounter implements Counter {
+        private io.prometheus.metrics.core.metrics.Summary createPrometheusSummary(String name, DetailLevel detailLevel,
+                String... labelNames) {
+            io.prometheus.metrics.core.metrics.Summary.Builder builder = io.prometheus.metrics.core.metrics.Summary
+                    .builder().name(name).help(name + " summary").quantile(0.5, 0.05); // Median
 
-        private final io.prometheus.client.Counter inner;
-        private final String name;
+            if (detailLevel == DetailLevel.ADVANCED) {
+                builder.quantile(0.95, 0.05)   // 95th percentile
+                        .quantile(0.99, 0.05); // 99th percentile
+            }
 
-        public PrometheusCounter(String name) {
-            this.name = name;
-            this.inner = io.prometheus.client.Counter
-                    .build(name, name)
-                    .register(collectorRegistry);
+            if (labelNames.length > 0) {
+                builder.labelNames(labelNames);
+            }
+            return builder.register(registry);
         }
 
         @Override
-        public void add(long delta) {
-            try {
-                inner.inc(delta);
-            } catch (IllegalArgumentException err) {
-                LOG.error("invalid delta {} for metric {}", delta, name, err);
-            }
+        public Summary getSummary(String name, DetailLevel detailLevel) {
+            ConcurrentMap<String, PrometheusSummaryWrapper> map = detailLevel == DetailLevel.BASIC ? basicSummaries
+                    : advancedSummaries;
+            return map.computeIfAbsent(name, key -> {
+                if ((detailLevel == DetailLevel.BASIC && advancedSummaries.containsKey(key))
+                        || (detailLevel == DetailLevel.ADVANCED && basicSummaries.containsKey(key))) {
+                    throw new IllegalArgumentException(
+                            "Already registered a summary as " + key + " with a different detail level");
+                }
+                io.prometheus.metrics.core.metrics.Summary prometheusSummary = createPrometheusSummary(key,
+                        detailLevel);
+                return new PrometheusSummaryWrapper(prometheusSummary);
+            });
         }
 
         @Override
-        public long get() {
-            // this method is used only for tests
-            // Prometheus returns a "double"
-            // it is safe to fine to a long
-            // we are never setting non-integer values
-            return (long) inner.get();
+        public SummarySet getSummarySet(String name, DetailLevel detailLevel) {
+            ConcurrentMap<String, PrometheusLabelledSummaryWrapper> map = detailLevel == DetailLevel.BASIC
+                    ? basicSummarySets : advancedSummarySets;
+            return map.computeIfAbsent(name, key -> {
+                if ((detailLevel == DetailLevel.BASIC && advancedSummarySets.containsKey(key))
+                        || (detailLevel == DetailLevel.ADVANCED && basicSummarySets.containsKey(key))) {
+                    throw new IllegalArgumentException(
+                            "Already registered a summary set as " + key + " with a different detail level");
+                }
+                io.prometheus.metrics.core.metrics.Summary prometheusSummary = createPrometheusSummary(key, detailLevel,
+                        LABEL);
+                return new PrometheusLabelledSummaryWrapper(prometheusSummary);
+            });
         }
-
     }
 
-    private class PrometheusGaugeWrapper {
+    // --- Wrapper classes to adapt Prometheus metrics to ZooKeeper's metric interfaces ---
 
-        private final io.prometheus.client.Gauge inner;
-        private final Gauge gauge;
-        private final String name;
+    private static class PrometheusCounterWrapper implements Counter {
+        private final io.prometheus.metrics.core.metrics.Counter prometheusCounter;
 
-        public PrometheusGaugeWrapper(String name, Gauge gauge, io.prometheus.client.Gauge prev) {
-            this.name = name;
-            this.gauge = gauge;
-            this.inner = prev != null ? prev
-                    : io.prometheus.client.Gauge
-                    .build(name, name)
-                    .register(collectorRegistry);
+        public PrometheusCounterWrapper(io.prometheus.metrics.core.metrics.Counter prometheusCounter) {
+            this.prometheusCounter = prometheusCounter;
         }
 
-        /**
-         * Call the callack and update Prometheus Gauge. This method is called
-         * when the server is polling for a value.
-         */
-        private void sample() {
-            Number value = gauge.get();
-            this.inner.set(value != null ? value.doubleValue() : 0);
+        @Override
+        public void add(long delta) {
+            try {
+                this.prometheusCounter.inc(delta);
+            } catch (final IllegalArgumentException e) {
+                LOG.error("invalid delta {} for metric {}", delta, prometheusCounter.getPrometheusName(), e);
+            }
         }
 
-        private void unregister() {
-            collectorRegistry.unregister(inner);
+        @Override
+        public long get() {
+            return (long) this.prometheusCounter.get();
         }
-
     }
 
-    private class PrometheusSummary implements Summary {
+    private static class PrometheusLabelledCounterWrapper implements CounterSet {
+        private final io.prometheus.metrics.core.metrics.Counter prometheusCounter;
 
-        private final io.prometheus.client.Summary inner;
-        private final String name;
-
-        public PrometheusSummary(String name, MetricsContext.DetailLevel level) {
-            this.name = name;
-            if (level == MetricsContext.DetailLevel.ADVANCED) {
-                this.inner = io.prometheus.client.Summary
-                        .build(name, name)
-                        .quantile(0.5, 0.05) // Add 50th percentile (= median) with 5% tolerated error
-                        .quantile(0.9, 0.01) // Add 90th percentile with 1% tolerated error
-                        .quantile(0.99, 0.001) // Add 99th percentile with 0.1% tolerated error
-                        .register(collectorRegistry);
-            } else {
-                this.inner = io.prometheus.client.Summary
-                        .build(name, name)
-                        .quantile(0.5, 0.05) // Add 50th percentile (= median) with 5% tolerated error
-                        .register(collectorRegistry);
-            }
+        public PrometheusLabelledCounterWrapper(io.prometheus.metrics.core.metrics.Counter prometheusCounter) {
+            this.prometheusCounter = prometheusCounter;
         }
 
         @Override
-        public void add(long delta) {
+        public void add(String key, long delta) {
             try {
-                inner.observe(delta);
-            } catch (IllegalArgumentException err) {
-                LOG.error("invalid delta {} for metric {}", delta, name, err);
+                this.prometheusCounter.labelValues(key).inc(delta);
+            } catch (final IllegalArgumentException e) {
+                LOG.error("invalid delta {} for metric {} with key {}", delta, prometheusCounter.getPrometheusName(),
+                        key, e);
             }
         }
 
+        @Override
+        public void inc(String key) {
+            add(key, 1);
+        }
     }
 
-    private class PrometheusLabelledSummary implements SummarySet {
-
-        private final io.prometheus.client.Summary inner;
-        private final String name;
-
-        public PrometheusLabelledSummary(String name, MetricsContext.DetailLevel level) {
-            this.name = name;
-            if (level == MetricsContext.DetailLevel.ADVANCED) {
-                this.inner = io.prometheus.client.Summary
-                        .build(name, name)
-                        .labelNames(LABELS)
-                        .quantile(0.5, 0.05) // Add 50th percentile (= median) with 5% tolerated error
-                        .quantile(0.9, 0.01) // Add 90th percentile with 1% tolerated error
-                        .quantile(0.99, 0.001) // Add 99th percentile with 0.1% tolerated error
-                        .register(collectorRegistry);
-            } else {
-                this.inner = io.prometheus.client.Summary
-                        .build(name, name)
-                        .labelNames(LABELS)
-                        .quantile(0.5, 0.05) // Add 50th percentile (= median) with 5% tolerated error
-                        .register(collectorRegistry);
-            }
+    private static class PrometheusSummaryWrapper implements Summary {
+        private final io.prometheus.metrics.core.metrics.Summary prometheusSummary;
+
+        public PrometheusSummaryWrapper(io.prometheus.metrics.core.metrics.Summary prometheusSummary) {
+            this.prometheusSummary = prometheusSummary;
         }
 
         @Override
-        public void add(String key, long value) {
-            try {
-                inner.labels(key).observe(value);
-            } catch (IllegalArgumentException err) {
-                LOG.error("invalid value {} for metric {} with key {}", value, name, key, err);
-            }
+        public void add(long value) {
+            this.prometheusSummary.observe(value);
         }
-
     }
 
-    class MetricsServletImpl extends MetricsServlet {
+    private static class PrometheusLabelledSummaryWrapper implements SummarySet {
+        private final io.prometheus.metrics.core.metrics.Summary prometheusSummary;
+
+        public PrometheusLabelledSummaryWrapper(io.prometheus.metrics.core.metrics.Summary prometheusSummary) {
+            this.prometheusSummary = prometheusSummary;
+        }
 
         @Override
-        protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
-            // little trick: update the Gauges before serving data
-            // from Prometheus CollectorRegistry
-            sampleGauges();
-            // serve data using Prometheus built in client.
-            super.doGet(req, resp);
+        public void add(String key, long value) {
+            this.prometheusSummary.labelValues(key).observe(value);
         }
     }
 }
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusRegistryDumper.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusRegistryDumper.java
new file mode 100644
index 00000000000..146f761595e
--- /dev/null
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusRegistryDumper.java
@@ -0,0 +1,160 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.metrics.prometheus;
+
+import io.prometheus.metrics.model.registry.PrometheusRegistry;
+import io.prometheus.metrics.model.snapshots.CounterSnapshot;
+import io.prometheus.metrics.model.snapshots.GaugeSnapshot;
+import io.prometheus.metrics.model.snapshots.Labels;
+import io.prometheus.metrics.model.snapshots.MetricSnapshot;
+import io.prometheus.metrics.model.snapshots.MetricSnapshots;
+import io.prometheus.metrics.model.snapshots.Quantile;
+import io.prometheus.metrics.model.snapshots.SummarySnapshot;
+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+
+/**
+ * Handles the logic of converting a PrometheusRegistry scrape result into a sequence of key-value pairs.
+ */
+public class PrometheusRegistryDumper {
+
+    private final PrometheusRegistry registry;
+
+    public PrometheusRegistryDumper(PrometheusRegistry registry) {
+        this.registry = registry;
+    }
+
+    /**
+     * Dumps all metrics from the PrometheusRegistry into a key-value map.
+     *
+     * @return a map containing all the metrics
+     */
+    public Map<String, Object> dump() {
+        Map<String, Object> allMetrics = new LinkedHashMap<>();
+        MetricSnapshots metricSnapshots = registry.scrape();
+        for (MetricSnapshot snapshot : metricSnapshots) {
+            Map<String, Object> convertedMetrics = null;
+            if (snapshot instanceof CounterSnapshot) {
+                convertedMetrics = convert((CounterSnapshot) snapshot);
+            } else if (snapshot instanceof GaugeSnapshot) {
+                convertedMetrics = convert((GaugeSnapshot) snapshot);
+            } else if (snapshot instanceof SummarySnapshot) {
+                convertedMetrics = convert((SummarySnapshot) snapshot);
+            }
+
+            if (convertedMetrics != null) {
+                allMetrics.putAll(convertedMetrics);
+            }
+        }
+        return allMetrics;
+    }
+
+    private Map<String, Object> convert(CounterSnapshot snapshot) {
+        Map<String, Object> result = new LinkedHashMap<>();
+        String metricName = snapshot.getMetadata().getName();
+        for (CounterSnapshot.CounterDataPointSnapshot dataPoint : snapshot.getDataPoints()) {
+            result.put(buildKeyForDump(metricName, dataPoint.getLabels()), dataPoint.getValue());
+        }
+        return result;
+    }
+
+    private Map<String, Object> convert(GaugeSnapshot snapshot) {
+        Map<String, Object> result = new LinkedHashMap<>();
+        String metricName = snapshot.getMetadata().getName();
+        for (GaugeSnapshot.GaugeDataPointSnapshot dataPoint : snapshot.getDataPoints()) {
+            result.put(buildKeyForDump(metricName, dataPoint.getLabels()), dataPoint.getValue());
+        }
+        return result;
+    }
+
+    private Map<String, Object> convert(SummarySnapshot snapshot) {
+        Map<String, Object> result = new LinkedHashMap<>();
+        String metricName = snapshot.getMetadata().getName();
+        for (SummarySnapshot.SummaryDataPointSnapshot dataPoint : snapshot.getDataPoints()) {
+            double count = dataPoint.getCount();
+            double sum = dataPoint.getSum();
+            double avg = (count == 0) ? 0 : sum / count;
+
+            // Add metrics in the requested order with prefixes
+            result.put(buildKeyForDump(metricName + "_avg", dataPoint.getLabels()), avg);
+            // Note: Prometheus Summary does not provide min/max, so they are omitted.
+            result.put(buildKeyForDump(metricName + "_count", dataPoint.getLabels()), count);
+            result.put(buildKeyForDump(metricName + "_sum", dataPoint.getLabels()), sum);
+
+            // A summary is considered "advanced" if it has more than one quantile configured.
+            boolean isAdvanced = dataPoint.getQuantiles().size() > 1;
+
+            if (isAdvanced) {
+                List<Quantile> quantiles = new ArrayList<>();
+                dataPoint.getQuantiles().forEach(quantiles::add);
+                quantiles.sort(Comparator.comparingDouble(Quantile::getQuantile));
+
+                for (Quantile quantile : quantiles) {
+                    String quantileValue = String.valueOf(quantile.getQuantile());
+                    switch (quantileValue) {
+                    default:
+                        break;
+                    case "0.5":
+                        result.put(buildKeyForDump(metricName, dataPoint.getLabels().add("quantile", quantileValue)),
+                                quantile.getValue());
+                        break;
+                    case "0.95":
+                        result.put(buildKeyForDump(metricName, dataPoint.getLabels().add("quantile", quantileValue)),
+                                quantile.getValue());
+                        break;
+                    case "0.99":
+                        result.put(buildKeyForDump(metricName, dataPoint.getLabels().add("quantile", quantileValue)),
+                                quantile.getValue());
+                        break;
+                    }
+                }
+            }
+        }
+        return result;
+    }
+
+    /**
+     * Builds a string key for a given metric and its labels, in a format suitable for the dump output.
+     *
+     * @param metricName
+     *            the name of the metric
+     * @param labels
+     *            the labels associated with the metric
+     *
+     * @return a formatted string key
+     */
+    private String buildKeyForDump(String metricName, Labels labels) {
+        StringBuilder sb = new StringBuilder();
+        sb.append(metricName);
+        if (labels.size() > 0) {
+            sb.append("{");
+            for (int i = 0; i < labels.size(); i++) {
+                if (i > 0) {
+                    sb.append(",");
+                }
+                sb.append(labels.getName(i)).append("=\"").append(labels.getValue(i)).append("\"");
+            }
+            sb.append("}");
+        }
+        return sb.toString();
+    }
+}
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/ExportJvmInfoTest.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/ExportJvmInfoTest.java
index fb5353d83dc..a923348f758 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/ExportJvmInfoTest.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/ExportJvmInfoTest.java
@@ -18,16 +18,14 @@
 
 package org.apache.zookeeper.metrics.prometheus;
 
-import static org.junit.Assert.assertEquals;
-import io.prometheus.client.CollectorRegistry;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.util.Properties;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 /**
- * Tests about Prometheus Metrics Provider. Please note that we are not testing
- * Prometheus but our integration.
+ * Tests about Prometheus Metrics Provider. Please note that we are not testing Prometheus but our integration.
  */
-public class ExportJvmInfoTest {
+public class ExportJvmInfoTest extends PrometheusMetricsTestBase {
 
     @Test
     public void exportInfo() throws Exception {
@@ -40,7 +38,6 @@ public void doNotExportInfo() throws Exception {
     }
 
     private void runTest(boolean exportJvmInfo) throws Exception {
-        CollectorRegistry.defaultRegistry.clear();
         PrometheusMetricsProvider provider = new PrometheusMetricsProvider();
         try {
             Properties configuration = new Properties();
@@ -48,7 +45,7 @@ private void runTest(boolean exportJvmInfo) throws Exception {
             configuration.setProperty("exportJvmInfo", exportJvmInfo + "");
             provider.configure(configuration);
             provider.start();
-            boolean[] found = {false};
+            boolean[] found = { false };
             provider.dump((k, v) -> {
                 found[0] = found[0] || k.contains("heap");
             });
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusHttpsMetricsProviderTest.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusHttpsMetricsProviderTest.java
new file mode 100644
index 00000000000..53332e24f8d
--- /dev/null
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusHttpsMetricsProviderTest.java
@@ -0,0 +1,220 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.metrics.prometheus;
+
+import static org.hamcrest.CoreMatchers.containsString;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import ch.qos.logback.classic.Logger;
+import ch.qos.logback.classic.spi.ILoggingEvent;
+import ch.qos.logback.core.read.ListAppender;
+import java.io.BufferedReader;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.io.InputStreamReader;
+import java.net.HttpURLConnection;
+import java.net.URL;
+import java.security.KeyStore;
+import java.util.Properties;
+import javax.net.ssl.HttpsURLConnection;
+import javax.net.ssl.KeyManagerFactory;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.TrustManagerFactory;
+import org.apache.zookeeper.metrics.Counter;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Tests about Prometheus Metrics Provider. Please note that we are not testing Prometheus but only our integration.
+ */
+public class PrometheusHttpsMetricsProviderTest extends PrometheusMetricsTestBase {
+
+    private PrometheusMetricsProvider provider;
+    private final String httpHost = "127.0.0.1";
+    private final int httpsPort = 4443;
+    private final int httpPort = 4000;
+    private final String testDataPath = System.getProperty("test.data.dir", "src/test/resources/data");
+
+    public void initializeProviderWithCustomConfig(Properties inputConfiguration) throws Exception {
+        provider = new PrometheusMetricsProvider();
+        Properties configuration = new Properties();
+        configuration.setProperty("httpHost", httpHost);
+        configuration.setProperty("exportJvmInfo", "false");
+        configuration.setProperty("ssl.keyStore.location", testDataPath + "/ssl/server_keystore.jks");
+        configuration.setProperty("ssl.keyStore.password", "testpass");
+        configuration.setProperty("ssl.trustStore.location", testDataPath + "/ssl/server_truststore.jks");
+        configuration.setProperty("ssl.trustStore.password", "testpass");
+        configuration.putAll(inputConfiguration);
+        provider.configure(configuration);
+        provider.start();
+    }
+
+    @AfterEach
+    public void tearDown() {
+        if (provider != null) {
+            provider.stop();
+        }
+    }
+
+    @Test
+    void testHttpResponse() throws Exception {
+        Properties configuration = new Properties();
+        configuration.setProperty("httpPort", String.valueOf(httpPort));
+        initializeProviderWithCustomConfig(configuration);
+        simulateMetricIncrement();
+        String metricsUrl = String.format("http://%s:%d/metrics", httpHost, httpPort);
+
+        HttpURLConnection conn = callAndGetResponse(metricsUrl, "GET");
+        validateMetricResponse(readResponse(conn));
+
+        conn = callAndGetResponse(metricsUrl, "TRACE");
+        assertEquals(HttpURLConnection.HTTP_BAD_METHOD, conn.getResponseCode());
+        conn.disconnect();
+    }
+
+    @Test
+    void testHttpsResponse() throws Exception {
+        Properties configuration = new Properties();
+        configuration.setProperty("httpsPort", String.valueOf(httpsPort));
+        initializeProviderWithCustomConfig(configuration);
+        simulateMetricIncrement();
+        String metricsUrl = String.format("https://%s:%d/metrics", httpHost, httpsPort);
+
+        HttpURLConnection conn = callAndGetResponse(metricsUrl, "GET");
+        validateMetricResponse(readResponse(conn));
+
+        conn = callAndGetResponse(metricsUrl, "TRACE");
+        assertEquals(HttpURLConnection.HTTP_BAD_METHOD, conn.getResponseCode());
+        conn.disconnect();
+    }
+
+    @Test
+    void testHttpAndHttpsResponse() throws Exception {
+        Properties configuration = new Properties();
+        configuration.setProperty("httpsPort", String.valueOf(httpsPort));
+        configuration.setProperty("httpPort", String.valueOf(httpPort));
+        initializeProviderWithCustomConfig(configuration);
+        simulateMetricIncrement();
+
+        HttpURLConnection conn = callAndGetResponse(String.format("https://%s:%d/metrics", httpHost, httpsPort), "GET");
+        validateMetricResponse(readResponse(conn));
+    }
+
+    private HttpURLConnection callAndGetResponse(String urlString, String method) throws Exception {
+        URL url = new URL(urlString);
+        HttpURLConnection conn;
+
+        if (url.getProtocol().equalsIgnoreCase("https")) {
+            // Re-use the existing SSL setup logic.
+            KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
+            try (FileInputStream keystoreStream = new FileInputStream(testDataPath + "/ssl/client_keystore.jks")) {
+                keyStore.load(keystoreStream, "testpass".toCharArray());
+            }
+
+            KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
+            try (FileInputStream trustStoreStream = new FileInputStream(testDataPath + "/ssl/client_truststore.jks")) {
+                trustStore.load(trustStoreStream, "testpass".toCharArray());
+            }
+
+            SSLContext sslContext = SSLContext.getInstance("TLS");
+            KeyManagerFactory keyManagerFactory = KeyManagerFactory
+                    .getInstance(KeyManagerFactory.getDefaultAlgorithm());
+            keyManagerFactory.init(keyStore, "testpass".toCharArray());
+            TrustManagerFactory trustManagerFactory = TrustManagerFactory
+                    .getInstance(TrustManagerFactory.getDefaultAlgorithm());
+            trustManagerFactory.init(trustStore);
+            sslContext.init(keyManagerFactory.getKeyManagers(), trustManagerFactory.getTrustManagers(),
+                    new java.security.SecureRandom());
+
+            HttpsURLConnection httpsConn = (HttpsURLConnection) url.openConnection();
+            httpsConn.setSSLSocketFactory(sslContext.getSocketFactory());
+            httpsConn.setHostnameVerifier((hostname, session) -> true);
+            conn = httpsConn;
+        } else {
+            conn = (HttpURLConnection) url.openConnection();
+        }
+
+        conn.setRequestMethod(method);
+        conn.connect();
+        return conn;
+    }
+
+    private String readResponse(HttpURLConnection connection) throws IOException {
+        int status = connection.getResponseCode();
+        try (BufferedReader reader = new BufferedReader(
+                new InputStreamReader(status > 299 ? connection.getErrorStream() : connection.getInputStream()))) {
+            StringBuilder content = new StringBuilder();
+            String inputLine;
+            while ((inputLine = reader.readLine()) != null) {
+                content.append(inputLine).append("\n");
+            }
+            return content.toString().trim();
+        } finally {
+            connection.disconnect();
+        }
+    }
+
+    public void simulateMetricIncrement() {
+        Counter counter = provider.getRootContext().getCounter("cc");
+        counter.add(10);
+    }
+
+    private void validateMetricResponse(String response) throws IOException {
+        assertThat(response, containsString("# TYPE cc_total counter"));
+        assertThat(response, containsString("cc_total 10.0"));
+    }
+
+    @Test
+    void testLogRedactorRedactsPasswords() throws Exception {
+        Logger logger = (Logger) LoggerFactory.getLogger(PrometheusMetricsProvider.class);
+        ListAppender<ILoggingEvent> listAppender = new ListAppender<>();
+        listAppender.start();
+        logger.addAppender(listAppender);
+
+        try {
+            provider = new PrometheusMetricsProvider();
+            Properties configuration = new Properties();
+            configuration.setProperty("httpPort", String.valueOf(httpPort));
+            configuration.setProperty("httpsPort", String.valueOf(httpsPort));
+            configuration.setProperty("ssl.keyStore.location", testDataPath + "/ssl/server_keystore.jks");
+            configuration.setProperty("ssl.keyStore.password", "SuperSecret123!");
+            configuration.setProperty("ssl.trustStore.location", testDataPath + "/ssl/server_truststore.jks");
+            configuration.setProperty("ssl.trustStore.password", "AnotherSecret456!");
+            provider.configure(configuration);
+
+            String logOutput = listAppender.list.stream()
+                    .map(ILoggingEvent::getFormattedMessage)
+                    .filter(msg -> msg.contains("configuration"))
+                    .findFirst()
+                    .orElse("");
+
+            assertFalse(logOutput.contains("SuperSecret123!"),
+                    "Logs should not contain keyStore password");
+            assertFalse(logOutput.contains("AnotherSecret456!"),
+                    "Logs should not contain trustStore password");
+            assertTrue(logOutput.contains(testDataPath + "/ssl/server_keystore.jks"),
+                    "Logs should still contain non-sensitive config like keyStore location");
+        } finally {
+            logger.detachAppender(listAppender);
+        }
+    }
+}
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderConfigTest.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderConfigTest.java
new file mode 100644
index 00000000000..66a01fb95e7
--- /dev/null
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderConfigTest.java
@@ -0,0 +1,311 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.metrics.prometheus;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.UnrecoverableKeyException;
+import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
+import java.util.Properties;
+import javax.net.ssl.KeyManager;
+import javax.net.ssl.KeyManagerFactory;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLHandshakeException;
+import javax.net.ssl.SSLSocket;
+import javax.net.ssl.SSLSocketFactory;
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.X509TrustManager;
+import org.apache.zookeeper.metrics.MetricsProviderLifeCycleException;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+public class PrometheusMetricsProviderConfigTest extends PrometheusMetricsTestBase {
+
+    private static final String KEYSTORE_TYPE_JKS = "JKS";
+    private static final String PASSWORD = "testpass";
+
+    private String keyStorePath;
+    private String trustStorePath;
+    private PrometheusMetricsProvider provider;
+
+    @BeforeEach
+    public void setup() {
+        String testDataPath = System.getProperty("test.data.dir", "src/test/resources/data");
+        keyStorePath = testDataPath + "/ssl/server_keystore.jks";
+        trustStorePath = testDataPath + "/ssl/server_truststore.jks";
+    }
+
+    @AfterEach
+    public void tearDown() {
+        if (provider != null) {
+            provider.stop();
+        }
+    }
+
+    @Test
+    public void testInvalidPort() throws MetricsProviderLifeCycleException {
+        provider = new PrometheusMetricsProvider();
+        Properties configuration = new Properties();
+        configuration.setProperty(PrometheusMetricsProvider.HTTP_PORT, "65536");
+        configuration.setProperty(PrometheusMetricsProvider.EXPORT_JVM_INFO, "false");
+        provider.configure(configuration);
+
+        MetricsProviderLifeCycleException exception =
+                assertThrows(MetricsProviderLifeCycleException.class, provider::start);
+
+        assertEquals("Failed to start Prometheus Jetty server", exception.getMessage());
+        assertNotNull(exception.getCause());
+        assertEquals("port out of range:65536", exception.getCause().getMessage());
+    }
+
+    @Test
+    public void testNoPortSet() {
+        provider = new PrometheusMetricsProvider();
+        Properties configuration = new Properties();
+        // Do not set HTTP port and HTTPS port here.
+
+        MetricsProviderLifeCycleException exception =
+                assertThrows(MetricsProviderLifeCycleException.class, () -> provider.configure(configuration));
+
+        assertEquals("Either httpPort or httpsPort must be configured for Prometheus exporter.",
+                exception.getMessage());
+    }
+
+    @Test
+    public void testInvalidAddr() throws MetricsProviderLifeCycleException {
+        provider = new PrometheusMetricsProvider();
+        Properties configuration = new Properties();
+        configuration.setProperty(PrometheusMetricsProvider.HTTP_HOST, "master");
+        configuration.setProperty(PrometheusMetricsProvider.HTTP_PORT, "0");
+        provider.configure(configuration);
+
+        MetricsProviderLifeCycleException exception =
+                assertThrows(MetricsProviderLifeCycleException.class, provider::start);
+
+        assertEquals("Failed to start Prometheus Jetty server", exception.getMessage());
+        assertNotNull(exception.getCause());
+        assertEquals("Failed to bind to master:0", exception.getCause().getMessage());
+    }
+
+    @Test
+    public void testValidConfig() throws MetricsProviderLifeCycleException {
+        provider = new PrometheusMetricsProvider();
+        Properties configuration = new Properties();
+        configuration.setProperty(PrometheusMetricsProvider.HTTP_HOST, "0.0.0.0");
+        configuration.setProperty(PrometheusMetricsProvider.HTTP_PORT, "0");
+        provider.configure(configuration);
+        provider.start();
+    }
+
+    @Test
+    public void testValidSslConfig() throws MetricsProviderLifeCycleException {
+        provider = new PrometheusMetricsProvider();
+        Properties configuration = new Properties();
+
+        configuration.setProperty(PrometheusMetricsProvider.HTTP_HOST, "127.0.0.1");
+        configuration.setProperty(PrometheusMetricsProvider.HTTPS_PORT, "0");
+        configuration.setProperty(PrometheusMetricsProvider.SSL_KEYSTORE_LOCATION, keyStorePath);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_KEYSTORE_PASSWORD, PASSWORD);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_TRUSTSTORE_LOCATION, trustStorePath);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_TRUSTSTORE_PASSWORD, PASSWORD);
+        provider.configure(configuration);
+        provider.start();
+    }
+
+    @Test
+    public void testValidHttpsAndHttpConfig() throws MetricsProviderLifeCycleException {
+        provider = new PrometheusMetricsProvider();
+        Properties configuration = new Properties();
+        configuration.setProperty(PrometheusMetricsProvider.HTTP_PORT, "0");
+        configuration.setProperty(PrometheusMetricsProvider.HTTPS_PORT, "0");
+        configuration.setProperty(PrometheusMetricsProvider.SSL_KEYSTORE_LOCATION, keyStorePath);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_KEYSTORE_PASSWORD, PASSWORD);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_TRUSTSTORE_LOCATION, trustStorePath);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_TRUSTSTORE_PASSWORD, PASSWORD);
+        provider.configure(configuration);
+        provider.start();
+    }
+
+    @Test
+    public void testInvalidSslConfig() throws MetricsProviderLifeCycleException {
+        provider = new PrometheusMetricsProvider();
+        Properties configuration = new Properties();
+        configuration.setProperty(PrometheusMetricsProvider.HTTPS_PORT, "50514");
+        // keystore missing
+        configuration.setProperty(PrometheusMetricsProvider.SSL_KEYSTORE_PASSWORD, PASSWORD);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_TRUSTSTORE_LOCATION, trustStorePath);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_TRUSTSTORE_PASSWORD, PASSWORD);
+        provider.configure(configuration);
+
+        MetricsProviderLifeCycleException exception =
+                assertThrows(MetricsProviderLifeCycleException.class, provider::start);
+
+        assertEquals("Failed to start Prometheus Jetty server", exception.getMessage());
+        assertNotNull(exception.getCause());
+        assertEquals(
+                "SSL/TLS is enabled, but 'ssl.keyStore.location' is not set.",
+                exception.getCause().getMessage());
+    }
+
+    @Test
+    public void testHandshakeWithSupportedProtocol() throws Exception {
+        provider = new PrometheusMetricsProvider();
+        Properties configuration = new Properties();
+        configuration.setProperty(PrometheusMetricsProvider.HTTP_HOST, "127.0.0.1");
+        configuration.setProperty(PrometheusMetricsProvider.HTTPS_PORT, "7000");
+        configuration.setProperty(PrometheusMetricsProvider.SSL_KEYSTORE_LOCATION, keyStorePath);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_KEYSTORE_PASSWORD, PASSWORD);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_TRUSTSTORE_LOCATION, trustStorePath);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_TRUSTSTORE_PASSWORD, PASSWORD);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_ENABLED_PROTOCOLS, "TLSv1.3");
+        provider.configure(configuration);
+        provider.start();
+
+        // Use a raw SSLSocket to verify the handshake
+        SSLContext sslContext = createSSLContext(keyStorePath, PASSWORD.toCharArray(), "TLSv1.3");
+        SSLSocketFactory factory = sslContext.getSocketFactory();
+
+        try (SSLSocket socket = (SSLSocket) factory.createSocket("localhost", 7000)) {
+            socket.startHandshake();
+            String negotiatedProtocol = socket.getSession().getProtocol();
+
+            // Verify that we actually landed on the protocol we expected
+            assertEquals("TLSv1.3", negotiatedProtocol,
+                    "The negotiated protocol should be TLSv1.3.");
+        }
+    }
+
+    @Test
+    public void testHandshakeWithUnsupportedProtocolFails() throws Exception {
+        provider = new PrometheusMetricsProvider();
+        Properties configuration = new Properties();
+        configuration.setProperty(PrometheusMetricsProvider.HTTP_HOST, "127.0.0.1");
+        configuration.setProperty(PrometheusMetricsProvider.HTTPS_PORT, "7000");
+        configuration.setProperty(PrometheusMetricsProvider.SSL_KEYSTORE_LOCATION, keyStorePath);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_KEYSTORE_PASSWORD, PASSWORD);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_TRUSTSTORE_LOCATION, trustStorePath);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_TRUSTSTORE_PASSWORD, PASSWORD);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_ENABLED_PROTOCOLS, "TLSv1.3");
+        provider.configure(configuration);
+        provider.start();
+
+        SSLContext sslContext = createSSLContext(keyStorePath, PASSWORD.toCharArray(), "TLSv1.1");
+        SSLSocketFactory factory = sslContext.getSocketFactory();
+
+        try (SSLSocket socket = (SSLSocket) factory.createSocket("localhost", 7000)) {
+            SSLHandshakeException exception = assertThrows(SSLHandshakeException.class, socket::startHandshake);
+            assertEquals(
+                    "No appropriate protocol (protocol is disabled or cipher suites are inappropriate)",
+                    exception.getMessage(),
+                    "The handshake should have failed due to a protocol mismatch.");
+        }
+    }
+
+    @Test
+    public void testCipherMismatchFails() throws Exception {
+        provider = new PrometheusMetricsProvider();
+        Properties configuration = new Properties();
+        configuration.setProperty(PrometheusMetricsProvider.HTTP_HOST, "127.0.0.1");
+        configuration.setProperty(PrometheusMetricsProvider.HTTPS_PORT, "7000");
+        configuration.setProperty(PrometheusMetricsProvider.SSL_KEYSTORE_LOCATION, keyStorePath);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_KEYSTORE_PASSWORD, PASSWORD);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_TRUSTSTORE_LOCATION, trustStorePath);
+        configuration.setProperty(PrometheusMetricsProvider.SSL_TRUSTSTORE_PASSWORD, PASSWORD);
+        System.setProperty(PrometheusMetricsProvider.SSL_ENABLED_CIPHERS,
+                "TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384");
+        provider.configure(configuration);
+        provider.start();
+
+        SSLContext sslContext = createSSLContext(keyStorePath, PASSWORD.toCharArray(), "TLSv1.2");
+        SSLSocketFactory factory = sslContext.getSocketFactory();
+
+        try (SSLSocket socket = (SSLSocket) factory.createSocket("localhost", 7000)) {
+            // Force the client to use a cipher NOT enabled for the AdminServer
+            String[] unsupportedCiphers = new String[]{"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"};
+            socket.setEnabledCipherSuites(unsupportedCiphers);
+
+            assertThrows(SSLHandshakeException.class, socket::startHandshake,
+                    "The handshake should have failed due to a cipher mismatch.");
+        }
+    }
+
+    private SSLContext createSSLContext(String keystorePath, char[] password, String protocol)
+            throws Exception {
+        KeyManager[] keyManagers = getKeyManagers(keystorePath, password);
+        TrustManager[] trustAllCerts = getTrustAllCerts();
+
+        SSLContext sslContext = SSLContext.getInstance(protocol);
+        sslContext.init(keyManagers, trustAllCerts, null);
+
+        return sslContext;
+    }
+
+    private static KeyManager[] getKeyManagers(String keystorePath, char[] password) throws KeyStoreException,
+            IOException, NoSuchAlgorithmException, CertificateException, UnrecoverableKeyException {
+        KeyStore keyStore = KeyStore.getInstance(KEYSTORE_TYPE_JKS);
+        try (FileInputStream fis = new FileInputStream(keystorePath)) {
+            keyStore.load(fis, password);
+        }
+
+        KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
+        kmf.init(keyStore, password);
+        return kmf.getKeyManagers();
+    }
+
+    public TrustManager[] getTrustAllCerts() {
+        // This is OK for testing.
+        return new TrustManager[]{
+                new X509TrustManager() {
+                    public X509Certificate[] getAcceptedIssuers() {
+                        return null;
+                    }
+
+                    public void checkClientTrusted(X509Certificate[] certs, String authType) {
+                    }
+
+                    public void checkServerTrusted(X509Certificate[] certs, String authType) {
+                    }
+                }
+        };
+    }
+
+    @Test
+    public void testPortUnification() throws Exception {
+        int unifiedPort = 5400;
+        Properties configuration = new Properties();
+        configuration.setProperty("httpsPort", String.valueOf(unifiedPort));
+        configuration.setProperty("httpPort", String.valueOf(unifiedPort));
+        String testDataPath = System.getProperty("test.data.dir", "src/test/resources/data");
+        configuration.setProperty("ssl.keyStore.location", testDataPath + "/ssl/server_keystore.jks");
+        configuration.setProperty("ssl.keyStore.password", "testpass");
+        configuration.setProperty("ssl.trustStore.location", testDataPath + "/ssl/server_truststore.jks");
+        configuration.setProperty("ssl.trustStore.password", "testpass");
+        PrometheusMetricsProvider provider = new PrometheusMetricsProvider();
+        provider.configure(configuration);
+        provider.start();
+    }
+}
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java
index 2d691db4f86..2d36b001763 100644
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java
@@ -19,68 +19,81 @@
 package org.apache.zookeeper.metrics.prometheus;
 
 import static org.hamcrest.CoreMatchers.containsString;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertSame;
-import static org.junit.Assert.assertThat;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
-import io.prometheus.client.CollectorRegistry;
+import java.io.ByteArrayOutputStream;
 import java.io.IOException;
-import java.io.PrintWriter;
-import java.io.StringWriter;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
 import java.util.Properties;
+import java.util.concurrent.atomic.AtomicInteger;
 import javax.servlet.ServletException;
+import javax.servlet.ServletOutputStream;
+import javax.servlet.WriteListener;
+import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import org.apache.zookeeper.metrics.Counter;
+import org.apache.zookeeper.metrics.CounterSet;
 import org.apache.zookeeper.metrics.Gauge;
+import org.apache.zookeeper.metrics.GaugeSet;
 import org.apache.zookeeper.metrics.MetricsContext;
 import org.apache.zookeeper.metrics.Summary;
+import org.apache.zookeeper.metrics.SummarySet;
+import org.apache.zookeeper.server.util.QuotaMetricsUtils;
 import org.hamcrest.CoreMatchers;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 /**
- * Tests about Prometheus Metrics Provider. Please note that we are not testing
- * Prometheus but only our integration.
+ * Tests about Prometheus Metrics Provider. Please note that we are not testing Prometheus but only our integration.
  */
-public class PrometheusMetricsProviderTest {
+public class PrometheusMetricsProviderTest extends PrometheusMetricsTestBase {
 
+    private static final String URL_FORMAT = "http://localhost:%d/metrics";
     private PrometheusMetricsProvider provider;
 
-    @Before
+    @BeforeEach
     public void setup() throws Exception {
-        CollectorRegistry.defaultRegistry.clear();
         provider = new PrometheusMetricsProvider();
         Properties configuration = new Properties();
+        configuration.setProperty("numWorkerThreads", "1"); // sync behavior for test
+        configuration.setProperty("httpHost", "127.0.0.1"); // local host for test
         configuration.setProperty("httpPort", "0"); // ephemeral port
         configuration.setProperty("exportJvmInfo", "false");
         provider.configure(configuration);
         provider.start();
     }
 
-    @After
+    @AfterEach
     public void tearDown() {
         if (provider != null) {
             provider.stop();
         }
-        CollectorRegistry.defaultRegistry.clear();
     }
 
     @Test
     public void testCounters() throws Exception {
         Counter counter = provider.getRootContext().getCounter("cc");
         counter.add(10);
-        int[] count = {0};
+        int[] count = { 0 };
         provider.dump((k, v) -> {
             assertEquals("cc", k);
             assertEquals(10, ((Number) v).intValue());
             count[0]++;
-        }
-        );
+        });
         assertEquals(1, count[0]);
         count[0] = 0;
 
@@ -91,22 +104,120 @@ public void testCounters() throws Exception {
             assertEquals("cc", k);
             assertEquals(10, ((Number) v).intValue());
             count[0]++;
-        }
-        );
+        });
         assertEquals(1, count[0]);
 
         // we always must get the same object
         assertSame(counter, provider.getRootContext().getCounter("cc"));
 
         String res = callServlet();
-        assertThat(res, CoreMatchers.containsString("# TYPE cc counter"));
-        assertThat(res, CoreMatchers.containsString("cc 10.0"));
+        assertThat(res, CoreMatchers.containsString("# TYPE cc_total counter"));
+        assertThat(res, CoreMatchers.containsString("cc_total 10.0"));
+    }
+
+    @Test
+    public void testCounterSet_single() throws Exception {
+        // create and register a CounterSet
+        final String name = QuotaMetricsUtils.QUOTA_EXCEEDED_ERROR_PER_NAMESPACE;
+        final CounterSet counterSet = provider.getRootContext().getCounterSet(name);
+        final String[] keys = { "ns1", "ns2" };
+        final int count = 3;
+
+        // update the CounterSet multiple times
+        for (int i = 0; i < count; i++) {
+            Arrays.asList(keys).forEach(key -> counterSet.inc(key));
+            Arrays.asList(keys).forEach(key -> counterSet.add(key, 2));
+        }
+
+        // validate with dump call
+        final Map<String, Number> expectedMetricsMap = new HashMap<>();
+        for (final String key : keys) {
+            expectedMetricsMap.put(String.format("%s{key=\"%s\"}", name, key), count * 3.0);
+        }
+        validateWithDump(expectedMetricsMap);
+
+        // validate with servlet call
+        final List<String> expectedNames = Collections.singletonList(String.format("# TYPE %s_total counter", name));
+        final List<String> expectedMetrics = new ArrayList<>();
+        for (final String key : keys) {
+            expectedMetrics.add(String.format("%s_total{key=\"%s\"} %s", name, key, count * 3.0));
+        }
+        validateWithServletCall(expectedNames, expectedMetrics);
+
+        // validate registering with same name, no overwriting
+        assertSame(counterSet, provider.getRootContext().getCounterSet(name));
+    }
+
+    @Test
+    public void testCounterSet_multiple() throws Exception {
+        final String name = QuotaMetricsUtils.QUOTA_EXCEEDED_ERROR_PER_NAMESPACE;
+
+        final String[] names = new String[] { name + "_1", name + "_2" };
+        final String[] keys = new String[] { "ns21", "ns22" };
+        final int[] counts = new int[] { 3, 5 };
+
+        final int length = names.length;
+        final CounterSet[] counterSets = new CounterSet[length];
+
+        // create and register the CounterSets
+        for (int i = 0; i < length; i++) {
+            counterSets[i] = provider.getRootContext().getCounterSet(names[i]);
+        }
+
+        // update each CounterSet multiple times
+        for (int i = 0; i < length; i++) {
+            for (int j = 0; j < counts[i]; j++) {
+                counterSets[i].inc(keys[i]);
+            }
+        }
+
+        // validate with dump call
+        final Map<String, Number> expectedMetricsMap = new HashMap<>();
+        for (int i = 0; i < length; i++) {
+            expectedMetricsMap.put(String.format("%s{key=\"%s\"}", names[i], keys[i]), counts[i] * 1.0);
+        }
+        validateWithDump(expectedMetricsMap);
+
+        // validate with servlet call
+        final List<String> expectedNames = new ArrayList<>();
+        final List<String> expectedMetrics = new ArrayList<>();
+        for (int i = 0; i < length; i++) {
+            expectedNames.add(String.format("# TYPE %s_total counter", names[i]));
+            expectedMetrics.add(String.format("%s_total{key=\"%s\"} %s", names[i], keys[i], counts[i] * 1.0));
+        }
+        validateWithServletCall(expectedNames, expectedMetrics);
+    }
+
+    @Test
+    public void testCounterSet_registerWithNullName() {
+        assertThrows(NullPointerException.class, () -> provider.getRootContext().getCounterSet(null));
+    }
+
+    @Test
+    public void testCounterSet_negativeValue() {
+        // create and register a CounterSet
+        final String name = QuotaMetricsUtils.QUOTA_EXCEEDED_ERROR_PER_NAMESPACE;
+        final CounterSet counterSet = provider.getRootContext().getCounterSet(name);
+
+        // add negative value and make sure no exception is thrown
+        counterSet.add("ns1", -1);
+    }
+
+    @Test
+    public void testCounterSet_nullKey() {
+        // create and register a CounterSet
+        final String name = QuotaMetricsUtils.QUOTA_EXCEEDED_ERROR_PER_NAMESPACE;
+        final CounterSet counterSet = provider.getRootContext().getCounterSet(name);
+
+        // increment the count with null key and make sure no exception is thrown
+        counterSet.inc(null);
+        counterSet.add(null, 2);
     }
 
     @Test
     public void testGauge() throws Exception {
-        int[] values = {78, -89};
-        int[] callCounts = {0, 0};
+        int[] values = { 78, -89 };
+        int[] callCounts = { 0, 0 };
         Gauge gauge0 = () -> {
             callCounts[0]++;
             return values[0];
@@ -117,13 +228,12 @@ public void testGauge() throws Exception {
         };
         provider.getRootContext().registerGauge("gg", gauge0);
 
-        int[] count = {0};
+        int[] count = { 0 };
         provider.dump((k, v) -> {
             assertEquals("gg", k);
             assertEquals(values[0], ((Number) v).intValue());
             count[0]++;
-        }
-        );
+        });
         assertEquals(1, callCounts[0]);
         assertEquals(0, callCounts[1]);
         assertEquals(1, count[0]);
@@ -135,8 +245,7 @@ public void testGauge() throws Exception {
         provider.getRootContext().unregisterGauge("gg");
         provider.dump((k, v) -> {
             count[0]++;
-        }
-        );
+        });
         assertEquals(2, callCounts[0]);
         assertEquals(0, callCounts[1]);
         assertEquals(0, count[0]);
@@ -149,8 +258,7 @@ public void testGauge() throws Exception {
             assertEquals("gg", k);
             assertEquals(values[1], ((Number) v).intValue());
             count[0]++;
-        }
-        );
+        });
         assertEquals(2, callCounts[0]);
         assertEquals(1, callCounts[1]);
         assertEquals(1, count[0]);
@@ -168,8 +276,7 @@ public void testGauge() throws Exception {
 
         provider.dump((k, v) -> {
             count[0]++;
-        }
-        );
+        });
         assertEquals(1, count[0]);
         assertEquals(3, callCounts[0]);
         assertEquals(2, callCounts[1]);
@@ -177,41 +284,37 @@ public void testGauge() throws Exception {
 
     @Test
     public void testBasicSummary() throws Exception {
-        Summary summary = provider.getRootContext()
-                .getSummary("cc", MetricsContext.DetailLevel.BASIC);
+        Summary summary = provider.getRootContext().getSummary("cc", MetricsContext.DetailLevel.BASIC);
         summary.add(10);
         summary.add(10);
-        int[] count = {0};
+        int[] count = { 0 };
         provider.dump((k, v) -> {
             count[0]++;
             int value = ((Number) v).intValue();
 
             switch (k) {
-                case "cc{quantile=\"0.5\"}":
-                    assertEquals(10, value);
-                    break;
-                case "cc_count":
-                    assertEquals(2, value);
-                    break;
-                case "cc_sum":
-                    assertEquals(20, value);
-                    break;
-                default:
-                    fail("unespected key " + k);
-                    break;
+            case "cc_avg":
+                assertEquals(10, value);
+                break;
+            case "cc_count":
+                assertEquals(2, value);
+                break;
+            case "cc_sum":
+                assertEquals(20, value);
+                break;
+            default:
+                fail("unespected key " + k);
+                break;
             }
-        }
-        );
+        });
         assertEquals(3, count[0]);
         count[0] = 0;
 
         // we always must get the same object
-        assertSame(summary, provider.getRootContext()
-                .getSummary("cc", MetricsContext.DetailLevel.BASIC));
+        assertSame(summary, provider.getRootContext().getSummary("cc", MetricsContext.DetailLevel.BASIC));
 
         try {
-            provider.getRootContext()
-                    .getSummary("cc", MetricsContext.DetailLevel.ADVANCED);
+            provider.getRootContext().getSummary("cc", MetricsContext.DetailLevel.ADVANCED);
             fail("Can't get the same summary with a different DetailLevel");
         } catch (IllegalArgumentException err) {
             assertThat(err.getMessage(), containsString("Already registered"));
@@ -220,53 +323,55 @@ public void testBasicSummary() throws Exception {
         String res = callServlet();
         assertThat(res, containsString("# TYPE cc summary"));
         assertThat(res, CoreMatchers.containsString("cc_sum 20.0"));
-        assertThat(res, CoreMatchers.containsString("cc_count 2.0"));
-        assertThat(res, CoreMatchers.containsString("cc{quantile=\"0.5\",} 10.0"));
+        assertThat(res, CoreMatchers.containsString("cc_count 2"));
+        assertThat(res, CoreMatchers.containsString("cc{quantile=\"0.5\"} 10.0"));
     }
 
     @Test
     public void testAdvancedSummary() throws Exception {
-        Summary summary = provider.getRootContext()
-                .getSummary("cc", MetricsContext.DetailLevel.ADVANCED);
+        Summary summary = provider.getRootContext().getSummary("cc", MetricsContext.DetailLevel.ADVANCED);
         summary.add(10);
         summary.add(10);
-        int[] count = {0};
+        int[] count = { 0 };
         provider.dump((k, v) -> {
             count[0]++;
             int value = ((Number) v).intValue();
 
             switch (k) {
-                case "cc{quantile=\"0.5\"}":
-                    assertEquals(10, value);
-                    break;
-                case "cc{quantile=\"0.9\"}":
-                    assertEquals(10, value);
-                    break;
-                case "cc{quantile=\"0.99\"}":
-                    assertEquals(10, value);
-                    break;
-                case "cc_count":
-                    assertEquals(2, value);
-                    break;
-                case "cc_sum":
-                    assertEquals(20, value);
-                    break;
-                default:
-                    fail("unespected key " + k);
-                    break;
+            case "cc{quantile=\"0.5\"}":
+                assertEquals(10, value);
+                break;
+            case "cc{quantile=\"0.9\"}":
+                assertEquals(10, value);
+                break;
+            case "cc{quantile=\"0.95\"}":
+                assertEquals(10, value);
+                break;
+            case "cc{quantile=\"0.99\"}":
+                assertEquals(10, value);
+                break;
+            case "cc_count":
+                assertEquals(2, value);
+                break;
+            case "cc_sum":
+                assertEquals(20, value);
+                break;
+            case "cc_avg":
+                assertEquals(10, value);
+                break;
+            default:
+                fail("unespected key " + k);
+                break;
             }
-        }
-        );
-        assertEquals(5, count[0]);
+        });
+        assertEquals(6, count[0]);
         count[0] = 0;
 
         // we always must get the same object
-        assertSame(summary, provider.getRootContext()
-                .getSummary("cc", MetricsContext.DetailLevel.ADVANCED));
+        assertSame(summary, provider.getRootContext().getSummary("cc", MetricsContext.DetailLevel.ADVANCED));
 
         try {
-            provider.getRootContext()
-                    .getSummary("cc", MetricsContext.DetailLevel.BASIC);
+            provider.getRootContext().getSummary("cc", MetricsContext.DetailLevel.BASIC);
             fail("Can't get the same summary with a different DetailLevel");
         } catch (IllegalArgumentException err) {
             assertThat(err.getMessage(), containsString("Already registered"));
@@ -275,22 +380,348 @@ public void testAdvancedSummary() throws Exception {
         String res = callServlet();
         assertThat(res, containsString("# TYPE cc summary"));
         assertThat(res, CoreMatchers.containsString("cc_sum 20.0"));
-        assertThat(res, CoreMatchers.containsString("cc_count 2.0"));
-        assertThat(res, CoreMatchers.containsString("cc{quantile=\"0.5\",} 10.0"));
-        assertThat(res, CoreMatchers.containsString("cc{quantile=\"0.9\",} 10.0"));
-        assertThat(res, CoreMatchers.containsString("cc{quantile=\"0.99\",} 10.0"));
+        assertThat(res, CoreMatchers.containsString("cc_count 2"));
+        assertThat(res, CoreMatchers.containsString("cc{quantile=\"0.5\"} 10.0"));
+        assertThat(res, CoreMatchers.containsString("cc{quantile=\"0.95\"} 10.0"));
+        assertThat(res, CoreMatchers.containsString("cc{quantile=\"0.99\"} 10.0"));
+    }
+
+    /**
+     * Using the TRACE method to visit the metrics provider, the response should be 405 Method Not Allowed. This unit
+     * test replaces the old test which was tightly coupled to the Jetty server implementation.
+     */
+    @Test
+    public void testTraceCall() throws ServletException, IOException {
+        final HttpServlet servlet = provider.getServlet();
+        final HttpServletRequest request = mock(HttpServletRequest.class);
+        final HttpServletResponse response = mock(HttpServletResponse.class);
+
+        // Configure the mock to return an empty enumeration for headers.
+        when(request.getHeaderNames()).thenReturn(Collections.enumeration(Collections.emptyList()));
+        when(request.getMethod()).thenReturn("TRACE");
+
+        final ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
+        final ServletOutputStream servletOutputStream = createMockServletOutputStream(outputStream);
+
+        when(response.getOutputStream()).thenReturn(servletOutputStream);
+
+        servlet.service(request, response);
+
+        // Verify that the servlet set the response status to 405 Method Not Allowed.
+        verify(response).sendError(HttpServletResponse.SC_METHOD_NOT_ALLOWED);
+    }
+
+    @Test
+    public void testSummary_asyncAndExceedMaxQueueSize() throws Exception {
+        final Properties config = new Properties();
+        config.setProperty("numWorkerThreads", "1");
+        config.setProperty("maxQueueSize", "1");
+        config.setProperty("httpPort", "0"); // ephemeral port
+        config.setProperty("exportJvmInfo", "false");
+
+        PrometheusMetricsProvider metricsProvider = null;
+        try {
+            metricsProvider = new PrometheusMetricsProvider();
+            metricsProvider.configure(config);
+            metricsProvider.start();
+            final Summary summary = metricsProvider.getRootContext().getSummary("cc",
+                    MetricsContext.DetailLevel.ADVANCED);
+
+            // make sure no error is thrown
+            for (int i = 0; i < 10; i++) {
+                summary.add(10);
+            }
+        } finally {
+            if (metricsProvider != null) {
+                metricsProvider.stop();
+            }
+        }
+    }
+
+    @Test
+    public void testSummarySet() throws Exception {
+        final String name = "ss";
+        final String[] keys = { "ns1", "ns2" };
+        final double count = 3.0;
+
+        // create and register a SummarySet
+        final SummarySet summarySet = provider.getRootContext().getSummarySet(name, MetricsContext.DetailLevel.BASIC);
+
+        // update the SummarySet multiple times
+        for (int i = 0; i < count; i++) {
+            Arrays.asList(keys).forEach(key -> summarySet.add(key, 1));
+        }
+
+        // validate with dump call
+        final Map<String, Number> expectedMetricsMap = new HashMap<>();
+        for (final String key : keys) {
+            expectedMetricsMap.put(String.format("%s_avg{key=\"%s\"}", name, key), 1.0);
+            expectedMetricsMap.put(String.format("%s_count{key=\"%s\"}", name, key), count);
+            expectedMetricsMap.put(String.format("%s_sum{key=\"%s\"}", name, key), count);
+        }
+        validateWithDump(expectedMetricsMap);
+
+        // validate with servlet call
+        final List<String> expectedNames = Collections.singletonList(String.format("# TYPE %s summary", name));
+        final List<String> expectedMetrics = new ArrayList<>();
+        for (final String key : keys) {
+            expectedMetrics.add(String.format("%s{key=\"%s\",quantile=\"0.5\"} %s", name, key, 1.0));
+            expectedMetrics.add(String.format("%s_count{key=\"%s\"} %d", name, key, (int) count));
+            expectedMetrics.add(String.format("%s_sum{key=\"%s\"} %s", name, key, count));
+        }
+        validateWithServletCall(expectedNames, expectedMetrics);
+
+        // validate registering with same name, no overwriting
+        assertSame(summarySet, provider.getRootContext().getSummarySet(name, MetricsContext.DetailLevel.BASIC));
+
+        // validate registering with different DetailLevel, not allowed
+        try {
+            provider.getRootContext().getSummarySet(name, MetricsContext.DetailLevel.ADVANCED);
+            fail("Can't get the same summarySet with a different DetailLevel");
+        } catch (final IllegalArgumentException e) {
+            assertThat(e.getMessage(), containsString("Already registered"));
+        }
+    }
+
+    /**
+     * Helper method to create a mock ServletOutputStream that writes to a provided ByteArrayOutputStream.
+     */
+    private ServletOutputStream createMockServletOutputStream(final ByteArrayOutputStream outputStream) {
+        return new ServletOutputStream() {
+            @Override
+            public boolean isReady() {
+                return true;
+            }
+
+            @Override
+            public void setWriteListener(WriteListener writeListener) {
+            }
+
+            @Override
+            public void write(int b) throws IOException {
+                outputStream.write(b);
+            }
+        };
     }
 
+    /**
+     * A utility method to simulate a GET request to the PrometheusMetricsServlet and return the response body as a
+     * String using Mockito mocks for the base servlet interfaces.
+     * <p>
+     * This method demonstrates how to test a servlet by mocking the request and response objects and capturing the
+     * output.
+     * </p>
+     *
+     * @return The content of the servlet's response body.
+     *
+     * @throws ServletException
+     *             if a servlet-related error occurs.
+     * @throws IOException
+     *             if an I/O error occurs.
+     */
     private String callServlet() throws ServletException, IOException {
-        // we are not performing an HTTP request
-        // but we are calling directly the servlet
-        StringWriter writer = new StringWriter();
-        HttpServletResponse response = mock(HttpServletResponse.class);
-        when(response.getWriter()).thenReturn(new PrintWriter(writer));
-        HttpServletRequest req = mock(HttpServletRequest.class);
-        provider.getServlet().doGet(req, response);
-        String res = writer.toString();
-        return res;
+        final HttpServlet servlet = provider.getServlet();
+        final HttpServletRequest request = mock(HttpServletRequest.class);
+        final HttpServletResponse response = mock(HttpServletResponse.class);
+
+        final ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
+        final ServletOutputStream servletOutputStream = createMockServletOutputStream(outputStream);
+
+        // Configure the mock response to return our custom output stream.
+        when(response.getOutputStream()).thenReturn(servletOutputStream);
+        when(request.getMethod()).thenReturn("GET");
+        servlet.service(request, response);
+
+        // Verify that the servlet set the HTTP status code to OK.
+        verify(response).setStatus(HttpServletResponse.SC_OK);
+
+        return outputStream.toString();
+    }
+
+    @Test
+    public void testGaugeSet_singleGaugeSet() throws Exception {
+        final String name = QuotaMetricsUtils.QUOTA_BYTES_LIMIT_PER_NAMESPACE;
+        final Number[] values = { 10.0, 100.0 };
+        final String[] keys = { "ns11", "ns12" };
+        final Map<String, Number> metricsMap = new HashMap<>();
+        for (int i = 0; i < values.length; i++) {
+            metricsMap.put(keys[i], values[i]);
+        }
+        final AtomicInteger callCount = new AtomicInteger(0);
+
+        // create and register GaugeSet
+        createAndRegisterGaugeSet(name, metricsMap, callCount);
+
+        // validate with dump call
+        final Map<String, Number> expectedMetricsMap = new HashMap<>();
+        for (int i = 0; i < values.length; i++) {
+            expectedMetricsMap.put(String.format("%s{key=\"%s\"}", name, keys[i]), values[i]);
+        }
+        validateWithDump(expectedMetricsMap);
+        assertEquals(1, callCount.get());
+
+        // validate with servlet call
+        final List<String> expectedNames = Collections.singletonList(String.format("# TYPE %s gauge", name));
+        final List<String> expectedMetrics = new ArrayList<>();
+        for (int i = 0; i < values.length; i++) {
+            expectedMetrics.add(String.format("%s{key=\"%s\"} %s", name, keys[i], values[i]));
+        }
+        validateWithServletCall(expectedNames, expectedMetrics);
+        assertEquals(2, callCount.get());
+
+        // unregister the GaugeSet
+        callCount.set(0);
+        provider.getRootContext().unregisterGaugeSet(name);
+
+        // validate with dump call
+        validateWithDump(Collections.emptyMap());
+        assertEquals(0, callCount.get());
+
+        // validate with servlet call
+        validateWithServletCall(new ArrayList<>(), new ArrayList<>());
+        assertEquals(0, callCount.get());
+    }
+
+    @Test
+    public void testGaugeSet_multipleGaugeSets() throws Exception {
+        final String[] names = new String[] { QuotaMetricsUtils.QUOTA_COUNT_LIMIT_PER_NAMESPACE,
+                QuotaMetricsUtils.QUOTA_COUNT_USAGE_PER_NAMESPACE };
+
+        final Number[] values = new Number[] { 20.0, 200.0 };
+        final String[] keys = new String[] { "ns21", "ns22" };
+        final int count = names.length;
+        final AtomicInteger[] callCounts = new AtomicInteger[count];
+
+        // create and register the GaugeSets
+        for (int i = 0; i < count; i++) {
+            final Map<String, Number> metricsMap = new HashMap<>();
+            metricsMap.put(keys[i], values[i]);
+            callCounts[i] = new AtomicInteger(0);
+            createAndRegisterGaugeSet(names[i], metricsMap, callCounts[i]);
+        }
+
+        // validate with dump call
+        final Map<String, Number> expectedMetricsMap = new HashMap<>();
+        for (int i = 0; i < count; i++) {
+            expectedMetricsMap.put(String.format("%s{key=\"%s\"}", names[i], keys[i]), values[i]);
+        }
+        validateWithDump(expectedMetricsMap);
+        for (int i = 0; i < count; i++) {
+            assertEquals(1, callCounts[i].get());
+        }
+
+        // validate with servlet call
+        final List<String> expectedNames = new ArrayList<>();
+        final List<String> expectedMetrics = new ArrayList<>();
+        for (int i = 0; i < count; i++) {
+            expectedNames.add(String.format("# TYPE %s gauge", names[i]));
+            expectedMetrics.add(String.format("%s{key=\"%s\"} %s", names[i], keys[i], values[i]));
+        }
+        validateWithServletCall(expectedNames, expectedMetrics);
+        for (int i = 0; i < count; i++) {
+            assertEquals(2, callCounts[i].get());
+        }
+
+        // unregister the GaugeSets
+        for (int i = 0; i < count; i++) {
+            callCounts[i].set(0);
+            provider.getRootContext().unregisterGaugeSet(names[i]);
+        }
+
+        // validate with dump call
+        validateWithDump(Collections.emptyMap());
+        for (int i = 0; i < count; i++) {
+            assertEquals(0, callCounts[i].get());
+        }
+
+        // validate with servlet call
+        validateWithServletCall(new ArrayList<>(), new ArrayList<>());
+        for (int i = 0; i < count; i++) {
+            assertEquals(0, callCounts[i].get());
+        }
+    }
+
+    @Test
+    public void testGaugeSet_overwriteRegister() {
+        final String[] names = new String[] { QuotaMetricsUtils.QUOTA_COUNT_LIMIT_PER_NAMESPACE,
+                QuotaMetricsUtils.QUOTA_COUNT_USAGE_PER_NAMESPACE };
+
+        final int count = names.length;
+        final Number[] values = new Number[] { 30.0, 300.0 };
+        final String[] keys = new String[] { "ns31", "ns32" };
+        final AtomicInteger[] callCounts = new AtomicInteger[count];
+
+        // create and register the GaugeSets
+        for (int i = 0; i < count; i++) {
+            final Map<String, Number> metricsMap = new HashMap<>();
+            metricsMap.put(keys[i], values[i]);
+            callCounts[i] = new AtomicInteger(0);
+            // use the same name so the first GaugeSet got overwrite
+            createAndRegisterGaugeSet(names[0], metricsMap, callCounts[i]);
+        }
+
+        // validate with dump call to make sure the second GaugeSet overwrites the first
+        final Map<String, Number> expectedMetricsMap = new HashMap<>();
+        expectedMetricsMap.put(String.format("%s{key=\"%s\"}", names[0], keys[1]), values[1]);
+        validateWithDump(expectedMetricsMap);
+        assertEquals(0, callCounts[0].get());
+        assertEquals(1, callCounts[1].get());
+    }
+
+    @Test
+    public void testGaugeSet_nullKey() {
+        final String name = QuotaMetricsUtils.QUOTA_COUNT_LIMIT_PER_NAMESPACE;
+        final Map<String, Number> metricsMap = new HashMap<>();
+        metricsMap.put(null, 10.0);
+
+        final AtomicInteger callCount = new AtomicInteger(0);
+
+        // create and register GaugeSet
+        createAndRegisterGaugeSet(name, metricsMap, callCount);
+
+        // validate with dump call
+        assertThrows(IllegalArgumentException.class, () -> provider.dump(new HashMap<>()::put));
+
+        // validate with servlet call
+        assertThrows(IllegalArgumentException.class, this::callServlet);
+    }
+
+    @Test
+    public void testGaugeSet_registerWithNullGaugeSet() {
+        assertThrows(NullPointerException.class, () -> provider.getRootContext().registerGaugeSet("name", null));
+
+        assertThrows(NullPointerException.class, () -> provider.getRootContext().registerGaugeSet(null, HashMap::new));
+    }
+
+    @Test
+    public void testGaugeSet_unregisterNull() {
+        assertThrows(NullPointerException.class, () -> provider.getRootContext().unregisterGaugeSet(null));
+    }
+
+    private void createAndRegisterGaugeSet(final String name, final Map<String, Number> metricsMap,
+            final AtomicInteger callCount) {
+        final GaugeSet gaugeSet = () -> {
+            callCount.addAndGet(1);
+            return metricsMap;
+        };
+        provider.getRootContext().registerGaugeSet(name, gaugeSet);
     }
 
+    private void validateWithDump(final Map<String, Number> expectedMetrics) {
+        final Map<String, Object> returnedMetrics = new HashMap<>();
+        provider.dump(returnedMetrics::put);
+        assertEquals(expectedMetrics.size(), returnedMetrics.size());
+        expectedMetrics.forEach((key, value) -> assertEquals(value, returnedMetrics.get(key)));
+    }
+
+    private void validateWithServletCall(final List<String> expectedNames, final List<String> expectedMetrics)
+            throws Exception {
+        final String response = callServlet();
+        if (expectedNames.isEmpty() && expectedMetrics.isEmpty()) {
+            assertTrue(response.isEmpty());
+        } else {
+            expectedNames.forEach(name -> assertThat(response, CoreMatchers.containsString(name)));
+            expectedMetrics.forEach(metric -> assertThat(response, CoreMatchers.containsString(metric)));
+        }
+    }
 }
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsTestBase.java b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsTestBase.java
new file mode 100644
index 00000000000..efd8f38a8a5
--- /dev/null
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsTestBase.java
@@ -0,0 +1,44 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.metrics.prometheus;
+
+import io.prometheus.metrics.instrumentation.jvm.JvmMetrics;
+import io.prometheus.metrics.model.registry.PrometheusRegistry;
+import java.lang.reflect.Field;
+import java.util.Set;
+import org.junit.jupiter.api.AfterEach;
+
+/**
+ * The base test for prometheus metrics unit tests.
+ */
+public abstract class PrometheusMetricsTestBase {
+
+    @AfterEach
+    void tearDown() throws Exception {
+        PrometheusRegistry.defaultRegistry.clear();
+        // JvmMetrics uses a static Set to track which registries it has been
+        // registered with. We need to clear this set via reflection to allow
+        // re-initialization in subsequent tests.
+        Field registeredField = JvmMetrics.class.getDeclaredField("REGISTERED");
+        registeredField.setAccessible(true);
+        @SuppressWarnings("unchecked")
+        Set<?> registeredSet = (Set<?>) registeredField.get(null);
+        registeredSet.clear();
+    }
+}
\ No newline at end of file
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/README.md b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/README.md
new file mode 100644
index 00000000000..4e1aa7484d1
--- /dev/null
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/README.md
@@ -0,0 +1,5 @@
+SSL test data
+===================
+
+Testing client/server keystore, password is "testpass".
+Testing client/server truststore, password is "testpass".
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/client_keystore.jks b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/client_keystore.jks
new file mode 100644
index 00000000000..56c0bdb7b8b
Binary files /dev/null and b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/client_keystore.jks differ
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/client_truststore.jks b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/client_truststore.jks
new file mode 100644
index 00000000000..23fc75232fd
Binary files /dev/null and b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/client_truststore.jks differ
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/server_keystore.jks b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/server_keystore.jks
new file mode 100644
index 00000000000..2cfdbfc6d15
Binary files /dev/null and b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/server_keystore.jks differ
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/server_truststore.jks b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/server_truststore.jks
new file mode 100644
index 00000000000..33d022ef030
Binary files /dev/null and b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/data/ssl/server_truststore.jks differ
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/log4j.properties b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/log4j.properties
deleted file mode 100644
index d7f930d3ce2..00000000000
--- a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/log4j.properties
+++ /dev/null
@@ -1,65 +0,0 @@
-# Copyright 2012 The Apache Software Foundation
-#
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Define some default values that can be overridden by system properties
-zookeeper.root.logger=INFO, CONSOLE
-
-zookeeper.console.threshold=INFO
-
-zookeeper.log.dir=.
-zookeeper.log.file=zookeeper.log
-zookeeper.log.threshold=INFO
-zookeeper.log.maxfilesize=256MB
-zookeeper.log.maxbackupindex=20
-
-zookeeper.tracelog.dir=${zookeeper.log.dir}
-zookeeper.tracelog.file=zookeeper_trace.log
-
-log4j.rootLogger=${zookeeper.root.logger}
-
-#
-# console
-# Add "console" to rootlogger above if you want to use this
-#
-log4j.appender.CONSOLE=org.apache.log4j.ConsoleAppender
-log4j.appender.CONSOLE.Threshold=${zookeeper.console.threshold}
-log4j.appender.CONSOLE.layout=org.apache.log4j.PatternLayout
-log4j.appender.CONSOLE.layout.ConversionPattern=%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L] - %m%n
-
-#
-# Add ROLLINGFILE to rootLogger to get log file output
-#
-log4j.appender.ROLLINGFILE=org.apache.log4j.RollingFileAppender
-log4j.appender.ROLLINGFILE.Threshold=${zookeeper.log.threshold}
-log4j.appender.ROLLINGFILE.File=${zookeeper.log.dir}/${zookeeper.log.file}
-log4j.appender.ROLLINGFILE.MaxFileSize=${zookeeper.log.maxfilesize}
-log4j.appender.ROLLINGFILE.MaxBackupIndex=${zookeeper.log.maxbackupindex}
-log4j.appender.ROLLINGFILE.layout=org.apache.log4j.PatternLayout
-log4j.appender.ROLLINGFILE.layout.ConversionPattern=%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L] - %m%n
-
-#
-# Add TRACEFILE to rootLogger to get log file output
-#    Log TRACE level and above messages to a log file
-#
-log4j.appender.TRACEFILE=org.apache.log4j.FileAppender
-log4j.appender.TRACEFILE.Threshold=TRACE
-log4j.appender.TRACEFILE.File=${zookeeper.tracelog.dir}/${zookeeper.tracelog.file}
-
-log4j.appender.TRACEFILE.layout=org.apache.log4j.PatternLayout
-### Notice we are including log4j's NDC here (%x)
-log4j.appender.TRACEFILE.layout.ConversionPattern=%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L][%x] - %m%n
diff --git a/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/logback.xml b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/logback.xml
new file mode 100644
index 00000000000..a1e627724a5
--- /dev/null
+++ b/zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/resources/logback.xml
@@ -0,0 +1,36 @@
+<!--
+ Copyright 2022 The Apache Software Foundation
+
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements.  See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership.  The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+ Define some default values that can be overridden by system properties
+-->
+<configuration>
+
+  <appender name="CONSOLE" class="ch.qos.logback.core.ConsoleAppender">
+    <encoder>
+      <pattern>%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L] - %m%n</pattern>
+    </encoder>
+    <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
+      <level>INFO</level>
+    </filter>
+  </appender>
+
+  <root level="INFO">
+    <appender-ref ref="CONSOLE" />
+  </root>
+</configuration>
diff --git a/zookeeper-recipes/README.txt b/zookeeper-recipes/README.txt
index 856dae0417b..bc788741d63 100644
--- a/zookeeper-recipes/README.txt
+++ b/zookeeper-recipes/README.txt
@@ -19,7 +19,7 @@ Zookeeper is used (and can be used) for more than what we have listed in the doc
 
 7) To run the c tests in all the recipes, 
 - make sure the main zookeeper c libraries in
-{top}/src/c/ are compiled. Run autoreconf -if;./configure; make. The libaries
+{top}/src/c/ are compiled. Run autoreconf -if;./configure; make. The libraries
 will be installed in {top}/src/c/.libs. 
 - run autoreconf if;./configure;make run-check 
   in zookeeper-recipes/$recipename/src/c
diff --git a/zookeeper-recipes/pom.xml b/zookeeper-recipes/pom.xml
old mode 100755
new mode 100644
index 051f6452265..65a63d64156
--- a/zookeeper-recipes/pom.xml
+++ b/zookeeper-recipes/pom.xml
@@ -24,7 +24,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-recipes</artifactId>
@@ -80,8 +80,8 @@
       <scope>test</scope>
     </dependency>
     <dependency>
-      <groupId>junit</groupId>
-      <artifactId>junit</artifactId>
+      <groupId>org.junit.jupiter</groupId>
+      <artifactId>junit-jupiter-engine</artifactId>
       <scope>test</scope>
     </dependency>
     <dependency>
diff --git a/zookeeper-recipes/zookeeper-recipes-election/pom.xml b/zookeeper-recipes/zookeeper-recipes-election/pom.xml
old mode 100755
new mode 100644
index a4deb42eb2e..21f5388bc21
--- a/zookeeper-recipes/zookeeper-recipes-election/pom.xml
+++ b/zookeeper-recipes/zookeeper-recipes-election/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-recipes</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-recipes-election</artifactId>
@@ -39,9 +39,6 @@
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-surefire-plugin</artifactId>
         <configuration>
-          <includes>
-            <include>**/*Test.java</include>
-          </includes>
           <forkCount>${surefire-forkcount}</forkCount>
           <reuseForks>false</reuseForks>
           <argLine>-Xmx512m</argLine>
diff --git a/zookeeper-recipes/zookeeper-recipes-election/src/main/java/org/apache/zookeeper/recipes/leader/LeaderElectionSupport.java b/zookeeper-recipes/zookeeper-recipes-election/src/main/java/org/apache/zookeeper/recipes/leader/LeaderElectionSupport.java
index 17419a878d5..45a53dd7e45 100644
--- a/zookeeper-recipes/zookeeper-recipes-election/src/main/java/org/apache/zookeeper/recipes/leader/LeaderElectionSupport.java
+++ b/zookeeper-recipes/zookeeper-recipes-election/src/main/java/org/apache/zookeeper/recipes/leader/LeaderElectionSupport.java
@@ -278,7 +278,7 @@ private void becomeFailed(Exception e) {
      * Fetch the (user supplied) hostname of the current leader. Note that by the
      * time this method returns, state could have changed so do not depend on this
      * to be strongly consistent. This method has to read all leader offers from
-     * ZooKeeper to deterime who the leader is (i.e. there is no caching) so
+     * ZooKeeper to determine who the leader is (i.e. there is no caching) so
      * consider the performance implications of frequent invocation. If there are
      * no leader offers this method returns null.
      *
diff --git a/zookeeper-recipes/zookeeper-recipes-election/src/test/java/org/apache/zookeeper/recipes/leader/LeaderElectionSupportTest.java b/zookeeper-recipes/zookeeper-recipes-election/src/test/java/org/apache/zookeeper/recipes/leader/LeaderElectionSupportTest.java
index 2ea721e519c..65df57d46bd 100644
--- a/zookeeper-recipes/zookeeper-recipes-election/src/test/java/org/apache/zookeeper/recipes/leader/LeaderElectionSupportTest.java
+++ b/zookeeper-recipes/zookeeper-recipes-election/src/test/java/org/apache/zookeeper/recipes/leader/LeaderElectionSupportTest.java
@@ -17,6 +17,8 @@
 
 package org.apache.zookeeper.recipes.leader;
 
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.concurrent.CountDownLatch;
@@ -27,10 +29,9 @@
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.recipes.leader.LeaderElectionSupport.EventType;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Assert;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -44,7 +45,7 @@ public class LeaderElectionSupportTest extends ClientBase {
 
     private ZooKeeper zooKeeper;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         super.setUp();
 
@@ -57,7 +58,7 @@ public void setUp() throws Exception {
             CreateMode.PERSISTENT);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         if (zooKeeper != null) {
             zooKeeper.delete(TEST_ROOT_NODE + Thread.currentThread().getId(), -1);
@@ -85,7 +86,7 @@ public void testNodes3() throws Exception {
             runElectionSupportThread(latch, failureCounter);
         }
 
-        Assert.assertEquals(0, failureCounter.get());
+        assertEquals(0, failureCounter.get());
 
         if (!latch.await(10, TimeUnit.SECONDS)) {
             LOGGER.info("Waited for all threads to start, but timed out. We had {} failures.", failureCounter);
@@ -102,7 +103,7 @@ public void testNodes9() throws Exception {
             runElectionSupportThread(latch, failureCounter);
         }
 
-        Assert.assertEquals(0, failureCounter.get());
+        assertEquals(0, failureCounter.get());
 
         if (!latch.await(10, TimeUnit.SECONDS)) {
             LOGGER.info("Waited for all threads to start, but timed out. We had {} failures.", failureCounter);
@@ -119,7 +120,7 @@ public void testNodes20() throws Exception {
             runElectionSupportThread(latch, failureCounter);
         }
 
-        Assert.assertEquals(0, failureCounter.get());
+        assertEquals(0, failureCounter.get());
 
         if (!latch.await(10, TimeUnit.SECONDS)) {
             LOGGER.info("Waited for all threads to start, but timed out. We had {} failures.", failureCounter);
@@ -136,7 +137,7 @@ public void testNodes100() throws Exception {
             runElectionSupportThread(latch, failureCounter);
         }
 
-        Assert.assertEquals(0, failureCounter.get());
+        assertEquals(0, failureCounter.get());
 
         if (!latch.await(20, TimeUnit.SECONDS)) {
             LOGGER.info("Waited for all threads to start, but timed out. We had {} failures.", failureCounter);
@@ -170,8 +171,8 @@ public void testGetLeaderHostName() throws Exception {
 
         String leaderHostName = electionSupport.getLeaderHostName();
 
-        Assert.assertNotNull(leaderHostName);
-        Assert.assertEquals("foohost", leaderHostName);
+        assertNotNull(leaderHostName);
+        assertEquals("foohost", leaderHostName);
 
         electionSupport.stop();
     }
@@ -220,7 +221,7 @@ public void onElectionEvent(EventType eventType) {
         expectedevents.add(EventType.ELECTED_START);
         expectedevents.add(EventType.ELECTED_COMPLETE);
 
-        Assert.assertEquals("Events has failed to executed in the order", expectedevents, events);
+        assertEquals(expectedevents, events, "Events has failed to executed in the order");
 
         electionSupport2.stop();
     }
diff --git a/zookeeper-recipes/zookeeper-recipes-lock/README.txt b/zookeeper-recipes/zookeeper-recipes-lock/README.txt
index 4ce629ee1e1..438de1bdbb9 100644
--- a/zookeeper-recipes/zookeeper-recipes-lock/README.txt
+++ b/zookeeper-recipes/zookeeper-recipes-lock/README.txt
@@ -19,7 +19,7 @@
 mentioned in ../../docs/recipes.[html,pdf].
 
 2) To compile the lock java recipe you can just run ant jar from 
-this directory. For compiling the c libarary go to zookeeper-client/zookeeper-client-c and read
+this directory. For compiling the c library go to zookeeper-client/zookeeper-client-c and read
 the INSTALLATION instructions. 
 Please report any bugs on the jira 
 
diff --git a/zookeeper-recipes/zookeeper-recipes-lock/pom.xml b/zookeeper-recipes/zookeeper-recipes-lock/pom.xml
old mode 100755
new mode 100644
index 4a5b134cb0f..b8c04fa73a3
--- a/zookeeper-recipes/zookeeper-recipes-lock/pom.xml
+++ b/zookeeper-recipes/zookeeper-recipes-lock/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-recipes</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-recipes-lock</artifactId>
@@ -39,9 +39,6 @@
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-surefire-plugin</artifactId>
         <configuration>
-          <includes>
-            <include>**/*Test.java</include>
-          </includes>
           <forkCount>${surefire-forkcount}</forkCount>
           <reuseForks>false</reuseForks>
           <argLine>-Xmx512m</argLine>
diff --git a/zookeeper-recipes/zookeeper-recipes-lock/src/main/c/acinclude.m4 b/zookeeper-recipes/zookeeper-recipes-lock/src/main/c/acinclude.m4
index a4d405a8044..13cacbf81e1 100644
--- a/zookeeper-recipes/zookeeper-recipes-lock/src/main/c/acinclude.m4
+++ b/zookeeper-recipes/zookeeper-recipes-lock/src/main/c/acinclude.m4
@@ -10,7 +10,7 @@
 # DX_???_FEATURE(ON|OFF) - control the default setting of a Doxygen feature.
 # Supported features are 'DOXYGEN' itself, 'DOT' for generating graphics,
 # 'HTML' for plain HTML, 'CHM' for compressed HTML help (for MS users), 'CHI'
-# for generating a seperate .chi file by the .chm file, and 'MAN', 'RTF',
+# for generating a separate .chi file by the .chm file, and 'MAN', 'RTF',
 # 'XML', 'PDF' and 'PS' for the appropriate output formats. The environment
 # variable DOXYGEN_PAPER_SIZE may be specified to override the default 'a4wide'
 # paper size.
@@ -239,8 +239,8 @@ DX_ARG_ABLE(chm, [generate doxygen compressed HTML help documentation],
              DX_ENV_APPEND(GENERATE_HTMLHELP, YES)],
             [DX_ENV_APPEND(GENERATE_HTMLHELP, NO)])
 
-# Seperate CHI file generation.
-DX_ARG_ABLE(chi, [generate doxygen seperate compressed HTML help index file],
+# Separate CHI file generation.
+DX_ARG_ABLE(chi, [generate doxygen separate compressed HTML help index file],
             [DX_CHECK_DEPEND(chm, 1)],
             [DX_CLEAR_DEPEND(chm, 1)],
             [],
diff --git a/zookeeper-recipes/zookeeper-recipes-lock/src/main/c/include/zoo_lock.h b/zookeeper-recipes/zookeeper-recipes-lock/src/main/c/include/zoo_lock.h
index 5c06bbf2ff2..a3c81123786 100644
--- a/zookeeper-recipes/zookeeper-recipes-lock/src/main/c/include/zoo_lock.h
+++ b/zookeeper-recipes/zookeeper-recipes-lock/src/main/c/include/zoo_lock.h
@@ -27,7 +27,7 @@ extern "C" {
 /**
  * \brief the call back function called on status change of lock
  * 
- * the call back funtion is called with a rc of 0 if lock is acquired and 
+ * the call back function is called with a rc of 0 if lock is acquired and
  * with an rc of 1 if the lock is released
  * \param rc the value to let us know if its locked or unlocked
  * \param cbdata the callback data that we passed when initializing 
@@ -124,7 +124,7 @@ ZOOAPI void zkr_lock_setcallback(zkr_lock_mutex_t *mutex,
 /**
  * \brief get the callback function for zookeeper mutex
  *
- * this method gets the callback funtion for zookeeper mutex
+ * this method gets the callback function for zookeeper mutex
  * \param mutex the zookeeper mutex
  * \return the lock completion function
  */
diff --git a/zookeeper-recipes/zookeeper-recipes-lock/src/main/c/tests/zkServer.sh b/zookeeper-recipes/zookeeper-recipes-lock/src/main/c/tests/zkServer.sh
index 4836612d68a..e6201e9bd28 100755
--- a/zookeeper-recipes/zookeeper-recipes-lock/src/main/c/tests/zkServer.sh
+++ b/zookeeper-recipes/zookeeper-recipes-lock/src/main/c/tests/zkServer.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#! /usr/bin/env bash
 #
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements.  See the NOTICE file
@@ -8,68 +8,64 @@
 # "License"); you may not use this file except in compliance
 # with the License.  You may obtain a copy of the License at
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
 
-if [ "x$1" == "x" ]
-then
-	echo "USAGE: $0 startClean|start|stop hostPorts"
-	exit 2
+if [[ -z $1 ]]; then
+  echo "USAGE: $0 startClean|start|stop hostPorts"
+  exit 2
 fi
 
-if [ "x$1" == "xstartClean" ]
-then
-	rm -rf /tmp/zkdata
+if [[ $1 == "startClean" ]]; then
+  rm -rf /tmp/zkdata
 fi
 
 # Make sure nothing is left over from before
-if [ -r "/tmp/zk.pid" ]
-then
-pid=`cat /tmp/zk.pid`
-kill -9 $pid
-rm -f /tmp/zk.pid
+if [[ -r "/tmp/zk.pid" ]]; then
+  pid=$(cat /tmp/zk.pid)
+  kill -9 "$pid"
+  rm -f /tmp/zk.pid
 fi
 
 base_dir="../../../../.."
 
-CLASSPATH="$CLASSPATH:${base_dir}/build/classes"
-CLASSPATH="$CLASSPATH:${base_dir}/conf"
+CLASSPATH="$CLASSPATH:$base_dir/build/classes"
+CLASSPATH="$CLASSPATH:$base_dir/conf"
 
-for f in "${base_dir}"/zookeeper-*.jar
-do
-    CLASSPATH="$CLASSPATH:$f"
+for f in "$base_dir"/zookeeper-*.jar; do
+  CLASSPATH="$CLASSPATH:$f"
 done
 
-for i in "${base_dir}"/build/lib/*.jar
-do
-    CLASSPATH="$CLASSPATH:$i"
+for i in "$base_dir"/build/lib/*.jar; do
+  CLASSPATH="$CLASSPATH:$i"
 done
 
-for i in "${base_dir}"/zookeeper-server/src/main/resource/lib/*.jar
-do
-    CLASSPATH="$CLASSPATH:$i"
+for i in "$base_dir"/zookeeper-server/src/main/resource/lib/*.jar; do
+  CLASSPATH="$CLASSPATH:$i"
 done
 
-CLASSPATH="$CLASSPATH:${CLOVER_HOME}/lib/clover.jar"
+CLASSPATH="$CLASSPATH:$CLOVER_HOME/lib/clover.jar"
+export CLASSPATH
 
 case $1 in
-start|startClean)
-	mkdir -p /tmp/zkdata
-	java -cp $CLASSPATH org.apache.zookeeper.server.ZooKeeperServerMain 22181 /tmp/zkdata &> /tmp/zk.log &
-        echo $! > /tmp/zk.pid
-        sleep 5
-	;;
-stop)
-	# Already killed above
-	;;
-*)
-	echo "Unknown command " + $1
-	exit 2
+  start | startClean)
+    mkdir -p /tmp/zkdata
+    java org.apache.zookeeper.server.ZooKeeperServerMain 22181 /tmp/zkdata &>/tmp/zk.log &
+    echo $! >/tmp/zk.pid
+    sleep 5
+    ;;
+  stop)
+    # Already killed above
+    ;;
+  *)
+    echo "Unknown command $1"
+    exit 2
+    ;;
 esac
-
diff --git a/zookeeper-recipes/zookeeper-recipes-lock/src/main/java/org/apache/zookeeper/recipes/lock/WriteLock.java b/zookeeper-recipes/zookeeper-recipes-lock/src/main/java/org/apache/zookeeper/recipes/lock/WriteLock.java
index bcaaba30b34..aeba7eff295 100644
--- a/zookeeper-recipes/zookeeper-recipes-lock/src/main/java/org/apache/zookeeper/recipes/lock/WriteLock.java
+++ b/zookeeper-recipes/zookeeper-recipes-lock/src/main/java/org/apache/zookeeper/recipes/lock/WriteLock.java
@@ -57,7 +57,7 @@ public class WriteLock extends ProtocolSupport {
     private LockZooKeeperOperation zop;
 
     /**
-     * zookeeper contructor for writelock.
+     * zookeeper constructor for writelock.
      *
      * @param zookeeper zookeeper client instance
      * @param dir the parent path you want to use for locking
@@ -73,7 +73,7 @@ public WriteLock(ZooKeeper zookeeper, String dir, List<ACL> acl) {
     }
 
     /**
-     * zookeeper contructor for writelock with callback.
+     * zookeeper constructor for writelock with callback.
      *
      * @param zookeeper the zookeeper client instance
      * @param dir the parent path you want to use for locking
@@ -174,10 +174,10 @@ public void process(WatchedEvent event) {
     private class LockZooKeeperOperation implements ZooKeeperOperation {
 
         /**
-         * find if we have been created earler if not create our node.
+         * find if we have been created earlier if not create our node.
          *
          * @param prefix the prefix node
-         * @param zookeeper teh zookeeper client
+         * @param zookeeper the zookeeper client
          * @param dir the dir paretn
          * @throws KeeperException
          * @throws InterruptedException
@@ -225,7 +225,7 @@ public boolean execute() throws KeeperException, InterruptedException {
                     // lets force the recreation of the id
                     id = null;
                 } else {
-                    // lets sort them explicitly (though they do seem to come back in order ususally :)
+                    // lets sort them explicitly (though they do seem to come back in order usually :)
                     SortedSet<ZNodeName> sortedNames = new TreeSet<>();
                     for (String name : names) {
                         sortedNames.add(new ZNodeName(dir + "/" + name));
diff --git a/zookeeper-recipes/zookeeper-recipes-lock/src/main/java/org/apache/zookeeper/recipes/lock/ZNodeName.java b/zookeeper-recipes/zookeeper-recipes-lock/src/main/java/org/apache/zookeeper/recipes/lock/ZNodeName.java
index 24d6f13ed62..3fc92690919 100644
--- a/zookeeper-recipes/zookeeper-recipes-lock/src/main/java/org/apache/zookeeper/recipes/lock/ZNodeName.java
+++ b/zookeeper-recipes/zookeeper-recipes-lock/src/main/java/org/apache/zookeeper/recipes/lock/ZNodeName.java
@@ -51,11 +51,14 @@ class ZNodeName implements Comparable<ZNodeName> {
     public ZNodeName(final String name) {
         this.name = Objects.requireNonNull(name, "ZNode name cannot be null");
 
-        final int idx = name.lastIndexOf('-');
+        int idx = name.lastIndexOf('-');
         if (idx < 0) {
             this.prefix = name;
             this.sequence = Optional.empty();
         } else {
+            if (idx > 0 && name.charAt(idx - 1) == '-') {
+                idx = idx - 1;
+            }
             this.prefix = name.substring(0, idx);
             this.sequence = Optional.ofNullable(parseSequenceString(name.substring(idx + 1)));
         }
diff --git a/zookeeper-recipes/zookeeper-recipes-lock/src/test/java/org/apache/zookeeper/recipes/lock/WriteLockTest.java b/zookeeper-recipes/zookeeper-recipes-lock/src/test/java/org/apache/zookeeper/recipes/lock/WriteLockTest.java
index 6809fadf521..e9082239af4 100644
--- a/zookeeper-recipes/zookeeper-recipes-lock/src/test/java/org/apache/zookeeper/recipes/lock/WriteLockTest.java
+++ b/zookeeper-recipes/zookeeper-recipes-lock/src/test/java/org/apache/zookeeper/recipes/lock/WriteLockTest.java
@@ -18,13 +18,14 @@
 
 package org.apache.zookeeper.recipes.lock;
 
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Assert;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
 
 /**
  * test for writelock.
@@ -74,11 +75,11 @@ protected void runTest(int count) throws Exception {
         dumpNodes(count);
 
         // lets assert that the first election is the leader
-        Assert.assertTrue("The first znode should be the leader " + first.getId(), first.isOwner());
+        assertTrue(first.isOwner(), "The first znode should be the leader " + first.getId());
 
         for (int i = 1; i < count; i++) {
             WriteLock node = nodes[i];
-            Assert.assertFalse("Node should not be the leader " + node.getId(), node.isOwner());
+            assertFalse(node.isOwner(), "Node should not be the leader " + node.getId());
         }
 
         if (count > 1) {
@@ -92,11 +93,11 @@ protected void runTest(int count) throws Exception {
                 WriteLock second = nodes[1];
                 dumpNodes(count);
                 // lets assert that the first election is the leader
-                Assert.assertTrue("The second znode should be the leader " + second.getId(), second.isOwner());
+                assertTrue(second.isOwner(), "The second znode should be the leader " + second.getId());
 
                 for (int i = 2; i < count; i++) {
                     WriteLock node = nodes[i];
-                    Assert.assertFalse("Node should not be the leader " + node.getId(), node.isOwner());
+                    assertFalse(node.isOwner(), "Node should not be the leader " + node.getId());
                 }
             }
 
@@ -130,7 +131,7 @@ protected void dumpNodes(int count) {
         }
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         if (nodes != null) {
             for (int i = 0; i < nodes.length; i++) {
diff --git a/zookeeper-recipes/zookeeper-recipes-lock/src/test/java/org/apache/zookeeper/recipes/lock/ZNodeNameTest.java b/zookeeper-recipes/zookeeper-recipes-lock/src/test/java/org/apache/zookeeper/recipes/lock/ZNodeNameTest.java
index 03dc2c29b06..7d82627b084 100644
--- a/zookeeper-recipes/zookeeper-recipes-lock/src/test/java/org/apache/zookeeper/recipes/lock/ZNodeNameTest.java
+++ b/zookeeper-recipes/zookeeper-recipes-lock/src/test/java/org/apache/zookeeper/recipes/lock/ZNodeNameTest.java
@@ -18,12 +18,14 @@
 
 package org.apache.zookeeper.recipes.lock;
 
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.Iterator;
 import java.util.stream.Collectors;
-import org.junit.Assert;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 /**
  * Test for znodenames.
@@ -32,7 +34,7 @@ public class ZNodeNameTest {
 
     @Test
     public void testOrderWithSamePrefix() throws Exception {
-        final String[] names = {"x-3", "x-5", "x-11", "x-1"};
+        final String[] names = {"x-3", "x-5", "x-11", "x-1", "x--20"};
         ZNodeName zname;
 
         final Collection<ZNodeName> nodeNames = Arrays.asList(names).stream()
@@ -41,24 +43,29 @@ public void testOrderWithSamePrefix() throws Exception {
         final Iterator<ZNodeName> it = nodeNames.iterator();
 
         zname = it.next();
-        Assert.assertEquals("x-1", zname.getName());
-        Assert.assertEquals("x", zname.getPrefix());
-        Assert.assertEquals(Integer.valueOf(1), zname.getSequence().get());
+        assertEquals("x--20", zname.getName());
+        assertEquals("x", zname.getPrefix());
+        assertEquals(Integer.valueOf(-20), zname.getSequence().get());
 
         zname = it.next();
-        Assert.assertEquals("x-3", zname.getName());
-        Assert.assertEquals("x", zname.getPrefix());
-        Assert.assertEquals(Integer.valueOf(3), zname.getSequence().get());
+        assertEquals("x-1", zname.getName());
+        assertEquals("x", zname.getPrefix());
+        assertEquals(Integer.valueOf(1), zname.getSequence().get());
 
         zname = it.next();
-        Assert.assertEquals("x-5", zname.getName());
-        Assert.assertEquals("x", zname.getPrefix());
-        Assert.assertEquals(Integer.valueOf(5), zname.getSequence().get());
+        assertEquals("x-3", zname.getName());
+        assertEquals("x", zname.getPrefix());
+        assertEquals(Integer.valueOf(3), zname.getSequence().get());
 
         zname = it.next();
-        Assert.assertEquals("x-11", zname.getName());
-        Assert.assertEquals("x", zname.getPrefix());
-        Assert.assertEquals(Integer.valueOf(11), zname.getSequence().get());
+        assertEquals("x-5", zname.getName());
+        assertEquals("x", zname.getPrefix());
+        assertEquals(Integer.valueOf(5), zname.getSequence().get());
+
+        zname = it.next();
+        assertEquals("x-11", zname.getName());
+        assertEquals("x", zname.getPrefix());
+        assertEquals(Integer.valueOf(11), zname.getSequence().get());
     }
 
     @Test
@@ -72,29 +79,29 @@ public void testOrderWithDifferentPrefixes() throws Exception {
         final Iterator<ZNodeName> it = nodeNames.iterator();
 
         zname = it.next();
-        Assert.assertEquals("r-1", zname.getName());
-        Assert.assertEquals("r", zname.getPrefix());
-        Assert.assertEquals(Integer.valueOf(1), zname.getSequence().get());
+        assertEquals("r-1", zname.getName());
+        assertEquals("r", zname.getPrefix());
+        assertEquals(Integer.valueOf(1), zname.getSequence().get());
 
         zname = it.next();
-        Assert.assertEquals("w-1", zname.getName());
-        Assert.assertEquals("w", zname.getPrefix());
-        Assert.assertEquals(Integer.valueOf(1), zname.getSequence().get());
+        assertEquals("w-1", zname.getName());
+        assertEquals("w", zname.getPrefix());
+        assertEquals(Integer.valueOf(1), zname.getSequence().get());
 
         zname = it.next();
-        Assert.assertEquals("r-2", zname.getName());
-        Assert.assertEquals("r", zname.getPrefix());
-        Assert.assertEquals(Integer.valueOf(2), zname.getSequence().get());
+        assertEquals("r-2", zname.getName());
+        assertEquals("r", zname.getPrefix());
+        assertEquals(Integer.valueOf(2), zname.getSequence().get());
 
         zname = it.next();
-        Assert.assertEquals("w-2", zname.getName());
-        Assert.assertEquals("w", zname.getPrefix());
-        Assert.assertEquals(Integer.valueOf(2), zname.getSequence().get());
+        assertEquals("w-2", zname.getName());
+        assertEquals("w", zname.getPrefix());
+        assertEquals(Integer.valueOf(2), zname.getSequence().get());
 
         zname = it.next();
-        Assert.assertEquals("r-3", zname.getName());
-        Assert.assertEquals("r", zname.getPrefix());
-        Assert.assertEquals(Integer.valueOf(3), zname.getSequence().get());
+        assertEquals("r-3", zname.getName());
+        assertEquals("r", zname.getPrefix());
+        assertEquals(Integer.valueOf(3), zname.getSequence().get());
     }
 
     @Test
@@ -112,19 +119,19 @@ public void testOrderWithDifferentPrefixIncludingSessionId() throws Exception {
         final Iterator<ZNodeName> it = nodeNames.iterator();
 
         zname = it.next();
-        Assert.assertEquals("x-98566387950223723-0000000001", zname.getName());
-        Assert.assertEquals("x-98566387950223723", zname.getPrefix());
-        Assert.assertEquals(Integer.valueOf(1), zname.getSequence().get());
+        assertEquals("x-98566387950223723-0000000001", zname.getName());
+        assertEquals("x-98566387950223723", zname.getPrefix());
+        assertEquals(Integer.valueOf(1), zname.getSequence().get());
 
         zname = it.next();
-        Assert.assertEquals("x-242681582799028564-0000000002", zname.getName());
-        Assert.assertEquals("x-242681582799028564", zname.getPrefix());
-        Assert.assertEquals(Integer.valueOf(2), zname.getSequence().get());
+        assertEquals("x-242681582799028564-0000000002", zname.getName());
+        assertEquals("x-242681582799028564", zname.getPrefix());
+        assertEquals(Integer.valueOf(2), zname.getSequence().get());
 
         zname = it.next();
-        Assert.assertEquals("x-170623981976748329-0000000003", zname.getName());
-        Assert.assertEquals("x-170623981976748329", zname.getPrefix());
-        Assert.assertEquals(Integer.valueOf(3), zname.getSequence().get());
+        assertEquals("x-170623981976748329-0000000003", zname.getName());
+        assertEquals("x-170623981976748329", zname.getPrefix());
+        assertEquals(Integer.valueOf(3), zname.getSequence().get());
     }
 
     @Test
@@ -138,19 +145,19 @@ public void testOrderWithExtraPrefixes() throws Exception {
         final Iterator<ZNodeName> it = nodeNames.iterator();
 
         zname = it.next();
-        Assert.assertEquals("r-2-2-1", zname.getName());
-        Assert.assertEquals("r-2-2", zname.getPrefix());
-        Assert.assertEquals(Integer.valueOf(1), zname.getSequence().get());
+        assertEquals("r-2-2-1", zname.getName());
+        assertEquals("r-2-2", zname.getPrefix());
+        assertEquals(Integer.valueOf(1), zname.getSequence().get());
 
         zname = it.next();
-        Assert.assertEquals("r-1-3-2", zname.getName());
-        Assert.assertEquals("r-1-3", zname.getPrefix());
-        Assert.assertEquals(Integer.valueOf(2), zname.getSequence().get());
+        assertEquals("r-1-3-2", zname.getName());
+        assertEquals("r-1-3", zname.getPrefix());
+        assertEquals(Integer.valueOf(2), zname.getSequence().get());
 
         zname = it.next();
-        Assert.assertEquals("r-3-1-3", zname.getName());
-        Assert.assertEquals("r-3-1", zname.getPrefix());
-        Assert.assertEquals(Integer.valueOf(3), zname.getSequence().get());
+        assertEquals("r-3-1-3", zname.getName());
+        assertEquals("r-3-1", zname.getPrefix());
+        assertEquals(Integer.valueOf(3), zname.getSequence().get());
     }
 
     @Test
@@ -164,24 +171,26 @@ public void testMissingSequenceNumber() throws Exception {
         final Iterator<ZNodeName> it = nodeNames.iterator();
 
         zname = it.next();
-        Assert.assertEquals("b-1", zname.getName());
-        Assert.assertEquals("b", zname.getPrefix());
-        Assert.assertEquals(Integer.valueOf(1), zname.getSequence().get());
+        assertEquals("b-1", zname.getName());
+        assertEquals("b", zname.getPrefix());
+        assertEquals(Integer.valueOf(1), zname.getSequence().get());
 
         zname = it.next();
-        Assert.assertEquals("a", zname.getName());
-        Assert.assertEquals("a", zname.getPrefix());
-        Assert.assertFalse(zname.getSequence().isPresent());
+        assertEquals("a", zname.getName());
+        assertEquals("a", zname.getPrefix());
+        assertFalse(zname.getSequence().isPresent());
 
         zname = it.next();
-        Assert.assertEquals("c", zname.getName());
-        Assert.assertEquals("c", zname.getPrefix());
-        Assert.assertFalse(zname.getSequence().isPresent());
+        assertEquals("c", zname.getName());
+        assertEquals("c", zname.getPrefix());
+        assertFalse(zname.getSequence().isPresent());
     }
 
-    @Test(expected = NullPointerException.class)
+    @Test
     public void testNullName() {
-        new ZNodeName(null);
+        assertThrows(NullPointerException.class, () -> {
+            new ZNodeName(null);
+        });
     }
 
 }
diff --git a/zookeeper-recipes/zookeeper-recipes-queue/pom.xml b/zookeeper-recipes/zookeeper-recipes-queue/pom.xml
old mode 100755
new mode 100644
index 3fa024694df..e8f6e1c3704
--- a/zookeeper-recipes/zookeeper-recipes-queue/pom.xml
+++ b/zookeeper-recipes/zookeeper-recipes-queue/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>zookeeper-recipes</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper-recipes-queue</artifactId>
@@ -44,9 +44,6 @@
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-surefire-plugin</artifactId>
         <configuration>
-          <includes>
-            <include>**/*Test.java</include>
-          </includes>
           <forkCount>${surefire-forkcount}</forkCount>
           <reuseForks>false</reuseForks>
           <argLine>-Xmx512m</argLine>
diff --git a/zookeeper-recipes/zookeeper-recipes-queue/src/main/c/acinclude.m4 b/zookeeper-recipes/zookeeper-recipes-queue/src/main/c/acinclude.m4
index a4d405a8044..13cacbf81e1 100644
--- a/zookeeper-recipes/zookeeper-recipes-queue/src/main/c/acinclude.m4
+++ b/zookeeper-recipes/zookeeper-recipes-queue/src/main/c/acinclude.m4
@@ -10,7 +10,7 @@
 # DX_???_FEATURE(ON|OFF) - control the default setting of a Doxygen feature.
 # Supported features are 'DOXYGEN' itself, 'DOT' for generating graphics,
 # 'HTML' for plain HTML, 'CHM' for compressed HTML help (for MS users), 'CHI'
-# for generating a seperate .chi file by the .chm file, and 'MAN', 'RTF',
+# for generating a separate .chi file by the .chm file, and 'MAN', 'RTF',
 # 'XML', 'PDF' and 'PS' for the appropriate output formats. The environment
 # variable DOXYGEN_PAPER_SIZE may be specified to override the default 'a4wide'
 # paper size.
@@ -239,8 +239,8 @@ DX_ARG_ABLE(chm, [generate doxygen compressed HTML help documentation],
              DX_ENV_APPEND(GENERATE_HTMLHELP, YES)],
             [DX_ENV_APPEND(GENERATE_HTMLHELP, NO)])
 
-# Seperate CHI file generation.
-DX_ARG_ABLE(chi, [generate doxygen seperate compressed HTML help index file],
+# Separate CHI file generation.
+DX_ARG_ABLE(chi, [generate doxygen separate compressed HTML help index file],
             [DX_CHECK_DEPEND(chm, 1)],
             [DX_CLEAR_DEPEND(chm, 1)],
             [],
diff --git a/zookeeper-recipes/zookeeper-recipes-queue/src/main/c/src/zoo_queue.c b/zookeeper-recipes/zookeeper-recipes-queue/src/main/c/src/zoo_queue.c
index d7cc5707ec0..8bf3415291b 100644
--- a/zookeeper-recipes/zookeeper-recipes-queue/src/main/c/src/zoo_queue.c
+++ b/zookeeper-recipes/zookeeper-recipes-queue/src/main/c/src/zoo_queue.c
@@ -249,7 +249,7 @@ ZOOAPI int zkr_queue_remove(zkr_queue_t *queue, char *buffer, int *buffer_len){
  *
  * Whichever thread is last to call their required function disposes of the latch.
  *
- * The latch may disposed if no threads will call the waiting, marking, or triggering functions using take_latch_destroy_syncrhonized().
+ * The latch may disposed if no threads will call the waiting, marking, or triggering functions using take_latch_destroy_synchronized().
  */
 
 struct take_latch {
diff --git a/zookeeper-recipes/zookeeper-recipes-queue/src/main/c/tests/zkServer.sh b/zookeeper-recipes/zookeeper-recipes-queue/src/main/c/tests/zkServer.sh
index 4836612d68a..e6201e9bd28 100755
--- a/zookeeper-recipes/zookeeper-recipes-queue/src/main/c/tests/zkServer.sh
+++ b/zookeeper-recipes/zookeeper-recipes-queue/src/main/c/tests/zkServer.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#! /usr/bin/env bash
 #
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements.  See the NOTICE file
@@ -8,68 +8,64 @@
 # "License"); you may not use this file except in compliance
 # with the License.  You may obtain a copy of the License at
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
 
-if [ "x$1" == "x" ]
-then
-	echo "USAGE: $0 startClean|start|stop hostPorts"
-	exit 2
+if [[ -z $1 ]]; then
+  echo "USAGE: $0 startClean|start|stop hostPorts"
+  exit 2
 fi
 
-if [ "x$1" == "xstartClean" ]
-then
-	rm -rf /tmp/zkdata
+if [[ $1 == "startClean" ]]; then
+  rm -rf /tmp/zkdata
 fi
 
 # Make sure nothing is left over from before
-if [ -r "/tmp/zk.pid" ]
-then
-pid=`cat /tmp/zk.pid`
-kill -9 $pid
-rm -f /tmp/zk.pid
+if [[ -r "/tmp/zk.pid" ]]; then
+  pid=$(cat /tmp/zk.pid)
+  kill -9 "$pid"
+  rm -f /tmp/zk.pid
 fi
 
 base_dir="../../../../.."
 
-CLASSPATH="$CLASSPATH:${base_dir}/build/classes"
-CLASSPATH="$CLASSPATH:${base_dir}/conf"
+CLASSPATH="$CLASSPATH:$base_dir/build/classes"
+CLASSPATH="$CLASSPATH:$base_dir/conf"
 
-for f in "${base_dir}"/zookeeper-*.jar
-do
-    CLASSPATH="$CLASSPATH:$f"
+for f in "$base_dir"/zookeeper-*.jar; do
+  CLASSPATH="$CLASSPATH:$f"
 done
 
-for i in "${base_dir}"/build/lib/*.jar
-do
-    CLASSPATH="$CLASSPATH:$i"
+for i in "$base_dir"/build/lib/*.jar; do
+  CLASSPATH="$CLASSPATH:$i"
 done
 
-for i in "${base_dir}"/zookeeper-server/src/main/resource/lib/*.jar
-do
-    CLASSPATH="$CLASSPATH:$i"
+for i in "$base_dir"/zookeeper-server/src/main/resource/lib/*.jar; do
+  CLASSPATH="$CLASSPATH:$i"
 done
 
-CLASSPATH="$CLASSPATH:${CLOVER_HOME}/lib/clover.jar"
+CLASSPATH="$CLASSPATH:$CLOVER_HOME/lib/clover.jar"
+export CLASSPATH
 
 case $1 in
-start|startClean)
-	mkdir -p /tmp/zkdata
-	java -cp $CLASSPATH org.apache.zookeeper.server.ZooKeeperServerMain 22181 /tmp/zkdata &> /tmp/zk.log &
-        echo $! > /tmp/zk.pid
-        sleep 5
-	;;
-stop)
-	# Already killed above
-	;;
-*)
-	echo "Unknown command " + $1
-	exit 2
+  start | startClean)
+    mkdir -p /tmp/zkdata
+    java org.apache.zookeeper.server.ZooKeeperServerMain 22181 /tmp/zkdata &>/tmp/zk.log &
+    echo $! >/tmp/zk.pid
+    sleep 5
+    ;;
+  stop)
+    # Already killed above
+    ;;
+  *)
+    echo "Unknown command $1"
+    exit 2
+    ;;
 esac
-
diff --git a/zookeeper-recipes/zookeeper-recipes-queue/src/test/java/org/apache/zookeeper/recipes/queue/DistributedQueueTest.java b/zookeeper-recipes/zookeeper-recipes-queue/src/test/java/org/apache/zookeeper/recipes/queue/DistributedQueueTest.java
index 73829204a5b..f5ec02f9d83 100644
--- a/zookeeper-recipes/zookeeper-recipes-queue/src/test/java/org/apache/zookeeper/recipes/queue/DistributedQueueTest.java
+++ b/zookeeper-recipes/zookeeper-recipes-queue/src/test/java/org/apache/zookeeper/recipes/queue/DistributedQueueTest.java
@@ -18,20 +18,23 @@
 
 package org.apache.zookeeper.recipes.queue;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.NoSuchElementException;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Assert;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
 
 /**
  * Tests for {@link DistributedQueue}.
  */
 public class DistributedQueueTest extends ClientBase {
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         super.tearDown();
     }
@@ -48,10 +51,10 @@ public void testOffer1() throws Exception {
             queueHandles[i] = new DistributedQueue(clients[i], dir, null);
         }
 
-        queueHandles[0].offer(testString.getBytes());
+        queueHandles[0].offer(testString.getBytes(UTF_8));
 
         byte[] dequeuedBytes = queueHandles[0].remove();
-        Assert.assertEquals(new String(dequeuedBytes), testString);
+        assertEquals(new String(dequeuedBytes, UTF_8), testString);
     }
 
     @Test
@@ -66,10 +69,10 @@ public void testOffer2() throws Exception {
             queueHandles[i] = new DistributedQueue(clients[i], dir, null);
         }
 
-        queueHandles[0].offer(testString.getBytes());
+        queueHandles[0].offer(testString.getBytes(UTF_8));
 
         byte[] dequeuedBytes = queueHandles[1].remove();
-        Assert.assertEquals(new String(dequeuedBytes), testString);
+        assertEquals(new String(dequeuedBytes, UTF_8), testString);
     }
 
     @Test
@@ -84,10 +87,10 @@ public void testTake1() throws Exception {
             queueHandles[i] = new DistributedQueue(clients[i], dir, null);
         }
 
-        queueHandles[0].offer(testString.getBytes());
+        queueHandles[0].offer(testString.getBytes(UTF_8));
 
         byte[] dequeuedBytes = queueHandles[0].take();
-        Assert.assertEquals(new String(dequeuedBytes), testString);
+        assertEquals(new String(dequeuedBytes, UTF_8), testString);
     }
 
     @Test
@@ -107,7 +110,7 @@ public void testRemove1() throws Exception {
             return;
         }
 
-        Assert.fail();
+        fail();
     }
 
     public void createNremoveMtest(String dir, int n, int m) throws Exception {
@@ -122,7 +125,7 @@ public void createNremoveMtest(String dir, int n, int m) throws Exception {
 
         for (int i = 0; i < n; i++) {
             String offerString = testString + i;
-            queueHandles[0].offer(offerString.getBytes());
+            queueHandles[0].offer(offerString.getBytes(UTF_8));
         }
 
         byte[] data = null;
@@ -130,8 +133,8 @@ public void createNremoveMtest(String dir, int n, int m) throws Exception {
             data = queueHandles[1].remove();
         }
 
-        Assert.assertNotNull(data);
-        Assert.assertEquals(new String(data), testString + (m - 1));
+        assertNotNull(data);
+        assertEquals(new String(data, UTF_8), testString + (m - 1));
     }
 
     @Test
@@ -155,13 +158,13 @@ public void createNremoveMelementTest(String dir, int n, int m) throws Exception
 
         for (int i = 0; i < n; i++) {
             String offerString = testString + i;
-            queueHandles[0].offer(offerString.getBytes());
+            queueHandles[0].offer(offerString.getBytes(UTF_8));
         }
 
         for (int i = 0; i < m; i++) {
             queueHandles[1].remove();
         }
-        Assert.assertEquals(new String(queueHandles[1].element()), testString + m);
+        assertEquals(new String(queueHandles[1].element(), UTF_8), testString + m);
     }
 
     @Test
@@ -209,7 +212,7 @@ public void testTakeWait1() throws Exception {
         Thread.sleep(1000);
         Thread offerThread = new Thread(() -> {
             try {
-                queueHandles[0].offer(testString.getBytes());
+                queueHandles[0].offer(testString.getBytes(UTF_8));
             } catch (KeeperException | InterruptedException ignore) {
                 // no op
             }
@@ -219,8 +222,8 @@ public void testTakeWait1() throws Exception {
 
         takeThread.join();
 
-        Assert.assertNotNull(takeResult[0]);
-        Assert.assertEquals(new String(takeResult[0]), testString);
+        assertNotNull(takeResult[0]);
+        assertEquals(new String(takeResult[0], UTF_8), testString);
     }
 
     @Test
@@ -250,7 +253,7 @@ public void testTakeWait2() throws Exception {
             Thread.sleep(1000);
             Thread offerThread = new Thread(() -> {
                 try {
-                    queueHandles[0].offer(threadTestString.getBytes());
+                    queueHandles[0].offer(threadTestString.getBytes(UTF_8));
                 } catch (KeeperException | InterruptedException ignore) {
                     // no op
                 }
@@ -260,8 +263,8 @@ public void testTakeWait2() throws Exception {
 
             takeThread.join();
 
-            Assert.assertNotNull(takeResult[0]);
-            Assert.assertEquals(new String(takeResult[0]), threadTestString);
+            assertNotNull(takeResult[0]);
+            assertEquals(new String(takeResult[0], UTF_8), threadTestString);
         }
     }
 
diff --git a/zookeeper-server/pom.xml b/zookeeper-server/pom.xml
old mode 100755
new mode 100644
index 21c30eae87f..f4b76095d2e
--- a/zookeeper-server/pom.xml
+++ b/zookeeper-server/pom.xml
@@ -23,8 +23,7 @@
   <parent>
     <groupId>org.apache.zookeeper</groupId>
     <artifactId>parent</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
-    <relativePath>..</relativePath>
+    <version>3.10.0-SNAPSHOT</version>
   </parent>
 
   <artifactId>zookeeper</artifactId>
@@ -41,18 +40,14 @@
     </dependency>
     <dependency>
       <groupId>org.hamcrest</groupId>
-      <artifactId>hamcrest-all</artifactId>
+      <artifactId>hamcrest-library</artifactId>
       <scope>test</scope>
     </dependency>
     <dependency>
-      <groupId>commons-collections</groupId>
-      <artifactId>commons-collections</artifactId>
+      <groupId>org.apache.commons</groupId>
+      <artifactId>commons-collections4</artifactId>
       <scope>test</scope>
     </dependency>
-    <dependency>
-      <groupId>commons-lang</groupId>
-      <artifactId>commons-lang</artifactId>
-    </dependency>
     <dependency>
       <groupId>org.apache.zookeeper</groupId>
       <artifactId>zookeeper-jute</artifactId>
@@ -74,14 +69,21 @@
     <dependency>
       <groupId>io.netty</groupId>
       <artifactId>netty-transport-native-epoll</artifactId>
+      <classifier>linux-x86_64</classifier>
+    </dependency>
+    <dependency>
+      <groupId>io.netty</groupId>
+      <artifactId>netty-tcnative-boringssl-static</artifactId>
     </dependency>
     <dependency>
       <groupId>org.slf4j</groupId>
       <artifactId>slf4j-api</artifactId>
     </dependency>
     <dependency>
-      <groupId>org.slf4j</groupId>
-      <artifactId>slf4j-log4j12</artifactId>
+      <groupId>ch.qos.logback</groupId>
+      <artifactId>logback-classic</artifactId>
+      <scope>runtime</scope>
+      <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>org.eclipse.jetty</groupId>
@@ -94,27 +96,27 @@
       <scope>provided</scope>
     </dependency>
     <dependency>
-      <groupId>com.fasterxml.jackson.core</groupId>
-      <artifactId>jackson-databind</artifactId>
+      <groupId>org.eclipse.jetty</groupId>
+      <artifactId>jetty-client</artifactId>
       <scope>provided</scope>
     </dependency>
     <dependency>
-      <groupId>com.googlecode.json-simple</groupId>
-      <artifactId>json-simple</artifactId>
+      <groupId>com.fasterxml.jackson.core</groupId>
+      <artifactId>jackson-databind</artifactId>
       <scope>provided</scope>
     </dependency>
     <dependency>
       <groupId>org.bouncycastle</groupId>
-      <artifactId>bcprov-jdk15on</artifactId>
+      <artifactId>bcprov-jdk18on</artifactId>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.bouncycastle</groupId>
-      <artifactId>bcpkix-jdk15on</artifactId>
+      <artifactId>bcpkix-jdk18on</artifactId>
       <scope>test</scope>
     </dependency>
     <dependency>
-      <groupId>jline</groupId>
+      <groupId>org.jline</groupId>
       <artifactId>jline</artifactId>
       <scope>provided</scope>
     </dependency>
@@ -123,10 +125,6 @@
        <artifactId>metrics-core</artifactId>
        <scope>provided</scope>
     </dependency>
-    <dependency>
-      <groupId>log4j</groupId>
-      <artifactId>log4j</artifactId>
-    </dependency>
     <dependency>
       <groupId>org.apache.kerby</groupId>
       <artifactId>kerb-core</artifactId>
@@ -147,14 +145,39 @@
       <artifactId>mockito-core</artifactId>
       <scope>test</scope>
     </dependency>
+    <dependency>
+      <groupId>org.mockito</groupId>
+      <artifactId>mockito-inline</artifactId>
+      <scope>test</scope>
+    </dependency>
     <dependency>
       <groupId>org.jmockit</groupId>
       <artifactId>jmockit</artifactId>
       <scope>test</scope>
     </dependency>
     <dependency>
-      <groupId>junit</groupId>
-      <artifactId>junit</artifactId>
+      <groupId>org.junit.jupiter</groupId>
+      <artifactId>junit-jupiter-api</artifactId>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.junit.jupiter</groupId>
+      <artifactId>junit-jupiter-engine</artifactId>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.junit.jupiter</groupId>
+      <artifactId>junit-jupiter-params</artifactId>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.junit.platform</groupId>
+      <artifactId>junit-platform-runner</artifactId>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.burningwave</groupId>
+      <artifactId>tools</artifactId>
       <scope>test</scope>
     </dependency>
     <dependency>
@@ -162,26 +185,42 @@
       <artifactId>snappy-java</artifactId>
       <scope>provided</scope>
     </dependency>
+    <dependency>
+      <groupId>commons-io</groupId>
+      <artifactId>commons-io</artifactId>
+      <scope>compile</scope>
+    </dependency>
+    <dependency>
+      <groupId>dnsjava</groupId>
+      <artifactId>dnsjava</artifactId>
+    </dependency>
   </dependencies>
 
   <build>
     <plugins>
-      <plugin> <!-- ${maven.build.timestamp} does not support timezone :( -->
+      <plugin>
         <groupId>org.codehaus.mojo</groupId>
         <artifactId>build-helper-maven-plugin</artifactId>
         <executions>
           <execution>
-            <id>tbuild-time</id>
+            <!-- ${maven.build.timestamp} does not support timezone :( -->
+            <id>build-time</id>
             <goals>
               <goal>timestamp-property</goal>
             </goals>
             <configuration>
               <name>build.time</name>
-              <pattern>MM/dd/yyyy HH:mm zz</pattern>
+              <pattern>yyyy-MM-dd HH:mm zz</pattern>
               <locale>en_US</locale>
-              <timeZone>GMT</timeZone>
+              <timeZone>UTC</timeZone>
             </configuration>
           </execution>
+          <execution>
+            <id>parse-version</id>
+            <goals>
+              <goal>parse-version</goal>
+            </goals>
+          </execution>
           <execution>
             <phase>generate-sources</phase>
             <goals>
@@ -197,44 +236,22 @@
       </plugin>
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
-        <artifactId>maven-compiler-plugin</artifactId>
+        <artifactId>maven-resources-plugin</artifactId>
         <executions>
           <execution>
-            <id>pre-compile-vergen</id>
-            <phase>generate-sources</phase>
-            <configuration>
-              <includes>
-                <include>org/apache/zookeeper/version/**/*.java</include>
-              </includes>
-            </configuration>
+            <id>prepare-filtered-java-source</id>
             <goals>
-              <goal>compile</goal>
+              <goal>copy-resources</goal>
             </goals>
-          </execution>
-        </executions>
-      </plugin>
-      <plugin>
-        <groupId>org.codehaus.mojo</groupId>
-        <artifactId>exec-maven-plugin</artifactId>
-        <executions>
-          <execution>
-            <id>generate-version-info</id>
             <phase>generate-sources</phase>
-            <goals>
-              <goal>exec</goal>
-            </goals>
             <configuration>
-              <workingDirectory>${project.basedir}/src/main/java/</workingDirectory>
-              <executable>java</executable>
-              <arguments>
-                <argument>-classpath</argument>
-                <classpath />
-                <argument>org.apache.zookeeper.version.util.VerGen</argument>
-                <argument>${project.version}</argument>
-                <argument>${mvngit.commit.id}</argument>
-                <argument>${build.time}</argument>
-                <argument>${project.basedir}/target/generated-sources/java</argument>
-              </arguments>
+              <outputDirectory>${project.build.directory}/generated-sources/java</outputDirectory>
+              <resources>
+                <resource>
+                  <directory>src/main/java-filtered</directory>
+                  <filtering>true</filtering>
+                </resource>
+              </resources>
             </configuration>
           </execution>
         </executions>
@@ -270,14 +287,57 @@
           <reuseForks>false</reuseForks>
           <argLine>-Xmx512m -Dtest.junit.threads=${surefire-forkcount} -Dzookeeper.junit.threadid=${surefire.forkNumber} -javaagent:${org.jmockit:jmockit:jar}</argLine>
           <basedir>${project.basedir}</basedir>
-          <redirectTestOutputToFile>true</redirectTestOutputToFile>
           <systemPropertyVariables>
             <build.test.dir>${project.build.directory}/surefire</build.test.dir>
             <zookeeper.DigestAuthenticationProvider.superDigest>super:D/InIHSb7yEEbrWz8b9l71RjZJU=</zookeeper.DigestAuthenticationProvider.superDigest>
           </systemPropertyVariables>
         </configuration>
       </plugin>
-	  
+
+      <plugin>
+        <groupId>org.apache.felix</groupId>
+        <artifactId>maven-bundle-plugin</artifactId>
+        <executions>
+          <execution>
+            <id>build bundle</id>
+            <phase>package</phase>
+            <goals>
+              <goal>bundle</goal>
+            </goals>
+          </execution>
+        </executions>
+        <configuration>
+          <instructions>
+            <Import-Package>
+              io.netty.buffer;resolution:=optional,
+              io.netty.channel;resolution:=optional,
+              io.netty.channel.group;resolution:=optional,
+              io.netty.channel.socket.nio;resolution:=optional,
+              javax.management;resolution:=optional,
+              javax.security.auth.callback,
+              javax.security.auth.login,
+              javax.security.sasl,
+              org.ietf.jgss,
+              org.osgi.framework;resolution:=optional,
+              org.osgi.util.tracker;resolution:=optional,
+              org.slf4j,
+              *;resolution:=optional
+            </Import-Package>
+            <Export-Package>
+              !org.apache.zookeeper.data,
+              !org.apache.zookeeper.proto,
+              !org.apache.zookeeper.txn,
+              org.apache.zookeeper*
+            </Export-Package>
+            <Bundle-Name>ZooKeeper Bundle</Bundle-Name>
+            <Bundle-DocURL>https://zookeeper.apache.org/doc/current/</Bundle-DocURL>
+            <Implementation-Build>${mvngit.commit.id}</Implementation-Build>
+            <Merge-Headers>!Implementation-Build,*</Merge-Headers>
+          </instructions>
+          <classifier>osgi</classifier>
+        </configuration>
+      </plugin>
+
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-jar-plugin</artifactId>
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/NotOp.java b/zookeeper-server/src/main/java-filtered/org/apache/zookeeper/version/Info.java
similarity index 64%
rename from zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/NotOp.java
rename to zookeeper-server/src/main/java-filtered/org/apache/zookeeper/version/Info.java
index d8ed7573faf..5570eccf800 100644
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/NotOp.java
+++ b/zookeeper-server/src/main/java-filtered/org/apache/zookeeper/version/Info.java
@@ -1,4 +1,4 @@
-/**
+/*
  * Licensed to the Apache Software Foundation (ASF) under one
  * or more contributor license agreements.  See the NOTICE file
  * distributed with this work for additional information
@@ -15,17 +15,15 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.apache.zookeeper.graph.filterops;
 
-import org.apache.zookeeper.graph.LogEntry;
-import org.apache.zookeeper.graph.FilterOp;
-import org.apache.zookeeper.graph.FilterException;
+package org.apache.zookeeper.version;
 
-public class NotOp extends FilterOp {
-    public boolean matches(LogEntry entry) throws FilterException {
-	if (subOps.size() != 1) {
-	    throw new FilterException("Not operation can only take one argument");
-	}
-	return !subOps.get(0).matches(entry);
-    }
+public interface Info {
+    int MAJOR=${parsedVersion.majorVersion};
+    int MINOR=${parsedVersion.minorVersion};
+    int MICRO=${parsedVersion.incrementalVersion};
+    String QUALIFIER="${parsedVersion.qualifier}".isEmpty() ? null : "${parsedVersion.qualifier}";
+    int REVISION=-1; //@deprecated, please use REVISION_HASH
+    String REVISION_HASH="${mvngit.commit.id}";
+    String BUILD_DATE="${build.time}";
 }
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/StringArg.java b/zookeeper-server/src/main/java-filtered/org/apache/zookeeper/version/VersionInfoMain.java
similarity index 76%
rename from zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/StringArg.java
rename to zookeeper-server/src/main/java-filtered/org/apache/zookeeper/version/VersionInfoMain.java
index 7345d3cc09a..b7d0054bd72 100644
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/StringArg.java
+++ b/zookeeper-server/src/main/java-filtered/org/apache/zookeeper/version/VersionInfoMain.java
@@ -1,4 +1,4 @@
-/**
+/*
  * Licensed to the Apache Software Foundation (ASF) under one
  * or more contributor license agreements.  See the NOTICE file
  * distributed with this work for additional information
@@ -15,14 +15,11 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.apache.zookeeper.graph.filterops;
 
-import org.apache.zookeeper.graph.FilterOp.*;
+package org.apache.zookeeper.version;
 
-public class StringArg extends Arg<String> {
-    public StringArg(String value) {
-	super(ArgType.STRING);
-	    this.value = value;
+public class VersionInfoMain implements org.apache.zookeeper.version.Info {
+    public static void main(String[] args) {
+        System.out.println("Apache ZooKeeper, version ${project.version} ${build.time}");
     }
-};
-
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/AsyncCallback.java b/zookeeper-server/src/main/java/org/apache/zookeeper/AsyncCallback.java
index 918d1180ae0..513238cfb59 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/AsyncCallback.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/AsyncCallback.java
@@ -62,10 +62,10 @@ interface StatCallback extends AsyncCallback {
          * @param ctx  Whatever context object that we passed to asynchronous calls.
          * @param stat {@link Stat} object of the node on given path.
          *
-         * @see ZooKeeper#exists(String, boolean, StatCallback, Object)
-         * @see ZooKeeper#exists(String, Watcher, StatCallback, Object)
-         * @see ZooKeeper#setData(String, byte[], int, StatCallback, Object)
-         * @see ZooKeeper#setACL(String, List, int, StatCallback, Object)
+         * @see ZooKeeper#exists(String, boolean, AsyncCallback.StatCallback, Object)
+         * @see ZooKeeper#exists(String, Watcher, AsyncCallback.StatCallback, Object)
+         * @see ZooKeeper#setData(String, byte[], int, AsyncCallback.StatCallback, Object)
+         * @see ZooKeeper#setACL(String, List, int, AsyncCallback.StatCallback, Object)
          */
         void processResult(int rc, String path, Object ctx, Stat stat);
 
@@ -84,7 +84,7 @@ interface AllChildrenNumberCallback extends AsyncCallback {
          * @param ctx     Whatever context object that we passed to asynchronous calls.
          * @param number  The number of children nodes under a specific path.
          *
-         * @see ZooKeeper#getAllChildrenNumber(String, AllChildrenNumberCallback, Object)
+         * @see ZooKeeper#getAllChildrenNumber(String, AsyncCallback.AllChildrenNumberCallback, Object)
          */
         void processResult(int rc, String path, Object ctx, int number);
 
@@ -113,10 +113,10 @@ interface DataCallback extends AsyncCallback {
          * @param data The data of the node.
          * @param stat {@link Stat} object of the node on given path.
          *
-         * @see ZooKeeper#getData(String, boolean, DataCallback, Object)
-         * @see ZooKeeper#getData(String, Watcher, DataCallback, Object)
-         * @see ZooKeeper#getConfig(boolean, DataCallback, Object)
-         * @see ZooKeeper#getConfig(Watcher, DataCallback, Object)
+         * @see ZooKeeper#getData(String, boolean, AsyncCallback.DataCallback, Object)
+         * @see ZooKeeper#getData(String, Watcher, AsyncCallback.DataCallback, Object)
+         * @see ZooKeeper#getConfig(boolean, AsyncCallback.DataCallback, Object)
+         * @see ZooKeeper#getConfig(Watcher, AsyncCallback.DataCallback, Object)
          */
         void processResult(int rc, String path, Object ctx, byte[] data, Stat stat);
 
@@ -145,7 +145,7 @@ interface ACLCallback extends AsyncCallback {
          * @param acl  ACL Id in {@link ZooDefs.Ids}.
          * @param stat {@link Stat} object of the node on given path.
          *
-         * @see ZooKeeper#getACL(String, Stat, ACLCallback, Object)
+         * @see ZooKeeper#getACL(String, Stat, AsyncCallback.ACLCallback, Object)
          */
         void processResult(int rc, String path, Object ctx, List<ACL> acl, Stat stat);
 
@@ -173,8 +173,8 @@ interface ChildrenCallback extends AsyncCallback {
          * @param ctx      Whatever context object that we passed to asynchronous calls.
          * @param children An unordered array of children of the node on given path.
          *
-         * @see ZooKeeper#getChildren(String, boolean, ChildrenCallback, Object)
-         * @see ZooKeeper#getChildren(String, Watcher, ChildrenCallback, Object)
+         * @see ZooKeeper#getChildren(String, boolean, AsyncCallback.ChildrenCallback, Object)
+         * @see ZooKeeper#getChildren(String, Watcher, AsyncCallback.ChildrenCallback, Object)
          */
         void processResult(int rc, String path, Object ctx, List<String> children);
 
@@ -196,8 +196,8 @@ interface Children2Callback extends AsyncCallback {
          * @param stat     {@link Stat} object of the node on given path.
          *
          * @see ChildrenCallback
-         * @see ZooKeeper#getChildren(String, boolean, Children2Callback, Object)
-         * @see ZooKeeper#getChildren(String, Watcher, Children2Callback, Object)
+         * @see ZooKeeper#getChildren(String, boolean, AsyncCallback.Children2Callback, Object)
+         * @see ZooKeeper#getChildren(String, Watcher, AsyncCallback.Children2Callback, Object)
          */
         void processResult(int rc, String path, Object ctx, List<String> children, Stat stat);
 
@@ -221,8 +221,8 @@ interface Create2Callback extends AsyncCallback {
          * @param stat {@link Stat} object of the node on given path.
          *
          * @see StringCallback
-         * @see ZooKeeper#create(String, byte[], List, CreateMode, Create2Callback, Object)
-         * @see ZooKeeper#create(String, byte[], List, CreateMode, Create2Callback, Object, long)
+         * @see ZooKeeper#create(String, byte[], List, CreateMode, AsyncCallback.Create2Callback, Object)
+         * @see ZooKeeper#create(String, byte[], List, CreateMode, AsyncCallback.Create2Callback, Object, long)
          */
         void processResult(int rc, String path, Object ctx, String name, Stat stat);
 
@@ -257,7 +257,7 @@ interface StringCallback extends AsyncCallback {
          *             and <i>path</i> are usually equal, unless a sequential node has
          *             been created.
          *
-         * @see ZooKeeper#create(String, byte[], List, CreateMode, StringCallback, Object)
+         * @see ZooKeeper#create(String, byte[], List, CreateMode, AsyncCallback.StringCallback, Object)
          */
         void processResult(int rc, String path, Object ctx, String name);
 
@@ -265,7 +265,7 @@ interface StringCallback extends AsyncCallback {
 
     /**
      * This callback doesn't retrieve anything from the node. It is useful for some APIs
-     * that doesn't want anything sent back, e.g. {@link ZooKeeper#sync(String, VoidCallback, Object)}.
+     * that doesn't want anything sent back, e.g. {@link ZooKeeper#sync(String, AsyncCallback.VoidCallback, Object)}.
      */
     @InterfaceAudience.Public
     interface VoidCallback extends AsyncCallback {
@@ -283,17 +283,17 @@ interface VoidCallback extends AsyncCallback {
          *             - The given version doesn't match the node's version for some API calls.</li>
          *  <li>{@link KeeperException.Code#NOTEMPTY}
          *             - the node has children and some API calls cannot succeed, e.g.
-         *             {@link ZooKeeper#delete(String, int, VoidCallback, Object)}.</li>
+         *             {@link ZooKeeper#delete(String, int, AsyncCallback.VoidCallback, Object)}.</li>
          * </ul>
          *
          * @param rc   The return code or the result of the call.
          * @param path The path that we passed to asynchronous calls.
          * @param ctx  Whatever context object that we passed to asynchronous calls.
          *
-         * @see ZooKeeper#delete(String, int, VoidCallback, Object)
-         * @see ZooKeeper#removeAllWatches(String, Watcher.WatcherType, boolean, VoidCallback, Object)
-         * @see ZooKeeper#removeWatches(String, Watcher, Watcher.WatcherType, boolean, VoidCallback, Object)
-         * @see ZooKeeper#sync(String, VoidCallback, Object)
+         * @see ZooKeeper#delete(String, int, AsyncCallback.VoidCallback, Object)
+         * @see ZooKeeper#removeAllWatches(String, Watcher.WatcherType, boolean, AsyncCallback.VoidCallback, Object)
+         * @see ZooKeeper#removeWatches(String, Watcher, Watcher.WatcherType, boolean, AsyncCallback.VoidCallback, Object)
+         * @see ZooKeeper#sync(String, AsyncCallback.VoidCallback, Object)
          *
          */
         void processResult(int rc, String path, Object ctx);
@@ -323,7 +323,7 @@ interface MultiCallback extends AsyncCallback {
          * @param opResults The list of results. One result for each operation, and the order
          *                  matches that of input.
          *
-         * @see ZooKeeper#multi(Iterable, MultiCallback, Object)
+         * @see ZooKeeper#multi(Iterable, AsyncCallback.MultiCallback, Object)
          */
         void processResult(int rc, String path, Object ctx, List<OpResult> opResults);
 
@@ -332,8 +332,8 @@ interface MultiCallback extends AsyncCallback {
     /**
      * This callback is used to process the getEphemerals results from a single getEphemerals call.
      *
-     * @see ZooKeeper#getEphemerals(EphemeralsCallback, Object)
-     * @see ZooKeeper#getEphemerals(String, EphemeralsCallback, Object)
+     * @see ZooKeeper#getEphemerals(AsyncCallback.EphemeralsCallback, Object)
+     * @see ZooKeeper#getEphemerals(String, AsyncCallback.EphemeralsCallback, Object)
      *
      * @since 3.6.0
      */
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
index b3591461675..020f9408aab 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxn.java
@@ -19,28 +19,27 @@
 package org.apache.zookeeper;
 
 import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
-import java.io.BufferedReader;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
-import java.io.InputStreamReader;
 import java.net.ConnectException;
 import java.net.InetSocketAddress;
-import java.net.Socket;
 import java.net.SocketAddress;
 import java.nio.ByteBuffer;
 import java.util.ArrayDeque;
 import java.util.ArrayList;
+import java.util.Collections;
 import java.util.HashSet;
 import java.util.Iterator;
 import java.util.List;
 import java.util.Map;
 import java.util.Map.Entry;
 import java.util.Queue;
-import java.util.Random;
 import java.util.Set;
 import java.util.concurrent.CopyOnWriteArraySet;
 import java.util.concurrent.LinkedBlockingDeque;
 import java.util.concurrent.LinkedBlockingQueue;
+import java.util.concurrent.ThreadLocalRandom;
+import java.util.concurrent.atomic.AtomicReference;
 import javax.security.auth.login.LoginException;
 import javax.security.sasl.SaslException;
 import org.apache.jute.BinaryInputArchive;
@@ -65,10 +64,12 @@
 import org.apache.zookeeper.ZooDefs.OpCode;
 import org.apache.zookeeper.ZooKeeper.States;
 import org.apache.zookeeper.ZooKeeper.WatchRegistration;
+import org.apache.zookeeper.client.FourLetterWordMain;
 import org.apache.zookeeper.client.HostProvider;
 import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.client.ZooKeeperSaslClient;
 import org.apache.zookeeper.common.Time;
+import org.apache.zookeeper.common.X509Exception;
 import org.apache.zookeeper.proto.AuthPacket;
 import org.apache.zookeeper.proto.ConnectRequest;
 import org.apache.zookeeper.proto.Create2Response;
@@ -139,7 +140,7 @@ static class AuthData {
 
     }
 
-    private final CopyOnWriteArraySet<AuthData> authInfo = new CopyOnWriteArraySet<AuthData>();
+    private final CopyOnWriteArraySet<AuthData> authInfo = new CopyOnWriteArraySet<>();
 
     /**
      * These are the packets that have been sent and are waiting for a response.
@@ -149,7 +150,7 @@ static class AuthData {
     /**
      * These are the packets that need to be sent.
      */
-    private final LinkedBlockingDeque<Packet> outgoingQueue = new LinkedBlockingDeque<Packet>();
+    private final LinkedBlockingDeque<Packet> outgoingQueue = new LinkedBlockingDeque<>();
 
     private int connectTimeout;
 
@@ -163,15 +164,17 @@ static class AuthData {
 
     private int readTimeout;
 
+    private int expirationTimeout;
+
     private final int sessionTimeout;
 
-    private final ZooKeeper zooKeeper;
+    private final long newSessionTimeout;
 
-    private final ClientWatchManager watcher;
+    private final ZKWatchManager watchManager;
 
     private long sessionId;
 
-    private byte[] sessionPasswd = new byte[16];
+    private byte[] sessionPasswd;
 
     /**
      * If true, the connection is allowed to go to r-o mode. This field's value
@@ -181,8 +184,6 @@ static class AuthData {
      */
     private boolean readOnly;
 
-    final String chrootPath;
-
     final SendThread sendThread;
 
     final EventThread eventThread;
@@ -215,8 +216,6 @@ static class AuthData {
      */
     volatile boolean seenRwServerBefore = false;
 
-    public ZooKeeperSaslClient zooKeeperSaslClient;
-
     private final ZKClientConfig clientConfig;
     /**
      * If any request's response in not received in configured requestTimeout
@@ -224,6 +223,10 @@ static class AuthData {
      */
     private long requestTimeout;
 
+    ZKWatchManager getWatcherManager() {
+        return watchManager;
+    }
+
     public long getSessionId() {
         return sessionId;
     }
@@ -284,8 +287,6 @@ static class Packet {
 
         WatchRegistration watchRegistration;
 
-        public boolean readOnly;
-
         WatchDeregistration watchDeregistration;
 
         /** Convenience ctor */
@@ -294,23 +295,12 @@ static class Packet {
             ReplyHeader replyHeader,
             Record request,
             Record response,
-            WatchRegistration watchRegistration) {
-            this(requestHeader, replyHeader, request, response, watchRegistration, false);
-        }
-
-        Packet(
-            RequestHeader requestHeader,
-            ReplyHeader replyHeader,
-            Record request,
-            Record response,
-            WatchRegistration watchRegistration,
-            boolean readOnly) {
-
+            WatchRegistration watchRegistration
+        ) {
             this.requestHeader = requestHeader;
             this.replyHeader = replyHeader;
             this.request = request;
             this.response = response;
-            this.readOnly = readOnly;
             this.watchRegistration = watchRegistration;
         }
 
@@ -324,8 +314,6 @@ public void createBB() {
                 }
                 if (request instanceof ConnectRequest) {
                     request.serialize(boa, "connect");
-                    // append "am-I-allowed-to-be-readonly" flag
-                    boa.writeBool(readOnly, "readOnly");
                 } else if (request != null) {
                     request.serialize(boa, "request");
                 }
@@ -360,37 +348,28 @@ public String toString() {
     /**
      * Creates a connection object. The actual network connect doesn't get
      * established until needed. The start() instance method must be called
-     * subsequent to construction.
+     * after construction.
      *
-     * @param chrootPath - the chroot of this client. Should be removed from this Class in ZOOKEEPER-838
-     * @param hostProvider
-     *                the list of ZooKeeper servers to connect to
-     * @param sessionTimeout
-     *                the timeout for connections.
-     * @param zooKeeper
-     *                the zookeeper object that this connection is related to.
-     * @param watcher watcher for this connection
-     * @param clientCnxnSocket
-     *                the socket implementation used (e.g. NIO/Netty)
-     * @param canBeReadOnly
-     *                whether the connection is allowed to go to read-only
-     *                mode in case of partitioning
-     * @throws IOException
+     * @param hostProvider the list of ZooKeeper servers to connect to
+     * @param sessionTimeout the timeout for connections.
+     * @param clientConfig the client configuration.
+     * @param defaultWatcher default watcher for this connection
+     * @param clientCnxnSocket the socket implementation used (e.g. NIO/Netty)
+     * @param canBeReadOnly whether the connection is allowed to go to read-only mode in case of partitioning
      */
     public ClientCnxn(
-        String chrootPath,
         HostProvider hostProvider,
         int sessionTimeout,
-        ZooKeeper zooKeeper,
-        ClientWatchManager watcher,
+        ZKClientConfig clientConfig,
+        Watcher defaultWatcher,
         ClientCnxnSocket clientCnxnSocket,
-        boolean canBeReadOnly) throws IOException {
+        boolean canBeReadOnly
+    ) throws IOException {
         this(
-            chrootPath,
             hostProvider,
             sessionTimeout,
-            zooKeeper,
-            watcher,
+            clientConfig,
+            defaultWatcher,
             clientCnxnSocket,
             0,
             new byte[16],
@@ -400,50 +379,76 @@ public ClientCnxn(
     /**
      * Creates a connection object. The actual network connect doesn't get
      * established until needed. The start() instance method must be called
-     * subsequent to construction.
+     * after construction.
      *
-     * @param chrootPath - the chroot of this client. Should be removed from this Class in ZOOKEEPER-838
-     * @param hostProvider
-     *                the list of ZooKeeper servers to connect to
-     * @param sessionTimeout
-     *                the timeout for connections.
-     * @param zooKeeper
-     *                the zookeeper object that this connection is related to.
-     * @param watcher watcher for this connection
-     * @param clientCnxnSocket
-     *                the socket implementation used (e.g. NIO/Netty)
+     * @param hostProvider the list of ZooKeeper servers to connect to
+     * @param sessionTimeout the timeout for connections.
+     * @param clientConfig the client configuration.
+     * @param defaultWatcher default watcher for this connection
+     * @param clientCnxnSocket the socket implementation used (e.g. NIO/Netty)
      * @param sessionId session id if re-establishing session
      * @param sessionPasswd session passwd if re-establishing session
-     * @param canBeReadOnly
-     *                whether the connection is allowed to go to read-only
-     *                mode in case of partitioning
+     * @param canBeReadOnly whether the connection is allowed to go to read-only mode in case of partitioning
      * @throws IOException in cases of broken network
      */
     public ClientCnxn(
-        String chrootPath,
         HostProvider hostProvider,
         int sessionTimeout,
-        ZooKeeper zooKeeper,
-        ClientWatchManager watcher,
+        ZKClientConfig clientConfig,
+        Watcher defaultWatcher,
         ClientCnxnSocket clientCnxnSocket,
         long sessionId,
         byte[] sessionPasswd,
-        boolean canBeReadOnly) throws IOException {
-        this.zooKeeper = zooKeeper;
-        this.watcher = watcher;
+        boolean canBeReadOnly
+    ) throws IOException {
+        this(hostProvider, sessionTimeout, Long.MAX_VALUE, clientConfig, defaultWatcher, clientCnxnSocket, sessionId, sessionPasswd, canBeReadOnly);
+    }
+
+    /**
+     * Creates a connection object. The actual network connect doesn't get
+     * established until needed. The start() instance method must be called
+     * after construction.
+     *
+     * @param hostProvider the list of ZooKeeper servers to connect to
+     * @param sessionTimeout the timeout for connections.
+     * @param newSessionTimeout the timeout before giving up brand-new session establishment.
+     * @param clientConfig the client configuration.
+     * @param defaultWatcher default watcher for this connection
+     * @param clientCnxnSocket the socket implementation used (e.g. NIO/Netty)
+     * @param sessionId session id if re-establishing session
+     * @param sessionPasswd session passwd if re-establishing session
+     * @param canBeReadOnly whether the connection is allowed to go to read-only mode in case of partitioning
+     * @throws IOException in cases of broken network
+     */
+    public ClientCnxn(
+            HostProvider hostProvider,
+            int sessionTimeout,
+            long newSessionTimeout,
+            ZKClientConfig clientConfig,
+            Watcher defaultWatcher,
+            ClientCnxnSocket clientCnxnSocket,
+            long sessionId,
+            byte[] sessionPasswd,
+            boolean canBeReadOnly
+    ) throws IOException {
+        this.hostProvider = hostProvider;
+        this.sessionTimeout = sessionTimeout;
+        this.clientConfig = clientConfig;
         this.sessionId = sessionId;
         this.sessionPasswd = sessionPasswd;
-        this.sessionTimeout = sessionTimeout;
-        this.hostProvider = hostProvider;
-        this.chrootPath = chrootPath;
+        this.readOnly = canBeReadOnly;
+
+        this.watchManager = new ZKWatchManager(
+                clientConfig.getBoolean(ZKClientConfig.DISABLE_AUTO_WATCH_RESET),
+                defaultWatcher);
 
-        connectTimeout = sessionTimeout / hostProvider.size();
-        readTimeout = sessionTimeout * 2 / 3;
-        readOnly = canBeReadOnly;
+        this.connectTimeout = sessionTimeout / hostProvider.size();
+        this.readTimeout = sessionTimeout * 2 / 3;
+        this.expirationTimeout = sessionTimeout * 4 / 3;
+        this.newSessionTimeout = newSessionTimeout == 0 ? expirationTimeout : newSessionTimeout;
 
-        sendThread = new SendThread(clientCnxnSocket);
-        eventThread = new EventThread();
-        this.clientConfig = zooKeeper.getClientConfig();
+        this.sendThread = new SendThread(clientCnxnSocket);
+        this.eventThread = new EventThread();
         initRequestTimeout();
     }
 
@@ -476,9 +481,19 @@ private static String makeThreadName(String suffix) {
         return name + suffix;
     }
 
+    /**
+     * Tests that current thread is the main event loop.
+     * This method is useful only for tests inside ZooKeeper project
+     * it is not a public API intended for use by external applications.
+     * @return true if Thread.currentThread() is an EventThread.
+     */
+    public static boolean isInEventThread() {
+        return Thread.currentThread() instanceof EventThread;
+    }
+
     class EventThread extends ZooKeeperThread {
 
-        private final LinkedBlockingQueue<Object> waitingEvents = new LinkedBlockingQueue<Object>();
+        private final LinkedBlockingQueue<Object> waitingEvents = new LinkedBlockingQueue<>();
 
         /** This is really the queued session state until the event
          * thread actually processes the event and hands it to the watcher.
@@ -506,10 +521,9 @@ private void queueEvent(WatchedEvent event, Set<Watcher> materializedWatchers) {
             final Set<Watcher> watchers;
             if (materializedWatchers == null) {
                 // materialize the watchers based on the event
-                watchers = watcher.materialize(event.getState(), event.getType(), event.getPath());
+                watchers = watchManager.materialize(event.getState(), event.getType(), event.getPath());
             } else {
-                watchers = new HashSet<Watcher>();
-                watchers.addAll(materializedWatchers);
+                watchers = new HashSet<>(materializedWatchers);
             }
             WatcherSetEventPair pair = new WatcherSetEventPair(watchers, event);
             // queue the pair (watch set & event) for later processing
@@ -576,7 +590,7 @@ private void processEvent(Object event) {
                         try {
                             watcher.process(pair.event);
                         } catch (Throwable t) {
-                            LOG.error("Error while calling watcher ", t);
+                            LOG.error("Error while calling watcher.", t);
                         }
                     }
                 } else if (event instanceof LocalCallback) {
@@ -597,6 +611,8 @@ private void processEvent(Object event) {
                         ((AsyncCallback.EphemeralsCallback) lcb.cb).processResult(lcb.rc, lcb.ctx, null);
                     } else if (lcb.cb instanceof AsyncCallback.AllChildrenNumberCallback) {
                         ((AsyncCallback.AllChildrenNumberCallback) lcb.cb).processResult(lcb.rc, lcb.path, lcb.ctx, -1);
+                    } else if (lcb.cb instanceof AsyncCallback.MultiCallback) {
+                        ((AsyncCallback.MultiCallback) lcb.cb).processResult(lcb.rc, lcb.path, lcb.ctx, Collections.emptyList());
                     } else {
                         ((VoidCallback) lcb.cb).processResult(lcb.rc, lcb.path, lcb.ctx);
                     }
@@ -613,7 +629,7 @@ private void processEvent(Object event) {
                                || p.response instanceof SetDataResponse
                                || p.response instanceof SetACLResponse) {
                         StatCallback cb = (StatCallback) p.cb;
-                        if (rc == 0) {
+                        if (rc == Code.OK.intValue()) {
                             if (p.response instanceof ExistsResponse) {
                                 cb.processResult(rc, clientPath, p.ctx, ((ExistsResponse) p.response).getStat());
                             } else if (p.response instanceof SetDataResponse) {
@@ -627,7 +643,7 @@ private void processEvent(Object event) {
                     } else if (p.response instanceof GetDataResponse) {
                         DataCallback cb = (DataCallback) p.cb;
                         GetDataResponse rsp = (GetDataResponse) p.response;
-                        if (rc == 0) {
+                        if (rc == Code.OK.intValue()) {
                             cb.processResult(rc, clientPath, p.ctx, rsp.getData(), rsp.getStat());
                         } else {
                             cb.processResult(rc, clientPath, p.ctx, null, null);
@@ -635,7 +651,7 @@ private void processEvent(Object event) {
                     } else if (p.response instanceof GetACLResponse) {
                         ACLCallback cb = (ACLCallback) p.cb;
                         GetACLResponse rsp = (GetACLResponse) p.response;
-                        if (rc == 0) {
+                        if (rc == Code.OK.intValue()) {
                             cb.processResult(rc, clientPath, p.ctx, rsp.getAcl(), rsp.getStat());
                         } else {
                             cb.processResult(rc, clientPath, p.ctx, null, null);
@@ -643,7 +659,7 @@ private void processEvent(Object event) {
                     } else if (p.response instanceof GetChildrenResponse) {
                         ChildrenCallback cb = (ChildrenCallback) p.cb;
                         GetChildrenResponse rsp = (GetChildrenResponse) p.response;
-                        if (rc == 0) {
+                        if (rc == Code.OK.intValue()) {
                             cb.processResult(rc, clientPath, p.ctx, rsp.getChildren());
                         } else {
                             cb.processResult(rc, clientPath, p.ctx, null);
@@ -651,7 +667,7 @@ private void processEvent(Object event) {
                     } else if (p.response instanceof GetAllChildrenNumberResponse) {
                         AllChildrenNumberCallback cb = (AllChildrenNumberCallback) p.cb;
                         GetAllChildrenNumberResponse rsp = (GetAllChildrenNumberResponse) p.response;
-                        if (rc == 0) {
+                        if (rc == Code.OK.intValue()) {
                             cb.processResult(rc, clientPath, p.ctx, rsp.getTotalNumber());
                         } else {
                             cb.processResult(rc, clientPath, p.ctx, -1);
@@ -659,7 +675,7 @@ private void processEvent(Object event) {
                     } else if (p.response instanceof GetChildren2Response) {
                         Children2Callback cb = (Children2Callback) p.cb;
                         GetChildren2Response rsp = (GetChildren2Response) p.response;
-                        if (rc == 0) {
+                        if (rc == Code.OK.intValue()) {
                             cb.processResult(rc, clientPath, p.ctx, rsp.getChildren(), rsp.getStat());
                         } else {
                             cb.processResult(rc, clientPath, p.ctx, null, null);
@@ -667,28 +683,24 @@ private void processEvent(Object event) {
                     } else if (p.response instanceof CreateResponse) {
                         StringCallback cb = (StringCallback) p.cb;
                         CreateResponse rsp = (CreateResponse) p.response;
-                        if (rc == 0) {
+                        if (rc == Code.OK.intValue()) {
                             cb.processResult(
                                 rc,
                                 clientPath,
                                 p.ctx,
-                                (chrootPath == null
-                                    ? rsp.getPath()
-                                    : rsp.getPath().substring(chrootPath.length())));
+                                rsp.getPath());
                         } else {
                             cb.processResult(rc, clientPath, p.ctx, null);
                         }
                     } else if (p.response instanceof Create2Response) {
                         Create2Callback cb = (Create2Callback) p.cb;
                         Create2Response rsp = (Create2Response) p.response;
-                        if (rc == 0) {
+                        if (rc == Code.OK.intValue()) {
                             cb.processResult(
                                     rc,
                                     clientPath,
                                     p.ctx,
-                                    (chrootPath == null
-                                            ? rsp.getPath()
-                                            : rsp.getPath().substring(chrootPath.length())),
+                                    rsp.getPath(),
                                     rsp.getStat());
                         } else {
                             cb.processResult(rc, clientPath, p.ctx, null, null);
@@ -696,7 +708,7 @@ private void processEvent(Object event) {
                     } else if (p.response instanceof MultiResponse) {
                         MultiCallback cb = (MultiCallback) p.cb;
                         MultiResponse rsp = (MultiResponse) p.response;
-                        if (rc == 0) {
+                        if (rc == Code.OK.intValue()) {
                             List<OpResult> results = rsp.getResultList();
                             int newRc = rc;
                             for (OpResult result : results) {
@@ -713,7 +725,7 @@ private void processEvent(Object event) {
                     } else if (p.response instanceof GetEphemeralsResponse) {
                         EphemeralsCallback cb = (EphemeralsCallback) p.cb;
                         GetEphemeralsResponse rsp = (GetEphemeralsResponse) p.response;
-                        if (rc == 0) {
+                        if (rc == Code.OK.intValue()) {
                             cb.processResult(rc, p.ctx, rsp.getEphemerals());
                         } else {
                             cb.processResult(rc, p.ctx, null);
@@ -745,7 +757,7 @@ protected void finishPacket(Packet p) {
                 for (Entry<EventType, Set<Watcher>> entry : materializedWatchers.entrySet()) {
                     Set<Watcher> watchers = entry.getValue();
                     if (watchers.size() > 0) {
-                        queueEvent(p.watchDeregistration.getClientPath(), err, watchers, entry.getKey());
+                        queueEvent(p.watchDeregistration.getServerPath(), err, watchers, entry.getKey());
                         // ignore connectionloss when removing from local
                         // session
                         p.replyHeader.setErr(Code.OK.intValue());
@@ -769,13 +781,13 @@ protected void finishPacket(Packet p) {
         }
     }
 
-    void queueEvent(String clientPath, int err, Set<Watcher> materializedWatchers, EventType eventType) {
+    void queueEvent(String serverPath, int err, Set<Watcher> materializedWatchers, EventType eventType) {
         KeeperState sessionState = KeeperState.SyncConnected;
         if (KeeperException.Code.SESSIONEXPIRED.intValue() == err
             || KeeperException.Code.CONNECTIONLOSS.intValue() == err) {
             sessionState = Event.KeeperState.Disconnected;
         }
-        WatchedEvent event = new WatchedEvent(eventType, sessionState, clientPath);
+        WatchedEvent event = new WatchedEvent(eventType, sessionState, serverPath);
         eventThread.queueEvent(event, materializedWatchers);
     }
 
@@ -826,6 +838,12 @@ public String toString() {
 
     }
 
+    private static class ConnectionTimeoutException extends IOException {
+        public ConnectionTimeoutException(String message) {
+            super(message);
+        }
+    }
+
     private static class SessionTimeoutException extends IOException {
 
         private static final long serialVersionUID = 824482094072071178L;
@@ -864,8 +882,9 @@ class SendThread extends ZooKeeperThread {
 
         private long lastPingSentNs;
         private final ClientCnxnSocket clientCnxnSocket;
-        private Random r = new Random();
         private boolean isFirstConnect = true;
+        private volatile ZooKeeperSaslClient zooKeeperSaslClient;
+        private final AtomicReference<Login> loginRef = new AtomicReference<>();
 
         void readResponse(ByteBuffer incomingBuffer) throws IOException {
             ByteBufferInputStream bbis = new ByteBufferInputStream(incomingBuffer);
@@ -894,20 +913,7 @@ void readResponse(ByteBuffer incomingBuffer) throws IOException {
                 WatcherEvent event = new WatcherEvent();
                 event.deserialize(bbia, "response");
 
-                // convert from a server path to a client path
-                if (chrootPath != null) {
-                    String serverPath = event.getPath();
-                    if (serverPath.compareTo(chrootPath) == 0) {
-                        event.setPath("/");
-                    } else if (serverPath.length() > chrootPath.length()) {
-                        event.setPath(serverPath.substring(chrootPath.length()));
-                     } else {
-                         LOG.warn("Got server path {} which is too short for chroot path {}.",
-                             event.getPath(), chrootPath);
-                     }
-                }
-
-                WatchedEvent we = new WatchedEvent(event);
+                WatchedEvent we = new WatchedEvent(event, replyHdr.getZxid());
                 LOG.debug("Got {} for session id 0x{}", we, Long.toHexString(sessionId));
                 eventThread.queueEvent(we);
                 return;
@@ -1004,33 +1010,31 @@ void primeConnection() throws IOException {
                 clientCnxnSocket.getRemoteSocketAddress());
             isFirstConnect = false;
             long sessId = (seenRwServerBefore) ? sessionId : 0;
-            ConnectRequest conReq = new ConnectRequest(0, lastZxid, sessionTimeout, sessId, sessionPasswd);
+            ConnectRequest conReq = new ConnectRequest(0, lastZxid, sessionTimeout, sessId, sessionPasswd, readOnly);
             // We add backwards since we are pushing into the front
             // Only send if there's a pending watch
-            // TODO: here we have the only remaining use of zooKeeper in
-            // this class. It's to be eliminated!
             if (!clientConfig.getBoolean(ZKClientConfig.DISABLE_AUTO_WATCH_RESET)) {
-                List<String> dataWatches = zooKeeper.getDataWatches();
-                List<String> existWatches = zooKeeper.getExistWatches();
-                List<String> childWatches = zooKeeper.getChildWatches();
-                List<String> persistentWatches = zooKeeper.getPersistentWatches();
-                List<String> persistentRecursiveWatches = zooKeeper.getPersistentRecursiveWatches();
+                List<String> dataWatches = watchManager.getDataWatchList();
+                List<String> existWatches = watchManager.getExistWatchList();
+                List<String> childWatches = watchManager.getChildWatchList();
+                List<String> persistentWatches = watchManager.getPersistentWatchList();
+                List<String> persistentRecursiveWatches = watchManager.getPersistentRecursiveWatchList();
                 if (!dataWatches.isEmpty() || !existWatches.isEmpty() || !childWatches.isEmpty()
                         || !persistentWatches.isEmpty() || !persistentRecursiveWatches.isEmpty()) {
-                    Iterator<String> dataWatchesIter = prependChroot(dataWatches).iterator();
-                    Iterator<String> existWatchesIter = prependChroot(existWatches).iterator();
-                    Iterator<String> childWatchesIter = prependChroot(childWatches).iterator();
-                    Iterator<String> persistentWatchesIter = prependChroot(persistentWatches).iterator();
-                    Iterator<String> persistentRecursiveWatchesIter = prependChroot(persistentRecursiveWatches).iterator();
+                    Iterator<String> dataWatchesIter = dataWatches.iterator();
+                    Iterator<String> existWatchesIter = existWatches.iterator();
+                    Iterator<String> childWatchesIter = childWatches.iterator();
+                    Iterator<String> persistentWatchesIter = persistentWatches.iterator();
+                    Iterator<String> persistentRecursiveWatchesIter = persistentRecursiveWatches.iterator();
                     long setWatchesLastZxid = lastZxid;
 
                     while (dataWatchesIter.hasNext() || existWatchesIter.hasNext() || childWatchesIter.hasNext()
                             || persistentWatchesIter.hasNext() || persistentRecursiveWatchesIter.hasNext()) {
-                        List<String> dataWatchesBatch = new ArrayList<String>();
-                        List<String> existWatchesBatch = new ArrayList<String>();
-                        List<String> childWatchesBatch = new ArrayList<String>();
-                        List<String> persistentWatchesBatch = new ArrayList<String>();
-                        List<String> persistentRecursiveWatchesBatch = new ArrayList<String>();
+                        List<String> dataWatchesBatch = new ArrayList<>();
+                        List<String> existWatchesBatch = new ArrayList<>();
+                        List<String> childWatchesBatch = new ArrayList<>();
+                        List<String> persistentWatchesBatch = new ArrayList<>();
+                        List<String> persistentRecursiveWatchesBatch = new ArrayList<>();
                         int batchLength = 0;
 
                         // Note, we may exceed our max length by a bit when we add the last
@@ -1086,28 +1090,11 @@ record = new SetWatches2(setWatchesLastZxid, dataWatchesBatch, existWatchesBatch
                         null,
                         null));
             }
-            outgoingQueue.addFirst(new Packet(null, null, conReq, null, null, readOnly));
+            outgoingQueue.addFirst(new Packet(null, null, conReq, null, null));
             clientCnxnSocket.connectionPrimed();
             LOG.debug("Session establishment request sent on {}", clientCnxnSocket.getRemoteSocketAddress());
         }
 
-        private List<String> prependChroot(List<String> paths) {
-            if (chrootPath != null && !paths.isEmpty()) {
-                for (int i = 0; i < paths.size(); ++i) {
-                    String clientPath = paths.get(i);
-                    String serverPath;
-                    // handle clientPath = "/"
-                    if (clientPath.length() == 1) {
-                        serverPath = chrootPath;
-                    } else {
-                        serverPath = chrootPath + clientPath;
-                    }
-                    paths.set(i, serverPath);
-                }
-            }
-            return paths;
-        }
-
         private void sendPing() {
             lastPingSentNs = System.nanoTime();
             RequestHeader h = new RequestHeader(ClientCnxn.PING_XID, OpCode.ping);
@@ -1131,7 +1118,7 @@ private void startConnect(InetSocketAddress addr) throws IOException {
             saslLoginFailed = false;
             if (!isFirstConnect) {
                 try {
-                    Thread.sleep(r.nextInt(1000));
+                    Thread.sleep(ThreadLocalRandom.current().nextLong(1000));
                 } catch (InterruptedException e) {
                     LOG.warn("Unexpected exception", e);
                 }
@@ -1143,10 +1130,8 @@ private void startConnect(InetSocketAddress addr) throws IOException {
             setName(getName().replaceAll("\\(.*\\)", "(" + hostPort + ")"));
             if (clientConfig.isSaslClientEnabled()) {
                 try {
-                    if (zooKeeperSaslClient != null) {
-                        zooKeeperSaslClient.shutdown();
-                    }
-                    zooKeeperSaslClient = new ZooKeeperSaslClient(SaslServerPrincipal.getServerPrincipal(addr, clientConfig), clientConfig);
+                    zooKeeperSaslClient = new ZooKeeperSaslClient(
+                        SaslServerPrincipal.getServerPrincipal(addr, clientConfig), clientConfig, loginRef);
                 } catch (LoginException e) {
                     // An authentication error occurred when the SASL client tried to initialize:
                     // for Kerberos this means that the client failed to authenticate with the KDC.
@@ -1173,6 +1158,7 @@ private void logStartConnect(InetSocketAddress addr) {
         }
 
         @Override
+        @SuppressFBWarnings("JLM_JSR166_UTILCONCURRENT_MONITORENTER")
         public void run() {
             clientCnxnSocket.introduce(this, sessionId, outgoingQueue);
             clientCnxnSocket.updateNow();
@@ -1196,7 +1182,9 @@ public void run() {
                         }
                         onConnecting(serverAddress);
                         startConnect(serverAddress);
-                        clientCnxnSocket.updateLastSendAndHeard();
+                        // Update now to start the connection timer right after we make a connection attempt
+                        clientCnxnSocket.updateNow();
+                        clientCnxnSocket.updateLastSend();
                     }
 
                     if (state.isConnected()) {
@@ -1234,16 +1222,29 @@ public void run() {
                         }
                         to = readTimeout - clientCnxnSocket.getIdleRecv();
                     } else {
-                        to = connectTimeout - clientCnxnSocket.getIdleRecv();
+                        to = connectTimeout - clientCnxnSocket.getIdleSend();
                     }
 
-                    if (to <= 0) {
+                    long expiration;
+                    if (sessionId == 0) {
+                        expiration = newSessionTimeout - clientCnxnSocket.getIdleRecv();
+                    } else {
+                        expiration = expirationTimeout - clientCnxnSocket.getIdleRecv();
+                    }
+                    if (expiration <= 0) {
                         String warnInfo = String.format(
                             "Client session timed out, have not heard from server in %dms for session id 0x%s",
                             clientCnxnSocket.getIdleRecv(),
                             Long.toHexString(sessionId));
                         LOG.warn(warnInfo);
+                        changeZkState(States.CLOSED);
                         throw new SessionTimeoutException(warnInfo);
+                    } else if (to <= 0) {
+                        String warnInfo = String.format(
+                            "Client connection timed out, have not heard from server in %dms for session id 0x%s",
+                            clientCnxnSocket.getIdleRecv(),
+                            Long.toHexString(sessionId));
+                        throw new ConnectionTimeoutException(warnInfo);
                     }
                     if (state.isConnected()) {
                         //1000(1 second) is to prevent race condition missing to send the second ping
@@ -1279,15 +1280,16 @@ public void run() {
                 } catch (Throwable e) {
                     if (closing) {
                         // closing so this is expected
-                        LOG.warn(
-                            "An exception was thrown while closing send thread for session 0x{}.",
-                            Long.toHexString(getSessionId()),
-                            e);
+                        if (LOG.isDebugEnabled()) {
+                            LOG.debug(
+                                "An exception was thrown while closing send thread for session 0x{}.",
+                                Long.toHexString(getSessionId()), e);
+                        }
                         break;
                     } else {
                         LOG.warn(
-                            "Session 0x{} for sever {}, Closing socket connection. "
-                                + "Attempting reconnect except it is a SessionExpiredException.",
+                            "Session 0x{} for server {}, Closing socket connection. "
+                                + "Attempting reconnect except it is a SessionExpiredException or SessionTimeoutException.",
                             Long.toHexString(getSessionId()),
                             serverAddress,
                             e);
@@ -1299,7 +1301,7 @@ public void run() {
                 }
             }
 
-            synchronized (state) {
+            synchronized (outgoingQueue) {
                 // When it comes to this point, it guarantees that later queued
                 // packet to outgoingQueue will be notified of death.
                 cleanup();
@@ -1308,20 +1310,40 @@ public void run() {
             if (state.isAlive()) {
                 eventThread.queueEvent(new WatchedEvent(Event.EventType.None, Event.KeeperState.Disconnected, null));
             }
-            eventThread.queueEvent(new WatchedEvent(Event.EventType.None, Event.KeeperState.Closed, null));
+            if (closing) {
+                eventThread.queueEvent(new WatchedEvent(Event.EventType.None, KeeperState.Closed, null));
+            } else if (state == States.CLOSED) {
+                eventThread.queueEvent(new WatchedEvent(Event.EventType.None, KeeperState.Expired, null));
+            }
+            eventThread.queueEventOfDeath();
+
+            Login l = loginRef.getAndSet(null);
+            if (l != null) {
+                l.shutdown();
+            }
             ZooTrace.logTraceMessage(
                 LOG,
                 ZooTrace.getTextTraceLevel(),
                 "SendThread exited loop for session: 0x" + Long.toHexString(getSessionId()));
         }
 
+        private void abortConnection() {
+            try {
+                clientCnxnSocket.testableCloseSocket();
+            } catch (IOException e) {
+                LOG.debug("Fail to close ongoing socket", e);
+            }
+        }
+
+        /**
+         * This is not thread-safe and should only be called inside {@link SendThread}.
+         */
         private void cleanAndNotifyState() {
             cleanup();
             if (state.isAlive()) {
                 eventThread.queueEvent(new WatchedEvent(Event.EventType.None, Event.KeeperState.Disconnected, null));
             }
             clientCnxnSocket.updateNow();
-            clientCnxnSocket.updateLastSendAndHeard();
         }
 
         private void pingRwServer() throws RWServerFoundException {
@@ -1329,42 +1351,16 @@ private void pingRwServer() throws RWServerFoundException {
             InetSocketAddress addr = hostProvider.next(0);
 
             LOG.info("Checking server {} for being r/w. Timeout {}", addr, pingRwTimeout);
-
-            Socket sock = null;
-            BufferedReader br = null;
             try {
-                sock = new Socket(addr.getHostString(), addr.getPort());
-                sock.setSoLinger(false, -1);
-                sock.setSoTimeout(1000);
-                sock.setTcpNoDelay(true);
-                sock.getOutputStream().write("isro".getBytes());
-                sock.getOutputStream().flush();
-                sock.shutdownOutput();
-                br = new BufferedReader(new InputStreamReader(sock.getInputStream()));
-                result = br.readLine();
+                result = FourLetterWordMain.send4LetterWord(addr.getHostString(), addr.getPort(), "isro", clientConfig, 1000);
             } catch (ConnectException e) {
                 // ignore, this just means server is not up
-            } catch (IOException e) {
+            } catch (IOException | X509Exception.SSLContextException e) {
                 // some unexpected error, warn about it
                 LOG.warn("Exception while seeking for r/w server.", e);
-            } finally {
-                if (sock != null) {
-                    try {
-                        sock.close();
-                    } catch (IOException e) {
-                        LOG.warn("Unexpected exception", e);
-                    }
-                }
-                if (br != null) {
-                    try {
-                        br.close();
-                    } catch (IOException e) {
-                        LOG.warn("Unexpected exception", e);
-                    }
-                }
             }
 
-            if ("rw".equals(result)) {
+            if ("rw\n".equals(result)) {
                 pingRwTimeout = minPingRwTimeout;
                 // save the found address so that it's used during the next
                 // connection attempt
@@ -1396,12 +1392,6 @@ private void cleanup() {
         /**
          * Callback invoked by the ClientCnxnSocket once a connection has been
          * established.
-         *
-         * @param _negotiatedSessionTimeout
-         * @param _sessionId
-         * @param _sessionPasswd
-         * @param isRO
-         * @throws IOException
          */
         void onConnected(
             int _negotiatedSessionTimeout,
@@ -1427,6 +1417,7 @@ void onConnected(
             }
 
             readTimeout = negotiatedSessionTimeout * 2 / 3;
+            expirationTimeout = negotiatedSessionTimeout * 4 / 3;
             connectTimeout = negotiatedSessionTimeout / hostProvider.size();
             hostProvider.onConnected();
             sessionId = _sessionId;
@@ -1482,6 +1473,14 @@ public void sendPacket(Packet p) throws IOException {
             clientCnxnSocket.sendPacket(p);
         }
 
+        public ZooKeeperSaslClient getZooKeeperSaslClient() {
+            return zooKeeperSaslClient;
+        }
+
+        // VisibleForTesting
+        Login getLogin() {
+            return loginRef.get();
+        }
     }
 
     /**
@@ -1500,9 +1499,6 @@ public void disconnect() {
             LOG.warn("Got interrupted while waiting for the sender thread to close", ex);
         }
         eventThread.queueEventOfDeath();
-        if (zooKeeperSaslClient != null) {
-            zooKeeperSaslClient.shutdown();
-        }
     }
 
     /**
@@ -1584,7 +1580,7 @@ public ReplyHeader submitRequest(
             }
         }
         if (r.getErr() == Code.REQUESTTIMEOUT.intValue()) {
-            sendThread.cleanAndNotifyState();
+            sendThread.abortConnection();
         }
         return r;
     }
@@ -1593,14 +1589,16 @@ public ReplyHeader submitRequest(
      * Wait for request completion with timeout.
      */
     private void waitForPacketFinish(ReplyHeader r, Packet packet) throws InterruptedException {
-        long waitStartTime = Time.currentElapsedTime();
-        while (!packet.finished) {
-            packet.wait(requestTimeout);
-            if (!packet.finished && ((Time.currentElapsedTime() - waitStartTime) >= requestTimeout)) {
-                LOG.error("Timeout error occurred for the packet '{}'.", packet);
-                r.setErr(Code.REQUESTTIMEOUT.intValue());
-                break;
-            }
+        long remainingTime = requestTimeout;
+        while (!packet.finished && remainingTime > 0) {
+            long waitStartTime = Time.currentElapsedTime();
+            packet.wait(remainingTime);
+            remainingTime -= (Time.currentElapsedTime() - waitStartTime);
+        }
+
+        if (!packet.finished) {
+            LOG.error("Timeout error occurred for the packet '{}'.", packet);
+            r.setErr(Code.REQUESTTIMEOUT.intValue());
         }
     }
 
@@ -1619,7 +1617,7 @@ public void sendPacket(Record request, Record response, AsyncCallback cb, int op
         ReplyHeader r = new ReplyHeader();
         r.setXid(xid);
 
-        Packet p = new Packet(h, r, request, response, null, false);
+        Packet p = new Packet(h, r, request, response, null);
         p.cb = cb;
         sendThread.sendPacket(p);
     }
@@ -1637,6 +1635,7 @@ public Packet queuePacket(
         return queuePacket(h, r, request, response, cb, clientPath, serverPath, ctx, watchRegistration, null);
     }
 
+    @SuppressFBWarnings("JLM_JSR166_UTILCONCURRENT_MONITORENTER")
     public Packet queuePacket(
         RequestHeader h,
         ReplyHeader r,
@@ -1663,7 +1662,7 @@ public Packet queuePacket(
         // 1. synchronize with the final cleanup() in SendThread.run() to avoid race
         // 2. synchronized against each packet. So if a closeSession packet is added,
         // later packet will be notified.
-        synchronized (state) {
+        synchronized (outgoingQueue) {
             if (!state.isAlive() || closing) {
                 conLossPacket(packet);
             } else {
@@ -1735,4 +1734,7 @@ private void initRequestTimeout() {
         }
     }
 
+    public ZooKeeperSaslClient getZooKeeperSaslClient() {
+        return sendThread.getZooKeeperSaslClient();
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocket.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocket.java
index 315d81feb8b..0437d73178c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocket.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocket.java
@@ -31,6 +31,7 @@
 import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.common.ZKConfig;
+import org.apache.zookeeper.compat.ProtocolManager;
 import org.apache.zookeeper.proto.ConnectResponse;
 import org.apache.zookeeper.server.ByteBufferInputStream;
 import org.slf4j.Logger;
@@ -48,6 +49,8 @@ abstract class ClientCnxnSocket {
 
     private static final Logger LOG = LoggerFactory.getLogger(ClientCnxnSocket.class);
 
+    private final ProtocolManager protocolManager = new ProtocolManager();
+
     protected boolean initialized;
 
     /**
@@ -62,7 +65,9 @@ abstract class ClientCnxnSocket {
     protected ByteBuffer incomingBuffer = lenBuffer;
     protected final AtomicLong sentCount = new AtomicLong(0L);
     protected final AtomicLong recvCount = new AtomicLong(0L);
+    // Used for reactive timeout detection, say connection read timeout and session expiration timeout.
     protected long lastHeard;
+    // Used for proactive timeout detection, say ping timeout and connection establishment timeout.
     protected long lastSend;
     protected long now;
     protected ClientCnxn.SendThread sendThread;
@@ -117,7 +122,7 @@ void updateLastSendAndHeard() {
 
     void readLength() throws IOException {
         int len = incomingBuffer.getInt();
-        if (len < 0 || len >= packetLen) {
+        if (len < 0 || len > packetLen) {
             throw new IOException("Packet len " + len + " is out of range!");
         }
         incomingBuffer = ByteBuffer.allocate(len);
@@ -131,27 +136,18 @@ void readConnectResult() throws IOException {
             }
             buf.append("]");
             if (LOG.isTraceEnabled()) {
-                LOG.trace("readConnectResult {} {}", incomingBuffer.remaining(), buf.toString());
+                LOG.trace("readConnectResult {} {}", incomingBuffer.remaining(), buf);
             }
         }
 
         ByteBufferInputStream bbis = new ByteBufferInputStream(incomingBuffer);
         BinaryInputArchive bbia = BinaryInputArchive.getArchive(bbis);
-        ConnectResponse conRsp = new ConnectResponse();
-        conRsp.deserialize(bbia, "connect");
-
-        // read "is read-only" flag
-        boolean isRO = false;
-        try {
-            isRO = bbia.readBool("readOnly");
-        } catch (IOException e) {
-            // this is ok -- just a packet from an old server which
-            // doesn't contain readOnly field
+        ConnectResponse conRsp = protocolManager.deserializeConnectResponse(bbia);
+        if (!protocolManager.isReadonlyAvailable()) {
             LOG.warn("Connected to an old server; r-o mode will be unavailable");
         }
-
         this.sessionId = conRsp.getSessionId();
-        sendThread.onConnected(conRsp.getTimeOut(), this.sessionId, conRsp.getPasswd(), isRO);
+        sendThread.onConnected(conRsp.getTimeOut(), this.sessionId, conRsp.getPasswd(), conRsp.getReadOnly());
     }
 
     abstract boolean isConnected();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNIO.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNIO.java
index 1fe53a363fa..e39bee11825 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNIO.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNIO.java
@@ -26,6 +26,8 @@
 import java.nio.channels.SelectionKey;
 import java.nio.channels.Selector;
 import java.nio.channels.SocketChannel;
+import java.nio.channels.UnresolvedAddressException;
+import java.nio.channels.UnsupportedAddressTypeException;
 import java.util.Iterator;
 import java.util.Queue;
 import java.util.Set;
@@ -152,12 +154,12 @@ void doIO(Queue<Packet> pendingQueue, ClientCnxn cnxn) throws InterruptedExcepti
         }
     }
 
-    private Packet findSendablePacket(LinkedBlockingDeque<Packet> outgoingQueue, boolean tunneledAuthInProgres) {
+    private Packet findSendablePacket(LinkedBlockingDeque<Packet> outgoingQueue, boolean tunneledAuthInProgress) {
         if (outgoingQueue.isEmpty()) {
             return null;
         }
         // If we've already starting sending the first packet, we better finish
-        if (outgoingQueue.getFirst().bb != null || !tunneledAuthInProgres) {
+        if (outgoingQueue.getFirst().bb != null || !tunneledAuthInProgress) {
             return outgoingQueue.getFirst();
         }
         // Since client's authentication with server is in progress,
@@ -207,6 +209,12 @@ void cleanup() {
             } catch (IOException e) {
                 LOG.debug("Ignoring exception during channel close", e);
             }
+            try {
+                selector.wakeup();
+                selector.selectNow();
+            } catch (IOException e) {
+                LOG.debug("Ignoring exception during selecting of cancelled socket", e);
+            }
         }
         try {
             Thread.sleep(100);
@@ -266,7 +274,7 @@ void connect(InetSocketAddress addr) throws IOException {
         SocketChannel sock = createSock();
         try {
             registerAndConnect(sock, addr);
-        } catch (IOException e) {
+        } catch (UnresolvedAddressException | UnsupportedAddressTypeException | SecurityException | IOException e) {
             LOG.error("Unable to open socket to {}", addr);
             sock.close();
             throw e;
@@ -333,18 +341,18 @@ void doTransport(
             selected = selector.selectedKeys();
         }
         // Everything below and until we get back to the select is
-        // non blocking, so time is effectively a constant. That is
+        // non-blocking, so time is effectively a constant. That is
         // Why we just have to do this once, here
         updateNow();
         for (SelectionKey k : selected) {
             SocketChannel sc = ((SocketChannel) k.channel());
-            if ((k.readyOps() & SelectionKey.OP_CONNECT) != 0) {
+            if (k.isConnectable()) {
                 if (sc.finishConnect()) {
                     updateLastSendAndHeard();
                     updateSocketAddresses();
                     sendThread.primeConnection();
                 }
-            } else if ((k.readyOps() & (SelectionKey.OP_READ | SelectionKey.OP_WRITE)) != 0) {
+            } else if (k.isReadable() || k.isWritable()) {
                 doIO(pendingQueue, cnxn);
             }
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java
old mode 100755
new mode 100644
index 2686feddc68..82364dcb55b
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ClientCnxnSocketNetty.java
@@ -18,7 +18,6 @@
 
 package org.apache.zookeeper;
 
-import static org.apache.zookeeper.common.X509Exception.SSLContextException;
 import io.netty.bootstrap.Bootstrap;
 import io.netty.buffer.ByteBuf;
 import io.netty.buffer.ByteBufAllocator;
@@ -33,7 +32,7 @@
 import io.netty.channel.EventLoopGroup;
 import io.netty.channel.SimpleChannelInboundHandler;
 import io.netty.channel.socket.SocketChannel;
-import io.netty.handler.ssl.SslHandler;
+import io.netty.handler.ssl.SslContext;
 import io.netty.util.concurrent.Future;
 import io.netty.util.concurrent.GenericFutureListener;
 import java.io.IOException;
@@ -48,14 +47,13 @@
 import java.util.concurrent.atomic.AtomicReference;
 import java.util.concurrent.locks.Lock;
 import java.util.concurrent.locks.ReentrantLock;
-import javax.net.ssl.SSLContext;
-import javax.net.ssl.SSLEngine;
+import javax.net.ssl.SSLException;
 import org.apache.zookeeper.ClientCnxn.EndOfStreamException;
 import org.apache.zookeeper.ClientCnxn.Packet;
 import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.common.ClientX509Util;
 import org.apache.zookeeper.common.NettyUtils;
-import org.apache.zookeeper.common.X509Util;
+import org.apache.zookeeper.common.X509Exception;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -205,7 +203,7 @@ void cleanup() {
                 connectFuture = null;
             }
             if (channel != null) {
-                channel.close().syncUninterruptibly();
+                channel.close();
                 channel = null;
             }
         } finally {
@@ -244,7 +242,9 @@ void packetAdded() {
 
     @Override
     void onClosing() {
-        firstConnect.countDown();
+        if (firstConnect != null) {
+            firstConnect.countDown();
+        }
         wakeupCnxn();
         LOG.info("channel is told closing");
     }
@@ -253,7 +253,9 @@ private void wakeupCnxn() {
         if (needSasl.get()) {
             waitSasl.release();
         }
-        outgoingQueue.add(WakeupPacket.getInstance());
+        if (outgoingQueue != null) {
+          outgoingQueue.add(WakeupPacket.getInstance());
+        }
     }
 
     @Override
@@ -304,7 +306,7 @@ private void addBack(Packet head) {
      * @return a ChannelFuture that will complete when the write operation
      *         succeeds or fails.
      */
-    private ChannelFuture sendPktAndFlush(Packet p) {
+    private ChannelFuture sendPktAndFlush(Packet p) throws IOException {
         return sendPkt(p, true);
     }
 
@@ -314,7 +316,7 @@ private ChannelFuture sendPktAndFlush(Packet p) {
      * @return a ChannelFuture that will complete when the write operation
      *         succeeds or fails.
      */
-    private ChannelFuture sendPktOnly(Packet p) {
+    private ChannelFuture sendPktOnly(Packet p) throws IOException {
         return sendPkt(p, false);
     }
 
@@ -325,7 +327,10 @@ private ChannelFuture sendPktOnly(Packet p) {
         }
     };
 
-    private ChannelFuture sendPkt(Packet p, boolean doFlush) {
+    private ChannelFuture sendPkt(Packet p, boolean doFlush) throws IOException {
+        if (channel == null) {
+            throw new IOException("channel has been closed");
+        }
         // Assuming the packet will be sent out successfully. Because if it fails,
         // the channel will close and clean up queues.
         p.createBB();
@@ -336,7 +341,7 @@ private ChannelFuture sendPkt(Packet p, boolean doFlush) {
         return result;
     }
 
-    private void sendPrimePacket() {
+    private void sendPrimePacket() throws IOException {
         // assuming the first packet is the priming packet.
         sendPktAndFlush(outgoingQueue.remove());
     }
@@ -344,7 +349,7 @@ private void sendPrimePacket() {
     /**
      * doWrite handles writing the packets from outgoingQueue via network to server.
      */
-    private void doWrite(Queue<Packet> pendingQueue, Packet p, ClientCnxn cnxn) {
+    private void doWrite(Queue<Packet> pendingQueue, Packet p, ClientCnxn cnxn) throws IOException {
         updateNow();
         boolean anyPacketsSent = false;
         while (true) {
@@ -374,9 +379,6 @@ private void doWrite(Queue<Packet> pendingQueue, Packet p, ClientCnxn cnxn) {
 
     @Override
     void sendPacket(ClientCnxn.Packet p) throws IOException {
-        if (channel == null) {
-            throw new IOException("channel has been closed");
-        }
         sendPktAndFlush(p);
     }
 
@@ -400,7 +402,7 @@ void testableCloseSocket() throws IOException {
         }
     }
 
-    // *************** <END> CientCnxnSocketNetty </END> ******************
+    // *************** <END> ClientCnxnSocketNetty </END> ******************
     private static class WakeupPacket {
 
         private static final Packet instance = new Packet(null, null, null, null, null);
@@ -420,13 +422,11 @@ public static Packet getInstance() {
      * connection implementation.
      */
     private class ZKClientPipelineFactory extends ChannelInitializer<SocketChannel> {
+        private SslContext sslContext = null;
+        private final String host;
+        private final int port;
 
-        private SSLContext sslContext = null;
-        private SSLEngine sslEngine = null;
-        private String host;
-        private int port;
-
-        public ZKClientPipelineFactory(String host, int port) {
+        private ZKClientPipelineFactory(String host, int port) {
             this.host = host;
             this.port = port;
         }
@@ -440,17 +440,16 @@ protected void initChannel(SocketChannel ch) throws Exception {
             pipeline.addLast("handler", new ZKClientHandler());
         }
 
-        // The synchronized is to prevent the race on shared variable "sslEngine".
+        // The synchronized is to prevent the race on shared variable "sslContext".
         // Basically we only need to create it once.
-        private synchronized void initSSL(ChannelPipeline pipeline) throws SSLContextException {
-            if (sslContext == null || sslEngine == null) {
-                try (X509Util x509Util = new ClientX509Util()) {
-                    sslContext = x509Util.createSSLContext(clientConfig);
-                    sslEngine = sslContext.createSSLEngine(host, port);
-                    sslEngine.setUseClientMode(true);
+        private synchronized void initSSL(ChannelPipeline pipeline)
+            throws X509Exception.KeyManagerException, X509Exception.TrustManagerException, SSLException {
+            if (sslContext == null) {
+                try (ClientX509Util x509Util = new ClientX509Util()) {
+                    sslContext = x509Util.createNettySslContextForClient(clientConfig);
                 }
             }
-            pipeline.addLast("ssl", new SslHandler(sslEngine));
+            pipeline.addLast("ssl", sslContext.newHandler(pipeline.channel().alloc(), host, port));
             LOG.info("SSL handler added for channel: {}", pipeline.channel());
         }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/CreateOptions.java b/zookeeper-server/src/main/java/org/apache/zookeeper/CreateOptions.java
new file mode 100644
index 00000000000..227124d89ee
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/CreateOptions.java
@@ -0,0 +1,88 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper;
+
+import java.util.List;
+import java.util.Objects;
+import org.apache.zookeeper.data.ACL;
+import org.apache.zookeeper.server.EphemeralType;
+
+/**
+ * Options for creating znode in ZooKeeper data tree.
+ */
+public class CreateOptions {
+    private final CreateMode createMode;
+    private final List<ACL> acl;
+    private final long ttl;
+
+    public CreateMode getCreateMode() {
+        return createMode;
+    }
+
+    public List<ACL> getAcl() {
+        return acl;
+    }
+
+    public long getTtl() {
+        return ttl;
+    }
+
+    /**
+     * Constructs a builder for {@link CreateOptions}.
+     *
+     * @param acl
+     *                the acl for the node
+     * @param createMode
+     *                specifying whether the node to be created is ephemeral
+     *                and/or sequential
+     */
+    public static Builder newBuilder(List<ACL> acl, CreateMode createMode) {
+        return new Builder(createMode, acl);
+    }
+
+    private CreateOptions(CreateMode createMode, List<ACL> acl, long ttl) {
+        this.createMode = createMode;
+        this.acl = acl;
+        this.ttl = ttl;
+        EphemeralType.validateTTL(createMode, ttl);
+    }
+
+    /**
+     * Builder for {@link CreateOptions}.
+     */
+    public static class Builder {
+        private final CreateMode createMode;
+        private final List<ACL> acl;
+        private long ttl = -1;
+
+        private Builder(CreateMode createMode, List<ACL> acl) {
+            this.createMode = Objects.requireNonNull(createMode, "create mode is mandatory for create options");
+            this.acl = Objects.requireNonNull(acl, "acl is mandatory for create options");
+        }
+
+        public Builder withTtl(long ttl) {
+            this.ttl = ttl;
+            return this;
+        }
+
+        public CreateOptions build() {
+            return new CreateOptions(createMode, acl, ttl);
+        }
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ByteBufferOutputStream.java b/zookeeper-server/src/main/java/org/apache/zookeeper/DeleteContainerRequest.java
similarity index 53%
rename from zookeeper-server/src/main/java/org/apache/zookeeper/server/ByteBufferOutputStream.java
rename to zookeeper-server/src/main/java/org/apache/zookeeper/DeleteContainerRequest.java
index 2531cbaffee..b7fd12689d2 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ByteBufferOutputStream.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/DeleteContainerRequest.java
@@ -16,36 +16,36 @@
  * limitations under the License.
  */
 
-package org.apache.zookeeper.server;
+package org.apache.zookeeper;
 
 import java.io.IOException;
-import java.io.OutputStream;
-import java.nio.ByteBuffer;
-import org.apache.jute.BinaryOutputArchive;
+import java.nio.charset.StandardCharsets;
+import org.apache.jute.InputArchive;
+import org.apache.jute.OutputArchive;
 import org.apache.jute.Record;
 
-public class ByteBufferOutputStream extends OutputStream {
+public class DeleteContainerRequest implements Record {
+    private String path;
 
-    ByteBuffer bb;
-    public ByteBufferOutputStream(ByteBuffer bb) {
-        this.bb = bb;
+    public DeleteContainerRequest() {
     }
-    @Override
-    public void write(int b) throws IOException {
-        bb.put((byte) b);
+
+    public DeleteContainerRequest(String path) {
+        this.path = path;
     }
-    @Override
-    public void write(byte[] b) throws IOException {
-        bb.put(b);
+
+    public String getPath() {
+        return path;
     }
+
     @Override
-    public void write(byte[] b, int off, int len) throws IOException {
-        bb.put(b, off, len);
-    }
-    public static void record2ByteBuffer(Record record, ByteBuffer bb) throws IOException {
-        BinaryOutputArchive oa;
-        oa = BinaryOutputArchive.getArchive(new ByteBufferOutputStream(bb));
-        record.serialize(oa, "request");
+    public void serialize(OutputArchive archive, String tag) throws IOException {
+        archive.writeBuffer(path.getBytes(StandardCharsets.UTF_8), "path");
     }
 
+    @Override
+    public void deserialize(InputArchive archive, String tag) throws IOException {
+        byte[] bytes = archive.readBuffer("path");
+        path = new String(bytes, StandardCharsets.UTF_8);
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/Environment.java b/zookeeper-server/src/main/java/org/apache/zookeeper/Environment.java
index 9ec38a19709..090f7e36c3b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/Environment.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/Environment.java
@@ -59,7 +59,7 @@ private static void put(List<Entry> l, String k, String v) {
     }
 
     public static List<Entry> list() {
-        List<Entry> l = new ArrayList<Entry>();
+        List<Entry> l = new ArrayList<>();
         put(l, "zookeeper.version", Version.getFullVersion());
 
         try {
@@ -85,9 +85,9 @@ public static List<Entry> list() {
         // Get memory information.
         Runtime runtime = Runtime.getRuntime();
         int mb = 1024 * 1024;
-        put(l, "os.memory.free", runtime.freeMemory() / mb + "MB");
-        put(l, "os.memory.max", runtime.maxMemory() / mb + "MB");
-        put(l, "os.memory.total", runtime.totalMemory() / mb + "MB");
+        put(l, "jvm.memory.free", runtime.freeMemory() / mb + "MB");
+        put(l, "jvm.memory.max", runtime.maxMemory() / mb + "MB");
+        put(l, "jvm.memory.total", runtime.totalMemory() / mb + "MB");
 
         return l;
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/JLineZNodeCompleter.java b/zookeeper-server/src/main/java/org/apache/zookeeper/JLineZNodeCompleter.java
index e55521400fa..67288e18070 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/JLineZNodeCompleter.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/JLineZNodeCompleter.java
@@ -20,44 +20,41 @@
 
 import java.util.Collections;
 import java.util.List;
-import jline.console.completer.Completer;
+import org.jline.reader.Candidate;
+import org.jline.reader.Completer;
+import org.jline.reader.LineReader;
+import org.jline.reader.ParsedLine;
+import org.jline.utils.AttributedString;
 
 class JLineZNodeCompleter implements Completer {
 
-    private ZooKeeper zk;
+    private final ZooKeeper zk;
 
     public JLineZNodeCompleter(ZooKeeper zk) {
         this.zk = zk;
     }
 
-    @SuppressWarnings({"unchecked", "rawtypes"})
-    public int complete(String buffer, int cursor, List candidates) {
+    @Override
+    public void complete(LineReader lineReader, ParsedLine commandLine, List<Candidate> candidates) {
         // Guarantee that the final token is the one we're expanding
-        buffer = buffer.substring(0, cursor);
-        String token = "";
-        if (!buffer.endsWith(" ")) {
-            String[] tokens = buffer.split(" ");
-            if (tokens.length != 0) {
-                token = tokens[tokens.length - 1];
-            }
-        }
+        String token = commandLine.words().get(commandLine.words().size() - 1);
 
         if (token.startsWith("/")) {
-            return completeZNode(buffer, token, candidates);
+            completeZNode(token, candidates);
+        } else {
+            completeCommand(token, candidates);
         }
-        return completeCommand(buffer, token, candidates);
     }
 
-    private int completeCommand(String buffer, String token, List<String> candidates) {
+    private void completeCommand(String token, List<Candidate> candidates) {
         for (String cmd : ZooKeeperMain.getCommands()) {
             if (cmd.startsWith(token)) {
-                candidates.add(cmd);
+                candidates.add(createCandidate(cmd));
             }
         }
-        return buffer.lastIndexOf(" ") + 1;
     }
 
-    private int completeZNode(String buffer, String token, List<String> candidates) {
+    private void completeZNode(String token, List<Candidate> candidates) {
         String path = token;
         int idx = path.lastIndexOf("/") + 1;
         String prefix = path.substring(idx);
@@ -67,16 +64,17 @@ private int completeZNode(String buffer, String token, List<String> candidates)
             List<String> children = zk.getChildren(dir, false);
             for (String child : children) {
                 if (child.startsWith(prefix)) {
-                    candidates.add(child);
+                    String zNode = dir + (idx == 1 ? "" : "/") + child;
+                    candidates.add(createCandidate(zNode));
                 }
             }
-        } catch (InterruptedException e) {
-            return 0;
-        } catch (KeeperException e) {
-            return 0;
+        } catch (InterruptedException | KeeperException e) {
+            return;
         }
         Collections.sort(candidates);
-        return candidates.size() == 0 ? buffer.length() : buffer.lastIndexOf("/") + 1;
     }
 
+    private static Candidate createCandidate(String cmd) {
+        return new Candidate(AttributedString.stripAnsi(cmd), cmd, null, null, null, null, true);
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/KeeperException.java b/zookeeper-server/src/main/java/org/apache/zookeeper/KeeperException.java
index 5cff6f3180c..0516892abfa 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/KeeperException.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/KeeperException.java
@@ -25,7 +25,6 @@
 import java.util.Map;
 import org.apache.yetus.audience.InterfaceAudience;
 
-@SuppressWarnings("serial")
 @InterfaceAudience.Public
 public abstract class KeeperException extends Exception {
 
@@ -148,9 +147,13 @@ public static KeeperException create(Code code) {
             return new SessionClosedRequireAuthException();
         case REQUESTTIMEOUT:
             return new RequestTimeoutException();
+        case QUOTAEXCEEDED:
+            return new QuotaExceededException();
+        case THROTTLEDOP:
+            return new ThrottledOpException();
         case OK:
         default:
-            throw new IllegalArgumentException("Invalid exception code");
+            throw new IllegalArgumentException("Invalid exception code:" + code.code);
         }
     }
 
@@ -178,6 +181,7 @@ public void setCode(int code) {
      * interface should be private, but it's declared public to enable
      * javadoc to include in the user API spec.
      */
+    @SuppressWarnings("DeprecatedIsStillUsed") // still used in Code - kept until 4.0
     @Deprecated
     @InterfaceAudience.Public
     public interface CodeDeprecated {
@@ -352,7 +356,7 @@ public enum Code implements CodeDeprecated {
         OPERATIONTIMEOUT(OperationTimeout),
         /** Invalid arguments */
         BADARGUMENTS(BadArguments),
-        /** No quorum of new config is connected and up-to-date with the leader of last commmitted config - try
+        /** No quorum of new config is connected and up-to-date with the leader of last committed config - try
          *  invoking reconfiguration after new servers are connected and synced */
         NEWCONFIGNOQUORUM(NewConfigNoQuorum),
         /** Another reconfiguration is in progress -- concurrent reconfigs not supported (yet) */
@@ -401,12 +405,19 @@ public enum Code implements CodeDeprecated {
         REQUESTTIMEOUT(-122),
         /** Attempts to perform a reconfiguration operation when reconfiguration feature is disabled. */
         RECONFIGDISABLED(-123),
-        /** The session has been closed by server because server requires client to do SASL authentication,
-         *  but client is not configured with SASL authentication or configuted with SASL but failed
+        /** The session has been closed by server because server requires client to do authentication
+         *  with configured authentication scheme at the server, but client is not configured with
+         *  required  authentication scheme or configured but authentication failed
          *  (i.e. wrong credential used.). */
-        SESSIONCLOSEDREQUIRESASLAUTH(-124);
+        SESSIONCLOSEDREQUIRESASLAUTH(-124),
+        /** Exceeded the quota that was set on the path.*/
+        QUOTAEXCEEDED(-125),
+        /** Operation was throttled and not executed at all. This error code indicates that zookeeper server
+         *  is under heavy load and can't process incoming requests at full speed; please retry with back off.
+         */
+        THROTTLEDOP (-127);
 
-        private static final Map<Integer, Code> lookup = new HashMap<Integer, Code>();
+        private static final Map<Integer, Code> lookup = new HashMap<>();
 
         static {
             for (Code c : EnumSet.allOf(Code.class)) {
@@ -430,10 +441,14 @@ public int intValue() {
         /**
          * Get the Code value for a particular integer error code
          * @param code int error code
-         * @return Code value corresponding to specified int code, or null
+         * @return Code value corresponding to specified int code, if null throws IllegalArgumentException
          */
         public static Code get(int code) {
-            return lookup.get(code);
+            Code codeVal = lookup.get(code);
+            if (codeVal == null) {
+                throw new IllegalArgumentException("The current client version cannot lookup this code:" + code);
+            }
+            return codeVal;
         }
     }
 
@@ -495,6 +510,10 @@ static String getCodeMessage(Code code) {
             return "Reconfig is disabled";
         case SESSIONCLOSEDREQUIRESASLAUTH:
             return "Session closed because client failed to authenticate";
+        case QUOTAEXCEEDED:
+            return "Quota has exceeded";
+        case THROTTLEDOP:
+            return "Op throttled due to high load";
         default:
             return "Unknown error " + code;
         }
@@ -940,4 +959,25 @@ public RequestTimeoutException() {
 
     }
 
+    /**
+     * @see Code#QUOTAEXCEEDED
+     */
+    @InterfaceAudience.Public
+    public static class QuotaExceededException extends KeeperException {
+        public QuotaExceededException() {
+            super(Code.QUOTAEXCEEDED);
+        }
+        public QuotaExceededException(String path) {
+            super(Code.QUOTAEXCEEDED, path);
+        }
+    }
+
+    /**
+     * @see Code#THROTTLEDOP
+     */
+    public static class ThrottledOpException extends KeeperException {
+        public ThrottledOpException() {
+            super(Code.THROTTLEDOP);
+        }
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/Login.java b/zookeeper-server/src/main/java/org/apache/zookeeper/Login.java
index 83af16256a3..2c483a5f74b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/Login.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/Login.java
@@ -26,8 +26,9 @@
  */
 
 import java.util.Date;
-import java.util.Random;
 import java.util.Set;
+import java.util.concurrent.ThreadLocalRandom;
+import java.util.function.Supplier;
 import javax.security.auth.Subject;
 import javax.security.auth.callback.CallbackHandler;
 import javax.security.auth.kerberos.KerberosPrincipal;
@@ -48,7 +49,7 @@ public class Login {
     private static final String KINIT_COMMAND_DEFAULT = "/usr/bin/kinit";
     private static final Logger LOG = LoggerFactory.getLogger(Login.class);
     public static final String SYSTEM_USER = System.getProperty("user.name", "<NA>");
-    public CallbackHandler callbackHandler;
+    private final Supplier<CallbackHandler> callbackHandlerSupplier;
 
     // LoginThread will sleep until 80% of time from last refresh to
     // ticket's expiry has been reached, at which time it will wake
@@ -63,16 +64,16 @@ public class Login {
     // Regardless of TICKET_RENEW_WINDOW setting above and the ticket expiry time,
     // thread will not sleep between refresh attempts any less than 1 minute (60*1000 milliseconds = 1 minute).
     // Change the '1' to e.g. 5, to change this to 5 minutes.
-    private static final long MIN_TIME_BEFORE_RELOGIN = 1 * 60 * 1000L;
+    private static final long DEFAULT_MIN_TIME_BEFORE_RELOGIN = 1 * 60 * 1000L;
+    public static final String MIN_TIME_BEFORE_RELOGIN_CONFIG_KEY = "zookeeper.kerberos.minReLoginTimeMs";
+    private static final long MIN_TIME_BEFORE_RELOGIN = Long.getLong(
+      MIN_TIME_BEFORE_RELOGIN_CONFIG_KEY, DEFAULT_MIN_TIME_BEFORE_RELOGIN);
 
     private Subject subject = null;
     private Thread t = null;
     private boolean isKrbTicket = false;
     private boolean isUsingTicketCache = false;
 
-    /** Random number generator */
-    private static Random rng = new Random();
-
     private LoginContext login = null;
     private String loginContextName = null;
     private String principal = null;
@@ -89,17 +90,17 @@ public class Login {
      *            name of section in JAAS file that will be use to login. Passed
      *            as first param to javax.security.auth.login.LoginContext().
      *
-     * @param callbackHandler
-     *            Passed as second param to
-     *            javax.security.auth.login.LoginContext().
+     * @param callbackHandlerSupplier
+     *            Per connection callbackhandler supplier.
+     *
      * @param zkConfig
      *            client or server configurations
      * @throws javax.security.auth.login.LoginException
      *             Thrown if authentication fails.
      */
-    public Login(final String loginContextName, CallbackHandler callbackHandler, final ZKConfig zkConfig) throws LoginException {
+    public Login(final String loginContextName, Supplier<CallbackHandler> callbackHandlerSupplier, final ZKConfig zkConfig) throws LoginException {
         this.zkConfig = zkConfig;
-        this.callbackHandler = callbackHandler;
+        this.callbackHandlerSupplier = callbackHandlerSupplier;
         login = login(loginContextName);
         this.loginContextName = loginContextName;
         subject = login.getSubject();
@@ -226,7 +227,7 @@ public void run() {
                                     --retry;
                                     // sleep for 10 seconds
                                     try {
-                                        Thread.sleep(10 * 1000);
+                                        sleepBeforeRetryFailedRefresh();
                                     } catch (InterruptedException ie) {
                                         LOG.error("Interrupted while renewing TGT, exiting Login thread");
                                         return;
@@ -254,7 +255,7 @@ public void run() {
                                     --retry;
                                     // sleep for 10 seconds.
                                     try {
-                                        Thread.sleep(10 * 1000);
+                                        sleepBeforeRetryFailedRefresh();
                                     } catch (InterruptedException e) {
                                         LOG.error("Interrupted during login retry after LoginException:", le);
                                         throw le;
@@ -274,6 +275,17 @@ public void run() {
         t.setDaemon(true);
     }
 
+    /**
+     * Return a new CallbackHandler for connections
+     * to avoid race conditions and state sharing in
+     * connection login processing.
+     *
+     * @return connection dependent CallbackHandler
+     */
+    public CallbackHandler newCallbackHandler() {
+        return callbackHandlerSupplier.get();
+    }
+
     public void startThreadIfNeeded() {
         // thread object 't' will be null if a refresh thread is not needed.
         if (t != null) {
@@ -315,7 +327,7 @@ private synchronized LoginContext login(final String loginContextName) throws Lo
                                      + ") and your "
                                      + getLoginContextMessage());
         }
-        LoginContext loginContext = new LoginContext(loginContextName, callbackHandler);
+        LoginContext loginContext = new LoginContext(loginContextName, newCallbackHandler());
         loginContext.login();
         LOG.info("{} successfully logged in.", loginContextName);
         return loginContext;
@@ -341,7 +353,9 @@ private long getRefreshTime(KerberosTicket tgt) {
         long expires = tgt.getEndTime().getTime();
         LOG.info("TGT valid starting at:        {}", tgt.getStartTime().toString());
         LOG.info("TGT expires:                  {}", tgt.getEndTime().toString());
-        long proposedRefresh = start + (long) ((expires - start) * (TICKET_RENEW_WINDOW + (TICKET_RENEW_JITTER * rng.nextDouble())));
+        long proposedRefresh = start + (long) ((expires - start)
+            * (TICKET_RENEW_WINDOW + (TICKET_RENEW_JITTER
+                * ThreadLocalRandom.current().nextDouble())));
         if (proposedRefresh > expires) {
             // proposedRefresh is too far in the future: it's after ticket expires: simply return now.
             return Time.currentWallTime();
@@ -401,10 +415,10 @@ private void setLastLogin(long time) {
     }
 
     /**
-     * Get the time of the last login.
-     * @return the number of milliseconds since the beginning of time.
+     * Get the time of the last login (ticket initialization or last ticket renewal).
+     * @return the number of milliseconds since epoch.
      */
-    private long getLastLogin() {
+    public long getLastLogin() {
         return lastLogin;
     }
 
@@ -429,7 +443,7 @@ private synchronized void reLogin() throws LoginException {
             //clear up the kerberos state. But the tokens are not cleared! As per
             //the Java kerberos login module code, only the kerberos credentials
             //are cleared
-            login.logout();
+            logout();
             //login and also update the subject field of this instance to
             //have the new credentials (pass it to the LoginContext constructor)
             login = new LoginContext(loginContextName, getSubject());
@@ -439,4 +453,18 @@ private synchronized void reLogin() throws LoginException {
         }
     }
 
+    // this method also visible for unit tests, to make sure kerberos state cleaned up
+    protected synchronized void logout() throws LoginException {
+        // We need to make sure not to call LoginContext.logout() when we
+        // are not logged in. Since Java 9 this could result in an NPE.
+        // See ZOOKEEPER-4477 for more details.
+        if (subject != null && !subject.getPrincipals().isEmpty()) {
+            login.logout();
+        }
+    }
+
+    // this method is overwritten in unit tests to test concurrency
+    protected void sleepBeforeRetryFailedRefresh() throws InterruptedException {
+        Thread.sleep(10 * 1000);
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/MultiOperationRecord.java b/zookeeper-server/src/main/java/org/apache/zookeeper/MultiOperationRecord.java
index d43e7284165..72e9f197c34 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/MultiOperationRecord.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/MultiOperationRecord.java
@@ -43,7 +43,7 @@
  */
 public class MultiOperationRecord implements Record, Iterable<Op> {
 
-    private List<Op> ops = new ArrayList<Op>();
+    private List<Op> ops = new ArrayList<>();
     private Op.OpKind opKind = null;
 
     public MultiOperationRecord() {
@@ -126,7 +126,12 @@ public void deserialize(InputArchive archive, String tag) throws IOException {
                 case ZooDefs.OpCode.createContainer:
                     CreateRequest cr = new CreateRequest();
                     cr.deserialize(archive, tag);
-                    add(Op.create(cr.getPath(), cr.getData(), cr.getAcl(), cr.getFlags()));
+                    CreateMode createMode = CreateMode.fromFlag(cr.getFlags(), null);
+                    if (createMode == null) {
+                        throw new IOException("invalid flag " + cr.getFlags() + " for create mode");
+                    }
+                    CreateOptions options = CreateOptions.newBuilder(cr.getAcl(), createMode).build();
+                    add(Op.create(cr.getPath(), cr.getData(), options, h.getType()));
                     break;
                 case ZooDefs.OpCode.createTTL:
                     CreateTTLRequest crTtl = new CreateTTLRequest();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/MultiResponse.java b/zookeeper-server/src/main/java/org/apache/zookeeper/MultiResponse.java
index 16d2fb29df5..2e678c93c7d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/MultiResponse.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/MultiResponse.java
@@ -41,7 +41,7 @@
  */
 public class MultiResponse implements Record, Iterable<OpResult> {
 
-    private List<OpResult> results = new ArrayList<OpResult>();
+    private List<OpResult> results = new ArrayList<>();
 
     public void add(OpResult x) {
         results.add(x);
@@ -101,7 +101,7 @@ public void serialize(OutputArchive archive, String tag) throws IOException {
 
     @Override
     public void deserialize(InputArchive archive, String tag) throws IOException {
-        results = new ArrayList<OpResult>();
+        results = new ArrayList<>();
 
         archive.startRecord(tag);
         MultiHeader h = new MultiHeader();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/Op.java b/zookeeper-server/src/main/java/org/apache/zookeeper/Op.java
index 8597ea846f8..ca0c0859d14 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/Op.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/Op.java
@@ -152,6 +152,42 @@ public static Op create(String path, byte[] data, List<ACL> acl, CreateMode crea
         return new Create(path, data, acl, createMode);
     }
 
+    /**
+     * Constructs a create operation which uses given op code if no one is inferred from create mode.
+     *
+     * @param path
+     *                the path for the node
+     * @param data
+     *                the initial data for the node
+     * @param options
+     *                options for creating znode
+     * @param defaultOpCode
+     *                op code to be used if no one is inferred from create mode
+     */
+    static Op create(String path, byte[] data, CreateOptions options, int defaultOpCode) {
+        if (options.getCreateMode().isTTL()) {
+            return new CreateTTL(path, data, options.getAcl(), options.getCreateMode(), options.getTtl());
+        }
+        return new Create(path, data, options.getAcl(), options.getCreateMode(), defaultOpCode);
+    }
+
+    /**
+     * Constructs a create operation which uses {@link ZooDefs.OpCode#create2} if no one is inferred from create mode.
+     *
+     * <p>The corresponding {@link OpResult.CreateResult#getStat()} could be null if connected to server without this
+     * patch.
+     *
+     * @param path
+     *                the path for the node
+     * @param data
+     *                the initial data for the node
+     * @param options
+     *                options for creating znode
+     */
+    public static Op create(String path, byte[] data, CreateOptions options) {
+        return create(path, data, options, ZooDefs.OpCode.create2);
+    }
+
     /**
      * Constructs a delete operation.  Arguments are as for the ZooKeeper method of the same name.
      * @see ZooKeeper#delete(String, int)
@@ -263,21 +299,29 @@ public static class Create extends Op {
         protected int flags;
 
         private Create(String path, byte[] data, List<ACL> acl, int flags) {
-            super(getOpcode(CreateMode.fromFlag(flags, CreateMode.PERSISTENT)), path, OpKind.TRANSACTION);
+            this(path, data, acl, flags, ZooDefs.OpCode.create);
+        }
+
+        private Create(String path, byte[] data, List<ACL> acl, int flags, int defaultOpCode) {
+            super(getOpcode(CreateMode.fromFlag(flags, CreateMode.PERSISTENT), defaultOpCode), path, OpKind.TRANSACTION);
             this.data = data;
             this.acl = acl;
             this.flags = flags;
         }
 
-        private static int getOpcode(CreateMode createMode) {
+        private static int getOpcode(CreateMode createMode, int defaultOpCode) {
             if (createMode.isTTL()) {
                 return ZooDefs.OpCode.createTTL;
             }
-            return createMode.isContainer() ? ZooDefs.OpCode.createContainer : ZooDefs.OpCode.create;
+            return createMode.isContainer() ? ZooDefs.OpCode.createContainer : defaultOpCode;
         }
 
         private Create(String path, byte[] data, List<ACL> acl, CreateMode createMode) {
-            super(getOpcode(createMode), path, OpKind.TRANSACTION);
+            this(path, data, acl, createMode, ZooDefs.OpCode.create);
+        }
+
+        private Create(String path, byte[] data, List<ACL> acl, CreateMode createMode, int defaultOpCode) {
+            super(getOpcode(createMode, defaultOpCode), path, OpKind.TRANSACTION);
             this.data = data;
             this.acl = acl;
             this.flags = createMode.toFlag();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/Quotas.java b/zookeeper-server/src/main/java/org/apache/zookeeper/Quotas.java
index 031ff367ad6..eb83cfea547 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/Quotas.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/Quotas.java
@@ -48,9 +48,19 @@ public class Quotas {
      * return the quota path associated with this
      * prefix
      * @param path the actual path in zookeeper.
-     * @return the limit quota path
+     * @return the quota path
      */
     public static String quotaPath(String path) {
+        return quotaZookeeper + path;
+    }
+
+    /**
+     * return the limit quota path associated with this
+     * prefix
+     * @param path the actual path in zookeeper.
+     * @return the limit quota path
+     */
+    public static String limitPath(String path) {
         return quotaZookeeper + path + "/" + limitNode;
     }
 
@@ -64,4 +74,13 @@ public static String statPath(String path) {
         return quotaZookeeper + path + "/" + statNode;
     }
 
+    /**
+     * return the real path associated with this
+     * quotaPath.
+     * @param quotaPath the quotaPath which's started with /zookeeper/quota
+     * @return the real path associated with this quotaPath.
+     */
+    public static String trimQuotaPath(String quotaPath) {
+        return quotaPath.substring(quotaZookeeper.length());
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/SaslServerPrincipal.java b/zookeeper-server/src/main/java/org/apache/zookeeper/SaslServerPrincipal.java
index 879955414e0..3262011ba41 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/SaslServerPrincipal.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/SaslServerPrincipal.java
@@ -38,7 +38,7 @@ public class SaslServerPrincipal {
      * @return the name of the principal.
      */
     static String getServerPrincipal(InetSocketAddress addr, ZKClientConfig clientConfig) {
-        return getServerPrincipal(new WrapperInetSocketAddress(addr), clientConfig);
+        return getServerPrincipal(new WrapperInetSocketAddress(addr, clientConfig), clientConfig);
     }
 
     /**
@@ -96,13 +96,20 @@ static String getServerPrincipal(WrapperInetSocketAddress addr, ZKClientConfig c
     static class WrapperInetSocketAddress {
 
         private final InetSocketAddress addr;
+        private final ZKClientConfig clientConfig;
 
-        WrapperInetSocketAddress(InetSocketAddress addr) {
+        WrapperInetSocketAddress(InetSocketAddress addr, ZKClientConfig clientConfig) {
             this.addr = addr;
+            this.clientConfig = clientConfig;
         }
 
         public String getHostName() {
-            return addr.getHostName();
+            if (clientConfig.getBoolean(ZKClientConfig.ZK_SASL_CLIENT_ALLOW_REVERSE_DNS,
+                                        ZKClientConfig.ZK_SASL_CLIENT_ALLOW_REVERSE_DNS_DEFAULT)) {
+                return addr.getHostName();
+            } else {
+                return addr.getHostString();
+            }
         }
 
         public WrapperInetAddress getAddress() {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ServerAdminClient.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ServerAdminClient.java
index ab7b08a28d9..a08810f28f6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ServerAdminClient.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ServerAdminClient.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
@@ -52,7 +53,7 @@ public static void ruok(String host, int port) {
             byte[] resBytes = new byte[4];
 
             int rc = is.read(resBytes);
-            String retv = new String(resBytes);
+            String retv = new String(resBytes, UTF_8);
             System.out.println("rc=" + rc + " retv=" + retv);
         } catch (IOException e) {
             LOG.warn("Unexpected exception", e);
@@ -86,7 +87,7 @@ public static void dump(String host, int port) {
             byte[] resBytes = new byte[1024];
 
             int rc = is.read(resBytes);
-            String retv = new String(resBytes);
+            String retv = new String(resBytes, UTF_8);
             System.out.println("rc=" + rc + " retv=" + retv);
         } catch (IOException e) {
             LOG.warn("Unexpected exception", e);
@@ -120,7 +121,7 @@ public static void stat(String host, int port) {
             byte[] resBytes = new byte[1024];
 
             int rc = is.read(resBytes);
-            String retv = new String(resBytes);
+            String retv = new String(resBytes, UTF_8);
             System.out.println("rc=" + rc + " retv=" + retv);
         } catch (IOException e) {
             LOG.warn("Unexpected exception", e);
@@ -153,7 +154,7 @@ public static void kill(String host, int port) {
             byte[] resBytes = new byte[4];
 
             int rc = is.read(resBytes);
-            String retv = new String(resBytes);
+            String retv = new String(resBytes, UTF_8);
             System.out.println("rc=" + rc + " retv=" + retv);
         } catch (IOException e) {
             LOG.warn("Unexpected exception", e);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/Shell.java b/zookeeper-server/src/main/java/org/apache/zookeeper/Shell.java
index d59079f5fc7..f780ff98556 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/Shell.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/Shell.java
@@ -33,10 +33,12 @@
 import java.io.File;
 import java.io.IOException;
 import java.io.InputStreamReader;
+import java.nio.charset.StandardCharsets;
 import java.util.Map;
 import java.util.Timer;
 import java.util.TimerTask;
 import java.util.concurrent.atomic.AtomicBoolean;
+import org.apache.commons.io.FileUtils;
 import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.server.ExitCode;
 import org.slf4j.Logger;
@@ -105,6 +107,24 @@ public static String[] getUlimitMemoryCommand(int memoryLimit) {
         return new String[]{ULIMIT_COMMAND, "-v", String.valueOf(memoryLimit)};
     }
 
+    /**
+     * Check if running in Windows Subsystem for Linux
+     * @return
+     * @throws IOException
+     */
+    public static boolean isWsl() throws IOException {
+        if (WINDOWS) {
+            return false;
+        }
+        final File f = new File("/proc/version");
+        if (!f.exists()) {
+            return false;
+        }
+        final String output = FileUtils.readFileToString(f, StandardCharsets.UTF_8.name());
+        return (output != null)
+                && System.getProperty("os.name").startsWith("Linux") && output.toLowerCase().contains("microsoft");
+    }
+
     /** Set to true on Windows platforms */
     public static final boolean WINDOWS /* borrowed from Path.WINDOWS */ = System.getProperty("os.name").startsWith("Windows");
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/StatsTrack.java b/zookeeper-server/src/main/java/org/apache/zookeeper/StatsTrack.java
index 4bd88e337cc..02fffb753fc 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/StatsTrack.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/StatsTrack.java
@@ -18,48 +18,71 @@
 
 package org.apache.zookeeper;
 
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Objects;
+import java.util.regex.Pattern;
+import org.apache.zookeeper.common.StringUtils;
+
 /**
  * a class that represents the stats associated with quotas
  */
 public class StatsTrack {
 
-    private int count;
-    private long bytes;
-    private String countStr = "count";
-    private String byteStr = "bytes";
+    private static final String countStr = "count";
+    private static final String countHardLimitStr = "countHardLimit";
+
+    private static final String byteStr = "bytes";
+    private static final String byteHardLimitStr = "byteHardLimit";
+
+    private final Map<String, Long> stats = new HashMap<>();
+    private static final Pattern PAIRS_SEPARATOR = Pattern.compile("[,;]+");
 
     /**
      * a default constructor for
      * stats
      */
     public StatsTrack() {
-        this(null);
+        this("");
     }
+
     /**
-     * the stat string should be of the form count=int,bytes=long
-     * if stats is called with null the count and bytes are initialized
-     * to -1.
-     * @param stats the stat string to be intialized with
+     *
+     * @param stat the byte[] stat to be initialized with
      */
-    public StatsTrack(String stats) {
-        if (stats == null) {
-            stats = "count=-1,bytes=-1";
+    public StatsTrack(byte[] stat) {
+        this(new String(stat, StandardCharsets.UTF_8));
+    }
+
+    /**
+     * the stat string should be of the form key1str=long,key2str=long,..
+     * where either , or ; are valid separators
+     * uninitialized values are returned as -1
+     * @param stat the stat string to be initialized with
+     */
+    public StatsTrack(String stat) {
+        this.stats.clear();
+        if (stat == null || stat.length() == 0) {
+            return;
         }
-        String[] split = stats.split(",");
-        if (split.length != 2) {
-            throw new IllegalArgumentException("invalid string " + stats);
+        String[] keyValuePairs = PAIRS_SEPARATOR.split(stat);
+        for (String keyValuePair : keyValuePairs) {
+            String[] kv = keyValuePair.split("=");
+            this.stats.put(kv[0], Long.parseLong(StringUtils.isEmpty(kv[1]) ? "-1" : kv[1]));
         }
-        count = Integer.parseInt(split[0].split("=")[1]);
-        bytes = Long.parseLong(split[1].split("=")[1]);
     }
 
+
     /**
      * get the count of nodes allowed as part of quota
      *
      * @return the count as part of this string
      */
-    public int getCount() {
-        return this.count;
+    public long getCount() {
+        return getValue(countStr);
     }
 
     /**
@@ -68,8 +91,26 @@ public int getCount() {
      * @param count
      *            the count to set with
      */
-    public void setCount(int count) {
-        this.count = count;
+    public void setCount(long count) {
+        setValue(countStr, count);
+    }
+
+    /**
+     * get the count of nodes allowed as part of quota (hard limit)
+     *
+     * @return the count as part of this string
+     */
+    public long getCountHardLimit() {
+        return getValue(countHardLimitStr);
+    }
+
+    /**
+     * set the count hard limit
+     *
+     * @param count the count limit to set
+     */
+    public void setCountHardLimit(long count) {
+        setValue(countHardLimitStr, count);
     }
 
     /**
@@ -78,24 +119,118 @@ public void setCount(int count) {
      * @return the bytes as part of this string
      */
     public long getBytes() {
-        return this.bytes;
+        return getValue(byteStr);
     }
 
     /**
-     * set teh bytes for this stat tracker.
+     * set the bytes for this stat tracker.
      *
      * @param bytes
      *            the bytes to set with
      */
     public void setBytes(long bytes) {
-        this.bytes = bytes;
+        setValue(byteStr, bytes);
+    }
+
+    /**
+     * get the count of bytes allowed as part of quota (hard limit)
+     *
+     * @return the bytes as part of this string
+     */
+    public long getByteHardLimit() {
+        return getValue(byteHardLimitStr);
+    }
+
+    /**
+     * set the byte hard limit
+     *
+     * @param bytes the byte limit to set
+     */
+    public void setByteHardLimit(long bytes) {
+        setValue(byteHardLimitStr, bytes);
+    }
+
+    /**
+     * get helper to lookup a given key
+     *
+     * @param key the key to lookup
+     * @return key's value or -1 if it doesn't exist
+     */
+    private long getValue(String key) {
+        Long val = this.stats.get(key);
+        return val == null ? -1 : val.longValue();
+    }
+
+    /**
+     * set helper to set the value for the specified key
+     *
+     * @param key   the key to set
+     * @param value the value to set
+     */
+    private void setValue(String key, long value) {
+        this.stats.put(key, value);
     }
 
-    @Override
     /*
      * returns the string that maps to this stat tracking.
-     */ public String toString() {
-        return countStr + "=" + count + "," + byteStr + "=" + bytes;
+     *
+     * Builds a string of the form
+     * "count=4,bytes=5=;countHardLimit=10;byteHardLimit=10"
+     *
+     * This string is slightly hacky to preserve compatibility with 3.4.3 and
+     * older parser. In particular, count must be first, bytes must be second,
+     * all new fields must use a separator that is not a "," (so, ";"), and the
+     * seemingly spurious "=" after the bytes field is essential to allowing
+     * it to be parseable by the old parsing code.
+     */
+    @Override
+    public String toString() {
+        StringBuilder buf = new StringBuilder();
+        ArrayList<String> keys = new ArrayList<>(stats.keySet());
+
+        // Special handling for count=,byte= to enforce them coming first
+        // for backwards compatibility
+        keys.remove(countStr);
+        keys.remove(byteStr);
+        buf.append(countStr);
+        buf.append("=");
+        buf.append(getCount());
+        buf.append(",");
+        buf.append(byteStr);
+        buf.append("=");
+        buf.append(getBytes());
+        if (!keys.isEmpty()) {
+            // Add extra = to trick old parsing code so it will ignore new flags
+            buf.append("=");
+            Collections.sort(keys);
+            for (String key : keys) {
+                buf.append(";");
+                buf.append(key);
+                buf.append("=");
+                buf.append(stats.get(key));
+            }
+        }
+        return buf.toString();
+    }
+
+    public byte[] getStatsBytes() {
+        return toString().getBytes(StandardCharsets.UTF_8);
     }
 
+    @Override
+    public boolean equals(final Object o) {
+        if (this == o) {
+            return true;
+        }
+        if (o == null || getClass() != o.getClass()) {
+            return false;
+        }
+        final StatsTrack that = (StatsTrack) o;
+        return Objects.equals(stats, that.stats);
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hash(stats);
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/Testable.java b/zookeeper-server/src/main/java/org/apache/zookeeper/Testable.java
index 780cbe893c1..a1c9c96e9c5 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/Testable.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/Testable.java
@@ -18,6 +18,8 @@
 
 package org.apache.zookeeper;
 
+import java.io.IOException;
+
 /**
  * Abstraction that exposes various methods useful for testing ZooKeeper
  */
@@ -35,4 +37,9 @@ public interface Testable {
      */
     void queueEvent(WatchedEvent event);
 
+    /**
+     * Close the ClientCnxn socket for testing purposes
+     */
+    default void closeSocket() throws IOException { }
+
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/Transaction.java b/zookeeper-server/src/main/java/org/apache/zookeeper/Transaction.java
index 7a6ba73c975..20913c414b6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/Transaction.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/Transaction.java
@@ -34,7 +34,7 @@
 public class Transaction {
 
     private ZooKeeper zk;
-    private List<Op> ops = new ArrayList<Op>();
+    private List<Op> ops = new ArrayList<>();
 
     protected Transaction(ZooKeeper zk) {
         this.zk = zk;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/Version.java b/zookeeper-server/src/main/java/org/apache/zookeeper/Version.java
index 4029c60ede3..4fc0507a2fc 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/Version.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/Version.java
@@ -24,6 +24,18 @@
 
 public class Version implements org.apache.zookeeper.version.Info {
 
+    /*
+     * Since the SVN to Git port this field doesn't return the revision anymore
+     * In version 3.5.6, 3.5.7 and 3.6.0 this function is removed by accident.
+     * From version 3.5.8+ and 3.6.1+ it is restored for backward compatibility, but will be removed later
+     * @deprecated deprecated in 3.5.5, use @see {@link #getRevisionHash()} instead
+     * @return the default value -1
+     */
+    @Deprecated
+    public static int getRevision() {
+        return REVISION;
+    }
+
     public static String getRevisionHash() {
         return REVISION_HASH;
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/WatchDeregistration.java b/zookeeper-server/src/main/java/org/apache/zookeeper/WatchDeregistration.java
index 16c7f843473..7d3b5f13517 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/WatchDeregistration.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/WatchDeregistration.java
@@ -22,27 +22,26 @@
 import java.util.Set;
 import org.apache.zookeeper.Watcher.Event.EventType;
 import org.apache.zookeeper.Watcher.WatcherType;
-import org.apache.zookeeper.ZooKeeper.ZKWatchManager;
 
 /**
  * Handles the special case of removing watches which has registered for a
- * client path
+ * server path
  */
 public class WatchDeregistration {
 
-    private final String clientPath;
+    private final String serverPath;
     private final Watcher watcher;
     private final WatcherType watcherType;
     private final boolean local;
     private final ZKWatchManager zkManager;
 
     public WatchDeregistration(
-        String clientPath,
+        String serverPath,
         Watcher watcher,
         WatcherType watcherType,
         boolean local,
         ZKWatchManager zkManager) {
-        this.clientPath = clientPath;
+        this.serverPath = serverPath;
         this.watcher = watcher;
         this.watcherType = watcherType;
         this.local = local;
@@ -57,16 +56,16 @@ public WatchDeregistration(
      *            watch on the path.
      */
     public Map<EventType, Set<Watcher>> unregister(int rc) throws KeeperException {
-        return zkManager.removeWatcher(clientPath, watcher, watcherType, local, rc);
+        return zkManager.removeWatcher(serverPath, watcher, watcherType, local, rc);
     }
 
     /**
-     * Returns client path which has specified for unregistering its watcher
+     * Returns server path which has specified for unregistering its watcher
      *
-     * @return client path
+     * @return server path
      */
-    public String getClientPath() {
-        return clientPath;
+    public String getServerPath() {
+        return serverPath;
     }
 
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/WatchedEvent.java b/zookeeper-server/src/main/java/org/apache/zookeeper/WatchedEvent.java
index 1de3d3ddf68..1303629c914 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/WatchedEvent.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/WatchedEvent.java
@@ -31,27 +31,38 @@
  */
 @InterfaceAudience.Public
 public class WatchedEvent {
+    public static final long NO_ZXID = -1L;
 
     private final KeeperState keeperState;
     private final EventType eventType;
-    private String path;
+    private final String path;
+    private final long zxid;
 
     /**
-     * Create a WatchedEvent with specified type, state and path
+     * Create a WatchedEvent with specified type, state, path and zxid
      */
-    public WatchedEvent(EventType eventType, KeeperState keeperState, String path) {
+    public WatchedEvent(EventType eventType, KeeperState keeperState, String path, long zxid) {
         this.keeperState = keeperState;
         this.eventType = eventType;
         this.path = path;
+        this.zxid = zxid;
     }
 
     /**
-     * Convert a WatcherEvent sent over the wire into a full-fledged WatcherEvent
+     * Create a WatchedEvent with specified type, state and path
      */
-    public WatchedEvent(WatcherEvent eventMessage) {
+    public WatchedEvent(EventType eventType, KeeperState keeperState, String path) {
+        this(eventType, keeperState, path, NO_ZXID);
+    }
+
+    /**
+     * Convert a WatcherEvent sent over the wire into a full-fledged WatchedEvent
+     */
+    public WatchedEvent(WatcherEvent eventMessage, long zxid) {
         keeperState = KeeperState.fromInt(eventMessage.getState());
         eventType = EventType.fromInt(eventMessage.getType());
         path = eventMessage.getPath();
+        this.zxid = zxid;
     }
 
     public KeeperState getState() {
@@ -66,9 +77,24 @@ public String getPath() {
         return path;
     }
 
+    /**
+     * Returns the zxid of the transaction that triggered this watch if it is
+     * of one of the following types:<ul>
+     *   <li>{@link EventType#NodeCreated}</li>
+     *   <li>{@link EventType#NodeDeleted}</li>
+     *   <li>{@link EventType#NodeDataChanged}</li>
+     *   <li>{@link EventType#NodeChildrenChanged}</li>
+     * </ul>
+     * Otherwise, returns {@value #NO_ZXID}. Note that {@value #NO_ZXID} is also
+     * returned by old servers that do not support this feature.
+     */
+    public long getZxid() {
+        return zxid;
+    }
+
     @Override
     public String toString() {
-        return "WatchedEvent state:" + keeperState + " type:" + eventType + " path:" + path;
+        return "WatchedEvent state:" + keeperState + " type:" + eventType + " path:" + path + " zxid: " + zxid;
     }
 
     /**
@@ -77,5 +103,4 @@ public String toString() {
     public WatcherEvent getWrapper() {
         return new WatcherEvent(eventType.getIntValue(), keeperState.getIntValue(), path);
     }
-
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/Watcher.java b/zookeeper-server/src/main/java/org/apache/zookeeper/Watcher.java
index ab4b654880e..01c3ae75a9f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/Watcher.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/Watcher.java
@@ -26,6 +26,11 @@
  * server it connects to. An application using such a client handles these
  * events by registering a callback object with the client. The callback object
  * is expected to be an instance of a class that implements Watcher interface.
+ * When {@link #process} is triggered by a watch firing, such as
+ * {@link Event.EventType#NodeDataChanged}, {@link WatchedEvent#getZxid()} will
+ * return the zxid of the transaction that caused said watch to fire. If
+ * {@value WatchedEvent#NO_ZXID} is returned then the server must be updated to
+ * support this feature.
  *
  */
 @InterfaceAudience.Public
@@ -191,6 +196,8 @@ public static EventType fromInt(int intValue) {
     enum WatcherType {
         Children(1),
         Data(2),
+        Persistent(4),
+        PersistentRecursive(5),
         Any(3);
 
         // Integer representation of value
@@ -212,7 +219,10 @@ public static WatcherType fromInt(int intValue) {
                 return WatcherType.Data;
             case 3:
                 return WatcherType.Any;
-
+            case 4:
+                return Persistent;
+            case 5:
+                return PersistentRecursive;
             default:
                 throw new RuntimeException("Invalid integer value for conversion to WatcherType");
             }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java
index 98a26566579..e149408dc20 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZKUtil.java
@@ -40,7 +40,7 @@
 public class ZKUtil {
 
     private static final Logger LOG = LoggerFactory.getLogger(ZKUtil.class);
-    private static final Map<Integer, String> permCache = new ConcurrentHashMap<Integer, String>();
+    private static final Map<Integer, String> permCache = new ConcurrentHashMap<>();
     /**
      * Recursively delete the node with the given path.
      * <p>
@@ -49,7 +49,14 @@ public class ZKUtil {
      * If there is an error with deleting one of the sub-nodes in the tree,
      * this operation would abort and would be the responsibility of the app to handle the same.
      *
-     *
+     * @param zk Zookeeper client
+     * @param pathRoot path to be deleted
+     * @param batchSize number of delete operations to be submitted in one call.
+     *                  batchSize is also used to decide sync and async delete API invocation.
+     *                  If batchSize>0 then async otherwise sync delete API is invoked. batchSize>0
+     *                  gives better performance. batchSize<=0 scenario is handled to preserve
+     *                  backward compatibility.
+     * @return true if given node and all its sub nodes are deleted successfully otherwise false
      * @throws IllegalArgumentException if an invalid path is specified
      */
     public static boolean deleteRecursive(
@@ -61,11 +68,19 @@ public static boolean deleteRecursive(
         List<String> tree = listSubTreeBFS(zk, pathRoot);
         LOG.debug("Deleting tree: {}", tree);
 
-        return deleteInBatch(zk, tree, batchSize);
+        if (batchSize > 0) {
+            return deleteInBatch(zk, tree, batchSize);
+        } else {
+            for (int i = tree.size() - 1; i >= 0; --i) {
+                //Delete the leaves first and eventually get rid of the root
+                zk.delete(tree.get(i), -1); //Delete all versions of the node with -1.
+            }
+            return true;
+        }
     }
 
     /**
-     * Same as {@link #deleteRecursive(org.apache.zookeeper.ZooKeeper, java.lang.String, int)
+     * Same as {@link #deleteRecursive(org.apache.zookeeper.ZooKeeper, java.lang.String, int)}
      * kept here for compatibility with 3.5 clients.
      *
      * @since 3.6.1
@@ -73,7 +88,8 @@ public static boolean deleteRecursive(
     public static void deleteRecursive(
         ZooKeeper zk,
         final String pathRoot) throws InterruptedException, KeeperException {
-        deleteRecursive(zk, pathRoot, 1000);
+        // batchSize=0 is passed to preserve the backward compatibility with older clients.
+        deleteRecursive(zk, pathRoot, 0);
     }
 
     private static class BatchedDeleteCbContext {
@@ -93,10 +109,10 @@ private static boolean deleteInBatch(ZooKeeper zk, List<String> tree, int batchS
         List<Op> ops = new ArrayList<>();
         BatchedDeleteCbContext context = new BatchedDeleteCbContext(rateLimit);
         MultiCallback cb = (rc, path, ctx, opResults) -> {
-            ((BatchedDeleteCbContext) ctx).sem.release();
             if (rc != Code.OK.intValue()) {
                 ((BatchedDeleteCbContext) ctx).success.set(false);
             }
+            ((BatchedDeleteCbContext) ctx).sem.release();
         };
 
         // Delete the leaves first and eventually get rid of the root
@@ -163,7 +179,7 @@ public static String validateFileInput(String filePath) {
             return "Read permission is denied on the file '" + file.getAbsolutePath() + "'";
         }
         if (file.isDirectory()) {
-            return "'" + file.getAbsolutePath() + "' is a direcory. it must be a file.";
+            return "'" + file.getAbsolutePath() + "' is a directory. it must be a file.";
         }
         return null;
     }
@@ -186,14 +202,15 @@ public static List<String> listSubTreeBFS(
         ZooKeeper zk,
         final String pathRoot) throws KeeperException, InterruptedException {
         Queue<String> queue = new ArrayDeque<>();
-        List<String> tree = new ArrayList<String>();
+        List<String> tree = new ArrayList<>();
         queue.add(pathRoot);
         tree.add(pathRoot);
         while (!queue.isEmpty()) {
             String node = queue.poll();
             List<String> children = zk.getChildren(node, false);
             for (final String child : children) {
-                final String childPath = node + "/" + child;
+                // Fix IllegalArgumentException when list "/".
+                final String childPath = (node.equals("/") ? "" : node) + "/" + child;
                 queue.add(childPath);
                 tree.add(childPath);
             }
@@ -290,4 +307,4 @@ public static String aclToString(List<ACL> acls) {
         }
         return sb.toString();
     }
-}
\ No newline at end of file
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZKWatchManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZKWatchManager.java
new file mode 100644
index 00000000000..ce0df4e9a12
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZKWatchManager.java
@@ -0,0 +1,462 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import org.apache.zookeeper.server.watch.PathParentIterator;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Manage watchers and handle events generated by the {@link ClientCnxn} object.
+ * <p>
+ * This class is intended to be packaged-private so that it doesn't serve
+ * as part of ZooKeeper client API.
+ */
+class ZKWatchManager implements ClientWatchManager {
+
+    private static final Logger LOG = LoggerFactory.getLogger(ZKWatchManager.class);
+
+    private final Map<String, Set<Watcher>> dataWatches = new HashMap<>();
+    private final Map<String, Set<Watcher>> existWatches = new HashMap<>();
+    private final Map<String, Set<Watcher>> childWatches = new HashMap<>();
+    private final Map<String, Set<Watcher>> persistentWatches = new HashMap<>();
+    private final Map<String, Set<Watcher>> persistentRecursiveWatches = new HashMap<>();
+    private final boolean disableAutoWatchReset;
+
+    private volatile Watcher defaultWatcher;
+
+    ZKWatchManager(boolean disableAutoWatchReset, Watcher defaultWatcher) {
+        this.disableAutoWatchReset = disableAutoWatchReset;
+        this.defaultWatcher = defaultWatcher;
+    }
+
+    void setDefaultWatcher(Watcher defaultWatcher) {
+        this.defaultWatcher = defaultWatcher;
+    }
+
+    Watcher getDefaultWatcher() {
+        return defaultWatcher;
+    }
+
+    List<String> getDataWatchList() {
+        synchronized (dataWatches) {
+            return new ArrayList<>(dataWatches.keySet());
+        }
+    }
+
+    List<String> getChildWatchList() {
+        synchronized (childWatches) {
+            return new ArrayList<>(childWatches.keySet());
+        }
+    }
+
+    List<String> getExistWatchList() {
+        synchronized (existWatches) {
+            return new ArrayList<>(existWatches.keySet());
+        }
+    }
+
+    List<String> getPersistentWatchList() {
+        synchronized (persistentWatches) {
+            return new ArrayList<>(persistentWatches.keySet());
+        }
+    }
+
+    List<String> getPersistentRecursiveWatchList() {
+        synchronized (persistentRecursiveWatches) {
+            return new ArrayList<>(persistentRecursiveWatches.keySet());
+        }
+    }
+
+    Map<String, Set<Watcher>> getDataWatches() {
+        return dataWatches;
+    }
+
+    Map<String, Set<Watcher>> getExistWatches() {
+        return existWatches;
+    }
+
+    Map<String, Set<Watcher>> getChildWatches() {
+        return childWatches;
+    }
+
+    Map<String, Set<Watcher>> getPersistentWatches() {
+        return persistentWatches;
+    }
+
+    Map<String, Set<Watcher>> getPersistentRecursiveWatches() {
+        return persistentRecursiveWatches;
+    }
+
+    private void addTo(Set<Watcher> from, Set<Watcher> to) {
+        if (from != null) {
+            to.addAll(from);
+        }
+    }
+
+    public Map<Watcher.Event.EventType, Set<Watcher>> removeWatcher(
+        String clientPath,
+        Watcher watcher,
+        Watcher.WatcherType watcherType,
+        boolean local,
+        int rc
+    ) throws KeeperException {
+        // Validate the provided znode path contains the given watcher of
+        // watcherType
+        containsWatcher(clientPath, watcher, watcherType);
+
+        Map<Watcher.Event.EventType, Set<Watcher>> removedWatchers = new HashMap<>();
+        HashSet<Watcher> childWatchersToRem = new HashSet<>();
+        removedWatchers.put(Watcher.Event.EventType.ChildWatchRemoved, childWatchersToRem);
+        HashSet<Watcher> dataWatchersToRem = new HashSet<>();
+        removedWatchers.put(Watcher.Event.EventType.DataWatchRemoved, dataWatchersToRem);
+        HashSet<Watcher> persistentWatchersToRem = new HashSet<>();
+        removedWatchers.put(Watcher.Event.EventType.PersistentWatchRemoved, persistentWatchersToRem);
+        boolean removedWatcher = false;
+        switch (watcherType) {
+        case Children: {
+            synchronized (childWatches) {
+                removedWatcher = removeWatches(childWatches, watcher, clientPath, local, rc, childWatchersToRem);
+            }
+            break;
+        }
+        case Data: {
+            synchronized (dataWatches) {
+                removedWatcher = removeWatches(dataWatches, watcher, clientPath, local, rc, dataWatchersToRem);
+            }
+
+            synchronized (existWatches) {
+                boolean removedDataWatcher = removeWatches(existWatches, watcher, clientPath, local, rc, dataWatchersToRem);
+                removedWatcher |= removedDataWatcher;
+            }
+            break;
+        }
+        case Persistent: {
+            synchronized (persistentWatches) {
+                removedWatcher = removeWatches(persistentWatches, watcher, clientPath, local, rc, persistentWatchersToRem);
+            }
+            break;
+        }
+        case PersistentRecursive: {
+            synchronized (persistentRecursiveWatches) {
+                removedWatcher = removeWatches(persistentRecursiveWatches, watcher, clientPath, local, rc, persistentWatchersToRem);
+            }
+            break;
+        }
+        case Any: {
+            synchronized (childWatches) {
+                removedWatcher = removeWatches(childWatches, watcher, clientPath, local, rc, childWatchersToRem);
+            }
+
+            synchronized (dataWatches) {
+                boolean removedDataWatcher = removeWatches(dataWatches, watcher, clientPath, local, rc, dataWatchersToRem);
+                removedWatcher |= removedDataWatcher;
+            }
+
+            synchronized (existWatches) {
+                boolean removedDataWatcher = removeWatches(existWatches, watcher, clientPath, local, rc, dataWatchersToRem);
+                removedWatcher |= removedDataWatcher;
+            }
+
+            synchronized (persistentWatches) {
+                boolean removedPersistentWatcher = removeWatches(persistentWatches,
+                        watcher, clientPath, local, rc, persistentWatchersToRem);
+                removedWatcher |= removedPersistentWatcher;
+            }
+
+            synchronized (persistentRecursiveWatches) {
+                boolean removedPersistentRecursiveWatcher = removeWatches(persistentRecursiveWatches,
+                        watcher, clientPath, local, rc, persistentWatchersToRem);
+                removedWatcher |= removedPersistentRecursiveWatcher;
+            }
+        }
+        }
+        // Watcher function doesn't exists for the specified params
+        if (!removedWatcher) {
+            throw new KeeperException.NoWatcherException(clientPath);
+        }
+        return removedWatchers;
+    }
+
+    private boolean contains(String path, Watcher watcherObj, Map<String, Set<Watcher>> pathVsWatchers) {
+        boolean watcherExists = true;
+        if (pathVsWatchers == null || pathVsWatchers.size() == 0) {
+            watcherExists = false;
+        } else {
+            Set<Watcher> watchers = pathVsWatchers.get(path);
+            if (watchers == null) {
+                watcherExists = false;
+            } else if (watcherObj == null) {
+                watcherExists = watchers.size() > 0;
+            } else {
+                watcherExists = watchers.contains(watcherObj);
+            }
+        }
+        return watcherExists;
+    }
+
+    /**
+     * Validate the provided znode path contains the given watcher and
+     * watcherType
+     *
+     * @param path
+     *            - client path
+     * @param watcher
+     *            - watcher object reference
+     * @param watcherType
+     *            - type of the watcher
+     * @throws KeeperException.NoWatcherException
+     */
+    void containsWatcher(String path, Watcher watcher, Watcher.WatcherType watcherType) throws
+            KeeperException.NoWatcherException {
+        boolean containsWatcher = false;
+        switch (watcherType) {
+        case Children: {
+            synchronized (childWatches) {
+                containsWatcher = contains(path, watcher, childWatches);
+            }
+            break;
+        }
+        case Data: {
+            synchronized (dataWatches) {
+                containsWatcher = contains(path, watcher, dataWatches);
+            }
+
+            synchronized (existWatches) {
+                boolean contains_temp = contains(path, watcher, existWatches);
+                containsWatcher |= contains_temp;
+            }
+            break;
+        }
+        case Persistent: {
+            synchronized (persistentWatches) {
+                containsWatcher |= contains(path, watcher, persistentWatches);
+            }
+            break;
+        }
+        case PersistentRecursive: {
+            synchronized (persistentRecursiveWatches) {
+                containsWatcher |= contains(path, watcher, persistentRecursiveWatches);
+            }
+            break;
+        }
+        case Any: {
+            synchronized (childWatches) {
+                containsWatcher = contains(path, watcher, childWatches);
+            }
+
+            synchronized (dataWatches) {
+                boolean contains_temp = contains(path, watcher, dataWatches);
+                containsWatcher |= contains_temp;
+            }
+
+            synchronized (existWatches) {
+                boolean contains_temp = contains(path, watcher, existWatches);
+                containsWatcher |= contains_temp;
+            }
+
+            synchronized (persistentWatches) {
+                boolean contains_temp = contains(path, watcher,
+                        persistentWatches);
+                containsWatcher |= contains_temp;
+            }
+
+            synchronized (persistentRecursiveWatches) {
+                boolean contains_temp = contains(path, watcher,
+                        persistentRecursiveWatches);
+                containsWatcher |= contains_temp;
+            }
+        }
+        }
+        // Watcher function doesn't exists for the specified params
+        if (!containsWatcher) {
+            throw new KeeperException.NoWatcherException(path);
+        }
+    }
+
+    protected boolean removeWatches(
+        Map<String, Set<Watcher>> pathVsWatcher,
+        Watcher watcher,
+        String path,
+        boolean local,
+        int rc,
+        Set<Watcher> removedWatchers) throws KeeperException {
+        if (!local && rc != KeeperException.Code.OK.intValue()) {
+            throw KeeperException.create(KeeperException.Code.get(rc), path);
+        }
+        boolean success = false;
+        // When local flag is true, remove watchers for the given path
+        // irrespective of rc. Otherwise shouldn't remove watchers locally
+        // when sees failure from server.
+        if (rc == KeeperException.Code.OK.intValue() || (local && rc != KeeperException.Code.OK.intValue())) {
+            // Remove all the watchers for the given path
+            if (watcher == null) {
+                Set<Watcher> pathWatchers = pathVsWatcher.remove(path);
+                if (pathWatchers != null) {
+                    // found path watchers
+                    removedWatchers.addAll(pathWatchers);
+                    success = true;
+                }
+            } else {
+                Set<Watcher> watchers = pathVsWatcher.get(path);
+                if (watchers != null) {
+                    if (watchers.remove(watcher)) {
+                        // found path watcher
+                        removedWatchers.add(watcher);
+                        // cleanup <path vs watchlist>
+                        if (watchers.size() <= 0) {
+                            pathVsWatcher.remove(path);
+                        }
+                        success = true;
+                    }
+                }
+            }
+        }
+        return success;
+    }
+
+    /* (non-Javadoc)
+     * @see org.apache.zookeeper.ClientWatchManager#materialize(Event.KeeperState,
+     *                                                        Event.EventType, java.lang.String)
+     */
+    @Override
+    public Set<Watcher> materialize(
+        Watcher.Event.KeeperState state,
+        Watcher.Event.EventType type,
+        String clientPath
+    ) {
+        final Set<Watcher> result = new HashSet<>();
+
+        switch (type) {
+        case None:
+            if (defaultWatcher != null) {
+                result.add(defaultWatcher);
+            }
+
+            boolean clear = disableAutoWatchReset && state != Watcher.Event.KeeperState.SyncConnected;
+            synchronized (dataWatches) {
+                for (Set<Watcher> ws : dataWatches.values()) {
+                    result.addAll(ws);
+                }
+                if (clear) {
+                    dataWatches.clear();
+                }
+            }
+
+            synchronized (existWatches) {
+                for (Set<Watcher> ws : existWatches.values()) {
+                    result.addAll(ws);
+                }
+                if (clear) {
+                    existWatches.clear();
+                }
+            }
+
+            synchronized (childWatches) {
+                for (Set<Watcher> ws : childWatches.values()) {
+                    result.addAll(ws);
+                }
+                if (clear) {
+                    childWatches.clear();
+                }
+            }
+
+            synchronized (persistentWatches) {
+                for (Set<Watcher> ws: persistentWatches.values()) {
+                    result.addAll(ws);
+                }
+            }
+
+            synchronized (persistentRecursiveWatches) {
+                for (Set<Watcher> ws: persistentRecursiveWatches.values()) {
+                    result.addAll(ws);
+                }
+            }
+
+            return result;
+        case NodeDataChanged:
+        case NodeCreated:
+            synchronized (dataWatches) {
+                addTo(dataWatches.remove(clientPath), result);
+            }
+            synchronized (existWatches) {
+                addTo(existWatches.remove(clientPath), result);
+            }
+            addPersistentWatches(clientPath, type, result);
+            break;
+        case NodeChildrenChanged:
+            synchronized (childWatches) {
+                addTo(childWatches.remove(clientPath), result);
+            }
+            addPersistentWatches(clientPath, type, result);
+            break;
+        case NodeDeleted:
+            synchronized (dataWatches) {
+                addTo(dataWatches.remove(clientPath), result);
+            }
+            // TODO This shouldn't be needed, but just in case
+            synchronized (existWatches) {
+                Set<Watcher> list = existWatches.remove(clientPath);
+                if (list != null) {
+                    addTo(list, result);
+                    LOG.warn("We are triggering an exists watch for delete! Shouldn't happen!");
+                }
+            }
+            synchronized (childWatches) {
+                addTo(childWatches.remove(clientPath), result);
+            }
+            addPersistentWatches(clientPath, type, result);
+            break;
+        default:
+            String errorMsg = String.format(
+                "Unhandled watch event type %s with state %s on path %s",
+                type,
+                state,
+                clientPath);
+            LOG.error(errorMsg);
+            throw new RuntimeException(errorMsg);
+        }
+
+        return result;
+    }
+
+    private void addPersistentWatches(String clientPath, Watcher.Event.EventType type, Set<Watcher> result) {
+        synchronized (persistentWatches) {
+            addTo(persistentWatches.get(clientPath), result);
+        }
+        // The semantics of persistent recursive watch promise no child events on descendant nodes. When there
+        // are standard child watches on descendants of node being watched in persistent recursive mode, server
+        // will deliver child events to client inevitably. So we have to filter out child events for persistent
+        // recursive watches on client side.
+        if (type == Watcher.Event.EventType.NodeChildrenChanged) {
+            return;
+        }
+        synchronized (persistentRecursiveWatches) {
+            for (String path : PathParentIterator.forAll(clientPath).asIterable()) {
+                addTo(persistentRecursiveWatches.get(path), result);
+            }
+        }
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooDefs.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooDefs.java
index a12e5803c27..77c3de37cb5 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooDefs.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooDefs.java
@@ -93,6 +93,8 @@ public interface OpCode {
 
         int addWatch = 106;
 
+        int whoAmI = 107;
+
         int createSession = -10;
 
         int closeSession = -11;
@@ -136,19 +138,19 @@ public interface Ids {
          * This is a completely open ACL .
          */
         @SuppressFBWarnings(value = "MS_MUTABLE_COLLECTION", justification = "Cannot break API")
-        ArrayList<ACL> OPEN_ACL_UNSAFE = new ArrayList<ACL>(Collections.singletonList(new ACL(Perms.ALL, ANYONE_ID_UNSAFE)));
+        ArrayList<ACL> OPEN_ACL_UNSAFE = new ArrayList<>(Collections.singletonList(new ACL(Perms.ALL, ANYONE_ID_UNSAFE)));
 
         /**
          * This ACL gives the creators authentication id's all permissions.
          */
         @SuppressFBWarnings(value = "MS_MUTABLE_COLLECTION", justification = "Cannot break API")
-        ArrayList<ACL> CREATOR_ALL_ACL = new ArrayList<ACL>(Collections.singletonList(new ACL(Perms.ALL, AUTH_IDS)));
+        ArrayList<ACL> CREATOR_ALL_ACL = new ArrayList<>(Collections.singletonList(new ACL(Perms.ALL, AUTH_IDS)));
 
         /**
          * This ACL gives the world the ability to read.
          */
         @SuppressFBWarnings(value = "MS_MUTABLE_COLLECTION", justification = "Cannot break API")
-        ArrayList<ACL> READ_ACL_UNSAFE = new ArrayList<ACL>(Collections.singletonList(new ACL(Perms.READ, ANYONE_ID_UNSAFE)));
+        ArrayList<ACL> READ_ACL_UNSAFE = new ArrayList<>(Collections.singletonList(new ACL(Perms.READ, ANYONE_ID_UNSAFE)));
 
     }
 
@@ -159,6 +161,4 @@ public interface AddWatchModes {
         int persistentRecursive = 1;  // matches AddWatchMode.PERSISTENT_RECURSIVE
     }
 
-    public static final String[] opNames = {"notification", "create", "delete", "exists", "getData", "setData", "getACL", "setACL", "getChildren", "getChildren2", "getMaxChildren", "setMaxChildren", "ping", "reconfig", "getConfig"};
-
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
index f6f165deaf4..32893d46af4 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeper.java
@@ -22,9 +22,10 @@
 import java.lang.reflect.Constructor;
 import java.net.InetSocketAddress;
 import java.net.SocketAddress;
+import java.time.Duration;
 import java.util.ArrayList;
 import java.util.Collection;
-import java.util.HashMap;
+import java.util.Collections;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
@@ -40,18 +41,20 @@
 import org.apache.zookeeper.AsyncCallback.StatCallback;
 import org.apache.zookeeper.AsyncCallback.StringCallback;
 import org.apache.zookeeper.AsyncCallback.VoidCallback;
-import org.apache.zookeeper.KeeperException.Code;
-import org.apache.zookeeper.KeeperException.NoWatcherException;
 import org.apache.zookeeper.OpResult.ErrorResult;
-import org.apache.zookeeper.Watcher.Event.EventType;
 import org.apache.zookeeper.Watcher.WatcherType;
+import org.apache.zookeeper.client.Chroot;
 import org.apache.zookeeper.client.ConnectStringParser;
 import org.apache.zookeeper.client.HostProvider;
+import org.apache.zookeeper.client.HostProviderFactory;
 import org.apache.zookeeper.client.StaticHostProvider;
 import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.client.ZooKeeperBuilder;
+import org.apache.zookeeper.client.ZooKeeperOptions;
 import org.apache.zookeeper.client.ZooKeeperSaslClient;
 import org.apache.zookeeper.common.PathUtils;
 import org.apache.zookeeper.data.ACL;
+import org.apache.zookeeper.data.ClientInfo;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.proto.AddWatchRequest;
 import org.apache.zookeeper.proto.CheckWatchesRequest;
@@ -83,9 +86,8 @@
 import org.apache.zookeeper.proto.SetDataResponse;
 import org.apache.zookeeper.proto.SyncRequest;
 import org.apache.zookeeper.proto.SyncResponse;
-import org.apache.zookeeper.server.DataTree;
+import org.apache.zookeeper.proto.WhoAmIResponse;
 import org.apache.zookeeper.server.EphemeralType;
-import org.apache.zookeeper.server.watch.PathParentIterator;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -152,15 +154,14 @@ public class ZooKeeper implements AutoCloseable {
      *             instead.
      */
     @Deprecated
-    public static final String ZOOKEEPER_CLIENT_CNXN_SOCKET = "zookeeper.clientCnxnSocket";
-    // Setting this to "true" will enable encrypted client-server communication.
+    public static final String ZOOKEEPER_CLIENT_CNXN_SOCKET = ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET;
 
     /**
      * @deprecated Use {@link ZKClientConfig#SECURE_CLIENT}
      *             instead.
      */
     @Deprecated
-    public static final String SECURE_CLIENT = "zookeeper.client.secure";
+    public static final String SECURE_CLIENT = ZKClientConfig.SECURE_CLIENT;
 
     protected final ClientCnxn cnxn;
     private static final Logger LOG;
@@ -173,6 +174,8 @@ public class ZooKeeper implements AutoCloseable {
 
     protected final HostProvider hostProvider;
 
+    private final Chroot chroot;
+
     /**
      * This function allows a client to update the connection string by providing
      * a new comma separated list of host:port pairs, each corresponding to a
@@ -228,11 +231,9 @@ public void updateServerList(String connectString) throws IOException {
     }
 
     public ZooKeeperSaslClient getSaslClient() {
-        return cnxn.zooKeeperSaslClient;
+        return cnxn.getZooKeeperSaslClient();
     }
 
-    protected final ZKWatchManager watchManager;
-
     private final ZKClientConfig clientConfig;
 
     public ZKClientConfig getClientConfig() {
@@ -240,406 +241,40 @@ public ZKClientConfig getClientConfig() {
     }
 
     protected List<String> getDataWatches() {
-        synchronized (watchManager.dataWatches) {
-            List<String> rc = new ArrayList<String>(watchManager.dataWatches.keySet());
-            return rc;
-        }
+        return getWatchManager().getDataWatchList();
     }
+
     protected List<String> getExistWatches() {
-        synchronized (watchManager.existWatches) {
-            List<String> rc = new ArrayList<String>(watchManager.existWatches.keySet());
-            return rc;
-        }
+        return getWatchManager().getExistWatchList();
     }
+
     protected List<String> getChildWatches() {
-        synchronized (watchManager.childWatches) {
-            List<String> rc = new ArrayList<String>(watchManager.childWatches.keySet());
-            return rc;
-        }
+        return getWatchManager().getChildWatchList();
     }
+
     protected List<String> getPersistentWatches() {
-        synchronized (watchManager.persistentWatches) {
-            List<String> rc = new ArrayList<String>(watchManager.persistentWatches.keySet());
-            return rc;
-        }
+        return getWatchManager().getPersistentWatchList();
     }
+
     protected List<String> getPersistentRecursiveWatches() {
-        synchronized (watchManager.persistentRecursiveWatches) {
-            List<String> rc = new ArrayList<String>(watchManager.persistentRecursiveWatches.keySet());
-            return rc;
-        }
+        return getWatchManager().getPersistentRecursiveWatchList();
     }
 
-    /**
-     * Manage watchers and handle events generated by the ClientCnxn object.
-     *
-     * We are implementing this as a nested class of ZooKeeper so that
-     * the public methods will not be exposed as part of the ZooKeeper client
-     * API.
-     */
-    static class ZKWatchManager implements ClientWatchManager {
-
-        private final Map<String, Set<Watcher>> dataWatches = new HashMap<String, Set<Watcher>>();
-        private final Map<String, Set<Watcher>> existWatches = new HashMap<String, Set<Watcher>>();
-        private final Map<String, Set<Watcher>> childWatches = new HashMap<String, Set<Watcher>>();
-        private final Map<String, Set<Watcher>> persistentWatches = new HashMap<String, Set<Watcher>>();
-        private final Map<String, Set<Watcher>> persistentRecursiveWatches = new HashMap<String, Set<Watcher>>();
-        private boolean disableAutoWatchReset;
-
-        ZKWatchManager(boolean disableAutoWatchReset) {
-            this.disableAutoWatchReset = disableAutoWatchReset;
-        }
-
-        protected volatile Watcher defaultWatcher;
-
-        private void addTo(Set<Watcher> from, Set<Watcher> to) {
-            if (from != null) {
-                to.addAll(from);
-            }
-        }
-
-        public Map<EventType, Set<Watcher>> removeWatcher(
-            String clientPath,
-            Watcher watcher,
-            WatcherType watcherType,
-            boolean local,
-            int rc) throws KeeperException {
-            // Validate the provided znode path contains the given watcher of
-            // watcherType
-            containsWatcher(clientPath, watcher, watcherType);
-
-            Map<EventType, Set<Watcher>> removedWatchers = new HashMap<>();
-            HashSet<Watcher> childWatchersToRem = new HashSet<>();
-            removedWatchers.put(EventType.ChildWatchRemoved, childWatchersToRem);
-            HashSet<Watcher> dataWatchersToRem = new HashSet<>();
-            removedWatchers.put(EventType.DataWatchRemoved, dataWatchersToRem);
-            HashSet<Watcher> persistentWatchersToRem = new HashSet<>();
-            removedWatchers.put(EventType.PersistentWatchRemoved, persistentWatchersToRem);
-            boolean removedWatcher = false;
-            switch (watcherType) {
-            case Children: {
-                synchronized (childWatches) {
-                    removedWatcher = removeWatches(childWatches, watcher, clientPath, local, rc, childWatchersToRem);
-                }
-                break;
-            }
-            case Data: {
-                synchronized (dataWatches) {
-                    removedWatcher = removeWatches(dataWatches, watcher, clientPath, local, rc, dataWatchersToRem);
-                }
-
-                synchronized (existWatches) {
-                    boolean removedDataWatcher = removeWatches(existWatches, watcher, clientPath, local, rc, dataWatchersToRem);
-                    removedWatcher |= removedDataWatcher;
-                }
-                break;
-            }
-            case Any: {
-                synchronized (childWatches) {
-                    removedWatcher = removeWatches(childWatches, watcher, clientPath, local, rc, childWatchersToRem);
-                }
-
-                synchronized (dataWatches) {
-                    boolean removedDataWatcher = removeWatches(dataWatches, watcher, clientPath, local, rc, dataWatchersToRem);
-                    removedWatcher |= removedDataWatcher;
-                }
-
-                synchronized (existWatches) {
-                    boolean removedDataWatcher = removeWatches(existWatches, watcher, clientPath, local, rc, dataWatchersToRem);
-                    removedWatcher |= removedDataWatcher;
-                }
-
-                synchronized (persistentWatches) {
-                    boolean removedPersistentWatcher = removeWatches(persistentWatches,
-                            watcher, clientPath, local, rc, persistentWatchersToRem);
-                    removedWatcher |= removedPersistentWatcher;
-                }
-
-                synchronized (persistentRecursiveWatches) {
-                    boolean removedPersistentRecursiveWatcher = removeWatches(persistentRecursiveWatches,
-                            watcher, clientPath, local, rc, persistentWatchersToRem);
-                    removedWatcher |= removedPersistentRecursiveWatcher;
-                }
-            }
-            }
-            // Watcher function doesn't exists for the specified params
-            if (!removedWatcher) {
-                throw new KeeperException.NoWatcherException(clientPath);
-            }
-            return removedWatchers;
-        }
-
-        private boolean contains(String path, Watcher watcherObj, Map<String, Set<Watcher>> pathVsWatchers) {
-            boolean watcherExists = true;
-            if (pathVsWatchers == null || pathVsWatchers.size() == 0) {
-                watcherExists = false;
-            } else {
-                Set<Watcher> watchers = pathVsWatchers.get(path);
-                if (watchers == null) {
-                    watcherExists = false;
-                } else if (watcherObj == null) {
-                    watcherExists = watchers.size() > 0;
-                } else {
-                    watcherExists = watchers.contains(watcherObj);
-                }
-            }
-            return watcherExists;
-        }
-
-        /**
-         * Validate the provided znode path contains the given watcher and
-         * watcherType
-         *
-         * @param path
-         *            - client path
-         * @param watcher
-         *            - watcher object reference
-         * @param watcherType
-         *            - type of the watcher
-         * @throws NoWatcherException
-         */
-        void containsWatcher(String path, Watcher watcher, WatcherType watcherType) throws NoWatcherException {
-            boolean containsWatcher = false;
-            switch (watcherType) {
-            case Children: {
-                synchronized (childWatches) {
-                    containsWatcher = contains(path, watcher, childWatches);
-                }
-
-                synchronized (persistentWatches) {
-                    boolean contains_temp = contains(path, watcher,
-                            persistentWatches);
-                    containsWatcher |= contains_temp;
-                }
-
-                synchronized (persistentRecursiveWatches) {
-                    boolean contains_temp = contains(path, watcher,
-                            persistentRecursiveWatches);
-                    containsWatcher |= contains_temp;
-                }
-                break;
-            }
-            case Data: {
-                synchronized (dataWatches) {
-                    containsWatcher = contains(path, watcher, dataWatches);
-                }
-
-                synchronized (existWatches) {
-                    boolean contains_temp = contains(path, watcher, existWatches);
-                    containsWatcher |= contains_temp;
-                }
-
-                synchronized (persistentWatches) {
-                    boolean contains_temp = contains(path, watcher,
-                            persistentWatches);
-                    containsWatcher |= contains_temp;
-                }
-
-                synchronized (persistentRecursiveWatches) {
-                    boolean contains_temp = contains(path, watcher,
-                            persistentRecursiveWatches);
-                    containsWatcher |= contains_temp;
-                }
-                break;
-            }
-            case Any: {
-                synchronized (childWatches) {
-                    containsWatcher = contains(path, watcher, childWatches);
-                }
-
-                synchronized (dataWatches) {
-                    boolean contains_temp = contains(path, watcher, dataWatches);
-                    containsWatcher |= contains_temp;
-                }
-
-                synchronized (existWatches) {
-                    boolean contains_temp = contains(path, watcher, existWatches);
-                    containsWatcher |= contains_temp;
-                }
-
-                synchronized (persistentWatches) {
-                    boolean contains_temp = contains(path, watcher,
-                            persistentWatches);
-                    containsWatcher |= contains_temp;
-                }
-
-                synchronized (persistentRecursiveWatches) {
-                    boolean contains_temp = contains(path, watcher,
-                            persistentRecursiveWatches);
-                    containsWatcher |= contains_temp;
-                }
-            }
-            }
-            // Watcher function doesn't exists for the specified params
-            if (!containsWatcher) {
-                throw new KeeperException.NoWatcherException(path);
-            }
-        }
-
-        protected boolean removeWatches(
-            Map<String, Set<Watcher>> pathVsWatcher,
-            Watcher watcher,
-            String path,
-            boolean local,
-            int rc,
-            Set<Watcher> removedWatchers) throws KeeperException {
-            if (!local && rc != Code.OK.intValue()) {
-                throw KeeperException.create(KeeperException.Code.get(rc), path);
-            }
-            boolean success = false;
-            // When local flag is true, remove watchers for the given path
-            // irrespective of rc. Otherwise shouldn't remove watchers locally
-            // when sees failure from server.
-            if (rc == Code.OK.intValue() || (local && rc != Code.OK.intValue())) {
-                // Remove all the watchers for the given path
-                if (watcher == null) {
-                    Set<Watcher> pathWatchers = pathVsWatcher.remove(path);
-                    if (pathWatchers != null) {
-                        // found path watchers
-                        removedWatchers.addAll(pathWatchers);
-                        success = true;
-                    }
-                } else {
-                    Set<Watcher> watchers = pathVsWatcher.get(path);
-                    if (watchers != null) {
-                        if (watchers.remove(watcher)) {
-                            // found path watcher
-                            removedWatchers.add(watcher);
-                            // cleanup <path vs watchlist>
-                            if (watchers.size() <= 0) {
-                                pathVsWatcher.remove(path);
-                            }
-                            success = true;
-                        }
-                    }
-                }
-            }
-            return success;
-        }
-
-        /* (non-Javadoc)
-         * @see org.apache.zookeeper.ClientWatchManager#materialize(Event.KeeperState,
-         *                                                        Event.EventType, java.lang.String)
-         */
-        @Override
-        public Set<Watcher> materialize(
-            Watcher.Event.KeeperState state,
-            Watcher.Event.EventType type,
-            String clientPath) {
-            Set<Watcher> result = new HashSet<Watcher>();
-
-            switch (type) {
-            case None:
-                result.add(defaultWatcher);
-                boolean clear = disableAutoWatchReset && state != Watcher.Event.KeeperState.SyncConnected;
-                synchronized (dataWatches) {
-                    for (Set<Watcher> ws : dataWatches.values()) {
-                        result.addAll(ws);
-                    }
-                    if (clear) {
-                        dataWatches.clear();
-                    }
-                }
-
-                synchronized (existWatches) {
-                    for (Set<Watcher> ws : existWatches.values()) {
-                        result.addAll(ws);
-                    }
-                    if (clear) {
-                        existWatches.clear();
-                    }
-                }
-
-                synchronized (childWatches) {
-                    for (Set<Watcher> ws : childWatches.values()) {
-                        result.addAll(ws);
-                    }
-                    if (clear) {
-                        childWatches.clear();
-                    }
-                }
-
-                synchronized (persistentWatches) {
-                    for (Set<Watcher> ws: persistentWatches.values()) {
-                        result.addAll(ws);
-                    }
-                }
-
-                synchronized (persistentRecursiveWatches) {
-                    for (Set<Watcher> ws: persistentRecursiveWatches.values()) {
-                        result.addAll(ws);
-                    }
-                }
-
-                return result;
-            case NodeDataChanged:
-            case NodeCreated:
-                synchronized (dataWatches) {
-                    addTo(dataWatches.remove(clientPath), result);
-                }
-                synchronized (existWatches) {
-                    addTo(existWatches.remove(clientPath), result);
-                }
-                addPersistentWatches(clientPath, result);
-                break;
-            case NodeChildrenChanged:
-                synchronized (childWatches) {
-                    addTo(childWatches.remove(clientPath), result);
-                }
-                addPersistentWatches(clientPath, result);
-                break;
-            case NodeDeleted:
-                synchronized (dataWatches) {
-                    addTo(dataWatches.remove(clientPath), result);
-                }
-                // TODO This shouldn't be needed, but just in case
-                synchronized (existWatches) {
-                    Set<Watcher> list = existWatches.remove(clientPath);
-                    if (list != null) {
-                        addTo(list, result);
-                        LOG.warn("We are triggering an exists watch for delete! Shouldn't happen!");
-                    }
-                }
-                synchronized (childWatches) {
-                    addTo(childWatches.remove(clientPath), result);
-                }
-                addPersistentWatches(clientPath, result);
-                break;
-            default:
-                String errorMsg = String.format(
-                    "Unhandled watch event type %s with state %s on path %s",
-                    type,
-                    state,
-                    clientPath);
-                LOG.error(errorMsg);
-                throw new RuntimeException(errorMsg);
-            }
-
-            return result;
-        }
-
-        private void addPersistentWatches(String clientPath, Set<Watcher> result) {
-            synchronized (persistentWatches) {
-                addTo(persistentWatches.get(clientPath), result);
-            }
-            synchronized (persistentRecursiveWatches) {
-                for (String path : PathParentIterator.forAll(clientPath).asIterable()) {
-                    addTo(persistentRecursiveWatches.get(path), result);
-                }
-            }
-        }
+    ZKWatchManager getWatchManager() {
+        return cnxn.getWatcherManager();
     }
 
     /**
      * Register a watcher for a particular path.
      */
-    public abstract class WatchRegistration {
+    public abstract static class WatchRegistration {
 
         private Watcher watcher;
-        private String clientPath;
-        public WatchRegistration(Watcher watcher, String clientPath) {
+        private String serverPath;
+
+        public WatchRegistration(Watcher watcher, String serverPath) {
             this.watcher = watcher;
-            this.clientPath = clientPath;
+            this.serverPath = serverPath;
         }
 
         protected abstract Map<String, Set<Watcher>> getWatches(int rc);
@@ -653,10 +288,10 @@ public void register(int rc) {
             if (shouldAddWatch(rc)) {
                 Map<String, Set<Watcher>> watches = getWatches(rc);
                 synchronized (watches) {
-                    Set<Watcher> watchers = watches.get(clientPath);
+                    Set<Watcher> watchers = watches.get(serverPath);
                     if (watchers == null) {
-                        watchers = new HashSet<Watcher>();
-                        watches.put(clientPath, watchers);
+                        watchers = new HashSet<>();
+                        watches.put(serverPath, watchers);
                     }
                     watchers.add(watcher);
                 }
@@ -669,7 +304,7 @@ public void register(int rc) {
          * @return true if the watch should be added, otw false
          */
         protected boolean shouldAddWatch(int rc) {
-            return rc == 0;
+            return rc == KeeperException.Code.OK.intValue();
         }
 
     }
@@ -680,17 +315,30 @@ protected boolean shouldAddWatch(int rc) {
     class ExistsWatchRegistration extends WatchRegistration {
 
         public ExistsWatchRegistration(Watcher watcher, String clientPath) {
-            super(watcher, clientPath);
+            super(chroot.interceptWatcher(watcher), prependChroot(clientPath));
         }
 
         @Override
         protected Map<String, Set<Watcher>> getWatches(int rc) {
-            return rc == 0 ? watchManager.dataWatches : watchManager.existWatches;
+            return rc == KeeperException.Code.OK.intValue()
+                    ? getWatchManager().getDataWatches() : getWatchManager().getExistWatches();
         }
 
         @Override
         protected boolean shouldAddWatch(int rc) {
-            return rc == 0 || rc == KeeperException.Code.NONODE.intValue();
+            return rc == KeeperException.Code.OK.intValue() || rc == KeeperException.Code.NONODE.intValue();
+        }
+
+    }
+
+    class ServerDataWatchRegistration extends WatchRegistration {
+        public ServerDataWatchRegistration(Watcher watcher, String serverPath) {
+            super(watcher, serverPath);
+        }
+
+        @Override
+        protected Map<String, Set<Watcher>> getWatches(int rc) {
+            return getWatchManager().getDataWatches();
         }
 
     }
@@ -698,12 +346,12 @@ protected boolean shouldAddWatch(int rc) {
     class DataWatchRegistration extends WatchRegistration {
 
         public DataWatchRegistration(Watcher watcher, String clientPath) {
-            super(watcher, clientPath);
+            super(chroot.interceptWatcher(watcher), prependChroot(clientPath));
         }
 
         @Override
         protected Map<String, Set<Watcher>> getWatches(int rc) {
-            return watchManager.dataWatches;
+            return getWatchManager().getDataWatches();
         }
 
     }
@@ -711,12 +359,12 @@ protected Map<String, Set<Watcher>> getWatches(int rc) {
     class ChildWatchRegistration extends WatchRegistration {
 
         public ChildWatchRegistration(Watcher watcher, String clientPath) {
-            super(watcher, clientPath);
+            super(chroot.interceptWatcher(watcher), prependChroot(clientPath));
         }
 
         @Override
         protected Map<String, Set<Watcher>> getWatches(int rc) {
-            return watchManager.childWatches;
+            return getWatchManager().getChildWatches();
         }
 
     }
@@ -725,7 +373,7 @@ class AddWatchRegistration extends WatchRegistration {
         private final AddWatchMode mode;
 
         public AddWatchRegistration(Watcher watcher, String clientPath, AddWatchMode mode) {
-            super(watcher, clientPath);
+            super(chroot.interceptWatcher(watcher), prependChroot(clientPath));
             this.mode = mode;
         }
 
@@ -733,16 +381,16 @@ public AddWatchRegistration(Watcher watcher, String clientPath, AddWatchMode mod
         protected Map<String, Set<Watcher>> getWatches(int rc) {
             switch (mode) {
                 case PERSISTENT:
-                    return watchManager.persistentWatches;
+                    return getWatchManager().getPersistentWatches();
                 case PERSISTENT_RECURSIVE:
-                    return watchManager.persistentRecursiveWatches;
+                    return getWatchManager().getPersistentRecursiveWatches();
             }
             throw new IllegalArgumentException("Mode not supported: " + mode);
         }
 
         @Override
         protected boolean shouldAddWatch(int rc) {
-            return rc == 0 || rc == KeeperException.Code.NONODE.intValue();
+            return rc == KeeperException.Code.OK.intValue() || rc == KeeperException.Code.NONODE.intValue();
         }
     }
 
@@ -770,6 +418,25 @@ public boolean isConnected() {
         }
     }
 
+    /**
+     * Creates a builder with given connect string and session timeout.
+     *
+     * @param connectString
+     *            comma separated host:port pairs, each corresponding to a zk
+     *            server. e.g. "127.0.0.1:3000,127.0.0.1:3001,127.0.0.1:3002"
+     *            If the optional chroot suffix is used the example would look
+     *            like: "127.0.0.1:3000,127.0.0.1:3001,127.0.0.1:3002/app/a"
+     *            where the client would be rooted at "/app/a" and all paths
+     *            would be relative to this root - ie getting/setting/etc...
+     *            "/foo/bar" would result in operations being run on
+     *            "/app/a/foo/bar" (from the server perspective).
+     * @param sessionTimeout
+     *            session timeout
+     */
+    public static ZooKeeperBuilder builder(String connectString, Duration sessionTimeout) {
+        return new ZooKeeperBuilder(connectString, sessionTimeout);
+    }
+
     /**
      * To create a ZooKeeper client object, the application needs to pass a
      * connection string containing a comma separated list of host:port pairs,
@@ -812,9 +479,13 @@ public boolean isConnected() {
      *             in cases of network failure
      * @throws IllegalArgumentException
      *             if an invalid chroot path is specified
+     *
+     * @see #builder(String, Duration) for builder style construction
      */
     public ZooKeeper(String connectString, int sessionTimeout, Watcher watcher) throws IOException {
-        this(connectString, sessionTimeout, watcher, false);
+        this(builder(connectString, Duration.ofMillis(sessionTimeout))
+            .withDefaultWatcher(watcher)
+            .toOptions());
     }
 
     /**
@@ -861,13 +532,18 @@ public ZooKeeper(String connectString, int sessionTimeout, Watcher watcher) thro
      *             in cases of network failure
      * @throws IllegalArgumentException
      *             if an invalid chroot path is specified
+     *
+     * @see #builder(String, Duration) for builder style construction
      */
     public ZooKeeper(
         String connectString,
         int sessionTimeout,
         Watcher watcher,
         ZKClientConfig conf) throws IOException {
-        this(connectString, sessionTimeout, watcher, false, conf);
+        this(builder(connectString, Duration.ofMillis(sessionTimeout))
+            .withDefaultWatcher(watcher)
+            .withClientConfig(conf)
+            .toOptions());
     }
 
     /**
@@ -926,6 +602,8 @@ public ZooKeeper(
      *             in cases of network failure
      * @throws IllegalArgumentException
      *             if an invalid chroot path is specified
+     *
+     * @see #builder(String, Duration) for builder style construction
      */
     public ZooKeeper(
         String connectString,
@@ -933,7 +611,11 @@ public ZooKeeper(
         Watcher watcher,
         boolean canBeReadOnly,
         HostProvider aHostProvider) throws IOException {
-        this(connectString, sessionTimeout, watcher, canBeReadOnly, aHostProvider, null);
+        this(builder(connectString, Duration.ofMillis(sessionTimeout))
+            .withDefaultWatcher(watcher)
+            .withCanBeReadOnly(canBeReadOnly)
+            .withHostProvider(ignored -> aHostProvider)
+            .toOptions());
     }
 
     /**
@@ -985,7 +667,7 @@ public ZooKeeper(
      *            connects to one in read-only mode, i.e. read requests are
      *            allowed while write requests are not. It continues seeking for
      *            majority in the background.
-     * @param aHostProvider
+     * @param hostProvider
      *            use this as HostProvider to enable custom behaviour.
      * @param clientConfig
      *            (added in 3.5.2) passing this conf object gives each client the flexibility of
@@ -994,56 +676,45 @@ public ZooKeeper(
      *             in cases of network failure
      * @throws IllegalArgumentException
      *             if an invalid chroot path is specified
+     *
+     * @see #builder(String, Duration) for builder style construction
      */
     public ZooKeeper(
         String connectString,
         int sessionTimeout,
         Watcher watcher,
         boolean canBeReadOnly,
-        HostProvider aHostProvider,
-        ZKClientConfig clientConfig) throws IOException {
-        LOG.info(
-            "Initiating client connection, connectString={} sessionTimeout={} watcher={}",
-            connectString,
-            sessionTimeout,
-            watcher);
-
-        if (clientConfig == null) {
-            clientConfig = new ZKClientConfig();
-        }
-        this.clientConfig = clientConfig;
-        watchManager = defaultWatchManager();
-        watchManager.defaultWatcher = watcher;
-        ConnectStringParser connectStringParser = new ConnectStringParser(connectString);
-        hostProvider = aHostProvider;
-
-        cnxn = createConnection(
-            connectStringParser.getChrootPath(),
-            hostProvider,
-            sessionTimeout,
-            this,
-            watchManager,
-            getClientCnxnSocket(),
-            canBeReadOnly);
-        cnxn.start();
+        HostProvider hostProvider,
+        ZKClientConfig clientConfig
+    ) throws IOException {
+        this(builder(connectString, Duration.ofMillis(sessionTimeout))
+            .withDefaultWatcher(watcher)
+            .withCanBeReadOnly(canBeReadOnly)
+            .withHostProvider(ignored -> hostProvider)
+            .withClientConfig(clientConfig)
+            .toOptions());
     }
 
-    // @VisibleForTesting
-    protected ClientCnxn createConnection(
-        String chrootPath,
+    ClientCnxn createConnection(
         HostProvider hostProvider,
         int sessionTimeout,
-        ZooKeeper zooKeeper,
-        ClientWatchManager watcher,
+        long newSessionTimeout,
+        ZKClientConfig clientConfig,
+        Watcher defaultWatcher,
         ClientCnxnSocket clientCnxnSocket,
-        boolean canBeReadOnly) throws IOException {
+        long sessionId,
+        byte[] sessionPasswd,
+        boolean canBeReadOnly
+    ) throws IOException {
         return new ClientCnxn(
-            chrootPath,
             hostProvider,
             sessionTimeout,
-            this,
-            watchManager,
+            newSessionTimeout,
+            clientConfig,
+            defaultWatcher,
             clientCnxnSocket,
+            sessionId,
+            sessionPasswd,
             canBeReadOnly);
     }
 
@@ -1098,13 +769,18 @@ protected ClientCnxn createConnection(
      *             in cases of network failure
      * @throws IllegalArgumentException
      *             if an invalid chroot path is specified
+     *
+     * @see #builder(String, Duration) for builder style construction
      */
     public ZooKeeper(
         String connectString,
         int sessionTimeout,
         Watcher watcher,
         boolean canBeReadOnly) throws IOException {
-        this(connectString, sessionTimeout, watcher, canBeReadOnly, createDefaultHostProvider(connectString));
+        this(builder(connectString, Duration.ofMillis(sessionTimeout))
+            .withDefaultWatcher(watcher)
+            .withCanBeReadOnly(canBeReadOnly)
+            .toOptions());
     }
 
     /**
@@ -1160,6 +836,8 @@ public ZooKeeper(
      *             in cases of network failure
      * @throws IllegalArgumentException
      *             if an invalid chroot path is specified
+     *
+     * @see #builder(String, Duration) for builder style construction
      */
     public ZooKeeper(
         String connectString,
@@ -1167,13 +845,11 @@ public ZooKeeper(
         Watcher watcher,
         boolean canBeReadOnly,
         ZKClientConfig conf) throws IOException {
-        this(
-            connectString,
-            sessionTimeout,
-            watcher,
-            canBeReadOnly,
-            createDefaultHostProvider(connectString),
-            conf);
+        this(builder(connectString, Duration.ofMillis(sessionTimeout))
+            .withDefaultWatcher(watcher)
+            .withCanBeReadOnly(canBeReadOnly)
+            .withClientConfig(conf)
+            .toOptions());
     }
 
     /**
@@ -1227,6 +903,8 @@ public ZooKeeper(
      * @throws IOException in cases of network failure
      * @throws IllegalArgumentException if an invalid chroot path is specified
      * @throws IllegalArgumentException for an invalid list of ZooKeeper hosts
+     *
+     * @see #builder(String, Duration) for builder style construction
      */
     public ZooKeeper(
         String connectString,
@@ -1234,7 +912,10 @@ public ZooKeeper(
         Watcher watcher,
         long sessionId,
         byte[] sessionPasswd) throws IOException {
-        this(connectString, sessionTimeout, watcher, sessionId, sessionPasswd, false);
+        this(builder(connectString, Duration.ofMillis(sessionTimeout))
+            .withDefaultWatcher(watcher)
+            .withSession(sessionId, sessionPasswd)
+            .toOptions());
     }
 
     /**
@@ -1300,6 +981,8 @@ public ZooKeeper(
      *            use this as HostProvider to enable custom behaviour.
      * @throws IOException in cases of network failure
      * @throws IllegalArgumentException if an invalid chroot path is specified
+     *
+     * @see #builder(String, Duration) for builder style construction
      */
     public ZooKeeper(
         String connectString,
@@ -1309,15 +992,12 @@ public ZooKeeper(
         byte[] sessionPasswd,
         boolean canBeReadOnly,
         HostProvider aHostProvider) throws IOException {
-        this(
-            connectString,
-            sessionTimeout,
-            watcher,
-            sessionId,
-            sessionPasswd,
-            canBeReadOnly,
-            aHostProvider,
-            null);
+        this(builder(connectString, Duration.ofMillis(sessionTimeout))
+            .withDefaultWatcher(watcher)
+            .withSession(sessionId, sessionPasswd)
+            .withCanBeReadOnly(canBeReadOnly)
+            .withHostProvider(ignored -> aHostProvider)
+            .toOptions());
     }
 
     /**
@@ -1379,7 +1059,7 @@ public ZooKeeper(
      *            connects to one in read-only mode, i.e. read requests are
      *            allowed while write requests are not. It continues seeking for
      *            majority in the background.
-     * @param aHostProvider
+     * @param hostProvider
      *            use this as HostProvider to enable custom behaviour.
      * @param clientConfig
      *            (added in 3.5.2) passing this conf object gives each client the flexibility of
@@ -1388,6 +1068,8 @@ public ZooKeeper(
      * @throws IllegalArgumentException if an invalid chroot path is specified
      *
      * @since 3.5.5
+     *
+     * @see #builder(String, Duration) for builder style construction
      */
     public ZooKeeper(
         String connectString,
@@ -1396,38 +1078,86 @@ public ZooKeeper(
         long sessionId,
         byte[] sessionPasswd,
         boolean canBeReadOnly,
-        HostProvider aHostProvider,
+        HostProvider hostProvider,
         ZKClientConfig clientConfig) throws IOException {
-        LOG.info(
-            "Initiating client connection, connectString={} "
-                + "sessionTimeout={} watcher={} sessionId=0x{} sessionPasswd={}",
-            connectString,
-            sessionTimeout,
-            watcher,
-            Long.toHexString(sessionId),
-            (sessionPasswd == null ? "<null>" : "<hidden>"));
-
-        if (clientConfig == null) {
-            clientConfig = new ZKClientConfig();
-        }
-        this.clientConfig = clientConfig;
-        watchManager = defaultWatchManager();
-        watchManager.defaultWatcher = watcher;
+        this(builder(connectString, Duration.ofMillis(sessionTimeout))
+            .withSession(sessionId, sessionPasswd)
+            .withDefaultWatcher(watcher)
+            .withCanBeReadOnly(canBeReadOnly)
+            .withHostProvider(ignored -> hostProvider)
+            .withClientConfig(clientConfig)
+            .toOptions());
+    }
 
+    /**
+     * Create a ZooKeeper client and establish session asynchronously.
+     *
+     * <p>This is private and export for internal usage.
+     *
+     * <p>This constructor will initiate connection to the server and return
+     * immediately - potentially (usually) before the session is fully established.
+     * The watcher from options will be notified of any changes in state. This
+     * notification can come at any point before or after the constructor call
+     * has returned.
+     *
+     * <p>The instantiated ZooKeeper client object will pick an arbitrary server
+     * from the connect string and attempt to connect to it. If establishment of
+     * the connection fails, another server in the connect string will be tried
+     * (the order is non-deterministic, as we random shuffle the list), until a
+     * connection is established. The client will continue attempts until the
+     * session is explicitly closed (or the session is expired by the server).
+     *
+     * @param options options for ZooKeeper client
+     * @throws IOException in cases of IO failure
+     */
+    @InterfaceAudience.Private
+    public ZooKeeper(ZooKeeperOptions options) throws IOException {
+        String connectString = options.getConnectString();
+        int sessionTimeout = options.getSessionTimeoutMs();
+        long sessionId = options.getSessionId();
+        byte[] sessionPasswd = sessionId == 0 ? new byte[16] : options.getSessionPasswd();
+        Watcher watcher = options.getDefaultWatcher();
+        boolean canBeReadOnly = options.isCanBeReadOnly();
+
+        if (sessionId == 0) {
+            LOG.info(
+                "Initiating client connection, connectString={} sessionTimeout={} watcher={}",
+                connectString,
+                sessionTimeout,
+                watcher);
+        } else {
+            LOG.info(
+                "Initiating client connection, connectString={} "
+                    + "sessionTimeout={} watcher={} sessionId=0x{} sessionPasswd={}",
+                connectString,
+                sessionTimeout,
+                watcher,
+                Long.toHexString(sessionId),
+                (sessionPasswd == null ? "<null>" : "<hidden>"));
+        }
+
+        ZKClientConfig clientConfig = options.getClientConfig();
+        this.clientConfig = clientConfig != null ? clientConfig : new ZKClientConfig();
         ConnectStringParser connectStringParser = new ConnectStringParser(connectString);
-        hostProvider = aHostProvider;
-
-        cnxn = new ClientCnxn(
-            connectStringParser.getChrootPath(),
+        HostProvider hostProvider;
+        if (options.getHostProvider() != null) {
+            hostProvider = options.getHostProvider().apply(connectStringParser.getServerAddresses());
+        } else {
+            hostProvider = HostProviderFactory.create(connectStringParser, clientConfig);
+        }
+        this.hostProvider = hostProvider;
+        chroot = Chroot.ofNullable(connectStringParser.getChrootPath());
+        cnxn = createConnection(
             hostProvider,
             sessionTimeout,
-            this,
-            watchManager,
+            options.getNewSessionTimeoutMs(),
+            this.clientConfig,
+            watcher,
             getClientCnxnSocket(),
             sessionId,
             sessionPasswd,
             canBeReadOnly);
-        cnxn.seenRwServerBefore = true; // since user has provided sessionId
+        cnxn.seenRwServerBefore = sessionId != 0; // since user has provided sessionId
         cnxn.start();
     }
 
@@ -1491,6 +1221,8 @@ public ZooKeeper(
      *            majority in the background.
      * @throws IOException in cases of network failure
      * @throws IllegalArgumentException if an invalid chroot path is specified
+     *
+     * @see #builder(String, Duration) for builder style construction
      */
     public ZooKeeper(
         String connectString,
@@ -1499,19 +1231,11 @@ public ZooKeeper(
         long sessionId,
         byte[] sessionPasswd,
         boolean canBeReadOnly) throws IOException {
-        this(
-            connectString,
-            sessionTimeout,
-            watcher,
-            sessionId,
-            sessionPasswd,
-            canBeReadOnly,
-            createDefaultHostProvider(connectString));
-    }
-
-    // default hostprovider
-    private static HostProvider createDefaultHostProvider(String connectString) {
-        return new StaticHostProvider(new ConnectStringParser(connectString).getServerAddresses());
+        this(builder(connectString, Duration.ofMillis(sessionTimeout))
+            .withDefaultWatcher(watcher)
+            .withSession(sessionId, sessionPasswd)
+            .withCanBeReadOnly(canBeReadOnly)
+            .toOptions());
     }
 
     // VisibleForTesting
@@ -1519,11 +1243,6 @@ public Testable getTestable() {
         return new ZooKeeperTestable(cnxn);
     }
 
-    /* Useful for testing watch handling behavior */
-    protected ZKWatchManager defaultWatchManager() {
-        return new ZKWatchManager(getClientConfig().getBoolean(ZKClientConfig.DISABLE_AUTO_WATCH_RESET));
-    }
-
     /**
      * The session id for this ZooKeeper client instance. The value returned is
      * not valid until the client connects to a server and may change after a
@@ -1578,11 +1297,9 @@ public void addAuthInfo(String scheme, byte[] auth) {
     /**
      * Specify the default watcher for the connection (overrides the one
      * specified during construction).
-     *
-     * @param watcher
      */
     public synchronized void register(Watcher watcher) {
-        watchManager.defaultWatcher = watcher;
+        getWatchManager().setDefaultWatcher(watcher);
     }
 
     /**
@@ -1615,6 +1332,10 @@ public synchronized void close() throws InterruptedException {
             LOG.debug("Ignoring unexpected exception during close", e);
         }
 
+        if (hostProvider != null) {
+            hostProvider.close();
+        }
+
         LOG.info("Session: 0x{} closed", Long.toHexString(getSessionId()));
     }
 
@@ -1642,15 +1363,7 @@ public boolean close(int waitForShutdownTimeoutMs) throws InterruptedException {
      * @return server view of the path (chroot prepended to client path)
      */
     private String prependChroot(String clientPath) {
-        if (cnxn.chrootPath != null) {
-            // handle clientPath = "/"
-            if (clientPath.length() == 1) {
-                return cnxn.chrootPath;
-            }
-            return cnxn.chrootPath + clientPath;
-        } else {
-            return clientPath;
-        }
+        return chroot.prepend(clientPath);
     }
 
     /**
@@ -1691,7 +1404,7 @@ private String prependChroot(String clientPath) {
      * of the node by getChildren calls.
      * <p>
      * The maximum allowable size of the data array is 1 MB (1,048,576 bytes).
-     * Arrays larger than this will cause a KeeperExecption to be thrown.
+     * Arrays larger than this will cause a KeeperException to be thrown.
      *
      * @param path
      *                the path for the node
@@ -1732,11 +1445,7 @@ public String create(
         if (r.getErr() != 0) {
             throw KeeperException.create(KeeperException.Code.get(r.getErr()), clientPath);
         }
-        if (cnxn.chrootPath == null) {
-            return response.getPath();
-        } else {
-            return response.getPath().substring(cnxn.chrootPath.length());
-        }
+        return chroot.strip(response.getPath());
     }
 
     /**
@@ -1777,7 +1486,7 @@ public String create(
      * of the node by getChildren calls.
      * <p>
      * The maximum allowable size of the data array is 1 MB (1,048,576 bytes).
-     * Arrays larger than this will cause a KeeperExecption to be thrown.
+     * Arrays larger than this will cause a KeeperException to be thrown.
      *
      * @param path
      *                the path for the node
@@ -1836,13 +1545,9 @@ public String create(
             throw KeeperException.create(KeeperException.Code.get(r.getErr()), clientPath);
         }
         if (stat != null) {
-            DataTree.copyStat(response.getStat(), stat);
-        }
-        if (cnxn.chrootPath == null) {
-            return response.getPath();
-        } else {
-            return response.getPath().substring(cnxn.chrootPath.length());
+            stat.copyFrom(response.getStat());
         }
+        return chroot.strip(response.getPath());
     }
 
     private void setCreateHeader(CreateMode createMode, RequestHeader h) {
@@ -1891,6 +1596,7 @@ public void create(
         EphemeralType.validateTTL(createMode, -1);
 
         final String serverPath = prependChroot(clientPath);
+        cb = chroot.interceptCallback(cb);
 
         RequestHeader h = new RequestHeader();
         h.setType(createMode.isContainer() ? ZooDefs.OpCode.createContainer : ZooDefs.OpCode.create);
@@ -1937,6 +1643,7 @@ public void create(
         EphemeralType.validateTTL(createMode, ttl);
 
         final String serverPath = prependChroot(clientPath);
+        cb = chroot.interceptCallback(cb);
 
         RequestHeader h = new RequestHeader();
         setCreateHeader(createMode, h);
@@ -2051,7 +1758,7 @@ public void multi(Iterable<Op> ops, MultiCallback cb, Object ctx) {
     }
 
     private List<OpResult> validatePath(Iterable<Op> ops) {
-        List<OpResult> results = new ArrayList<OpResult>();
+        List<OpResult> results = new ArrayList<>();
         boolean error = false;
         for (Op op : ops) {
             try {
@@ -2080,7 +1787,7 @@ private List<OpResult> validatePath(Iterable<Op> ops) {
 
     private MultiOperationRecord generateMultiTransaction(Iterable<Op> ops) {
         // reconstructing transaction with the chroot prefix
-        List<Op> transaction = new ArrayList<Op>();
+        List<Op> transaction = new ArrayList<>();
         for (Op op : ops) {
             transaction.add(withRootPrefix(op));
         }
@@ -2101,6 +1808,11 @@ protected void multiInternal(
         MultiOperationRecord request,
         MultiCallback cb,
         Object ctx) throws IllegalArgumentException {
+        if (request.size() == 0) {
+            // nothing to do, early exit
+            cnxn.queueCallback(cb, KeeperException.Code.OK.intValue(), null, ctx);
+            return;
+        }
         RequestHeader h = new RequestHeader();
         switch (request.getOpKind()) {
         case TRANSACTION:
@@ -2119,6 +1831,10 @@ protected void multiInternal(
     protected List<OpResult> multiInternal(
         MultiOperationRecord request) throws InterruptedException, KeeperException, IllegalArgumentException {
         RequestHeader h = new RequestHeader();
+        if (request.size() == 0) {
+            // nothing to do, early exit
+            return Collections.emptyList();
+        }
         switch (request.getOpKind()) {
         case TRANSACTION:
             h.setType(ZooDefs.OpCode.multi);
@@ -2224,7 +1940,6 @@ public Stat exists(final String path, Watcher watcher) throws KeeperException, I
         final String clientPath = path;
         PathUtils.validatePath(clientPath);
 
-        // the watch contains the un-chroot path
         WatchRegistration wcb = null;
         if (watcher != null) {
             wcb = new ExistsWatchRegistration(watcher, clientPath);
@@ -2252,23 +1967,22 @@ public Stat exists(final String path, Watcher watcher) throws KeeperException, I
     /**
      * Return the stat of the node of the given path. Return null if no such a
      * node exists.
-     * <p>
-     * If the watch is true and the call is successful (no exception is thrown),
+     *
+     * <p>If the watch is true and the call is successful (no exception is thrown),
      * a watch will be left on the node with the given path. The watch will be
      * triggered by a successful operation that creates/delete the node or sets
      * the data on the node.
      *
-     * @param path
-     *                the node path
-     * @param watch
-     *                whether need to watch this node
+     * @param path the node path
+     * @param watch whether need to watch this node
      * @return the stat of the node of the given path; return null if no such a
      *         node exists.
      * @throws KeeperException If the server signals an error
+     * @throws IllegalStateException if watch this node with a null default watcher
      * @throws InterruptedException If the server transaction is interrupted.
      */
     public Stat exists(String path, boolean watch) throws KeeperException, InterruptedException {
-        return exists(path, watch ? watchManager.defaultWatcher : null);
+        return exists(path, getDefaultWatcher(watch));
     }
 
     /**
@@ -2280,7 +1994,6 @@ public void exists(final String path, Watcher watcher, StatCallback cb, Object c
         final String clientPath = path;
         PathUtils.validatePath(clientPath);
 
-        // the watch contains the un-chroot path
         WatchRegistration wcb = null;
         if (watcher != null) {
             wcb = new ExistsWatchRegistration(watcher, clientPath);
@@ -2300,10 +2013,12 @@ public void exists(final String path, Watcher watcher, StatCallback cb, Object c
     /**
      * The asynchronous version of exists.
      *
+     * @throws IllegalStateException if watch this node with a null default watcher
+     *
      * @see #exists(String, boolean)
      */
     public void exists(String path, boolean watch, StatCallback cb, Object ctx) {
-        exists(path, watch ? watchManager.defaultWatcher : null, cb, ctx);
+        exists(path, getDefaultWatcher(watch), cb, ctx);
     }
 
     /**
@@ -2329,7 +2044,6 @@ public byte[] getData(final String path, Watcher watcher, Stat stat) throws Keep
         final String clientPath = path;
         PathUtils.validatePath(clientPath);
 
-        // the watch contains the un-chroot path
         WatchRegistration wcb = null;
         if (watcher != null) {
             wcb = new DataWatchRegistration(watcher, clientPath);
@@ -2348,7 +2062,7 @@ public byte[] getData(final String path, Watcher watcher, Stat stat) throws Keep
             throw KeeperException.create(KeeperException.Code.get(r.getErr()), clientPath);
         }
         if (stat != null) {
-            DataTree.copyStat(response.getStat(), stat);
+            stat.copyFrom(response.getStat());
         }
         return response.getData();
     }
@@ -2369,10 +2083,11 @@ public byte[] getData(final String path, Watcher watcher, Stat stat) throws Keep
      * @param stat the stat of the node
      * @return the data of the node
      * @throws KeeperException If the server signals an error with a non-zero error code
+     * @throws IllegalStateException if watch this node with a null default watcher
      * @throws InterruptedException If the server transaction is interrupted.
      */
     public byte[] getData(String path, boolean watch, Stat stat) throws KeeperException, InterruptedException {
-        return getData(path, watch ? watchManager.defaultWatcher : null, stat);
+        return getData(path, getDefaultWatcher(watch), stat);
     }
 
     /**
@@ -2384,7 +2099,6 @@ public void getData(final String path, Watcher watcher, DataCallback cb, Object
         final String clientPath = path;
         PathUtils.validatePath(clientPath);
 
-        // the watch contains the un-chroot path
         WatchRegistration wcb = null;
         if (watcher != null) {
             wcb = new DataWatchRegistration(watcher, clientPath);
@@ -2404,10 +2118,12 @@ public void getData(final String path, Watcher watcher, DataCallback cb, Object
     /**
      * The asynchronous version of getData.
      *
+     * @throws IllegalStateException if watch this node with a null default watcher
+     *
      * @see #getData(String, boolean, Stat)
      */
     public void getData(String path, boolean watch, DataCallback cb, Object ctx) {
-        getData(path, watch ? watchManager.defaultWatcher : null, cb, ctx);
+        getData(path, getDefaultWatcher(watch), cb, ctx);
     }
 
     /**
@@ -2433,7 +2149,7 @@ public byte[] getConfig(Watcher watcher, Stat stat) throws KeeperException, Inte
         // the watch contains the un-chroot path
         WatchRegistration wcb = null;
         if (watcher != null) {
-            wcb = new DataWatchRegistration(watcher, configZnode);
+            wcb = new ServerDataWatchRegistration(watcher, configZnode);
         }
 
         RequestHeader h = new RequestHeader();
@@ -2447,7 +2163,7 @@ public byte[] getConfig(Watcher watcher, Stat stat) throws KeeperException, Inte
             throw KeeperException.create(KeeperException.Code.get(r.getErr()), configZnode);
         }
         if (stat != null) {
-            DataTree.copyStat(response.getStat(), stat);
+            stat.copyFrom(response.getStat());
         }
         return response.getData();
     }
@@ -2463,7 +2179,7 @@ public void getConfig(Watcher watcher, DataCallback cb, Object ctx) {
         // the watch contains the un-chroot path
         WatchRegistration wcb = null;
         if (watcher != null) {
-            wcb = new DataWatchRegistration(watcher, configZnode);
+            wcb = new ServerDataWatchRegistration(watcher, configZnode);
         }
 
         RequestHeader h = new RequestHeader();
@@ -2490,19 +2206,22 @@ public void getConfig(Watcher watcher, DataCallback cb, Object ctx) {
      * @param stat the stat of the configuration node ZooDefs.CONFIG_NODE
      * @return configuration data stored in ZooDefs.CONFIG_NODE
      * @throws KeeperException If the server signals an error with a non-zero error code
+     * @throws IllegalStateException if watch this node with a null default watcher
      * @throws InterruptedException If the server transaction is interrupted.
      */
     public byte[] getConfig(boolean watch, Stat stat) throws KeeperException, InterruptedException {
-        return getConfig(watch ? watchManager.defaultWatcher : null, stat);
+        return getConfig(getDefaultWatcher(watch), stat);
     }
 
     /**
      * The Asynchronous version of getConfig.
      *
+     * @throws IllegalStateException if watch this node with a null default watcher
+     *
      * @see #getData(String, boolean, Stat)
      */
     public void getConfig(boolean watch, DataCallback cb, Object ctx) {
-        getConfig(watch ? watchManager.defaultWatcher : null, cb, ctx);
+        getConfig(getDefaultWatcher(watch), cb, ctx);
     }
 
     /**
@@ -2606,7 +2325,7 @@ public List<ACL> getACL(final String path, Stat stat) throws KeeperException, In
             throw KeeperException.create(KeeperException.Code.get(r.getErr()), clientPath);
         }
         if (stat != null) {
-            DataTree.copyStat(response.getStat(), stat);
+            stat.copyFrom(response.getStat());
         }
         return response.getAcl();
     }
@@ -2647,7 +2366,7 @@ public void getACL(final String path, Stat stat, ACLCallback cb, Object ctx) {
      * @return the stat of the node.
      * @throws InterruptedException If the server transaction is interrupted.
      * @throws KeeperException If the server signals an error with a non-zero error code.
-     * @throws org.apache.zookeeper.KeeperException.InvalidACLException If the acl is invalide.
+     * @throws org.apache.zookeeper.KeeperException.InvalidACLException If the acl is invalid.
      * @throws IllegalArgumentException if an invalid path is specified
      */
     public Stat setACL(final String path, List<ACL> acl, int aclVersion) throws KeeperException, InterruptedException {
@@ -2752,14 +2471,15 @@ public List<String> getChildren(final String path, Watcher watcher) throws Keepe
      * A KeeperException with error code KeeperException.NoNode will be thrown
      * if no node with the given path exists.
      *
-     * @param path
-     * @param watch
+     * @param path the node path
+     * @param watch whether need to watch this node
      * @return an unordered array of children of the node with the given path
+     * @throws IllegalStateException if watch this node with a null default watcher
      * @throws InterruptedException If the server transaction is interrupted.
      * @throws KeeperException If the server signals an error with a non-zero error code.
      */
     public List<String> getChildren(String path, boolean watch) throws KeeperException, InterruptedException {
-        return getChildren(path, watch ? watchManager.defaultWatcher : null);
+        return getChildren(path, getDefaultWatcher(watch));
     }
 
     /**
@@ -2791,10 +2511,12 @@ public void getChildren(final String path, Watcher watcher, ChildrenCallback cb,
     /**
      * The asynchronous version of getChildren.
      *
+     * @throws IllegalStateException if watch this node with a null default watcher
+     *
      * @see #getChildren(String, boolean)
      */
     public void getChildren(String path, boolean watch, ChildrenCallback cb, Object ctx) {
-        getChildren(path, watch ? watchManager.defaultWatcher : null, cb, ctx);
+        getChildren(path, getDefaultWatcher(watch), cb, ctx);
     }
 
     /**
@@ -2847,7 +2569,7 @@ public List<String> getChildren(
             throw KeeperException.create(KeeperException.Code.get(r.getErr()), clientPath);
         }
         if (stat != null) {
-            DataTree.copyStat(response.getStat(), stat);
+            stat.copyFrom(response.getStat());
         }
         return response.getChildren();
     }
@@ -2868,10 +2590,11 @@ public List<String> getChildren(
      *
      * @since 3.3.0
      *
-     * @param path
-     * @param watch
+     * @param path the node path
+     * @param watch whether need to watch this node
      * @param stat stat of the znode designated by path
      * @return an unordered array of children of the node with the given path
+     * @throws IllegalStateException if watch this node with a null default watcher
      * @throws InterruptedException If the server transaction is interrupted.
      * @throws KeeperException If the server signals an error with a non-zero
      *  error code.
@@ -2880,7 +2603,7 @@ public List<String> getChildren(
         String path,
         boolean watch,
         Stat stat) throws KeeperException, InterruptedException {
-        return getChildren(path, watch ? watchManager.defaultWatcher : null, stat);
+        return getChildren(path, getDefaultWatcher(watch), stat);
     }
 
     /**
@@ -2916,10 +2639,12 @@ public void getChildren(final String path, Watcher watcher, Children2Callback cb
      *
      * @since 3.3.0
      *
+     * @throws IllegalStateException if watch this node with a null default watcher
+     *
      * @see #getChildren(String, boolean, Stat)
      */
     public void getChildren(String path, boolean watch, Children2Callback cb, Object ctx) {
-        getChildren(path, watch ? watchManager.defaultWatcher : null, cb, ctx);
+        getChildren(path, getDefaultWatcher(watch), cb, ctx);
     }
 
     /**
@@ -3030,6 +2755,31 @@ public void getEphemerals(AsyncCallback.EphemeralsCallback cb, Object ctx) {
         getEphemerals("/", cb, ctx);
     }
 
+    /**
+     * Synchronous sync. Flushes channel between process and leader.
+     *
+     * @param path the given path
+     * @throws KeeperException If the server signals an error with a non-zero error code
+     * @throws InterruptedException If the server transaction is interrupted.
+     * @throws IllegalArgumentException if an invalid path is specified
+     */
+    public void sync(final String path) throws KeeperException, InterruptedException {
+        final String clientPath = path;
+        PathUtils.validatePath(clientPath);
+
+        final String serverPath = prependChroot(clientPath);
+
+        RequestHeader h = new RequestHeader();
+        h.setType(ZooDefs.OpCode.sync);
+        SyncRequest request = new SyncRequest();
+        SyncResponse response = new SyncResponse();
+        request.setPath(serverPath);
+        ReplyHeader r = cnxn.submitRequest(h, request, response, null);
+        if (r.getErr() != 0) {
+            throw KeeperException.create(KeeperException.Code.get(r.getErr()), clientPath);
+        }
+    }
+
     /**
      * Asynchronous sync. Flushes channel between process and leader.
      * @param path
@@ -3170,6 +2920,7 @@ public void removeAllWatches(String path, WatcherType watcherType, boolean local
     public void addWatch(String basePath, Watcher watcher, AddWatchMode mode)
             throws KeeperException, InterruptedException {
         PathUtils.validatePath(basePath);
+        validateWatcher(watcher);
         String serverPath = prependChroot(basePath);
 
         RequestHeader h = new RequestHeader();
@@ -3196,9 +2947,11 @@ public void addWatch(String basePath, Watcher watcher, AddWatchMode mode)
      *  error code.
      * @since 3.6.0
      */
-    public void addWatch(String basePath, AddWatchMode mode)
-            throws KeeperException, InterruptedException {
-        addWatch(basePath, watchManager.defaultWatcher, mode);
+    public void addWatch(
+            String basePath,
+            AddWatchMode mode
+    ) throws KeeperException, InterruptedException {
+        addWatch(basePath, getWatchManager().getDefaultWatcher(), mode);
     }
 
     /**
@@ -3212,9 +2965,14 @@ public void addWatch(String basePath, AddWatchMode mode)
      * @throws IllegalArgumentException if an invalid path is specified
      * @since 3.6.0
      */
-    public void addWatch(String basePath, Watcher watcher, AddWatchMode mode,
-                         VoidCallback cb, Object ctx) {
+    public void addWatch(
+            String basePath,
+            Watcher watcher, AddWatchMode mode,
+            VoidCallback cb,
+            Object ctx
+    ) {
         PathUtils.validatePath(basePath);
+        validateWatcher(watcher);
         String serverPath = prependChroot(basePath);
 
         RequestHeader h = new RequestHeader();
@@ -3234,9 +2992,8 @@ public void addWatch(String basePath, Watcher watcher, AddWatchMode mode,
      * @throws IllegalArgumentException if an invalid path is specified
      * @since 3.6.0
      */
-    public void addWatch(String basePath, AddWatchMode mode,
-                         VoidCallback cb, Object ctx) {
-        addWatch(basePath, watchManager.defaultWatcher, mode, cb, ctx);
+    public void addWatch(String basePath, AddWatchMode mode, VoidCallback cb, Object ctx) {
+        addWatch(basePath, getWatchManager().getDefaultWatcher(), mode, cb, ctx);
     }
 
     private void validateWatcher(Watcher watcher) {
@@ -3254,7 +3011,7 @@ private void removeWatches(
         PathUtils.validatePath(path);
         final String clientPath = path;
         final String serverPath = prependChroot(clientPath);
-        WatchDeregistration wcb = new WatchDeregistration(clientPath, watcher, watcherType, local, watchManager);
+        WatchDeregistration wcb = new WatchDeregistration(serverPath, chroot.interceptWatcher(watcher), watcherType, local, getWatchManager());
 
         RequestHeader h = new RequestHeader();
         h.setType(opCode);
@@ -3277,7 +3034,7 @@ private void removeWatches(
         PathUtils.validatePath(path);
         final String clientPath = path;
         final String serverPath = prependChroot(clientPath);
-        WatchDeregistration wcb = new WatchDeregistration(clientPath, watcher, watcherType, local, watchManager);
+        WatchDeregistration wcb = new WatchDeregistration(serverPath, chroot.interceptWatcher(watcher), watcherType, local, getWatchManager());
 
         RequestHeader h = new RequestHeader();
         h.setType(opCode);
@@ -3385,9 +3142,12 @@ protected SocketAddress testableLocalSocketAddress() {
 
     private ClientCnxnSocket getClientCnxnSocket() throws IOException {
         String clientCnxnSocketName = getClientConfig().getProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET);
-        if (clientCnxnSocketName == null) {
+        if (clientCnxnSocketName == null || clientCnxnSocketName.equals(ClientCnxnSocketNIO.class.getSimpleName())) {
             clientCnxnSocketName = ClientCnxnSocketNIO.class.getName();
+        } else if (clientCnxnSocketName.equals(ClientCnxnSocketNetty.class.getSimpleName())) {
+            clientCnxnSocketName = ClientCnxnSocketNetty.class.getName();
         }
+
         try {
             Constructor<?> clientCxnConstructor = Class.forName(clientCnxnSocketName)
                                                        .getDeclaredConstructor(ZKClientConfig.class);
@@ -3398,6 +3158,26 @@ private ClientCnxnSocket getClientCnxnSocket() throws IOException {
         }
     }
 
+    /**
+     * Return the default watcher of this instance if required.
+     *
+     * @param required if the default watcher required
+     * @return the default watcher if required, otherwise {@code null}.
+     * @throws IllegalStateException if a null default watcher is required
+     */
+    private Watcher getDefaultWatcher(boolean required) {
+        if (required) {
+            final Watcher defaultWatcher = getWatchManager().getDefaultWatcher();
+            if (defaultWatcher != null) {
+                return defaultWatcher;
+            } else {
+                throw new IllegalStateException("Default watcher is required, but it is null.");
+            }
+        }
+
+        return null;
+    }
+
     /**
      * Validates the provided ACL list for null, empty or null value in it.
      *
@@ -3412,4 +3192,18 @@ private void validateACL(List<ACL> acl) throws KeeperException.InvalidACLExcepti
         }
     }
 
+    /**
+     * Gives all authentication information added into the current session.
+     *
+     * @return list of authentication info
+     * @throws InterruptedException when interrupted
+     */
+    public synchronized List<ClientInfo> whoAmI() throws InterruptedException {
+        RequestHeader h = new RequestHeader();
+        h.setType(ZooDefs.OpCode.whoAmI);
+        WhoAmIResponse response = new WhoAmIResponse();
+        cnxn.submitRequest(h, null, response, null);
+        return response.getClientInfo();
+    }
+
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
index dad878cf87c..6b469fec83b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperMain.java
@@ -23,6 +23,7 @@
 import java.io.InputStreamReader;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
+import java.nio.file.Paths;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
@@ -31,39 +32,21 @@
 import java.util.LinkedList;
 import java.util.List;
 import java.util.Map;
-import java.util.Map.Entry;
 import java.util.NoSuchElementException;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.TimeUnit;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
+import java.util.stream.Stream;
 import org.apache.yetus.audience.InterfaceAudience;
 import org.apache.zookeeper.admin.ZooKeeperAdmin;
-import org.apache.zookeeper.cli.AddAuthCommand;
-import org.apache.zookeeper.cli.AddWatchCommand;
 import org.apache.zookeeper.cli.CliCommand;
 import org.apache.zookeeper.cli.CliException;
-import org.apache.zookeeper.cli.CloseCommand;
+import org.apache.zookeeper.cli.CommandFactory;
 import org.apache.zookeeper.cli.CommandNotFoundException;
-import org.apache.zookeeper.cli.CreateCommand;
-import org.apache.zookeeper.cli.DelQuotaCommand;
-import org.apache.zookeeper.cli.DeleteAllCommand;
-import org.apache.zookeeper.cli.DeleteCommand;
-import org.apache.zookeeper.cli.GetAclCommand;
-import org.apache.zookeeper.cli.GetAllChildrenNumberCommand;
-import org.apache.zookeeper.cli.GetCommand;
-import org.apache.zookeeper.cli.GetConfigCommand;
-import org.apache.zookeeper.cli.GetEphemeralsCommand;
-import org.apache.zookeeper.cli.ListQuotaCommand;
-import org.apache.zookeeper.cli.LsCommand;
 import org.apache.zookeeper.cli.MalformedCommandException;
-import org.apache.zookeeper.cli.ReconfigCommand;
-import org.apache.zookeeper.cli.RemoveWatchesCommand;
-import org.apache.zookeeper.cli.SetAclCommand;
-import org.apache.zookeeper.cli.SetCommand;
-import org.apache.zookeeper.cli.SetQuotaCommand;
-import org.apache.zookeeper.cli.StatCommand;
-import org.apache.zookeeper.cli.SyncCommand;
-import org.apache.zookeeper.cli.VersionCommand;
 import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.server.ExitCode;
 import org.apache.zookeeper.util.ServiceUtils;
 import org.slf4j.Logger;
@@ -77,61 +60,52 @@
 public class ZooKeeperMain {
 
     private static final Logger LOG = LoggerFactory.getLogger(ZooKeeperMain.class);
-    static final Map<String, String> commandMap = new HashMap<String, String>();
-    static final Map<String, CliCommand> commandMapCli = new HashMap<String, CliCommand>();
+    static final Map<String, String> commandMap = new HashMap<>();
+    static final Map<String, CliCommand> commandMapCli = new HashMap<>();
 
     protected MyCommandOptions cl = new MyCommandOptions();
-    protected HashMap<Integer, String> history = new HashMap<Integer, String>();
+    protected HashMap<Integer, String> history = new HashMap<>();
     protected int commandCount = 0;
     protected boolean printWatches = true;
     protected int exitCode = ExitCode.EXECUTION_FINISHED.getValue();
 
     protected ZooKeeper zk;
     protected String host = "";
+    private CountDownLatch connectLatch = null;
 
     public boolean getPrintWatches() {
         return printWatches;
     }
 
+    private static final String CMD_CONNECT = "connect";
+    private static final String CMD_HISTORY = "history";
+    private static final String CMD_REDO = "redo";
+    private static final String CMD_QUIT = "quit";
+    private static final String CMD_EXIT = "exit";
+    private static final String CMD_PRINT_WATCHES = "printwatches";
+
+
     static {
-        commandMap.put("connect", "host:port");
-        commandMap.put("history", "");
-        commandMap.put("redo", "cmdno");
-        commandMap.put("printwatches", "on|off");
-        commandMap.put("quit", "");
-
-        new CloseCommand().addToMap(commandMapCli);
-        new CreateCommand().addToMap(commandMapCli);
-        new DeleteCommand().addToMap(commandMapCli);
-        new DeleteAllCommand().addToMap(commandMapCli);
-        new SetCommand().addToMap(commandMapCli);
-        new GetCommand().addToMap(commandMapCli);
-        new LsCommand().addToMap(commandMapCli);
-        new GetAclCommand().addToMap(commandMapCli);
-        new SetAclCommand().addToMap(commandMapCli);
-        new StatCommand().addToMap(commandMapCli);
-        new SyncCommand().addToMap(commandMapCli);
-        new SetQuotaCommand().addToMap(commandMapCli);
-        new ListQuotaCommand().addToMap(commandMapCli);
-        new DelQuotaCommand().addToMap(commandMapCli);
-        new AddAuthCommand().addToMap(commandMapCli);
-        new ReconfigCommand().addToMap(commandMapCli);
-        new GetConfigCommand().addToMap(commandMapCli);
-        new RemoveWatchesCommand().addToMap(commandMapCli);
-        new GetEphemeralsCommand().addToMap(commandMapCli);
-        new GetAllChildrenNumberCommand().addToMap(commandMapCli);
-        new VersionCommand().addToMap(commandMapCli);
-        new AddWatchCommand().addToMap(commandMapCli);
-
-        // add all to commandMap
-        for (Entry<String, CliCommand> entry : commandMapCli.entrySet()) {
-            commandMap.put(entry.getKey(), entry.getValue().getOptionStr());
-        }
+        commandMap.put(CMD_CONNECT, "host:port");
+        commandMap.put(CMD_HISTORY, "");
+        commandMap.put(CMD_REDO, "cmdno");
+        commandMap.put(CMD_PRINT_WATCHES, "on|off");
+        commandMap.put(CMD_QUIT, "");
+        commandMap.put(CMD_EXIT, "");
+        Stream.of(CommandFactory.Command.values())
+            .map(command -> CommandFactory.getInstance(command))
+            // add all commands to commandMapCli and commandMap
+            .forEach(cliCommand ->{
+                cliCommand.addToMap(commandMapCli);
+                commandMap.put(
+                        cliCommand.getCmdStr(),
+                        cliCommand.getOptionStr());
+            });
     }
 
     static void usage() {
-        System.err.println("ZooKeeper -server host:port cmd args");
-        List<String> cmdList = new ArrayList<String>(commandMap.keySet());
+        System.err.println("ZooKeeper -server host:port -client-configuration properties-file cmd args");
+        List<String> cmdList = new ArrayList<>(commandMap.keySet());
         Collections.sort(cmdList);
         for (String cmd : cmdList) {
             System.err.println("\t" + cmd + " " + commandMap.get(cmd));
@@ -145,6 +119,13 @@ public void process(WatchedEvent event) {
                 ZooKeeperMain.printMessage("WATCHER::");
                 ZooKeeperMain.printMessage(event.toString());
             }
+            if (connectLatch != null) {
+                // connection success
+                if (event.getType() == Event.EventType.None
+                    && event.getState() == Event.KeeperState.SyncConnected) {
+                    connectLatch.countDown();
+                }
+            }
         }
 
     }
@@ -155,7 +136,7 @@ public void process(WatchedEvent event) {
      */
     static class MyCommandOptions {
 
-        private Map<String, String> options = new HashMap<String, String>();
+        private Map<String, String> options = new HashMap<>();
         private List<String> cmdArgs = null;
         private String command = null;
         public static final Pattern ARGS_PATTERN = Pattern.compile("\\s*([^\"\']\\S*|\"[^\"]*\"|'[^']*')\\s*");
@@ -205,6 +186,10 @@ public boolean parseOptions(String[] args) {
                         options.put("timeout", it.next());
                     } else if (opt.equals("-r")) {
                         options.put("readonly", "true");
+                    } else if (opt.equals("-client-configuration")) {
+                        options.put("client-configuration", it.next());
+                    } else if (opt.equals("-waitforconnection")) {
+                        options.put("waitforconnection", "true");
                     }
                 } catch (NoSuchElementException e) {
                     System.err.println("Error: no argument found for option " + opt);
@@ -213,7 +198,7 @@ public boolean parseOptions(String[] args) {
 
                 if (!opt.startsWith("-")) {
                     command = opt;
-                    cmdArgs = new ArrayList<String>();
+                    cmdArgs = new ArrayList<>();
                     cmdArgs.add(command);
                     while (it.hasNext()) {
                         cmdArgs.add(it.next());
@@ -232,7 +217,7 @@ public boolean parseOptions(String[] args) {
         public boolean parseCommand(String cmdstring) {
             Matcher matcher = ARGS_PATTERN.matcher(cmdstring);
 
-            List<String> args = new LinkedList<String>();
+            List<String> args = new LinkedList<>();
             while (matcher.find()) {
                 String value = matcher.group(1);
                 if (QUOTED_PATTERN.matcher(value).matches()) {
@@ -262,7 +247,7 @@ protected void addToHistory(int i, String cmd) {
     }
 
     public static List<String> getCommands() {
-        List<String> cmdList = new ArrayList<String>(commandMap.keySet());
+        List<String> cmdList = new ArrayList<>(commandMap.keySet());
         Collections.sort(cmdList);
         return cmdList;
     }
@@ -286,10 +271,34 @@ protected void connectToZK(String newHost) throws InterruptedException, IOExcept
             System.setProperty(ZKClientConfig.SECURE_CLIENT, "true");
             System.out.println("Secure connection is enabled");
         }
-        zk = new ZooKeeperAdmin(host, Integer.parseInt(cl.getOption("timeout")), new MyWatcher(), readOnly);
+
+        ZKClientConfig clientConfig = null;
+
+        if (cl.getOption("client-configuration") != null) {
+            try {
+                clientConfig = new ZKClientConfig(Paths.get(cl.getOption("client-configuration")));
+            } catch (ConfigException e) {
+                e.printStackTrace();
+                ServiceUtils.requestSystemExit(ExitCode.INVALID_INVOCATION.getValue());
+            }
+        }
+
+        if (cl.getOption("waitforconnection") != null) {
+            connectLatch = new CountDownLatch(1);
+        }
+
+        int timeout = Integer.parseInt(cl.getOption("timeout"));
+        zk = new ZooKeeperAdmin(host, timeout, new MyWatcher(), readOnly, clientConfig);
+        if (connectLatch != null) {
+            if (!connectLatch.await(timeout, TimeUnit.MILLISECONDS)) {
+                zk.close();
+                throw new IOException(KeeperException.create(KeeperException.Code.CONNECTIONLOSS));
+            }
+        }
+
     }
 
-    public static void main(String[] args) throws CliException, IOException, InterruptedException {
+    public static void main(String[] args) throws IOException, InterruptedException {
         ZooKeeperMain main = new ZooKeeperMain(args);
         main.run();
     }
@@ -304,27 +313,26 @@ public ZooKeeperMain(ZooKeeper zk) {
         this.zk = zk;
     }
 
-    void run() throws CliException, IOException, InterruptedException {
+    void run() throws IOException, InterruptedException {
         if (cl.getCommand() == null) {
             System.out.println("Welcome to ZooKeeper!");
 
-            boolean jlinemissing = false;
+            boolean jlinemissing = true;
             // only use jline if it's in the classpath
             try {
-                Class<?> consoleC = Class.forName("jline.console.ConsoleReader");
-                Class<?> completorC = Class.forName("org.apache.zookeeper.JLineZNodeCompleter");
+                Class<?> readerC = Class.forName("org.jline.reader.LineReader");
+                Class<?> completerC = Class.forName("org.apache.zookeeper.JLineZNodeCompleter");
 
+                jlinemissing = false;
                 System.out.println("JLine support is enabled");
 
-                Object console = consoleC.getConstructor().newInstance();
-
-                Object completor = completorC.getConstructor(ZooKeeper.class).newInstance(zk);
-                Method addCompletor = consoleC.getMethod("addCompleter", Class.forName("jline.console.completer.Completer"));
-                addCompletor.invoke(console, completor);
+                Object completer = completerC.getConstructor(ZooKeeper.class).newInstance(zk);
+                Object terminal = createTerminal();
+                Object reader = createLineReader(terminal, completer);
 
                 String line;
-                Method readLine = consoleC.getMethod("readLine", String.class);
-                while ((line = (String) readLine.invoke(console, getPrompt())) != null) {
+                Method readLine = readerC.getMethod("readLine", String.class);
+                while ((line = (String) readLine.invoke(reader, getPrompt())) != null) {
                     executeLine(line);
                 }
             } catch (ClassNotFoundException
@@ -333,8 +341,9 @@ void run() throws CliException, IOException, InterruptedException {
                 | IllegalAccessException
                 | InstantiationException e
             ) {
-                LOG.debug("Unable to start jline", e);
-                jlinemissing = true;
+                if (jlinemissing) {
+                    LOG.debug("Unable to start jline", e);
+                }
             }
 
             if (jlinemissing) {
@@ -353,7 +362,27 @@ void run() throws CliException, IOException, InterruptedException {
         ServiceUtils.requestSystemExit(exitCode);
     }
 
-    public void executeLine(String line) throws CliException, InterruptedException, IOException {
+    private static Object createTerminal() throws ClassNotFoundException, NoSuchMethodException, IllegalAccessException, InvocationTargetException {
+        Class<?> terminalBuilderC = Class.forName("org.jline.terminal.TerminalBuilder");
+        Method terminalBuilderMethod = terminalBuilderC.getMethod("builder");
+        Object terminalBuilder = terminalBuilderMethod.invoke(null);
+        Method terminalBuildMethod = terminalBuilderC.getMethod("build");
+        return terminalBuildMethod.invoke(terminalBuilder);
+    }
+
+    private static Object createLineReader(Object terminal, Object completer) throws ClassNotFoundException, NoSuchMethodException, IllegalAccessException, InvocationTargetException {
+        Class<?> readerBuilderC = Class.forName("org.jline.reader.LineReaderBuilder");
+        Method readerBuilderMethod = readerBuilderC.getMethod("builder");
+        Object readerBuilder = readerBuilderMethod.invoke(null);
+        Method setTerminalMethod = readerBuilderC.getMethod("terminal", Class.forName("org.jline.terminal.Terminal"));
+        setTerminalMethod.invoke(readerBuilder, terminal);
+        Method setCompleterMethod = readerBuilderC.getMethod("completer", Class.forName("org.jline.reader.Completer"));
+        setCompleterMethod.invoke(readerBuilder, completer);
+        Method readerBuildMethod = readerBuilderC.getMethod("build");
+        return readerBuildMethod.invoke(readerBuilder);
+    }
+
+    public void executeLine(String line) throws InterruptedException, IOException {
         if (!line.equals("")) {
             cl.parseCommand(line);
             addToHistory(commandCount, line);
@@ -362,7 +391,7 @@ public void executeLine(String line) throws CliException, InterruptedException,
         }
     }
 
-    protected boolean processCmd(MyCommandOptions co) throws CliException, IOException, InterruptedException {
+    protected boolean processCmd(MyCommandOptions co) throws IOException, InterruptedException {
         boolean watch = false;
         try {
             watch = processZKCmd(co);
@@ -391,34 +420,34 @@ protected boolean processZKCmd(MyCommandOptions co) throws CliException, IOExcep
 
         LOG.debug("Processing {}", cmd);
 
-        if (cmd.equals("quit")) {
+        if (cmd.equals(CMD_QUIT) || cmd.equals(CMD_EXIT)) {
             zk.close();
             ServiceUtils.requestSystemExit(exitCode);
-        } else if (cmd.equals("redo") && args.length >= 2) {
+        } else if (cmd.equals(CMD_REDO) && args.length >= 2) {
             Integer i = Integer.decode(args[1]);
             if (commandCount <= i || i < 0) { // don't allow redoing this redo
                 throw new MalformedCommandException("Command index out of range");
             }
             cl.parseCommand(history.get(i));
-            if (cl.getCommand().equals("redo")) {
+            if (cl.getCommand().equals(CMD_REDO)) {
                 throw new MalformedCommandException("No redoing redos");
             }
             history.put(commandCount, history.get(i));
             processCmd(cl);
-        } else if (cmd.equals("history")) {
+        } else if (cmd.equals(CMD_HISTORY)) {
             for (int i = commandCount - 10; i <= commandCount; ++i) {
                 if (i < 0) {
                     continue;
                 }
                 System.out.println(i + " - " + history.get(i));
             }
-        } else if (cmd.equals("printwatches")) {
+        } else if (cmd.equals(CMD_PRINT_WATCHES)) {
             if (args.length == 1) {
                 System.out.println("printwatches is " + (printWatches ? "on" : "off"));
             } else {
                 printWatches = args[1].equals("on");
             }
-        } else if (cmd.equals("connect")) {
+        } else if (cmd.equals(CMD_CONNECT)) {
             if (args.length >= 2) {
                 connectToZK(args[1]);
             } else {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperTestable.java b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperTestable.java
index f7e403c33d6..1822200396e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperTestable.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/ZooKeeperTestable.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper;
 
+import java.io.IOException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -47,4 +48,10 @@ public void queueEvent(WatchedEvent event) {
         clientCnxn.eventThread.queueEvent(event);
     }
 
+    @Override
+    public void closeSocket() throws IOException {
+        LOG.info("closeSocket() called");
+        clientCnxn.sendThread.testableCloseSocket();
+    }
+
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/admin/ZooKeeperAdmin.java b/zookeeper-server/src/main/java/org/apache/zookeeper/admin/ZooKeeperAdmin.java
index 05c992899d7..75d088d4dfc 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/admin/ZooKeeperAdmin.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/admin/ZooKeeperAdmin.java
@@ -27,13 +27,13 @@
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.client.ZooKeeperOptions;
 import org.apache.zookeeper.common.StringUtils;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.proto.GetDataResponse;
 import org.apache.zookeeper.proto.ReconfigRequest;
 import org.apache.zookeeper.proto.ReplyHeader;
 import org.apache.zookeeper.proto.RequestHeader;
-import org.apache.zookeeper.server.DataTree;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -53,6 +53,11 @@ public class ZooKeeperAdmin extends ZooKeeper {
 
     private static final Logger LOG = LoggerFactory.getLogger(ZooKeeperAdmin.class);
 
+    @InterfaceAudience.Private
+    public ZooKeeperAdmin(ZooKeeperOptions options) throws IOException {
+        super(options);
+    }
+
     /**
      * Create a ZooKeeperAdmin object which is used to perform dynamic reconfiguration
      * operations.
@@ -124,6 +129,54 @@ public ZooKeeperAdmin(
         super(connectString, sessionTimeout, watcher, conf);
     }
 
+    /**
+     * Create a ZooKeeperAdmin object which is used to perform dynamic reconfiguration
+     * operations.
+     *
+     * @param connectString
+     *            comma separated host:port pairs, each corresponding to a zk
+     *            server. e.g. "127.0.0.1:3000,127.0.0.1:3001,127.0.0.1:3002" If
+     *            the optional chroot suffix is used the example would look
+     *            like: "127.0.0.1:3000,127.0.0.1:3001,127.0.0.1:3002/app/a"
+     *            where the client would be rooted at "/app/a" and all paths
+     *            would be relative to this root - ie getting/setting/etc...
+     *            "/foo/bar" would result in operations being run on
+     *            "/app/a/foo/bar" (from the server perspective).
+     * @param sessionTimeout
+     *            session timeout in milliseconds
+     * @param watcher
+     *            a watcher object which will be notified of state changes, may
+     *            also be notified for node events
+     * @param canBeReadOnly
+     *            whether the created client is allowed to go to
+     *            read-only mode in case of partitioning. Read-only mode
+     *            basically means that if the client can't find any majority
+     *            servers but there's partitioned server it could reach, it
+     *            connects to one in read-only mode, i.e. read requests are
+     *            allowed while write requests are not. It continues seeking for
+     *            majority in the background.
+     * @param conf
+     *            passing this conf object gives each client the flexibility of
+     *            configuring properties differently compared to other instances
+     *
+     * @throws IOException
+     *             in cases of network failure
+     * @throws IllegalArgumentException
+     *             if an invalid chroot path is specified
+     *
+     * @see ZooKeeper#ZooKeeper(String, int, Watcher, boolean, ZKClientConfig)
+     *
+     * @since 3.6.1
+     */
+    public ZooKeeperAdmin(
+        String connectString,
+        int sessionTimeout,
+        Watcher watcher,
+        boolean canBeReadOnly,
+        ZKClientConfig conf) throws IOException {
+        super(connectString, sessionTimeout, watcher, canBeReadOnly, conf);
+    }
+
     /**
      * Create a ZooKeeperAdmin object which is used to perform dynamic reconfiguration
      * operations.
@@ -198,7 +251,7 @@ public byte[] reconfigure(
             throw KeeperException.create(KeeperException.Code.get(r.getErr()), "");
         }
         if (stat != null) {
-            DataTree.copyStat(response.getStat(), stat);
+            stat.copyFrom(response.getStat());
         }
         return response.getData();
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/audit/AuditHelper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/audit/AuditHelper.java
index ce0d58a87ba..d6f1178c609 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/audit/AuditHelper.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/audit/AuditHelper.java
@@ -20,7 +20,6 @@
 import java.io.IOException;
 import java.util.HashMap;
 import java.util.Map;
-import org.apache.jute.Record;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.MultiOperationRecord;
@@ -29,10 +28,10 @@
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.audit.AuditEvent.Result;
 import org.apache.zookeeper.proto.CreateRequest;
+import org.apache.zookeeper.proto.CreateTTLRequest;
 import org.apache.zookeeper.proto.DeleteRequest;
 import org.apache.zookeeper.proto.SetACLRequest;
 import org.apache.zookeeper.proto.SetDataRequest;
-import org.apache.zookeeper.server.ByteBufferInputStream;
 import org.apache.zookeeper.server.DataTree.ProcessTxnResult;
 import org.apache.zookeeper.server.Request;
 import org.slf4j.Logger;
@@ -59,7 +58,7 @@ public static void addAuditLog(Request request, ProcessTxnResult txnResult, bool
         if (!ZKAuditProvider.isAuditEnabled()) {
             return;
         }
-        String op = null;
+        String op;
         //For failed transaction rc.path is null
         String path = txnResult.path;
         String acls = null;
@@ -70,42 +69,41 @@ public static void addAuditLog(Request request, ProcessTxnResult txnResult, bool
                 case ZooDefs.OpCode.create2:
                 case ZooDefs.OpCode.createContainer:
                     op = AuditConstants.OP_CREATE;
+                    CreateRequest createRequest = request.readRequestRecord(CreateRequest::new);
+                    createMode = getCreateMode(createRequest.getFlags());
                     if (failedTxn) {
-                        CreateRequest createRequest = new CreateRequest();
-                        deserialize(request, createRequest);
                         path = createRequest.getPath();
-                        createMode =
-                                getCreateMode(createRequest);
-                    } else {
-                        createMode = getCreateMode(request);
+                    }
+                    break;
+                case ZooDefs.OpCode.createTTL:
+                    op = AuditConstants.OP_CREATE;
+                    CreateTTLRequest createTtlRequest = request.readRequestRecord(CreateTTLRequest::new);
+                    createMode = getCreateMode(createTtlRequest.getFlags());
+                    if (failedTxn) {
+                        path = createTtlRequest.getPath();
                     }
                     break;
                 case ZooDefs.OpCode.delete:
                 case ZooDefs.OpCode.deleteContainer:
                     op = AuditConstants.OP_DELETE;
                     if (failedTxn) {
-                        DeleteRequest deleteRequest = new DeleteRequest();
-                        deserialize(request, deleteRequest);
+                        DeleteRequest deleteRequest = request.readRequestRecord(DeleteRequest::new);
                         path = deleteRequest.getPath();
                     }
                     break;
                 case ZooDefs.OpCode.setData:
                     op = AuditConstants.OP_SETDATA;
                     if (failedTxn) {
-                        SetDataRequest setDataRequest = new SetDataRequest();
-                        deserialize(request, setDataRequest);
+                        SetDataRequest setDataRequest = request.readRequestRecord(SetDataRequest::new);
                         path = setDataRequest.getPath();
                     }
                     break;
                 case ZooDefs.OpCode.setACL:
                     op = AuditConstants.OP_SETACL;
+                    SetACLRequest setACLRequest = request.readRequestRecord(SetACLRequest::new);
+                    acls = ZKUtil.aclToString(setACLRequest.getAcl());
                     if (failedTxn) {
-                        SetACLRequest setACLRequest = new SetACLRequest();
-                        deserialize(request, setACLRequest);
                         path = setACLRequest.getPath();
-                        acls = ZKUtil.aclToString(setACLRequest.getAcl());
-                    } else {
-                        acls = getACLs(request);
                     }
                     break;
                 case ZooDefs.OpCode.multi:
@@ -131,11 +129,6 @@ public static void addAuditLog(Request request, ProcessTxnResult txnResult, bool
         }
     }
 
-    private static void deserialize(Request request, Record record) throws IOException {
-        request.request.rewind();
-        ByteBufferInputStream.byteBuffer2Record(request.request.slice(), record);
-    }
-
     private static Result getResult(ProcessTxnResult rc, boolean failedTxn) {
         if (failedTxn) {
             return Result.FAILURE;
@@ -179,7 +172,7 @@ private static void logMultiOperation(Request request, ProcessTxnResult rc) thro
     }
 
     private static void log(Request request, String path, String op, String acls, String createMode, Result result) {
-        log(request.getUsers(), op, path, acls, createMode,
+        log(request.getUsersForAudit(), op, path, acls, createMode,
                 request.cnxn.getSessionIdHex(), request.cnxn.getHostAddress(), result);
     }
 
@@ -188,20 +181,8 @@ private static void log(String user, String operation, String znode, String acl,
         ZKAuditProvider.log(user, operation, znode, acl, createMode, session, ip, result);
     }
 
-    private static String getACLs(Request request) throws IOException {
-        SetACLRequest setACLRequest = new SetACLRequest();
-        deserialize(request, setACLRequest);
-        return ZKUtil.aclToString(setACLRequest.getAcl());
-    }
-
-    private static String getCreateMode(Request request) throws IOException, KeeperException {
-        CreateRequest createRequest = new CreateRequest();
-        deserialize(request, createRequest);
-        return getCreateMode(createRequest);
-    }
-
-    private static String getCreateMode(CreateRequest createRequest) throws KeeperException {
-        return CreateMode.fromFlag(createRequest.getFlags()).toString().toLowerCase();
+    private static String getCreateMode(int createFlags) throws KeeperException {
+        return CreateMode.fromFlag(createFlags).toString().toLowerCase();
     }
 
     private static Map<String, String> getCreateModes(Request request)
@@ -210,14 +191,13 @@ private static Map<String, String> getCreateModes(Request request)
         if (!ZKAuditProvider.isAuditEnabled()) {
             return createModes;
         }
-        MultiOperationRecord multiRequest = new MultiOperationRecord();
-        deserialize(request, multiRequest);
+        MultiOperationRecord multiRequest = request.readRequestRecord(MultiOperationRecord::new);
         for (Op op : multiRequest) {
             if (op.getType() == ZooDefs.OpCode.create || op.getType() == ZooDefs.OpCode.create2
                     || op.getType() == ZooDefs.OpCode.createContainer) {
                 CreateRequest requestRecord = (CreateRequest) op.toRequestRecord();
                 createModes.put(requestRecord.getPath(),
-                        getCreateMode(requestRecord));
+                        getCreateMode(requestRecord.getFlags()));
             }
         }
         return createModes;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/audit/Log4jAuditLogger.java b/zookeeper-server/src/main/java/org/apache/zookeeper/audit/Slf4jAuditLogger.java
similarity index 87%
rename from zookeeper-server/src/main/java/org/apache/zookeeper/audit/Log4jAuditLogger.java
rename to zookeeper-server/src/main/java/org/apache/zookeeper/audit/Slf4jAuditLogger.java
index c4efc1c4e08..b162e74ec0b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/audit/Log4jAuditLogger.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/audit/Slf4jAuditLogger.java
@@ -22,10 +22,10 @@
 import org.slf4j.LoggerFactory;
 
 /**
- * Log4j based audit logger
+ * Slf4j based audit logger
  */
-public class Log4jAuditLogger implements AuditLogger {
-    private static final Logger LOG = LoggerFactory.getLogger(Log4jAuditLogger.class);
+public class Slf4jAuditLogger implements AuditLogger {
+    private static final Logger LOG = LoggerFactory.getLogger(Slf4jAuditLogger.class);
 
     @Override
     public void logAuditEvent(AuditEvent auditEvent) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/audit/ZKAuditProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/audit/ZKAuditProvider.java
index 00646baf871..864d2366c97 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/audit/ZKAuditProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/audit/ZKAuditProvider.java
@@ -46,7 +46,7 @@ public class ZKAuditProvider {
     private static AuditLogger getAuditLogger() {
         String auditLoggerClass = System.getProperty(AUDIT_IMPL_CLASS);
         if (auditLoggerClass == null) {
-            auditLoggerClass = Log4jAuditLogger.class.getName();
+            auditLoggerClass = Slf4jAuditLogger.class.getName();
         }
         try {
             Constructor<?> clientCxnConstructor = Class.forName(auditLoggerClass)
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/AclParser.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/AclParser.java
index 81111580491..ff7f1544344 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/AclParser.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/AclParser.java
@@ -32,12 +32,12 @@ public class AclParser {
     /**
      * parse string into list of ACL
      * @param aclString
-     * @return
+     * @return list of ACL
      */
     public static List<ACL> parse(String aclString) {
         List<ACL> acl;
         String[] acls = aclString.split(",");
-        acl = new ArrayList<ACL>();
+        acl = new ArrayList<>();
         for (String a : acls) {
             int firstColon = a.indexOf(':');
             int lastColon = a.lastIndexOf(':');
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/AddAuthCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/AddAuthCommand.java
index de466f6e938..4c4aff0cefa 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/AddAuthCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/AddAuthCommand.java
@@ -18,11 +18,11 @@
 
 package org.apache.zookeeper.cli;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 
 /**
  * addAuth command for cli
@@ -38,7 +38,7 @@ public AddAuthCommand() {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         CommandLine cl;
         try {
             cl = parser.parse(options, cmdArgs);
@@ -58,7 +58,7 @@ public CliCommand parse(String[] cmdArgs) throws CliParseException {
     public boolean exec() throws CliException {
         byte[] b = null;
         if (args.length >= 3) {
-            b = args[2].getBytes();
+            b = args[2].getBytes(UTF_8);
         }
 
         zk.addAuthInfo(args[1], b);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/AddWatchCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/AddWatchCommand.java
index 1e34b10159c..591de8bb0b5 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/AddWatchCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/AddWatchCommand.java
@@ -20,10 +20,9 @@
 
 import java.util.Arrays;
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.AddWatchMode;
 import org.apache.zookeeper.KeeperException;
 
@@ -50,7 +49,7 @@ public AddWatchCommand() {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         try {
             cl = parser.parse(options, cmdArgs);
         } catch (ParseException ex) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/Base64OutputFormatter.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/Base64OutputFormatter.java
new file mode 100644
index 00000000000..a2224beacc1
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/Base64OutputFormatter.java
@@ -0,0 +1,31 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.cli;
+
+import java.util.Base64;
+
+public class Base64OutputFormatter implements OutputFormatter {
+
+    public static final Base64OutputFormatter INSTANCE = new Base64OutputFormatter();
+
+    @Override
+    public String format(byte[] data) {
+        return Base64.getEncoder().encodeToString(data);
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CliCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CliCommand.java
index 83e03a84175..192841f84fb 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CliCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CliCommand.java
@@ -20,6 +20,8 @@
 
 import java.io.PrintStream;
 import java.util.Map;
+import javax.annotation.Nullable;
+import org.apache.commons.cli.Options;
 import org.apache.zookeeper.ZooKeeper;
 
 /**
@@ -32,6 +34,8 @@ public abstract class CliCommand {
     protected PrintStream err;
     private String cmdStr;
     private String optionStr;
+    @Nullable
+    private Options options;
 
     /**
      * a CLI command with command string and options.
@@ -40,10 +44,22 @@ public abstract class CliCommand {
      * @param optionStr the string used to call this command
      */
     public CliCommand(String cmdStr, String optionStr) {
+        this(cmdStr, optionStr, null);
+    }
+
+    /**
+     * a CLI command with command string and options.
+     * Using System.out and System.err for printing
+     * @param cmdStr the string used to call this command
+     * @param optionStr the string used to call this command
+     * @param options the command options
+     */
+    public CliCommand(String cmdStr, String optionStr, Options options) {
         this.out = System.out;
         this.err = System.err;
         this.cmdStr = cmdStr;
         this.optionStr = optionStr;
+        this.options = options;
     }
 
     /**
@@ -72,7 +88,6 @@ public void setZk(ZooKeeper zk) {
 
     /**
      * get the string used to call this command
-     * @return
      */
     public String getCmdStr() {
         return cmdStr;
@@ -80,7 +95,6 @@ public String getCmdStr() {
 
     /**
      * get the option string
-     * @return
      */
     public String getOptionStr() {
         return optionStr;
@@ -88,10 +102,9 @@ public String getOptionStr() {
 
     /**
      * get a usage string, contains the command and the options
-     * @return
      */
     public String getUsageStr() {
-        return cmdStr + " " + optionStr;
+        return CommandUsageHelper.getUsage(cmdStr + " " + optionStr, options);
     }
 
     /**
@@ -112,7 +125,7 @@ public void addToMap(Map<String, CliCommand> cmdMap) {
 
     /**
      *
-     * @return
+     * @return true if command has watch option, false otherwise
      * @throws CliException
      */
     public abstract boolean exec() throws CliException;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CliWrapperException.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CliWrapperException.java
index b2d00bfec3d..aa1bf44a54c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CliWrapperException.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CliWrapperException.java
@@ -43,7 +43,7 @@ private static String getMessage(Throwable cause) {
             } else if (keeperException instanceof KeeperException.InvalidACLException) {
                 return "Acl is not valid : " + keeperException.getPath();
             } else if (keeperException instanceof KeeperException.NoAuthException) {
-                return "Authentication is not valid : " + keeperException.getPath();
+                return "Insufficient permission : " + keeperException.getPath();
             } else if (keeperException instanceof KeeperException.BadArgumentsException) {
                 return "Arguments are not valid : " + keeperException.getPath();
             } else if (keeperException instanceof KeeperException.BadVersionException) {
@@ -52,8 +52,10 @@ private static String getMessage(Throwable cause) {
                 return "Another reconfiguration is in progress -- concurrent " + "reconfigs not supported (yet)";
             } else if (keeperException instanceof KeeperException.NewConfigNoQuorum) {
                 return "No quorum of new config is connected and "
-                       + "up-to-date with the leader of last commmitted config - try invoking reconfiguration after "
+                       + "up-to-date with the leader of last committed config - try invoking reconfiguration after "
                        + "new servers are connected and synced";
+            } else if (keeperException instanceof KeeperException.QuotaExceededException) {
+                return "Quota has exceeded : " + keeperException.getPath();
             }
         }
         return cause.getMessage();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CommandFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CommandFactory.java
new file mode 100644
index 00000000000..681eabad512
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CommandFactory.java
@@ -0,0 +1,75 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.cli;
+
+import java.util.function.Supplier;
+
+/**
+ * Factory class for creating instances of {@link CliCommand}.
+ */
+public class CommandFactory {
+
+    /**
+     * All Cli Commands.
+     */
+    public enum Command {
+        CLOSE(CloseCommand::new),
+        CREATE(CreateCommand::new),
+        DELETE(DeleteCommand::new),
+        DELETE_ALL(DeleteAllCommand::new),
+        SET(SetCommand::new),
+        GET(GetCommand::new),
+        LS(LsCommand::new),
+        GET_ACL(GetAclCommand::new),
+        SET_ACL(SetAclCommand::new),
+        STAT(StatCommand::new),
+        SYNC(SyncCommand::new),
+        SET_QUOTA(SetQuotaCommand::new),
+        LIST_QUOTA(ListQuotaCommand::new),
+        DEL_QUOTA(DelQuotaCommand::new),
+        ADD_AUTH(AddAuthCommand::new),
+        RECONFIG(ReconfigCommand::new),
+        GET_CONFIG(GetConfigCommand::new),
+        REMOVE_WATCHES(RemoveWatchesCommand::new),
+        GET_EPHEMERALS(GetEphemeralsCommand::new),
+        GET_ALL_CHILDREN_NUMBER(GetAllChildrenNumberCommand::new),
+        VERSION(VersionCommand::new),
+        ADD_WATCH(AddWatchCommand::new),
+        WHO_AM_I(WhoAmICommand::new);
+
+        private Supplier<? extends CliCommand> instantiator;
+
+        private CliCommand getInstance() {
+            return instantiator.get();
+        }
+
+        Command(Supplier<? extends CliCommand> instantiator) {
+            this.instantiator = instantiator;
+        }
+    }
+
+    /**
+     * Creates a new {@link CliCommand} instance.
+     * @param command the {@link Command} to create a new instance of
+     * @return the new {@code CliCommand} instance
+     */
+    public static CliCommand getInstance (Command command) {
+        return command.getInstance();
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CommandUsageHelper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CommandUsageHelper.java
new file mode 100644
index 00000000000..95eb135695d
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CommandUsageHelper.java
@@ -0,0 +1,42 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.cli;
+
+import java.io.PrintWriter;
+import java.io.StringWriter;
+import javax.annotation.Nullable;
+import org.apache.commons.cli.HelpFormatter;
+import org.apache.commons.cli.Options;
+
+public class CommandUsageHelper {
+
+    public static String getUsage(String commandSyntax, @Nullable Options options) {
+        StringBuilder buffer = new StringBuilder();
+        buffer.append(commandSyntax);
+        if (options != null && !options.getOptions().isEmpty()) {
+            buffer.append(System.lineSeparator());
+            StringWriter out = new StringWriter();
+            HelpFormatter formatter = new HelpFormatter();
+            formatter.printOptions(new PrintWriter(out), formatter.getWidth(), options, formatter.getLeftPadding(),
+                    formatter.getDescPadding());
+            buffer.append(out);
+        }
+        return buffer.toString();
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CreateCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CreateCommand.java
index d906238382c..395ffa5a8ba 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CreateCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/CreateCommand.java
@@ -18,13 +18,13 @@
 
 package org.apache.zookeeper.cli;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.util.List;
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Option;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZooDefs;
@@ -54,7 +54,7 @@ public CreateCommand() {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         try {
             cl = parser.parse(options, cmdArgs);
         } catch (ParseException ex) {
@@ -113,7 +113,7 @@ public boolean exec() throws CliException {
         String path = args[1];
         byte[] data = null;
         if (args.length > 2) {
-            data = args[2].getBytes();
+            data = args[2].getBytes(UTF_8);
         }
         List<ACL> acl = ZooDefs.Ids.OPEN_ACL_UNSAFE;
         if (args.length > 3) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/DelQuotaCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/DelQuotaCommand.java
index 56e630b6ae9..d84c83028a1 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/DelQuotaCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/DelQuotaCommand.java
@@ -18,15 +18,13 @@
 
 package org.apache.zookeeper.cli;
 
-import java.io.IOException;
 import java.util.List;
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Option;
 import org.apache.commons.cli.OptionGroup;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.Quotas;
 import org.apache.zookeeper.StatsTrack;
@@ -43,17 +41,20 @@ public class DelQuotaCommand extends CliCommand {
     private CommandLine cl;
 
     public DelQuotaCommand() {
-        super("delquota", "[-n|-b] path");
+        super("delquota", "[-n|-b|-N|-B] path");
 
         OptionGroup og1 = new OptionGroup();
-        og1.addOption(new Option("b", false, "bytes quota"));
-        og1.addOption(new Option("n", false, "num quota"));
+        og1.addOption(new Option("n", false, "num soft quota"));
+        og1.addOption(new Option("b", false, "bytes soft quota"));
+        og1.addOption(new Option("N", false, "num hard quota"));
+        og1.addOption(new Option("B", false, "bytes hard quota"));
+
         options.addOptionGroup(og1);
     }
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         try {
             cl = parser.parse(options, cmdArgs);
         } catch (ParseException ex) {
@@ -69,22 +70,35 @@ public CliCommand parse(String[] cmdArgs) throws CliParseException {
 
     @Override
     public boolean exec() throws CliException {
-        //if neither option -n or -b is specified, we delete
-        // the quota node for this node.
         String path = args[1];
+        // Use a StatsTrack object to pass in to delQuota which quotas
+        // to delete by setting them to 1 as a flag.
+        StatsTrack quota = new StatsTrack();
+        if (cl.hasOption("n")) {
+            quota.setCount(1);
+        }
+        if (cl.hasOption("b")) {
+            quota.setBytes(1);
+        }
+        if (cl.hasOption("N")) {
+            quota.setCountHardLimit(1);
+        }
+        if (cl.hasOption("B")) {
+            quota.setByteHardLimit(1);
+        }
+
+        boolean flagSet = (cl.hasOption("n") || cl.hasOption("N")
+                || cl.hasOption("b") || cl.hasOption("B"));
         try {
-            if (cl.hasOption("b")) {
-                delQuota(zk, path, true, false);
-            } else if (cl.hasOption("n")) {
-                delQuota(zk, path, false, true);
-            } else if (args.length == 2) {
-                // we don't have an option specified.
-                // just delete whole quota node
-                delQuota(zk, path, true, true);
-            }
-        } catch (KeeperException | InterruptedException | IOException ex) {
+            delQuota(zk, path, flagSet ? quota : null);
+        } catch (IllegalArgumentException ex) {
+            throw new MalformedPathException(ex.getMessage());
+        } catch (KeeperException.NoNodeException ne) {
+            err.println("quota for " + path + " does not exist.");
+        } catch (KeeperException | InterruptedException ex) {
             throw new CliWrapperException(ex);
         }
+
         return false;
     }
 
@@ -93,20 +107,16 @@ public boolean exec() throws CliException {
      *
      * @param zk the zookeeper client
      * @param path the path to delete quota for
-     * @param bytes true if number of bytes needs to be unset
-     * @param numNodes true if number of nodes needs to be unset
+     * @param quota the quotas to delete (set to 1), null to delete all
      * @return true if quota deletion is successful
      * @throws KeeperException
-     * @throws IOException
+     * @throws MalformedPathException
      * @throws InterruptedException
      */
-    public static boolean delQuota(
-        ZooKeeper zk,
-        String path,
-        boolean bytes,
-        boolean numNodes) throws KeeperException, IOException, InterruptedException, MalformedPathException {
-        String parentPath = Quotas.quotaZookeeper + path;
-        String quotaPath = Quotas.quotaZookeeper + path + "/" + Quotas.limitNode;
+    public static boolean delQuota(ZooKeeper zk, String path, StatsTrack quota)
+            throws KeeperException, InterruptedException, MalformedPathException {
+        String parentPath = Quotas.quotaPath(path);
+        String quotaPath = Quotas.limitPath(path);
         if (zk.exists(quotaPath, false) == null) {
             System.out.println("Quota does not exist for " + path);
             return true;
@@ -117,17 +127,11 @@ public static boolean delQuota(
         } catch (IllegalArgumentException ex) {
             throw new MalformedPathException(ex.getMessage());
         } catch (KeeperException.NoNodeException ne) {
-            System.err.println("quota does not exist for " + path);
-            return true;
+            throw new KeeperException.NoNodeException(ne.getMessage());
         }
-        StatsTrack strack = new StatsTrack(new String(data));
-        if (bytes && !numNodes) {
-            strack.setBytes(-1L);
-            zk.setData(quotaPath, strack.toString().getBytes(), -1);
-        } else if (!bytes && numNodes) {
-            strack.setCount(-1);
-            zk.setData(quotaPath, strack.toString().getBytes(), -1);
-        } else if (bytes && numNodes) {
+        StatsTrack strack = new StatsTrack(data);
+
+        if (quota == null) {
             // delete till you can find a node with more than
             // one child
             List<String> children = zk.getChildren(parentPath, false);
@@ -137,7 +141,23 @@ public static boolean delQuota(
             }
             // cut the tree till their is more than one child
             trimProcQuotas(zk, parentPath);
+        } else {
+            if (quota.getCount() > 0) {
+                strack.setCount(-1);
+            }
+            if (quota.getBytes() > 0) {
+                strack.setBytes(-1L);
+            }
+            if (quota.getCountHardLimit() > 0) {
+                strack.setCountHardLimit(-1);
+            }
+            if (quota.getByteHardLimit() > 0) {
+                strack.setByteHardLimit(-1L);
+            }
+
+            zk.setData(quotaPath, strack.getStatsBytes(), -1);
         }
+
         return true;
     }
 
@@ -149,12 +169,10 @@ public static boolean delQuota(
      * unwanted parent in the path.
      * @return true if successful
      * @throws KeeperException
-     * @throws IOException
      * @throws InterruptedException
      */
-    private static boolean trimProcQuotas(
-        ZooKeeper zk,
-        String path) throws KeeperException, IOException, InterruptedException {
+    private static boolean trimProcQuotas(ZooKeeper zk, String path)
+            throws KeeperException, InterruptedException {
         if (Quotas.quotaZookeeper.equals(path)) {
             return true;
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/DeleteAllCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/DeleteAllCommand.java
index cbeceb0e08e..537a9b05ba6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/DeleteAllCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/DeleteAllCommand.java
@@ -19,11 +19,10 @@
 package org.apache.zookeeper.cli;
 
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Option;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZKUtil;
 
@@ -50,7 +49,7 @@ public DeleteAllCommand(String cmdStr) {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         try {
             cl = parser.parse(options, cmdArgs);
         } catch (ParseException ex) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/DeleteCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/DeleteCommand.java
index 228eba45da5..91d98512007 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/DeleteCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/DeleteCommand.java
@@ -19,10 +19,9 @@
 package org.apache.zookeeper.cli;
 
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.KeeperException;
 
 /**
@@ -44,7 +43,7 @@ public DeleteCommand() {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         try {
             cl = parser.parse(options, cmdArgs);
         } catch (ParseException ex) {
@@ -64,7 +63,7 @@ private void retainCompatibility(String[] cmdArgs) throws CliParseException {
         if (args.length > 2) {
             err.println("'delete path [version]' has been deprecated. "
                         + "Please use 'delete [-v version] path' instead.");
-            Parser parser = new PosixParser();
+            DefaultParser parser = new DefaultParser();
             try {
                 cl = parser.parse(options, cmdArgs);
             } catch (ParseException ex) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetAclCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetAclCommand.java
index 553395093f0..0ecdc9ec6bc 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetAclCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetAclCommand.java
@@ -19,10 +19,9 @@
 
 import java.util.List;
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZKUtil;
 import org.apache.zookeeper.data.ACL;
@@ -47,7 +46,7 @@ public GetAclCommand() {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         try {
             cl = parser.parse(options, cmdArgs);
         } catch (ParseException ex) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetAllChildrenNumberCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetAllChildrenNumberCommand.java
index dda48d1abcd..342a460248e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetAllChildrenNumberCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetAllChildrenNumberCommand.java
@@ -18,10 +18,9 @@
 package org.apache.zookeeper.cli;
 
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.KeeperException;
 
 /**
@@ -38,7 +37,7 @@ public GetAllChildrenNumberCommand() {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         CommandLine cl;
         try {
             cl = parser.parse(options, cmdArgs);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetCommand.java
index 57821edde63..2de0a0bde6e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetCommand.java
@@ -19,10 +19,9 @@
 package org.apache.zookeeper.cli;
 
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.data.Stat;
 
@@ -36,18 +35,20 @@ public class GetCommand extends CliCommand {
     private CommandLine cl;
 
     static {
-        options.addOption("s", false, "stats");
-        options.addOption("w", false, "watch");
+        options.addOption("s", false, "Print znode stats additionally");
+        options.addOption("w", false, "Watch for changes on the znode");
+        options.addOption("b", false, "Output data in base64 format");
+        options.addOption("x", false, "Output data in hexdump format");
     }
 
     public GetCommand() {
-        super("get", "[-s] [-w] path");
+        super("get", "[-s] [-w] [-b] [-x] path", options);
     }
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
 
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         try {
             cl = parser.parse(options, cmdArgs);
         } catch (ParseException ex) {
@@ -69,7 +70,7 @@ private void retainCompatibility(String[] cmdArgs) throws CliParseException {
             // rewrite to option
             cmdArgs[2] = "-w";
             err.println("'get path [watch]' has been deprecated. " + "Please use 'get [-s] [-w] path' instead.");
-            Parser parser = new PosixParser();
+            DefaultParser parser = new DefaultParser();
             try {
                 cl = parser.parse(options, cmdArgs);
             } catch (ParseException ex) {
@@ -90,10 +91,17 @@ public boolean exec() throws CliException {
         } catch (IllegalArgumentException ex) {
             throw new MalformedPathException(ex.getMessage());
         } catch (KeeperException | InterruptedException ex) {
-            throw new CliException(ex);
+            throw new CliWrapperException(ex);
+        }
+        OutputFormatter formatter = PlainOutputFormatter.INSTANCE;
+        if (cl.hasOption("b")) {
+            formatter = Base64OutputFormatter.INSTANCE;
+        }
+        if (cl.hasOption("x")) {
+            formatter = HexDumpOutputFormatter.INSTANCE;
         }
         data = (data == null) ? "null".getBytes() : data;
-        out.println(new String(data));
+        out.println(formatter.format(data));
         if (cl.hasOption("s")) {
             new StatPrinter(out).print(stat);
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetConfigCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetConfigCommand.java
index 4fc681f42b4..5da9c4f8350 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetConfigCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetConfigCommand.java
@@ -18,11 +18,11 @@
 
 package org.apache.zookeeper.cli;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.server.util.ConfigUtils;
@@ -49,7 +49,7 @@ public GetConfigCommand() {
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
 
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         try {
             cl = parser.parse(options, cmdArgs);
         } catch (ParseException ex) {
@@ -73,11 +73,11 @@ public boolean exec() throws CliException {
         } catch (KeeperException | InterruptedException ex) {
             throw new CliWrapperException(ex);
         }
-        data = (data == null) ? "null".getBytes() : data;
+        data = (data == null) ? "null".getBytes(UTF_8) : data;
         if (cl.hasOption("c")) {
-            out.println(ConfigUtils.getClientConfigStr(new String(data)));
+            out.println(ConfigUtils.getClientConfigStr(new String(data, UTF_8)));
         } else {
-            out.println(new String(data));
+            out.println(new String(data, UTF_8));
         }
 
         if (cl.hasOption("s")) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetEphemeralsCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetEphemeralsCommand.java
index 8d39a59eb2c..de667e8afe0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetEphemeralsCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/GetEphemeralsCommand.java
@@ -19,10 +19,9 @@
 
 import java.util.List;
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.KeeperException;
 
 /**
@@ -39,7 +38,7 @@ public GetEphemeralsCommand() {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         CommandLine cl;
         try {
             cl = parser.parse(options, cmdArgs);
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/AndOp.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/HexDumpOutputFormatter.java
similarity index 64%
rename from zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/AndOp.java
rename to zookeeper-server/src/main/java/org/apache/zookeeper/cli/HexDumpOutputFormatter.java
index 581bdaacc0a..d545a422efc 100644
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/AndOp.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/HexDumpOutputFormatter.java
@@ -1,4 +1,4 @@
-/**
+/*
  * Licensed to the Apache Software Foundation (ASF) under one
  * or more contributor license agreements.  See the NOTICE file
  * distributed with this work for additional information
@@ -15,19 +15,20 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.apache.zookeeper.graph.filterops;
 
-import org.apache.zookeeper.graph.LogEntry;
-import org.apache.zookeeper.graph.FilterOp;
-import org.apache.zookeeper.graph.FilterException;
+package org.apache.zookeeper.cli;
 
-public class AndOp extends FilterOp {
-    public boolean matches(LogEntry entry) throws FilterException {
-	for (FilterOp f : subOps) {
-	    if (!f.matches(entry)) {
-		return false;
-	    }
-	}
-	return true;
+import io.netty.buffer.ByteBuf;
+import io.netty.buffer.ByteBufUtil;
+import io.netty.buffer.Unpooled;
+
+public class HexDumpOutputFormatter implements OutputFormatter {
+
+    public static final HexDumpOutputFormatter INSTANCE = new HexDumpOutputFormatter();
+
+    @Override
+    public String format(byte[] data) {
+        ByteBuf buf = Unpooled.wrappedBuffer(data);
+        return ByteBufUtil.prettyHexDump(buf);
     }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/ListQuotaCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/ListQuotaCommand.java
index b6d9f51be3a..fe5fe6b88dd 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/ListQuotaCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/ListQuotaCommand.java
@@ -18,14 +18,16 @@
 
 package org.apache.zookeeper.cli;
 
+import java.util.ArrayList;
+import java.util.List;
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.Quotas;
 import org.apache.zookeeper.StatsTrack;
+import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.data.Stat;
 
 /**
@@ -42,7 +44,7 @@ public ListQuotaCommand() {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         CommandLine cl;
         try {
             cl = parser.parse(options, cmdArgs);
@@ -60,16 +62,18 @@ public CliCommand parse(String[] cmdArgs) throws CliParseException {
     @Override
     public boolean exec() throws CliException {
         String path = args[1];
-        String absolutePath = Quotas.quotaZookeeper + path + "/" + Quotas.limitNode;
+        String absolutePath = Quotas.limitPath(path);
         try {
             err.println("absolute path is " + absolutePath);
-            Stat stat = new Stat();
-            byte[] data = zk.getData(absolutePath, false, stat);
-            StatsTrack st = new StatsTrack(new String(data));
-            out.println("Output quota for " + path + " " + st.toString());
-
-            data = zk.getData(Quotas.quotaZookeeper + path + "/" + Quotas.statNode, false, stat);
-            out.println("Output stat for " + path + " " + new StatsTrack(new String(data)).toString());
+            List<StatsTrack> statsTracks = listQuota(zk, path);
+            for (int i = 0; i < statsTracks.size(); i++) {
+                StatsTrack st = statsTracks.get(i);
+                if (i == 0) {
+                    out.println("Output quota for " + path + " " + st.toString());
+                } else {
+                    out.println("Output stat for " + path + " " + st.toString());
+                }
+            }
         } catch (IllegalArgumentException ex) {
             throw new MalformedPathException(ex.getMessage());
         } catch (KeeperException.NoNodeException ne) {
@@ -81,4 +85,19 @@ public boolean exec() throws CliException {
         return false;
     }
 
+    // @VisibleForTesting
+    public static List<StatsTrack> listQuota(ZooKeeper zk, String path) throws KeeperException, InterruptedException {
+        List<StatsTrack> statsTracks = new ArrayList<>();
+        Stat stat = new Stat();
+        byte[] data = zk.getData(Quotas.limitPath(path), false, stat);
+        StatsTrack st = new StatsTrack(data);
+        statsTracks.add(st);
+
+        data = zk.getData(Quotas.statPath(path), false, stat);
+        st = new StatsTrack(data);
+        statsTracks.add(st);
+
+        return statsTracks;
+    }
+
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/LsCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/LsCommand.java
index b12a12acd46..813396b590c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/LsCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/LsCommand.java
@@ -20,11 +20,10 @@
 import java.util.Collections;
 import java.util.List;
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.HelpFormatter;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZKUtil;
 import org.apache.zookeeper.data.Stat;
@@ -56,7 +55,7 @@ private void printHelp() {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         try {
             cl = parser.parse(options, cmdArgs);
         } catch (ParseException ex) {
@@ -79,7 +78,7 @@ private void retainCompatibility(String[] cmdArgs) throws CliParseException {
             // rewrite to option
             cmdArgs[2] = "-w";
             err.println("'ls path [watch]' has been deprecated. " + "Please use 'ls [-w] path' instead.");
-            Parser parser = new PosixParser();
+            DefaultParser parser = new DefaultParser();
             try {
                 cl = parser.parse(options, cmdArgs);
             } catch (ParseException ex) {
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/FilterException.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/OutputFormatter.java
similarity index 84%
rename from zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/FilterException.java
rename to zookeeper-server/src/main/java/org/apache/zookeeper/cli/OutputFormatter.java
index c0912fa7dfd..d306ac42fdf 100644
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/FilterException.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/OutputFormatter.java
@@ -1,4 +1,4 @@
-/**
+/*
  * Licensed to the Apache Software Foundation (ASF) under one
  * or more contributor license agreements.  See the NOTICE file
  * distributed with this work for additional information
@@ -15,8 +15,10 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.apache.zookeeper.graph;
 
-public class FilterException extends Exception {
-    public FilterException(String s) { super(s); }
-};
+package org.apache.zookeeper.cli;
+
+public interface OutputFormatter {
+
+    String format(byte[] data);
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/PlainOutputFormatter.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/PlainOutputFormatter.java
new file mode 100644
index 00000000000..c536f2ba9e5
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/PlainOutputFormatter.java
@@ -0,0 +1,31 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.cli;
+
+import static java.nio.charset.StandardCharsets.UTF_8;
+
+public class PlainOutputFormatter implements OutputFormatter {
+
+    public static final PlainOutputFormatter INSTANCE = new PlainOutputFormatter();
+
+    @Override
+    public String format(byte[] data) {
+        return new String(data, UTF_8);
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/ReconfigCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/ReconfigCommand.java
index d48d16e2c7c..ce490ad8039 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/ReconfigCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/ReconfigCommand.java
@@ -18,13 +18,13 @@
 
 package org.apache.zookeeper.cli;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.io.FileInputStream;
 import java.util.Properties;
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.admin.ZooKeeperAdmin;
 import org.apache.zookeeper.data.Stat;
@@ -83,7 +83,7 @@ public CliCommand parse(String[] cmdArgs) throws CliParseException {
         joining = null;
         leaving = null;
         members = null;
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         try {
             cl = parser.parse(options, cmdArgs);
         } catch (ParseException ex) {
@@ -130,7 +130,7 @@ public CliCommand parse(String[] cmdArgs) throws CliParseException {
                 //check that membership makes sense; leader will make these checks again
                 //don't check for leader election ports since
                 //client doesn't know what leader election alg is used
-                members = QuorumPeerConfig.parseDynamicConfig(dynamicCfg, 0, true, false).toString();
+                members = QuorumPeerConfig.parseDynamicConfig(dynamicCfg, 0, true, false, null).toString();
             } catch (Exception e) {
                 throw new CliParseException("Error processing " + cl.getOptionValue("file") + e.getMessage());
             }
@@ -152,7 +152,7 @@ public boolean exec() throws CliException {
             }
 
             byte[] curConfig = ((ZooKeeperAdmin) zk).reconfigure(joining, leaving, members, version, stat);
-            out.println("Committed new configuration:\n" + new String(curConfig));
+            out.println("Committed new configuration:\n" + new String(curConfig, UTF_8));
 
             if (cl.hasOption("s")) {
                 new StatPrinter(out).print(stat);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/RemoveWatchesCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/RemoveWatchesCommand.java
index 1603cd43b85..748f0c2f2b0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/RemoveWatchesCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/RemoveWatchesCommand.java
@@ -19,10 +19,9 @@
 package org.apache.zookeeper.cli;
 
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.Watcher.WatcherType;
 
@@ -38,6 +37,8 @@ public class RemoveWatchesCommand extends CliCommand {
     static {
         options.addOption("c", false, "child watcher type");
         options.addOption("d", false, "data watcher type");
+        options.addOption("p", false, "persistent watcher type");
+        options.addOption("r", false, "persistent recursive watcher type");
         options.addOption("a", false, "any watcher type");
         options.addOption("l", false, "remove locally when there is no server connection");
     }
@@ -48,7 +49,7 @@ public RemoveWatchesCommand() {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         try {
             cl = parser.parse(options, cmdArgs);
         } catch (ParseException ex) {
@@ -71,6 +72,10 @@ public boolean exec() throws CliWrapperException, MalformedPathException {
             wtype = WatcherType.Children;
         } else if (cl.hasOption("d")) {
             wtype = WatcherType.Data;
+        } else if (cl.hasOption("p")) {
+            wtype = WatcherType.Persistent;
+        } else if (cl.hasOption("r")) {
+            wtype = WatcherType.PersistentRecursive;
         } else if (cl.hasOption("a")) {
             wtype = WatcherType.Any;
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetAclCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetAclCommand.java
index 25aa3dda0a0..856041bec10 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetAclCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetAclCommand.java
@@ -20,10 +20,9 @@
 
 import java.util.List;
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZKUtil;
 import org.apache.zookeeper.data.ACL;
@@ -53,7 +52,7 @@ public SetAclCommand() {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         try {
             cl = parser.parse(options, cmdArgs);
         } catch (ParseException ex) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetCommand.java
index e8a0634ea26..34ac14e7422 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetCommand.java
@@ -18,11 +18,12 @@
 
 package org.apache.zookeeper.cli;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
+import java.util.Base64;
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.data.Stat;
 
@@ -36,17 +37,18 @@ public class SetCommand extends CliCommand {
     private CommandLine cl;
 
     static {
-        options.addOption("s", false, "stats");
-        options.addOption("v", true, "version");
+        options.addOption("s", false, "Print znode stats additionally");
+        options.addOption("v", true, "Set with an expected version");
+        options.addOption("b", false, "Supply data in base64 format");
     }
 
     public SetCommand() {
-        super("set", "[-s] [-v version] path data");
+        super("set", "path data [-s] [-v version] [-b]", options);
     }
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         try {
             cl = parser.parse(options, cmdArgs);
         } catch (ParseException ex) {
@@ -63,7 +65,12 @@ public CliCommand parse(String[] cmdArgs) throws CliParseException {
     @Override
     public boolean exec() throws CliException {
         String path = args[1];
-        byte[] data = args[2].getBytes();
+        byte[] data;
+        if (cl.hasOption("b")) {
+            data = Base64.getDecoder().decode(args[2]);
+        } else {
+            data = args[2].getBytes(UTF_8);
+        }
         int version;
         if (cl.hasOption("v")) {
             version = Integer.parseInt(cl.getOptionValue("v"));
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetQuotaCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetQuotaCommand.java
index d9717ecfe9d..f564398eb70 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetQuotaCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SetQuotaCommand.java
@@ -21,12 +21,11 @@
 import java.util.ArrayList;
 import java.util.List;
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Option;
 import org.apache.commons.cli.OptionGroup;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.Quotas;
@@ -49,18 +48,21 @@ public class SetQuotaCommand extends CliCommand {
     private CommandLine cl;
 
     public SetQuotaCommand() {
-        super("setquota", "-n|-b val path");
+        super("setquota", "-n|-b|-N|-B val path");
 
         OptionGroup og1 = new OptionGroup();
-        og1.addOption(new Option("b", true, "bytes quota"));
-        og1.addOption(new Option("n", true, "num quota"));
+        og1.addOption(new Option("n", true, "num soft quota"));
+        og1.addOption(new Option("b", true, "bytes soft quota"));
+        og1.addOption(new Option("N", true, "num hard quota"));
+        og1.addOption(new Option("B", true, "bytes hard quota"));
+
         og1.setRequired(true);
         options.addOptionGroup(og1);
     }
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         try {
             cl = parser.parse(options, cmdArgs);
         } catch (ParseException ex) {
@@ -83,36 +85,95 @@ public boolean exec() throws CliException {
             return false;
         }
 
-        if (cl.hasOption("b")) {
-            // we are setting the bytes quota
-            long bytes = Long.parseLong(cl.getOptionValue("b"));
-            try {
-                createQuota(zk, path, bytes, -1);
-            } catch (KeeperException | InterruptedException | IllegalArgumentException ex) {
-                throw new CliWrapperException(ex);
-            }
-        } else if (cl.hasOption("n")) {
-            // we are setting the num quota
-            int numNodes = Integer.parseInt(cl.getOptionValue("n"));
+        StatsTrack quota = new StatsTrack();
+        quota.setCount(-1);
+        quota.setBytes(-1L);
+        quota.setCountHardLimit(-1);
+        quota.setByteHardLimit(-1L);
+
+        if (!checkOptionValue(quota)) {
+            return false;
+        }
+
+        boolean flagSet = (cl.hasOption("n") || cl.hasOption("N")
+                || cl.hasOption("b") || cl.hasOption("B"));
+        if (flagSet) {
             try {
-                createQuota(zk, path, -1L, numNodes);
-            } catch (KeeperException | InterruptedException | IllegalArgumentException ex) {
+                createQuota(zk, path, quota);
+            } catch (IllegalArgumentException ex) {
+                throw new MalformedPathException(ex.getMessage());
+            } catch (KeeperException | InterruptedException ex) {
                 throw new CliWrapperException(ex);
             }
         } else {
-            throw new MalformedCommandException(getUsageStr());
+            err.println(getUsageStr());
         }
 
         return false;
     }
 
-    public static boolean createQuota(
-        ZooKeeper zk,
-        String path,
-        long bytes,
-        int numNodes) throws KeeperException, InterruptedException, IllegalArgumentException, MalformedPathException {
+    private boolean checkOptionValue(StatsTrack quota) {
+
+        try {
+            if (cl.hasOption("n")) {
+                // we are setting the num quota
+                int count = Integer.parseInt(cl.getOptionValue("n"));
+                if (count > 0) {
+                    quota.setCount(count);
+                } else {
+                    err.println("the num quota must be greater than zero");
+                    return false;
+                }
+            }
+            if (cl.hasOption("b")) {
+                // we are setting the bytes quota
+                long bytes = Long.parseLong(cl.getOptionValue("b"));
+                if (bytes >= 0) {
+                    quota.setBytes(bytes);
+                } else {
+                    err.println("the bytes quota must be greater than or equal to zero");
+                    return false;
+                }
+            }
+            if (cl.hasOption("N")) {
+                // we are setting the num hard quota
+                int count = Integer.parseInt(cl.getOptionValue("N"));
+                if (count > 0) {
+                    quota.setCountHardLimit(count);
+                } else {
+                    err.println("the num quota must be greater than zero");
+                    return false;
+                }
+            }
+            if (cl.hasOption("B")) {
+                // we are setting the byte hard quota
+                long bytes = Long.parseLong(cl.getOptionValue("B"));
+                if (bytes >= 0) {
+                    quota.setByteHardLimit(bytes);
+                } else {
+                    err.println("the bytes quota must be greater than or equal to zero");
+                    return false;
+                }
+            }
+        } catch (NumberFormatException e) {
+            err.println("NumberFormatException happens when parsing the option value");
+            return false;
+        }
+
+        return true;
+    }
+
+    /**
+     * this method creates a quota node for the path
+     * @param zk the ZooKeeper client
+     * @param path the path for which quota needs to be created
+     * @param quota the quotas
+     * @return true if its successful and false if not.
+     */
+    public static boolean createQuota(ZooKeeper zk, String path, StatsTrack quota)
+            throws KeeperException, InterruptedException, MalformedPathException {
         // check if the path exists. We cannot create
-        // quota for a path that already exists in zookeeper
+        // quota for a path that doesn't exist in zookeeper
         // for now.
         Stat initStat;
         try {
@@ -158,39 +219,77 @@ public static boolean createQuota(
         for (int i = 1; i < splits.length; i++) {
             sb.append("/").append(splits[i]);
             quotaPath = sb.toString();
-            try {
-                zk.create(quotaPath, null, ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-            } catch (KeeperException.NodeExistsException ne) {
-                //do nothing
+            if (zk.exists(quotaPath, false) == null) {
+                try {
+                    zk.create(quotaPath, null, ZooDefs.Ids.OPEN_ACL_UNSAFE,
+                            CreateMode.PERSISTENT);
+                } catch (KeeperException.NodeExistsException ne) {
+                    //do nothing
+                }
             }
         }
         String statPath = quotaPath + "/" + Quotas.statNode;
         quotaPath = quotaPath + "/" + Quotas.limitNode;
-        StatsTrack strack = new StatsTrack(null);
-        strack.setBytes(bytes);
-        strack.setCount(numNodes);
-        try {
-            zk.create(quotaPath, strack.toString().getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-            StatsTrack stats = new StatsTrack(null);
-            stats.setBytes(0L);
+        byte[] data;
+
+        if (zk.exists(quotaPath, false) == null) {
+            zk.create(quotaPath, quota.getStatsBytes(),
+                    ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+            StatsTrack stats = new StatsTrack();
             stats.setCount(0);
-            zk.create(statPath, stats.toString().getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        } catch (KeeperException.NodeExistsException ne) {
-            byte[] data = zk.getData(quotaPath, false, new Stat());
-            StatsTrack strackC = new StatsTrack(new String(data));
-            if (bytes != -1L) {
-                strackC.setBytes(bytes);
+            stats.setBytes(0L);
+
+            zk.create(statPath, stats.getStatsBytes(),
+                    ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+            data = zk.getData(quotaPath, false, new Stat());
+            StatsTrack quotaStrack = new StatsTrack(data);
+
+            data = zk.getData(statPath, false, new Stat());
+            StatsTrack statStrack = new StatsTrack(data);
+            checkQuota(quotaStrack, statStrack);
+
+        } else {
+            data = zk.getData(quotaPath, false, new Stat());
+            StatsTrack quotaStrack = new StatsTrack(data);
+
+            if (quota.getCount() > -1) {
+                quotaStrack.setCount(quota.getCount());
+            }
+            if (quota.getBytes() > -1L) {
+                quotaStrack.setBytes(quota.getBytes());
+            }
+            if (quota.getCountHardLimit() > -1) {
+                quotaStrack.setCountHardLimit(quota.getCountHardLimit());
             }
-            if (numNodes != -1) {
-                strackC.setCount(numNodes);
+            if (quota.getByteHardLimit() > -1L) {
+                quotaStrack.setByteHardLimit(quota.getByteHardLimit());
             }
-            zk.setData(quotaPath, strackC.toString().getBytes(), -1);
+
+            data = zk.getData(statPath, false, new Stat());
+            StatsTrack statStrack = new StatsTrack(data);
+            checkQuota(quotaStrack, statStrack);
+
+            zk.setData(quotaPath, quotaStrack.getStatsBytes(), -1);
         }
+
         return true;
     }
 
+    private static void checkQuota(StatsTrack quotaStrack, StatsTrack statStrack) {
+        if ((quotaStrack.getCount() > -1 && quotaStrack.getCount() < statStrack.getCount()) || (quotaStrack.getCountHardLimit() > -1
+                && quotaStrack.getCountHardLimit() < statStrack.getCount())) {
+            System.out.println("[Warning]: the count quota you create is less than the existing count:" + statStrack.getCount());
+        }
+        if ((quotaStrack.getBytes() > -1 && quotaStrack.getBytes() < statStrack.getBytes()) || (quotaStrack.getByteHardLimit() > -1
+                && quotaStrack.getByteHardLimit() < statStrack.getBytes())) {
+            System.out.println("[Warning]: the bytes quota you create is less than the existing bytes:" + statStrack.getBytes());
+        }
+    }
+
     private static void checkIfChildQuota(ZooKeeper zk, String path) throws KeeperException, InterruptedException {
-        String realPath = Quotas.quotaZookeeper + path;
+        String realPath = Quotas.quotaPath(path);
 
         try {
             ZKUtil.visitSubTreeDFS(zk, realPath, false, (rc, quotaPath, ctx, name) -> {
@@ -209,7 +308,7 @@ private static void checkIfChildQuota(ZooKeeper zk, String path) throws KeeperEx
                 }
                 for (String child : children) {
                     if (!quotaPath.equals(Quotas.quotaZookeeper + path) && Quotas.limitNode.equals(child)) {
-                        throw new IllegalArgumentException(path + " has a child " + quotaPath.substring(Quotas.quotaZookeeper.length()) + " which has a quota");
+                        throw new IllegalArgumentException(path + " has a child " + Quotas.trimQuotaPath(quotaPath) + " which has a quota");
                     }
                 }
             });
@@ -221,13 +320,13 @@ private static void checkIfChildQuota(ZooKeeper zk, String path) throws KeeperEx
     private static void checkIfParentQuota(ZooKeeper zk, String path) throws InterruptedException, KeeperException {
         final String[] splits = path.split("/");
         String quotaPath = Quotas.quotaZookeeper;
-        for (String str : splits) {
-            if (str.length() == 0) {
-                // this should only be for the beginning of the path
-                // i.e. "/..." - split(path)[0] is empty string before first '/'
-                continue;
-            }
-            quotaPath += "/" + str;
+
+        StringBuilder sb = new StringBuilder();
+        sb.append(quotaPath);
+        for (int i = 1; i < splits.length - 1; i++) {
+            sb.append("/");
+            sb.append(splits[i]);
+            quotaPath = sb.toString();
             List<String> children = null;
             try {
                 children = zk.getChildren(quotaPath, false);
@@ -239,11 +338,10 @@ private static void checkIfParentQuota(ZooKeeper zk, String path) throws Interru
                 return;
             }
             for (String child : children) {
-                if (!quotaPath.equals(Quotas.quotaZookeeper + path) && Quotas.limitNode.equals(child)) {
-                    throw new IllegalArgumentException(path + " has a parent " + quotaPath.substring(Quotas.quotaZookeeper.length()) + " which has a quota");
+                if (!quotaPath.equals(Quotas.quotaPath(path)) && Quotas.limitNode.equals(child)) {
+                    throw new IllegalArgumentException(path + " has a parent " + Quotas.trimQuotaPath(quotaPath) + " which has a quota");
                 }
             }
         }
     }
-
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/StatCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/StatCommand.java
index 7fd962c2987..c8068ad66fe 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/StatCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/StatCommand.java
@@ -19,10 +19,9 @@
 package org.apache.zookeeper.cli;
 
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.data.Stat;
 
@@ -45,7 +44,7 @@ public StatCommand() {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         try {
             cl = parser.parse(options, cmdArgs);
         } catch (ParseException ex) {
@@ -67,7 +66,7 @@ private void retainCompatibility(String[] cmdArgs) throws CliParseException {
             // rewrite to option
             cmdArgs[2] = "-w";
             err.println("'stat path [watch]' has been deprecated. " + "Please use 'stat [-w] path' instead.");
-            Parser parser = new PosixParser();
+            DefaultParser parser = new DefaultParser();
             try {
                 cl = parser.parse(options, cmdArgs);
             } catch (ParseException ex) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SyncCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SyncCommand.java
index f37e6420b11..26ef5367035 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SyncCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/SyncCommand.java
@@ -22,10 +22,9 @@
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.TimeoutException;
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 
 /**
  * sync command for cli
@@ -42,7 +41,7 @@ public SyncCommand() {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         CommandLine cl;
         try {
             cl = parser.parse(options, cmdArgs);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/VersionCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/VersionCommand.java
index 6af21bd6ca7..b2290306e9d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/VersionCommand.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/VersionCommand.java
@@ -18,10 +18,9 @@
 package org.apache.zookeeper.cli;
 
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.Parser;
-import org.apache.commons.cli.PosixParser;
 import org.apache.zookeeper.Version;
 
 /**
@@ -38,7 +37,7 @@ public VersionCommand() {
 
     @Override
     public CliCommand parse(String[] cmdArgs) throws CliParseException {
-        Parser parser = new PosixParser();
+        DefaultParser parser = new DefaultParser();
         CommandLine cl;
         try {
             cl = parser.parse(options, cmdArgs);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/cli/WhoAmICommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/WhoAmICommand.java
new file mode 100644
index 00000000000..62b7099acb0
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/cli/WhoAmICommand.java
@@ -0,0 +1,55 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.cli;
+
+import java.util.List;
+import org.apache.zookeeper.data.ClientInfo;
+
+/**
+ * WhoAmI command for cli
+ */
+public class WhoAmICommand extends CliCommand {
+
+    public WhoAmICommand() {
+        super("whoami", "");
+    }
+
+    @Override
+    public CliCommand parse(String[] cmdArgs) throws CliParseException {
+        return this;
+    }
+
+    @Override
+    public boolean exec() throws CliException {
+        try {
+            List<ClientInfo> clientInfos = zk.whoAmI();
+            out.println("Auth scheme: User");
+            if (clientInfos != null) {
+                // clientInfos will never be null, added null check to pass static checks
+                clientInfos.forEach(clientInfo -> {
+                    out.println(clientInfo.getAuthScheme() + ": " + clientInfo.getUser());
+                });
+            }
+        } catch (Exception ex) {
+            throw new CliWrapperException(ex);
+        }
+        return false;
+    }
+
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/Chroot.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/Chroot.java
new file mode 100644
index 00000000000..64b909ba1f2
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/Chroot.java
@@ -0,0 +1,157 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.client;
+
+import java.util.Objects;
+import org.apache.yetus.audience.InterfaceAudience;
+import org.apache.zookeeper.AsyncCallback;
+import org.apache.zookeeper.WatchedEvent;
+import org.apache.zookeeper.Watcher;
+
+@InterfaceAudience.Private
+public interface Chroot {
+    static Chroot ofNullable(String chroot) {
+        if (chroot == null) {
+            return new Root();
+        }
+        return new NotRoot(chroot);
+    }
+
+    /**
+     * Creates server path by prepending chroot to given client path.
+     *
+     * @param clientPath client path
+     * @return sever path with chroot prepended
+     */
+    String prepend(String clientPath);
+
+    /**
+     * Creates client path by stripping chroot from given sever path.
+     *
+     * @param serverPath sever path with chroot prepended
+     * @return client path with chroot stripped
+     * @throws IllegalArgumentException if given server path contains no chroot
+     */
+    String strip(String serverPath);
+
+    /**
+     * Creates a delegating callback to strip chroot from created node name.
+     */
+    AsyncCallback.StringCallback interceptCallback(AsyncCallback.StringCallback callback);
+
+    /**
+     * Creates a delegating callback to strip chroot from created node name.
+     */
+    AsyncCallback.Create2Callback interceptCallback(AsyncCallback.Create2Callback callback);
+
+    /**
+     * Creates a delegating watcher to strip chroot from {@link WatchedEvent#getPath()} for given watcher.
+     */
+    Watcher interceptWatcher(Watcher watcher);
+
+    final class Root implements Chroot {
+        @Override
+        public String prepend(String clientPath) {
+            return clientPath;
+        }
+
+        @Override
+        public String strip(String serverPath) {
+            return serverPath;
+        }
+
+        @Override
+        public AsyncCallback.StringCallback interceptCallback(AsyncCallback.StringCallback callback) {
+            return callback;
+        }
+
+        @Override
+        public AsyncCallback.Create2Callback interceptCallback(AsyncCallback.Create2Callback callback) {
+            return callback;
+        }
+
+        @Override
+        public Watcher interceptWatcher(Watcher watcher) {
+            return watcher;
+        }
+    }
+
+    final class NotRoot implements Chroot {
+        private final String chroot;
+
+        public NotRoot(String chroot) {
+            this.chroot = Objects.requireNonNull(chroot);
+        }
+
+        @Override
+        public String prepend(String clientPath) {
+            // handle clientPath = "/"
+            if (clientPath.length() == 1) {
+                return chroot;
+            }
+            return chroot + clientPath;
+        }
+
+        @Override
+        public String strip(String serverPath) {
+            if (!serverPath.startsWith(chroot)) {
+                String msg = String.format("server path %s does no start with chroot %s", serverPath, chroot);
+                throw new IllegalArgumentException(msg);
+            }
+            if (chroot.length() == serverPath.length()) {
+                return "/";
+            } else {
+                return serverPath.substring(chroot.length());
+            }
+        }
+
+        @Override
+        public AsyncCallback.StringCallback interceptCallback(AsyncCallback.StringCallback callback) {
+            return new ChrootCreateCallback(this, callback);
+        }
+
+        @Override
+        public AsyncCallback.Create2Callback interceptCallback(AsyncCallback.Create2Callback callback) {
+            return new ChrootCreateCallback(this, callback);
+        }
+
+        @Override
+        public Watcher interceptWatcher(Watcher watcher) {
+            return new ChrootWatcher(this, watcher);
+        }
+
+        @Override
+        public boolean equals(Object other) {
+            if (other instanceof NotRoot) {
+                return Objects.equals(chroot, ((NotRoot) other).chroot);
+            }
+            return false;
+        }
+
+        @Override
+        public int hashCode() {
+            return Objects.hash(chroot);
+        }
+
+        @Override
+        public String toString() {
+            return chroot;
+        }
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ChrootCreateCallback.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ChrootCreateCallback.java
new file mode 100644
index 00000000000..cf4aee7dc61
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ChrootCreateCallback.java
@@ -0,0 +1,51 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.client;
+
+import org.apache.yetus.audience.InterfaceAudience;
+import org.apache.zookeeper.AsyncCallback;
+import org.apache.zookeeper.data.Stat;
+
+@InterfaceAudience.Private
+class ChrootCreateCallback implements AsyncCallback.StringCallback, AsyncCallback.Create2Callback {
+    private final Chroot.NotRoot chroot;
+    private final AsyncCallback callback;
+
+    public ChrootCreateCallback(Chroot.NotRoot chroot, StringCallback callback) {
+        this.chroot = chroot;
+        this.callback = callback;
+    }
+
+    public ChrootCreateCallback(Chroot.NotRoot chroot, Create2Callback callback) {
+        this.chroot = chroot;
+        this.callback = callback;
+    }
+
+    @Override
+    public void processResult(int rc, String path, Object ctx, String name) {
+        StringCallback cb = (StringCallback) callback;
+        cb.processResult(rc, path, ctx, name == null ? null : chroot.strip(name));
+    }
+
+    @Override
+    public void processResult(int rc, String path, Object ctx, String name, Stat stat) {
+        Create2Callback cb = (Create2Callback) callback;
+        cb.processResult(rc, path, ctx, name == null ? null : chroot.strip(name), stat);
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ChrootWatcher.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ChrootWatcher.java
new file mode 100644
index 00000000000..47a61328617
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ChrootWatcher.java
@@ -0,0 +1,58 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.client;
+
+import java.util.Objects;
+import org.apache.yetus.audience.InterfaceAudience;
+import org.apache.zookeeper.WatchedEvent;
+import org.apache.zookeeper.Watcher;
+
+@InterfaceAudience.Private
+class ChrootWatcher implements Watcher {
+    private final Chroot.NotRoot chroot;
+    private final Watcher watcher;
+
+    public ChrootWatcher(Chroot.NotRoot chroot, Watcher watcher) {
+        this.chroot = chroot;
+        this.watcher = watcher;
+    }
+
+    @Override
+    public boolean equals(Object other) {
+        if (other instanceof ChrootWatcher) {
+            return chroot.equals(((ChrootWatcher) other).chroot) && watcher.equals(((ChrootWatcher) other).watcher);
+        }
+        return false;
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hash(chroot, watcher);
+    }
+
+    @Override
+    public void process(WatchedEvent event) {
+        String path = event.getPath();
+        if (path != null) {
+            path = chroot.strip(path);
+            event = new WatchedEvent(event.getType(), event.getState(), path, event.getZxid());
+        }
+        watcher.process(event);
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ConnectStringParser.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ConnectStringParser.java
index 2cea78bc20b..6c2c7ec6b1b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ConnectStringParser.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ConnectStringParser.java
@@ -22,9 +22,9 @@
 import java.net.InetSocketAddress;
 import java.util.ArrayList;
 import java.util.List;
+import org.apache.zookeeper.common.NetUtils;
 import org.apache.zookeeper.common.PathUtils;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
-import org.apache.zookeeper.server.util.ConfigUtils;
+import org.apache.zookeeper.common.StringUtils;
 
 /**
  * A parser for ZooKeeper Client connect strings.
@@ -39,57 +39,112 @@
 public final class ConnectStringParser {
 
     private static final int DEFAULT_PORT = 2181;
+    private static final String DNS_SRV_PREFIX = "dns-srv://";
 
-    private final String chrootPath;
+    public enum ConnectionType {
+        DNS_SRV,
+        HOST_PORT
+    }
 
-    private final ArrayList<InetSocketAddress> serverAddresses = new ArrayList<InetSocketAddress>();
+    private String chrootPath;
+    private final ArrayList<InetSocketAddress> serverAddresses = new ArrayList<>();
+    private final ConnectionType connectionType;
+    private final String connectString;
 
     /**
-     * Parse host and port by spliting client connectString
-     * with support for IPv6 literals
-     * @throws IllegalArgumentException
-     *             for an invalid chroot path.
+     * Constructs a ConnectStringParser with given connect string.
+     *
+     * <p>Supports two connection string formats:</p>
+     * <ul>
+     * <li><strong>Host:Port format:</strong> "host1:2181,host2:2181/chroot"</li>
+     * <li><strong>DNS SRV format:</strong> "dns-srv://service.domain.com/chroot"</li>
+     * </ul>
+     *
+     * @param connectString the connect string to parse
+     * @throws IllegalArgumentException if connectString is null/empty or contains invalid chroot path
      */
-    public ConnectStringParser(String connectString) {
+    public ConnectStringParser(final String connectString) {
+        if (StringUtils.isBlank(connectString)) {
+            throw new IllegalArgumentException("Connect string cannot be null or empty");
+        }
+
+        if (connectString.startsWith(DNS_SRV_PREFIX)) {
+            connectionType = ConnectionType.DNS_SRV;
+            parseDnsSrvFormat(connectString);
+        } else {
+            connectionType = ConnectionType.HOST_PORT;
+            parseHostPortFormat(connectString);
+        }
+        this.connectString = connectString;
+    }
+
+    public String getChrootPath() {
+        return chrootPath;
+    }
+
+    public ArrayList<InetSocketAddress> getServerAddresses() {
+        return serverAddresses;
+    }
+
+    public ConnectionType getConnectionType() {
+        return connectionType;
+    }
+
+    public String getConnectString() {
+        return connectString;
+    }
+
+    private String[] parseConnectString(final String connectString) {
+        String serverPart = connectString;
+        String chrootPath = null;
+
         // parse out chroot, if any
-        int off = connectString.indexOf('/');
+        final int off = connectString.indexOf('/');
         if (off >= 0) {
-            String chrootPath = connectString.substring(off);
+            chrootPath = connectString.substring(off);
             // ignore "/" chroot spec, same as null
             if (chrootPath.length() == 1) {
-                this.chrootPath = null;
+                chrootPath = null;
             } else {
                 PathUtils.validatePath(chrootPath);
-                this.chrootPath = chrootPath;
             }
-            connectString = connectString.substring(0, off);
-        } else {
-            this.chrootPath = null;
+            serverPart = connectString.substring(0, off);
         }
+        return new String[]{serverPart, chrootPath};
+    }
+
+    private void parseHostPortFormat(final String connectString) {
+        final String[] parts = parseConnectString(connectString);
+        chrootPath = parts[1];
 
-        List<String> hostsList = split(connectString, ",");
+        final List<String> hostsList = split(parts[0], ",");
         for (String host : hostsList) {
             int port = DEFAULT_PORT;
-            try {
-                String[] hostAndPort = ConfigUtils.getHostAndPort(host);
+            final String[] hostAndPort = NetUtils.getIPV6HostAndPort(host);
+            if (hostAndPort.length != 0) {
                 host = hostAndPort[0];
                 if (hostAndPort.length == 2) {
                     port = Integer.parseInt(hostAndPort[1]);
                 }
-            } catch (ConfigException e) {
-                e.printStackTrace();
+            } else {
+                int pidx = host.lastIndexOf(':');
+                if (pidx >= 0) {
+                    // otherwise : is at the end of the string, ignore
+                    if (pidx < host.length() - 1) {
+                        port = Integer.parseInt(host.substring(pidx + 1));
+                    }
+                    host = host.substring(0, pidx);
+                }
             }
-
             serverAddresses.add(InetSocketAddress.createUnresolved(host, port));
         }
     }
 
-    public String getChrootPath() {
-        return chrootPath;
-    }
-
-    public ArrayList<InetSocketAddress> getServerAddresses() {
-        return serverAddresses;
+    private void parseDnsSrvFormat(final String connectString) {
+        final String[] parts = parseConnectString(connectString.substring(DNS_SRV_PREFIX.length()));
+        chrootPath = parts[1];
+        // The DNS service name is stored as a placeholder address
+        // The actual resolution will be handled by DnsSrvHostProvider
+        serverAddresses.add(InetSocketAddress.createUnresolved(parts[0], DEFAULT_PORT));
     }
-
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/DnsSrvHostProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/DnsSrvHostProvider.java
new file mode 100644
index 00000000000..55cdfcd8e58
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/DnsSrvHostProvider.java
@@ -0,0 +1,329 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.client;
+
+import java.io.IOException;
+import java.net.InetSocketAddress;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Objects;
+import java.util.Set;
+import java.util.Timer;
+import java.util.TimerTask;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.concurrent.atomic.AtomicReference;
+import org.apache.yetus.audience.InterfaceAudience;
+import org.apache.zookeeper.common.StringUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.xbill.DNS.Lookup;
+import org.xbill.DNS.Record;
+import org.xbill.DNS.SRVRecord;
+import org.xbill.DNS.Type;
+
+/**
+ * DNS SRV-based HostProvider that dynamically resolves host port names from DNS SRV records.
+ *
+ * <p>This implementation periodically refreshes the server list by querying DNS SRV records
+ * and uses HostConnectionManager for all connection management and reconfiguration logic.</p>
+ *
+ * <p><strong>Two-Phase Update Strategy:</strong></p>
+ * <ul>
+ * <li><strong>Phase 1 (Background):</strong> Timer thread detects DNS changes without caching results</li>
+ * <li><strong>Phase 2 (Connection-time):</strong> Fresh DNS lookup during connect attempt if changes detected</li>
+ * </ul>
+ */
+@InterfaceAudience.Public
+public final class DnsSrvHostProvider implements HostProvider {
+    private static final Logger LOG = LoggerFactory.getLogger(DnsSrvHostProvider.class);
+
+    public interface DnsSrvResolver {
+        SRVRecord[] lookupSrvRecords(String dnsSrvName) throws IOException;
+    }
+
+    private final String dnsSrvName;
+    private final DnsSrvResolver dnsResolver;
+
+    private final HostConnectionManager connectionManager;
+    // Track the previous server list to detect changes
+    private volatile Set<InetSocketAddress> previousServerSet;
+    private Timer dnsRefreshTimer;
+
+    // Track the current connected host for accurate load balancing decisions
+    private final AtomicReference<InetSocketAddress> currentConnectedHost = new AtomicReference<>();
+    private final AtomicBoolean serverListChanged = new AtomicBoolean(false);
+
+    /**
+     * Constructs a DnsSrvHostProvider with the given DNS name
+     *
+     * @param dnsSrvName the DNS name to query for SRV records
+     * @throws IllegalArgumentException if dnsSrvName is null or empty or invalid
+     *                                  or if no SRV records are found for the DNS name
+     *                                  or if DNS lookup fails
+     */
+    public DnsSrvHostProvider(final String dnsSrvName) {
+        this(dnsSrvName, null);
+    }
+
+
+    /**
+     * Constructs a DnsSrvHostProvider with the given DNS name and ZKClientConfig
+     *
+     * @param dnsSrvName the DNS name to query for SRV records
+     * @param clientConfig ZooKeeper client configuration
+     * @throws IllegalArgumentException if dnsSrvName is null or empty or invalid
+     *                                  or if no SRV records are found for the DNS name
+     *                                  or if DNS lookup fails
+     */
+    public DnsSrvHostProvider(final String dnsSrvName, final ZKClientConfig clientConfig) {
+        this(dnsSrvName, System.currentTimeMillis() ^ dnsSrvName.hashCode(), clientConfig);
+    }
+
+    /**
+     * Constructs a DnsSrvHostProvider with the given DNS name, randomness seed and ZKClientConfig
+     *
+     * @param dnsSrvName the DNS name to query for SRV records
+     * @param randomnessSeed seed for randomization
+     * @param clientConfig ZooKeeper client configuration
+     * @throws IllegalArgumentException if dnsSrvName is null or empty or invalid
+     *                                  or if no SRV records are found for the DNS name
+     *                                  or if DNS lookup fails
+     */
+    public DnsSrvHostProvider(final String dnsSrvName, final long randomnessSeed, final ZKClientConfig clientConfig) {
+        this(dnsSrvName, randomnessSeed, new DefaultDnsResolver(), clientConfig);
+    }
+
+    /**
+     * Constructs a DnsSrvHostProvider with the given DNS name, randomization seed, DNS resolver and ZKClientConfig
+     *
+     * @param dnsSrvName the DNS name to query for SRV records
+     * @param randomnessSeed seed for randomization
+     * @param dnsResolver custom DNS resolver
+     * @param clientConfig ZooKeeper client configuration
+     * @throws IllegalArgumentException if dnsSrvName is null or empty or invalid
+     *                                  or if no SRV records are found for the DNS name
+     *                                  or if DNS lookup fails
+     */
+    public DnsSrvHostProvider(final String dnsSrvName, final long randomnessSeed, final DnsSrvResolver dnsResolver, final ZKClientConfig clientConfig) {
+        if (StringUtils.isBlank(dnsSrvName)) {
+            throw new IllegalArgumentException("DNS name cannot be null or empty");
+        }
+
+        this.dnsSrvName = dnsSrvName;
+        this.dnsResolver = dnsResolver;
+        try {
+            final List<InetSocketAddress> serverAddresses = lookupDnsSrvRecords();
+            if (serverAddresses.isEmpty()) {
+                LOG.error("No SRV records found for DNS name: {}", dnsSrvName);
+                throw new IllegalArgumentException("No SRV records found for DNS name: " + dnsSrvName);
+            }
+
+            this.connectionManager = new HostConnectionManager(serverAddresses, randomnessSeed, clientConfig);
+            this.previousServerSet = new HashSet<>(serverAddresses);
+
+
+            final long refreshIntervalInSeconds = getRefreshInterval();
+            if (refreshIntervalInSeconds > 0) {
+                dnsRefreshTimer = new Timer("DnsSrvRefresh-" + dnsSrvName, true);
+                dnsRefreshTimer.scheduleAtFixedRate(new TimerTask() {
+                                                        @Override
+                                                        public void run() {
+                                                            refreshServerListInBackground();
+                                                        }
+                                                    },
+                        refreshIntervalInSeconds * 1000,
+                        refreshIntervalInSeconds * 1000);
+            }
+            LOG.info("DnsSrvHostProvider initialized with {} servers from DNS name: {} with refresh interval: {} seconds",
+                    serverAddresses.size(), dnsSrvName, refreshIntervalInSeconds);
+        } catch (final Exception e) {
+            LOG.error("Failed to initialize DnsSrvHostProvider for DNS name: {}", dnsSrvName, e);
+
+            if (dnsRefreshTimer != null) {
+                dnsRefreshTimer.cancel();
+            }
+
+            if (e instanceof IllegalArgumentException) {
+                throw e;
+            } else {
+                throw new IllegalArgumentException("Failed to initialize DnsSrvHostProvider for DNS name: " + dnsSrvName, e);
+            }
+        }
+    }
+
+    @Override
+    public int size() {
+        return connectionManager.size();
+    }
+
+    @Override
+    public InetSocketAddress next(long spinDelay) {
+        applyServerListUpdate();
+        return connectionManager.next(spinDelay);
+    }
+
+    @Override
+    public void onConnected() {
+        currentConnectedHost.set(connectionManager.getServerAtCurrentIndex());
+        connectionManager.onConnected();
+    }
+
+    @Override
+    public boolean updateServerList(Collection<InetSocketAddress> serverAddresses, InetSocketAddress currentHost) {
+        return connectionManager.updateServerList(serverAddresses, currentHost);
+    }
+
+    @Override
+    public void close() {
+        if (dnsRefreshTimer != null) {
+            dnsRefreshTimer.cancel();
+        }
+    }
+
+    private long getRefreshInterval() {
+        final long defaultInterval = ZKClientConfig.DNS_SRV_REFRESH_INTERVAL_SECONDS_DEFAULT;
+        final long interval = Long.getLong(ZKClientConfig.DNS_SRV_REFRESH_INTERVAL_SECONDS, defaultInterval);
+        if (interval < 0) {
+            LOG.error("Invalid DNS SRV refresh interval {} seconds", interval);
+            throw new IllegalArgumentException("Invalid DNS SRV refresh interval: " + interval);
+        }
+        if (interval == 0) {
+            LOG.info("DNS SRV refresh disabled (interval = 0) for {}", dnsSrvName);
+        }
+        return interval;
+    }
+
+    private List<InetSocketAddress> lookupDnsSrvRecords() {
+        final List<InetSocketAddress> addresses = new ArrayList<>();
+
+        try {
+            final SRVRecord[] srvRecords = dnsResolver.lookupSrvRecords(dnsSrvName);
+            for (final SRVRecord srvRecord : srvRecords) {
+                final InetSocketAddress address = createAddressFromSrvRecord(srvRecord);
+                if (address != null) {
+                    addresses.add(address);
+                }
+            }
+        } catch (final Exception e) {
+            LOG.error("DNS SRV lookup failed for {}", dnsSrvName, e);
+            throw new RuntimeException("DNS SRV lookup failed for " + dnsSrvName, e);
+        }
+        return addresses;
+    }
+
+    private InetSocketAddress createAddressFromSrvRecord(final SRVRecord srvRecord) {
+        if (srvRecord == null) {
+            LOG.error("Null SRV record encountered from DnsSrvResolver implementation");
+            return null;
+        }
+
+        try {
+            final String target = srvRecord.getTarget().toString(true);
+            final int port = srvRecord.getPort();
+
+            if (port <= 0 || port > 65535) {
+                LOG.error("Invalid port {} in SRV record for target {}", port, target);
+                return null;
+            }
+
+            if (StringUtils.isBlank(target)) {
+                LOG.error("Empty or blank target in SRV record {}", srvRecord);
+                return null;
+            }
+
+            return new InetSocketAddress(target, port);
+        } catch (final Exception e) {
+            LOG.error("Failed to create InetSocketAddress from SRV record {}", srvRecord, e);
+            return null;
+        }
+    }
+
+    /**
+     * Performs background DNS refresh to detect server list changes without caching DNS responses.
+     *
+     * <p><strong>Important:</strong> This method only detects changes, the actual fresh DNS query happens
+     * in {@link #applyServerListUpdate()} when needed.</p>
+     */
+    private void refreshServerListInBackground() {
+        try {
+            // Refresh the server list
+            final List<InetSocketAddress> newAddresses = lookupDnsSrvRecords();
+            if (newAddresses.isEmpty()) {
+                LOG.warn("DNS SRV lookup returned no records for {}, will retry on next refresh", dnsSrvName);
+                return;
+            }
+
+            // Check if server list has changed
+            final Set<InetSocketAddress> newServerSet = new HashSet<>(newAddresses);
+            if (!Objects.equals(previousServerSet, newServerSet)) {
+                serverListChanged.set(true);
+                LOG.info("Server list change detected from DNS SRV: {} servers", newAddresses.size());
+            }
+        } catch (final Exception e) {
+            LOG.warn("Failed to refresh server list from DNS SRV records for {}: {}", dnsSrvName, e.getMessage());
+        }
+    }
+
+    /**
+     * Apply pending server list updates when connection is actually needed.
+     * It is called from next() to ensure server list changes are applied with proper connection context.
+     */
+    private synchronized void applyServerListUpdate() {
+        if (serverListChanged.get()) {
+            try {
+                // Query DNS to get the updated server list
+                final List<InetSocketAddress> latestServerList = lookupDnsSrvRecords();
+                if (latestServerList.isEmpty()) {
+                    LOG.warn("DNS SRV lookup returned no records for {}, will use the existing ones", dnsSrvName);
+                    return;
+                }
+
+                final boolean needReconnect = connectionManager.updateServerList(latestServerList, currentConnectedHost.get());
+                previousServerSet = new HashSet<>(latestServerList);
+                serverListChanged.set(false);
+
+                LOG.info("Applied server list update during connection attempt. servers size: {}, need reconnection: {}",
+                        latestServerList.size(), needReconnect);
+            } catch (final Exception e) {
+                LOG.warn("Failed to apply server list update", e);
+            }
+        }
+    }
+
+    private static class DefaultDnsResolver implements DnsSrvResolver {
+        @Override
+        public SRVRecord[] lookupSrvRecords(final String dnsSrvName) throws IOException {
+            final Lookup lookup = new Lookup(dnsSrvName, Type.SRV);
+            final Record[] records = lookup.run();
+            if (lookup.getResult() != Lookup.SUCCESSFUL) {
+                final String errorMsg = lookup.getErrorString();
+                throw new IOException("DNS SRV lookup failed for " + dnsSrvName + ": " + errorMsg);
+            }
+
+            if (records == null) {
+                return new SRVRecord[0];
+            }
+            return Arrays.stream(records).map(SRVRecord.class::cast).toArray(SRVRecord[]::new);
+        }
+    }
+}
+
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/FourLetterWordMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/FourLetterWordMain.java
index 9fa042a72c2..b4e6602879b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/FourLetterWordMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/FourLetterWordMain.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.client;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.io.BufferedReader;
 import java.io.IOException;
 import java.io.InputStreamReader;
@@ -90,30 +91,84 @@ public static String send4LetterWord(
         String cmd,
         boolean secure,
         int timeout) throws IOException, SSLContextException {
-        LOG.info("connecting to {} {}", host, port);
-        Socket sock;
-        InetSocketAddress hostaddress = host != null
-            ? new InetSocketAddress(host, port)
-            : new InetSocketAddress(InetAddress.getByName(null), port);
-        if (secure) {
-            LOG.info("using secure socket");
+        return send4LetterWord(host, port, cmd, secure, timeout, null);
+    }
+
+    /**
+     * Send the 4letterword
+     * @param host the destination host
+     * @param port the destination port
+     * @param cmd the 4letterword
+     * @param clientConfig client config
+     * @param timeout in milliseconds, maximum time to wait while connecting/reading data
+     * @return server response
+     * @throws SSLContextException
+     * @throws IOException
+     */
+    public static String send4LetterWord(
+            String host,
+            int port,
+            String cmd,
+            ZKClientConfig clientConfig,
+            int timeout) throws SSLContextException, IOException {
+        boolean useSecure = clientConfig.getBoolean(ZKClientConfig.SECURE_CLIENT);
+        SSLContext sslContext = null;
+        if (useSecure) {
             try (X509Util x509Util = new ClientX509Util()) {
-                SSLContext sslContext = x509Util.getDefaultSSLContext();
+                sslContext = x509Util.createSSLContext(clientConfig);
+            }
+        }
+        return send4LetterWord(host, port, cmd, useSecure, timeout, sslContext);
+    }
+
+    /**
+     * Send the 4letterword
+     * @param host the destination host
+     * @param port the destination port
+     * @param cmd the 4letterword
+     * @param secure whether to use SSL
+     * @param timeout in milliseconds, maximum time to wait while connecting/reading data
+     * @param sslContext SSL context
+     * @return server response
+     * @throws java.io.IOException
+     * @throws SSLContextException
+     */
+    public static String send4LetterWord(
+        String host,
+        int port,
+        String cmd,
+        boolean secure,
+        int timeout,
+        SSLContext sslContext) throws IOException, SSLContextException {
+        LOG.info("connecting to {}:{} (secure={})", host, port, secure);
+
+        Socket sock = null;
+        BufferedReader reader = null;
+        try {
+            InetSocketAddress hostaddress = host != null
+                ? new InetSocketAddress(host, port)
+                : new InetSocketAddress(InetAddress.getByName(null), port);
+            if (secure) {
+                LOG.info("using secure socket");
+                if (sslContext == null) {
+                    try (X509Util x509Util = new ClientX509Util()) {
+                        sslContext = x509Util.getDefaultSSLContext();
+                    }
+                }
                 SSLSocketFactory socketFactory = sslContext.getSocketFactory();
                 SSLSocket sslSock = (SSLSocket) socketFactory.createSocket();
                 sslSock.connect(hostaddress, timeout);
                 sslSock.startHandshake();
                 sock = sslSock;
+            } else {
+                sock = new Socket();
+                sock.connect(hostaddress, timeout);
             }
-        } else {
-            sock = new Socket();
-            sock.connect(hostaddress, timeout);
-        }
-        sock.setSoTimeout(timeout);
-        BufferedReader reader = null;
-        try {
+            sock.setSoLinger(false, -1);
+            sock.setSoTimeout(timeout);
+            sock.setTcpNoDelay(true);
             OutputStream outstream = sock.getOutputStream();
-            outstream.write(cmd.getBytes());
+            outstream.write(cmd.getBytes(UTF_8));
             outstream.flush();
 
             // this replicates NC - close the output stream before reading
@@ -132,7 +187,9 @@ public static String send4LetterWord(
         } catch (SocketTimeoutException e) {
             throw new IOException("Exception while executing four letter word: " + cmd, e);
         } finally {
-            sock.close();
+            if (sock != null) {
+                sock.close();
+            }
             if (reader != null) {
                 reader.close();
             }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/HostConnectionManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/HostConnectionManager.java
new file mode 100644
index 00000000000..b278014a3ce
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/HostConnectionManager.java
@@ -0,0 +1,413 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.client;
+
+import java.net.InetAddress;
+import java.net.InetSocketAddress;
+import java.net.UnknownHostException;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.List;
+import java.util.Random;
+import org.apache.yetus.audience.InterfaceAudience;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Manages ZooKeeper server connections with round-robin selection and load balancing during
+ * cluster reconfiguration.
+ *
+ * <p><strong>Key Features:</strong></p>
+ * <ul>
+ * <li>Round-robin server selection with IP address resolution</li>
+ * <li>Migrates clients to balance load when servers are added or removed</li>
+ * <li>Probabilistic client migration during server list updates</li>
+ * </ul>
+ *
+ * <p><strong>Reconfiguration Behavior:</strong></p>
+ * When server list changes, enters "reconfigMode" and calculates migration probabilities
+ * to balance load between old and new servers.
+ *
+ * <p>See <a href="https://issues.apache.org/jira/browse/ZOOKEEPER-1355">ZOOKEEPER-1355</a>
+ * for more details.</p>
+ */
+@InterfaceAudience.Private
+public final class HostConnectionManager {
+
+    /**
+     * Interface for address resolution to support testing and different resolution strategies.
+     */
+    public interface Resolver {
+        InetAddress[] getAllByName(String name) throws UnknownHostException;
+    }
+
+    private static final Logger LOG = LoggerFactory.getLogger(HostConnectionManager.class);
+
+    private List<InetSocketAddress> serverAddresses;
+    private final Random sourceOfRandomness;
+    private final Resolver resolver;
+    private final ZKClientConfig clientConfig;
+
+    private int lastIndex;
+    private int currentIndex;
+
+    /**
+     * The following fields are used to migrate clients during reconfiguration
+     */
+    private boolean reconfigMode = false;
+    private final List<InetSocketAddress> oldServers = new ArrayList<>(5);
+    private final List<InetSocketAddress> newServers = new ArrayList<>(5);
+    private int currentIndexOld = -1;
+    private int currentIndexNew = -1;
+    private float pOld, pNew;
+
+    /**
+     * Constructs a HostConnectionManager with default resolver.
+     *
+     * @param serverAddresses
+     *              possibly unresolved ZooKeeper server addresses
+     *  @param randomnessSeed
+     *              a seed used to initialize sourceOfRandomness
+     * @param clientConfig
+     *              ZooKeeper client configuration
+     * @throws IllegalArgumentException
+     *              if serverAddresses is empty
+     */
+    public HostConnectionManager(Collection<InetSocketAddress> serverAddresses, long randomnessSeed, ZKClientConfig clientConfig) {
+        this(serverAddresses, randomnessSeed, null, clientConfig);
+    }
+
+    /**
+     * Constructs a HostConnectionManager with custom resolver.
+     *
+     * @param serverAddresses
+     *              possibly unresolved ZooKeeper server addresses
+     * @param randomnessSeed
+     *              a seed used to initialize sourceOfRandomness
+     * @param resolver
+     *              custom resolver implementation
+     * @param clientConfig
+     *              ZooKeeper client configuration
+     * @throws IllegalArgumentException
+     *              if serverAddresses is empty
+     */
+    public HostConnectionManager(Collection<InetSocketAddress> serverAddresses,
+                                long randomnessSeed,
+                                Resolver resolver,
+                                ZKClientConfig clientConfig) {
+        if (serverAddresses.isEmpty()) {
+            throw new IllegalArgumentException("A HostProvider may not be empty!");
+        }
+        this.sourceOfRandomness = new Random(randomnessSeed);
+        this.serverAddresses = shuffle(serverAddresses);
+        this.resolver = resolver == null ? InetAddress::getAllByName : resolver;
+        this.clientConfig = clientConfig == null ? new ZKClientConfig() : clientConfig;
+
+        currentIndex = -1;
+        lastIndex = -1;
+
+        LOG.info("HostConnectionManager initialized with {} servers", serverAddresses.size());
+    }
+
+    /**
+     * Update the list of servers. This returns true if changing connections is necessary for load-balancing, false
+     * otherwise. Changing connections is necessary if one of the following holds:
+     * a) the host to which this client is currently connected is not in serverAddresses.
+     *    Otherwise (if currentHost is in the new list serverAddresses):
+     * b) the number of servers in the cluster is increasing - in this case the load on currentHost should decrease,
+     *    which means that SOME of the clients connected to it will migrate to the new servers. The decision whether
+     *    this client migrates or not (i.e., whether true or false is returned) is probabilistic so that the expected
+     *    number of clients connected to each server is the same.
+     *
+     * If true is returned, the function sets pOld and pNew that correspond to the probability to migrate to one of the
+     * new servers in serverAddresses or one of the old servers (migrating to one of the old servers is done only
+     * if our client's currentHost is not in serverAddresses). See nextHostInReconfigMode for the selection logic.
+     *
+     * See <a href="https://issues.apache.org/jira/browse/ZOOKEEPER-1355">ZOOKEEPER-1355</a>
+     * for the protocol and its evaluation.
+     *
+     * @param serverAddresses
+     *              new host list
+     * @param currentHost
+     *              the host to which this client is currently connected
+     * @return true if changing connections is necessary for load-balancing, false otherwise
+     */
+    synchronized boolean updateServerList(Collection<InetSocketAddress> serverAddresses, InetSocketAddress currentHost) {
+        List<InetSocketAddress> shuffledList = shuffle(serverAddresses);
+        if (shuffledList.isEmpty()) {
+            throw new IllegalArgumentException("The server list may not be empty!");
+        }
+
+        int oldSize = this.serverAddresses.size();
+        int newSize = shuffledList.size();
+
+        // Check if client's current server is in the new list of servers
+        boolean myServerInNewConfig = false;
+        InetSocketAddress myServer = currentHost;
+
+        // choose "current" server according to the client rebalancing algorithm
+        if (reconfigMode) {
+            myServer = next(0);
+        }
+
+        // if the client is not currently connected to any server
+        if (myServer == null) {
+            // reconfigMode = false (next shouldn't return null).
+            if (lastIndex >= 0) {
+                // take the last server to which we were connected
+                myServer = this.serverAddresses.get(lastIndex);
+            } else {
+                // take the first server on the list
+                myServer = this.serverAddresses.get(0);
+            }
+        }
+
+        for (InetSocketAddress addr : shuffledList) {
+            if (addr.getPort() == myServer.getPort()
+                && ((addr.getAddress() != null
+                     && myServer.getAddress() != null
+                     && addr.getAddress().equals(myServer.getAddress()))
+                    || addr.getHostString().equals(myServer.getHostString()))) {
+                myServerInNewConfig = true;
+                break;
+            }
+        }
+
+        reconfigMode = true;
+
+        newServers.clear();
+        oldServers.clear();
+        // Divide the new servers into oldServers that were in the previous list
+        // and newServers that were not in the previous list
+        for (InetSocketAddress address : shuffledList) {
+            if (this.serverAddresses.contains(address)) {
+                oldServers.add(address);
+            } else {
+                newServers.add(address);
+            }
+        }
+
+        int numOld = oldServers.size();
+        int numNew = newServers.size();
+
+        // number of servers increased
+        if (numOld + numNew > this.serverAddresses.size()) {
+            if (myServerInNewConfig) {
+                // my server is in new config, but load should be decreased.
+                // Need to decide if this client
+                // is moving to one of the new servers
+                if (sourceOfRandomness.nextFloat() <= (1 - ((float) this.serverAddresses.size()) / (numOld + numNew))) {
+                    pNew = 1;
+                    pOld = 0;
+                } else {
+                    // do nothing special - stay with the current server
+                    reconfigMode = false;
+                }
+            } else {
+                // my server is not in new config, and load on old servers must
+                // be decreased, so connect to
+                // one of the new servers
+                pNew = 1;
+                pOld = 0;
+            }
+        } else { // number of servers stayed the same or decreased
+            if (myServerInNewConfig) {
+                // my server is in new config, and load should be increased, so
+                // stay with this server and do nothing special
+                reconfigMode = false;
+            } else {
+                pOld = ((float) (numOld * (this.serverAddresses.size() - (numOld + numNew))))
+                       / ((numOld + numNew) * (this.serverAddresses.size() - numOld));
+                pNew = 1 - pOld;
+            }
+        }
+
+        if (!reconfigMode) {
+            currentIndex = shuffledList.indexOf(getServerAtCurrentIndex());
+        } else {
+            currentIndex = -1;
+        }
+        this.serverAddresses = shuffledList;
+        currentIndexOld = -1;
+        currentIndexNew = -1;
+        lastIndex = currentIndex;
+
+        LOG.info("Server list updated: oldSize={}, newSize={}, reconfigMode={}", oldSize, newSize, reconfigMode);
+
+        return reconfigMode;
+    }
+
+    /**
+     * Get the next server to connect to.
+     *
+     * @param spinDelay milliseconds to wait if all hosts have been tried once
+     * @return the next server address to connect to
+     */
+    InetSocketAddress next(long spinDelay) {
+        boolean needToSleep = false;
+        InetSocketAddress addr;
+
+        synchronized (this) {
+            if (reconfigMode) {
+                addr = nextHostInReconfigMode();
+                if (addr != null) {
+                    currentIndex = serverAddresses.indexOf(addr);
+                    return resolve(addr);
+                }
+                //tried all servers and couldn't connect
+                reconfigMode = false;
+                needToSleep = (spinDelay > 0);
+            }
+            ++currentIndex;
+            if (currentIndex == serverAddresses.size()) {
+                currentIndex = 0;
+            }
+            addr = serverAddresses.get(currentIndex);
+            needToSleep = needToSleep || (currentIndex == lastIndex && spinDelay > 0);
+            if (lastIndex == -1) {
+                // We don't want to sleep on the first ever connect attempt.
+                lastIndex = 0;
+            }
+        }
+
+        if (needToSleep) {
+            try {
+                Thread.sleep(spinDelay);
+            } catch (InterruptedException e) {
+                LOG.warn("Unexpected exception", e);
+            }
+        }
+
+        return resolve(addr);
+    }
+
+    /**
+     * Notify that a connection has been established successfully.
+     */
+    synchronized void onConnected() {
+        lastIndex = currentIndex;
+        reconfigMode = false;
+    }
+
+    /**
+     * Get the server at the specified index.
+     *
+     * @param i the index
+     * @return the server address at the index, or null if index is out of bounds
+     */
+    synchronized InetSocketAddress getServerAtIndex(int i) {
+        if (i < 0 || i >= serverAddresses.size()) {
+            return null;
+        }
+        return serverAddresses.get(i);
+    }
+
+    /**
+     * Get the server at the current index.
+     *
+     * @return the server address at the current index
+     */
+    synchronized InetSocketAddress getServerAtCurrentIndex() {
+        return getServerAtIndex(currentIndex);
+    }
+
+    /**
+     * Get the number of servers in the list.
+     *
+     * @return the number of servers
+     */
+    synchronized int size() {
+        return serverAddresses.size();
+    }
+
+    /**
+     * Resolves an InetSocketAddress to a concrete address.
+     *
+     * @param address
+     *              the address to resolve
+     * @return resolved address or original address if resolution fails
+     */
+    private InetSocketAddress resolve(InetSocketAddress address) {
+        try {
+            String curHostString = address.getHostString();
+            List<InetAddress> resolvedAddresses = new ArrayList<>(Arrays.asList(this.resolver.getAllByName(curHostString)));
+            if (resolvedAddresses.isEmpty()) {
+                return address;
+            }
+            if (clientConfig.isShuffleDnsResponseEnabled()) {
+                Collections.shuffle(resolvedAddresses);
+            }
+            return new InetSocketAddress(resolvedAddresses.get(0), address.getPort());
+        } catch (UnknownHostException e) {
+            LOG.error("Unable to resolve address: {}", address, e);
+            return address;
+        }
+    }
+
+    /**
+     * Shuffles the server addresses using the internal random source.
+     *
+     * @param serverAddresses
+     *              collection of server addresses to shuffle
+     * @return shuffled list of server addresses
+     */
+    private List<InetSocketAddress> shuffle(Collection<InetSocketAddress> serverAddresses) {
+        List<InetSocketAddress> tmpList = new ArrayList<>(serverAddresses.size());
+        tmpList.addAll(serverAddresses);
+        Collections.shuffle(tmpList, sourceOfRandomness);
+        return tmpList;
+    }
+
+    /**
+     * Get the next server to connect to, when in "reconfigMode", which means that
+     * you've just updated the server list, and now trying to find some server to connect to.
+     * Once onConnected() is called, reconfigMode is set to false. Similarly, if we tried to connect
+     * to all servers in new config and failed, reconfigMode is set to false.
+     *
+     * While in reconfigMode, we should connect to a server in newServers with probability pNew and to servers in
+     * oldServers with probability pOld (which is just 1-pNew). If we tried out all servers in either oldServers
+     * or newServers we continue to try servers from the other set, regardless of pNew or pOld. If we tried all servers
+     * we give up and go back to the normal round robin mode
+     *
+     * When called, this should be protected by synchronized(this)
+     */
+    private InetSocketAddress nextHostInReconfigMode() {
+        boolean takeNew = (sourceOfRandomness.nextFloat() <= pNew);
+
+        // take one of the new servers if it is possible (there are still such
+        // servers we didn't try),
+        // and either the probability tells us to connect to one of the new
+        // servers or if we already
+        // tried all the old servers
+        if (((currentIndexNew + 1) < newServers.size()) && (takeNew || (currentIndexOld + 1) >= oldServers.size())) {
+            ++currentIndexNew;
+            return newServers.get(currentIndexNew);
+        }
+
+        // start taking old servers
+        if ((currentIndexOld + 1) < oldServers.size()) {
+            ++currentIndexOld;
+            return oldServers.get(currentIndexOld);
+        }
+
+        return null;
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/HostProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/HostProvider.java
index 73a102f1a8c..f154f080b00 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/HostProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/HostProvider.java
@@ -43,7 +43,7 @@
  * * A HostProvider that prefers nearby hosts.
  */
 @InterfaceAudience.Public
-public interface HostProvider {
+public interface HostProvider extends AutoCloseable {
 
     int size();
 
@@ -72,4 +72,12 @@ public interface HostProvider {
      */
     boolean updateServerList(Collection<InetSocketAddress> serverAddresses, InetSocketAddress currentHost);
 
+    /**
+     * Close the HostProvider and release any resources.
+     *
+     * Default implementation does nothing for backward compatibility
+     */
+    @Override
+    default void close() {
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/HostProviderFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/HostProviderFactory.java
new file mode 100644
index 00000000000..4f3f3a3741c
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/HostProviderFactory.java
@@ -0,0 +1,66 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.client;
+
+import org.apache.yetus.audience.InterfaceAudience;
+
+/**
+ * Factory for creating appropriate HostProvider instances based on connect string format.
+ * This factory enables zero-code-change migration by automatically detecting the connect
+ * string format and creating the appropriate HostProvider implementation.
+ *
+ * Supported formats:
+ * - Host:Port: "host1:port1,host2:port2,host3:port3" (StaticHostProvider)
+ * - DNS SRV: "dns-srv://service.domain.com"  (DnsSrvHostProvider)
+ *
+ * - Future formats can be easily added by extending the factory
+ */
+@InterfaceAudience.Public
+public class HostProviderFactory {
+    /**
+     * Creates a HostProvider based on the connect string format.
+     * This is a convenience method for zero-code-change migration.
+     *
+     * @param connectString the connect string
+     * @return appropriate HostProvider
+     */
+    public static HostProvider create(final String connectString) {
+        final ConnectStringParser connectStringParser = new ConnectStringParser(connectString);
+        return create(connectStringParser, null);
+    }
+
+    /**
+     * Creates a HostProvider based on the connect string format.
+     *
+     * @param connectStringParser the connect string parser
+     * @param clientConfig ZooKeeper client configuration
+     *
+     * @return appropriate HostProvider
+     */
+    @InterfaceAudience.Private
+    public static HostProvider create(final ConnectStringParser connectStringParser, final ZKClientConfig clientConfig) {
+        switch (connectStringParser.getConnectionType()) {
+            case DNS_SRV:
+                final String dnsSrvName = connectStringParser.getServerAddresses().get(0).getHostString();
+                return new DnsSrvHostProvider(dnsSrvName, clientConfig);
+            default:
+                return new StaticHostProvider(connectStringParser.getServerAddresses(), clientConfig);
+        }
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/StaticHostProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/StaticHostProvider.java
index 3f1ce4fdd28..6cc45a1a082 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/StaticHostProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/StaticHostProvider.java
@@ -21,15 +21,8 @@
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
 import java.net.UnknownHostException;
-import java.util.ArrayList;
-import java.util.Arrays;
 import java.util.Collection;
-import java.util.Collections;
-import java.util.List;
-import java.util.Random;
 import org.apache.yetus.audience.InterfaceAudience;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 /**
  * Most simple HostProvider, resolves on every next() call.
@@ -38,6 +31,7 @@
  * present across the stack like in JVM, OS level, hardware, etc. The best we could do here is to get the most recent
  * address from the underlying system which is considered up-to-date.
  *
+ * It uses HostConnectionManager for all connection management and reconfiguration logic.
  */
 @InterfaceAudience.Public
 public final class StaticHostProvider implements HostProvider {
@@ -48,30 +42,7 @@ public interface Resolver {
 
     }
 
-    private static final Logger LOG = LoggerFactory.getLogger(StaticHostProvider.class);
-
-    private List<InetSocketAddress> serverAddresses = new ArrayList<InetSocketAddress>(5);
-
-    private Random sourceOfRandomness;
-    private int lastIndex = -1;
-
-    private int currentIndex = -1;
-
-    /**
-     * The following fields are used to migrate clients during reconfiguration
-     */
-    private boolean reconfigMode = false;
-
-    private final List<InetSocketAddress> oldServers = new ArrayList<InetSocketAddress>(5);
-
-    private final List<InetSocketAddress> newServers = new ArrayList<InetSocketAddress>(5);
-
-    private int currentIndexOld = -1;
-    private int currentIndexNew = -1;
-
-    private float pOld, pNew;
-
-    private Resolver resolver;
+    private final HostConnectionManager connectionManager;
 
     /**
      * Constructs a SimpleHostSet.
@@ -82,12 +53,25 @@ public interface Resolver {
      *             if serverAddresses is empty or resolves to an empty list
      */
     public StaticHostProvider(Collection<InetSocketAddress> serverAddresses) {
-        init(serverAddresses, System.currentTimeMillis() ^ this.hashCode(), new Resolver() {
-            @Override
-            public InetAddress[] getAllByName(String name) throws UnknownHostException {
-                return InetAddress.getAllByName(name);
-            }
-        });
+        connectionManager = new HostConnectionManager(serverAddresses, System.currentTimeMillis() ^ this.hashCode(), null);
+    }
+
+    /**
+     * Constructs a SimpleHostSet with ZKClientConfig.
+     *
+     * Introduced this new overload in 3.10.0 in order to take advantage of some newly introduced feature flags. Like
+     * the shuffle (old) / not to shuffle (new) behavior of DNS resolution.
+     *
+     * @param serverAddresses
+     *            possibly unresolved ZooKeeper server addresses
+     * @param clientConfig
+     *            ZooKeeper client configuration
+     */
+    public StaticHostProvider(Collection<InetSocketAddress> serverAddresses, ZKClientConfig clientConfig) {
+        connectionManager = new HostConnectionManager(serverAddresses,
+                                                        System.currentTimeMillis() ^ this.hashCode(),
+                                                        null,
+                                                        clientConfig);
     }
 
     /**
@@ -102,7 +86,10 @@ public InetAddress[] getAllByName(String name) throws UnknownHostException {
      *              custom resolver implementation
      */
     public StaticHostProvider(Collection<InetSocketAddress> serverAddresses, Resolver resolver) {
-        init(serverAddresses, System.currentTimeMillis() ^ this.hashCode(), resolver);
+        this.connectionManager = new HostConnectionManager(serverAddresses,
+                                                    System.currentTimeMillis() ^ this.hashCode(),
+                                                    resolver::getAllByName,
+                                                    null);
     }
 
     /**
@@ -111,266 +98,42 @@ public StaticHostProvider(Collection<InetSocketAddress> serverAddresses, Resolve
      *
      * @param serverAddresses
      *            possibly unresolved ZooKeeper server addresses
-     * @param randomnessSeed a seed used to initialize sourceOfRandomnes
+     * @param randomnessSeed a seed used to initialize sourceOfRandomness
      * @throws IllegalArgumentException
      *             if serverAddresses is empty or resolves to an empty list
      */
     public StaticHostProvider(Collection<InetSocketAddress> serverAddresses, long randomnessSeed) {
-        init(serverAddresses, randomnessSeed, new Resolver() {
-            @Override
-            public InetAddress[] getAllByName(String name) throws UnknownHostException {
-                return InetAddress.getAllByName(name);
-            }
-        });
-    }
-
-    private void init(Collection<InetSocketAddress> serverAddresses, long randomnessSeed, Resolver resolver) {
-        this.sourceOfRandomness = new Random(randomnessSeed);
-        this.resolver = resolver;
-        if (serverAddresses.isEmpty()) {
-            throw new IllegalArgumentException("A HostProvider may not be empty!");
-        }
-        this.serverAddresses = shuffle(serverAddresses);
-        currentIndex = -1;
-        lastIndex = -1;
+        this.connectionManager = new HostConnectionManager(serverAddresses,
+                                                            randomnessSeed,
+                                                            null,
+                                                            null);
     }
 
-    private InetSocketAddress resolve(InetSocketAddress address) {
-        try {
-            String curHostString = address.getHostString();
-            List<InetAddress> resolvedAddresses = new ArrayList<>(Arrays.asList(this.resolver.getAllByName(curHostString)));
-            if (resolvedAddresses.isEmpty()) {
-                return address;
-            }
-            Collections.shuffle(resolvedAddresses);
-            return new InetSocketAddress(resolvedAddresses.get(0), address.getPort());
-        } catch (UnknownHostException e) {
-            LOG.error("Unable to resolve address: {}", address.toString(), e);
-            return address;
-        }
-    }
-
-    private List<InetSocketAddress> shuffle(Collection<InetSocketAddress> serverAddresses) {
-        List<InetSocketAddress> tmpList = new ArrayList<>(serverAddresses.size());
-        tmpList.addAll(serverAddresses);
-        Collections.shuffle(tmpList, sourceOfRandomness);
-        return tmpList;
-    }
-
-    /**
-     * Update the list of servers. This returns true if changing connections is necessary for load-balancing, false
-     * otherwise. Changing connections is necessary if one of the following holds:
-     * a) the host to which this client is currently connected is not in serverAddresses.
-     *    Otherwise (if currentHost is in the new list serverAddresses):
-     * b) the number of servers in the cluster is increasing - in this case the load on currentHost should decrease,
-     *    which means that SOME of the clients connected to it will migrate to the new servers. The decision whether
-     *    this client migrates or not (i.e., whether true or false is returned) is probabilistic so that the expected
-     *    number of clients connected to each server is the same.
-     *
-     * If true is returned, the function sets pOld and pNew that correspond to the probability to migrate to ones of the
-     * new servers in serverAddresses or one of the old servers (migrating to one of the old servers is done only
-     * if our client's currentHost is not in serverAddresses). See nextHostInReconfigMode for the selection logic.
-     *
-     * See <a href="https://issues.apache.org/jira/browse/ZOOKEEPER-1355">ZOOKEEPER-1355</a>
-     * for the protocol and its evaluation, and StaticHostProviderTest for the tests that illustrate how load balancing
-     * works with this policy.
-     *
-     * @param serverAddresses new host list
-     * @param currentHost the host to which this client is currently connected
-     * @return true if changing connections is necessary for load-balancing, false otherwise
-     */
     @Override
-    public synchronized boolean updateServerList(
-        Collection<InetSocketAddress> serverAddresses,
-        InetSocketAddress currentHost) {
-        List<InetSocketAddress> shuffledList = shuffle(serverAddresses);
-        if (shuffledList.isEmpty()) {
-            throw new IllegalArgumentException("A HostProvider may not be empty!");
-        }
-        // Check if client's current server is in the new list of servers
-        boolean myServerInNewConfig = false;
-
-        InetSocketAddress myServer = currentHost;
-
-        // choose "current" server according to the client rebalancing algorithm
-        if (reconfigMode) {
-            myServer = next(0);
-        }
-
-        // if the client is not currently connected to any server
-        if (myServer == null) {
-            // reconfigMode = false (next shouldn't return null).
-            if (lastIndex >= 0) {
-                // take the last server to which we were connected
-                myServer = this.serverAddresses.get(lastIndex);
-            } else {
-                // take the first server on the list
-                myServer = this.serverAddresses.get(0);
-            }
-        }
-
-        for (InetSocketAddress addr : shuffledList) {
-            if (addr.getPort() == myServer.getPort()
-                && ((addr.getAddress() != null
-                     && myServer.getAddress() != null
-                     && addr.getAddress().equals(myServer.getAddress()))
-                    || addr.getHostString().equals(myServer.getHostString()))) {
-                myServerInNewConfig = true;
-                break;
-            }
-        }
-
-        reconfigMode = true;
-
-        newServers.clear();
-        oldServers.clear();
-        // Divide the new servers into oldServers that were in the previous list
-        // and newServers that were not in the previous list
-        for (InetSocketAddress address : shuffledList) {
-            if (this.serverAddresses.contains(address)) {
-                oldServers.add(address);
-            } else {
-                newServers.add(address);
-            }
-        }
-
-        int numOld = oldServers.size();
-        int numNew = newServers.size();
-
-        // number of servers increased
-        if (numOld + numNew > this.serverAddresses.size()) {
-            if (myServerInNewConfig) {
-                // my server is in new config, but load should be decreased.
-                // Need to decide if this client
-                // is moving to one of the new servers
-                if (sourceOfRandomness.nextFloat() <= (1 - ((float) this.serverAddresses.size()) / (numOld + numNew))) {
-                    pNew = 1;
-                    pOld = 0;
-                } else {
-                    // do nothing special - stay with the current server
-                    reconfigMode = false;
-                }
-            } else {
-                // my server is not in new config, and load on old servers must
-                // be decreased, so connect to
-                // one of the new servers
-                pNew = 1;
-                pOld = 0;
-            }
-        } else { // number of servers stayed the same or decreased
-            if (myServerInNewConfig) {
-                // my server is in new config, and load should be increased, so
-                // stay with this server and do nothing special
-                reconfigMode = false;
-            } else {
-                pOld = ((float) (numOld * (this.serverAddresses.size() - (numOld + numNew))))
-                       / ((numOld + numNew) * (this.serverAddresses.size() - numOld));
-                pNew = 1 - pOld;
-            }
-        }
-
-        if (!reconfigMode) {
-            currentIndex = shuffledList.indexOf(getServerAtCurrentIndex());
-        } else {
-            currentIndex = -1;
-        }
-        this.serverAddresses = shuffledList;
-        currentIndexOld = -1;
-        currentIndexNew = -1;
-        lastIndex = currentIndex;
-        return reconfigMode;
+    public boolean updateServerList(Collection<InetSocketAddress> serverAddresses, InetSocketAddress currentHost) {
+        return connectionManager.updateServerList(serverAddresses, currentHost);
     }
 
-    public synchronized InetSocketAddress getServerAtIndex(int i) {
-        if (i < 0 || i >= serverAddresses.size()) {
-            return null;
-        }
-        return serverAddresses.get(i);
-    }
-
-    public synchronized InetSocketAddress getServerAtCurrentIndex() {
-        return getServerAtIndex(currentIndex);
+    @Override
+    public int size() {
+        return connectionManager.size();
     }
 
-    public synchronized int size() {
-        return serverAddresses.size();
+    @Override
+    public InetSocketAddress next(long spinDelay) {
+        return connectionManager.next(spinDelay);
     }
 
-    /**
-     * Get the next server to connect to, when in "reconfigMode", which means that
-     * you've just updated the server list, and now trying to find some server to connect to.
-     * Once onConnected() is called, reconfigMode is set to false. Similarly, if we tried to connect
-     * to all servers in new config and failed, reconfigMode is set to false.
-     *
-     * While in reconfigMode, we should connect to a server in newServers with probability pNew and to servers in
-     * oldServers with probability pOld (which is just 1-pNew). If we tried out all servers in either oldServers
-     * or newServers we continue to try servers from the other set, regardless of pNew or pOld. If we tried all servers
-     * we give up and go back to the normal round robin mode
-     *
-     * When called, this should be protected by synchronized(this)
-     */
-    private InetSocketAddress nextHostInReconfigMode() {
-        boolean takeNew = (sourceOfRandomness.nextFloat() <= pNew);
-
-        // take one of the new servers if it is possible (there are still such
-        // servers we didn't try),
-        // and either the probability tells us to connect to one of the new
-        // servers or if we already
-        // tried all the old servers
-        if (((currentIndexNew + 1) < newServers.size()) && (takeNew || (currentIndexOld + 1) >= oldServers.size())) {
-            ++currentIndexNew;
-            return newServers.get(currentIndexNew);
-        }
-
-        // start taking old servers
-        if ((currentIndexOld + 1) < oldServers.size()) {
-            ++currentIndexOld;
-            return oldServers.get(currentIndexOld);
-        }
-
-        return null;
+    @Override
+    public void onConnected() {
+        connectionManager.onConnected();
     }
 
-    public InetSocketAddress next(long spinDelay) {
-        boolean needToSleep = false;
-        InetSocketAddress addr;
-
-        synchronized (this) {
-            if (reconfigMode) {
-                addr = nextHostInReconfigMode();
-                if (addr != null) {
-                    currentIndex = serverAddresses.indexOf(addr);
-                    return resolve(addr);
-                }
-                //tried all servers and couldn't connect
-                reconfigMode = false;
-                needToSleep = (spinDelay > 0);
-            }
-            ++currentIndex;
-            if (currentIndex == serverAddresses.size()) {
-                currentIndex = 0;
-            }
-            addr = serverAddresses.get(currentIndex);
-            needToSleep = needToSleep || (currentIndex == lastIndex && spinDelay > 0);
-            if (lastIndex == -1) {
-                // We don't want to sleep on the first ever connect attempt.
-                lastIndex = 0;
-            }
-        }
-        if (needToSleep) {
-            try {
-                Thread.sleep(spinDelay);
-            } catch (InterruptedException e) {
-                LOG.warn("Unexpected exception", e);
-            }
-        }
-
-        return resolve(addr);
+    public InetSocketAddress getServerAtIndex(int i) {
+        return connectionManager.getServerAtIndex(i);
     }
 
-    public synchronized void onConnected() {
-        lastIndex = currentIndex;
-        reconfigMode = false;
+    public InetSocketAddress getServerAtCurrentIndex() {
+        return connectionManager.getServerAtCurrentIndex();
     }
-
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZKClientConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZKClientConfig.java
index 10c61375d1d..a429d483834 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZKClientConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZKClientConfig.java
@@ -19,10 +19,10 @@
 package org.apache.zookeeper.client;
 
 import java.io.File;
+import java.nio.file.Path;
 import org.apache.yetus.audience.InterfaceAudience;
-import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.common.ZKConfig;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
 
 /**
  * Handles client specific properties
@@ -35,13 +35,10 @@ public class ZKClientConfig extends ZKConfig {
     public static final String ZK_SASL_CLIENT_USERNAME_DEFAULT = "zookeeper";
     public static final String ZK_SASL_CLIENT_CANONICALIZE_HOSTNAME = "zookeeper.sasl.client.canonicalize.hostname";
     public static final String ZK_SASL_CLIENT_CANONICALIZE_HOSTNAME_DEFAULT = "true";
-    @SuppressWarnings("deprecation")
-    public static final String LOGIN_CONTEXT_NAME_KEY = ZooKeeperSaslClient.LOGIN_CONTEXT_NAME_KEY;
+    public static final String LOGIN_CONTEXT_NAME_KEY = "zookeeper.sasl.clientconfig";
     public static final String LOGIN_CONTEXT_NAME_KEY_DEFAULT = "Client";
-    @SuppressWarnings("deprecation")
-    public static final String ENABLE_CLIENT_SASL_KEY = ZooKeeperSaslClient.ENABLE_CLIENT_SASL_KEY;
-    @SuppressWarnings("deprecation")
-    public static final String ENABLE_CLIENT_SASL_DEFAULT = ZooKeeperSaslClient.ENABLE_CLIENT_SASL_DEFAULT;
+    public static final String ENABLE_CLIENT_SASL_KEY = "zookeeper.sasl.client";
+    public static final String ENABLE_CLIENT_SASL_DEFAULT = "true";
     public static final String ZOOKEEPER_SERVER_REALM = "zookeeper.server.realm";
     /**
      * This controls whether automatic watch resetting is enabled. Clients
@@ -50,13 +47,11 @@ public class ZKClientConfig extends ZKConfig {
      * "zookeeper.disableAutoWatchReset" to "true"
      */
     public static final String DISABLE_AUTO_WATCH_RESET = "zookeeper.disableAutoWatchReset";
-    @SuppressWarnings("deprecation")
-    public static final String ZOOKEEPER_CLIENT_CNXN_SOCKET = ZooKeeper.ZOOKEEPER_CLIENT_CNXN_SOCKET;
+    public static final String ZOOKEEPER_CLIENT_CNXN_SOCKET = "zookeeper.clientCnxnSocket";
     /**
      * Setting this to "true" will enable encrypted client-server communication.
      */
-    @SuppressWarnings("deprecation")
-    public static final String SECURE_CLIENT = ZooKeeper.SECURE_CLIENT;
+    public static final String SECURE_CLIENT = "zookeeper.client.secure";
     public static final int CLIENT_MAX_PACKET_LENGTH_DEFAULT = 0xfffff; /* 1 MB */
     public static final String ZOOKEEPER_REQUEST_TIMEOUT = "zookeeper.request.timeout";
     public static final String ZOOKEEPER_SERVER_PRINCIPAL = "zookeeper.server.principal";
@@ -64,20 +59,54 @@ public class ZKClientConfig extends ZKConfig {
      * Feature is disabled by default.
      */
     public static final long ZOOKEEPER_REQUEST_TIMEOUT_DEFAULT = 0;
+    public static final String ZK_SASL_CLIENT_ALLOW_REVERSE_DNS = "zookeeper.sasl.client.allowReverseDnsLookup";
+    public static final boolean ZK_SASL_CLIENT_ALLOW_REVERSE_DNS_DEFAULT = false;
+    /**
+     * True value preserves the old behavior is to shuffle the addresses in DNS response regardless of address type.
+     * This could help with buggy DNS servers which always return addresses in the same order, but at the same time
+     * ignores the JVM option java.net.preferIPv6Addresses.
+     */
+    public static final String ZOOKEEPER_SHUFFLE_DNS_RESPONSE = "zookeeper.shuffleDnsResponse";
+    public static final boolean ZOOKEEPER_SHUFFLE_DNS_RESPONSE_DEFAULT = false;
+
+    /**
+     * DNS SRV refresh interval in seconds for DnsSrvHostProvider.
+     * A value of 0 disables periodic refresh.
+     */
+    public static final String DNS_SRV_REFRESH_INTERVAL_SECONDS = "zookeeper.hostProvider.dnsSrvRefreshIntervalSeconds";
+    public static final long DNS_SRV_REFRESH_INTERVAL_SECONDS_DEFAULT = 60;
 
     public ZKClientConfig() {
         super();
         initFromJavaSystemProperties();
     }
 
+    /**
+     * <p><b>Use {@link ZKClientConfig#ZKClientConfig(Path configPath)} instead.</b>
+     *
+     * <p><b>The signature of this method has been changed to throw {@link ConfigException}
+     * instead of {@code QuorumPeerConfig.ConfigException}.</b>
+     */
+    @Deprecated
     public ZKClientConfig(File configFile) throws ConfigException {
         super(configFile);
     }
 
+    /**
+     * <p><b>Use {@link ZKClientConfig#ZKClientConfig(Path configPath)} instead.</b>
+     *
+     * <p><b>The signature of this method has been changed to throw {@link ConfigException}
+     * instead of {@code QuorumPeerConfig.ConfigException}.</b>
+     */
+    @Deprecated
     public ZKClientConfig(String configPath) throws ConfigException {
         super(configPath);
     }
 
+    public ZKClientConfig(Path configPath) throws ConfigException {
+        super(configPath);
+    }
+
     /**
      * Initialize all the ZooKeeper client properties which are configurable as
      * java system property
@@ -106,6 +135,8 @@ protected void handleBackwardCompatibility() {
         setProperty(DISABLE_AUTO_WATCH_RESET, System.getProperty(DISABLE_AUTO_WATCH_RESET));
         setProperty(ZOOKEEPER_CLIENT_CNXN_SOCKET, System.getProperty(ZOOKEEPER_CLIENT_CNXN_SOCKET));
         setProperty(SECURE_CLIENT, System.getProperty(SECURE_CLIENT));
+        setProperty(ZK_SASL_CLIENT_ALLOW_REVERSE_DNS, System.getProperty(ZK_SASL_CLIENT_ALLOW_REVERSE_DNS));
+        setProperty(DNS_SRV_REFRESH_INTERVAL_SECONDS, System.getProperty(DNS_SRV_REFRESH_INTERVAL_SECONDS));
     }
 
     /**
@@ -120,6 +151,14 @@ public boolean isSaslClientEnabled() {
         return Boolean.valueOf(getProperty(ENABLE_CLIENT_SASL_KEY, ENABLE_CLIENT_SASL_DEFAULT));
     }
 
+    /**
+     * Return true if we need to use the old behavior of default DNS resolver and always shuffle the IP addresses
+     * in the DNS lookup response in order to pick a completely random IP address.
+     */
+    public boolean isShuffleDnsResponseEnabled() {
+        return getBoolean(ZOOKEEPER_SHUFFLE_DNS_RESPONSE, ZOOKEEPER_SHUFFLE_DNS_RESPONSE_DEFAULT);
+    }
+
     /**
      * Get the value of the <code>key</code> property as an <code>long</code>.
      * If property is not set, the provided <code>defaultValue</code> is
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperBuilder.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperBuilder.java
new file mode 100644
index 00000000000..03b5f4c4ec0
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperBuilder.java
@@ -0,0 +1,191 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.client;
+
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+import java.io.IOException;
+import java.net.InetSocketAddress;
+import java.time.Duration;
+import java.util.Collection;
+import java.util.Objects;
+import java.util.function.Function;
+import org.apache.yetus.audience.InterfaceAudience;
+import org.apache.yetus.audience.InterfaceStability;
+import org.apache.zookeeper.Watcher;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.admin.ZooKeeperAdmin;
+
+/**
+ * Builder to construct {@link ZooKeeper} and {@link ZooKeeperAdmin}.
+ */
+@InterfaceAudience.Public
+@InterfaceStability.Evolving
+public class ZooKeeperBuilder {
+    private final String connectString;
+    private final Duration sessionTimeout;
+    private Duration newSessionTimeout = Duration.ofSeconds(Long.MAX_VALUE, 999_999_999L);
+    private Function<Collection<InetSocketAddress>, HostProvider> hostProvider;
+    private Watcher defaultWatcher;
+    private boolean canBeReadOnly = false;
+    private long sessionId = 0;
+    private byte[] sessionPasswd;
+    private ZKClientConfig clientConfig;
+
+    /**
+     * This is private and export for internal usage. Use {@link ZooKeeper#builder(String, Duration)} instead.
+     */
+    @InterfaceAudience.Private
+    public ZooKeeperBuilder(String connectString, Duration sessionTimeout) {
+        this.connectString = Objects.requireNonNull(connectString, "connect string must not be null");
+        this.sessionTimeout = Objects.requireNonNull(sessionTimeout, "session timeout must not be null");
+    }
+
+    /**
+     * Specified watcher to receive state changes, and node events if attached later.
+     *
+     * @param watcher
+     *            a watcher object which will be notified of state changes, may
+     *            also be notified for node events
+     * @return this
+     */
+    public ZooKeeperBuilder withDefaultWatcher(Watcher watcher) {
+        this.defaultWatcher = watcher;
+        return this;
+    }
+
+    /**
+     * Specifies a function to construct a {@link HostProvider} with initial server addresses from connect string.
+     *
+     * @param hostProvider
+     *            use this as HostProvider to enable custom behaviour.
+     * @return this
+     */
+    public ZooKeeperBuilder withHostProvider(Function<Collection<InetSocketAddress>, HostProvider> hostProvider) {
+        this.hostProvider = hostProvider;
+        return this;
+    }
+
+    /**
+     * Specifies whether the created client is allowed to go to read-only mode in case of partitioning.
+     *
+     * @param canBeReadOnly
+     *            whether the created client is allowed to go to
+     *            read-only mode in case of partitioning. Read-only mode
+     *            basically means that if the client can't find any majority
+     *            servers but there's partitioned server it could reach, it
+     *            connects to one in read-only mode, i.e. read requests are
+     *            allowed while write requests are not. It continues seeking for
+     *            majority in the background.
+     * @return this
+     * @since 3.4
+     */
+    public ZooKeeperBuilder withCanBeReadOnly(boolean canBeReadOnly) {
+        this.canBeReadOnly = canBeReadOnly;
+        return this;
+    }
+
+    /**
+     * Specifies session id and password in session reestablishment.
+     *
+     * @param sessionId
+     *            session id to use if reconnecting, otherwise 0 to open new session
+     * @param sessionPasswd
+     *            password for this session
+     * @return this
+     * @see ZooKeeper#getSessionId()
+     * @see ZooKeeper#getSessionPasswd()
+     */
+    @SuppressFBWarnings({"EI_EXPOSE_REP", "EI_EXPOSE_REP2"})
+    public ZooKeeperBuilder withSession(long sessionId, byte[] sessionPasswd) {
+        this.sessionId = sessionId;
+        this.sessionPasswd = sessionPasswd;
+        return this;
+    }
+
+    /**
+     * Specifies timeout to establish a brand-new session.
+     *
+     * @param timeout timeout to get {@link org.apache.zookeeper.Watcher.Event.KeeperState#Expired} in establishing a
+     *                brand-new session. {@code Duration.ofSeconds(Long.MAX_VALUE, 999_999_999L)}, which is the default,
+     *                means endless retry until connected. {@code Duration.ZERO} means a sensible value deduced from
+     *                specified session timeout, currently, it is approximate {@code sessionTimeout * 4 / 3}.
+     * @return this
+     * @since 3.10.0
+     */
+    public ZooKeeperBuilder withNewSessionTimeout(Duration timeout) {
+        this.newSessionTimeout = timeout;
+        return this;
+    }
+
+    /**
+     * Specifies the client config used to construct ZooKeeper instances.
+     *
+     * @param clientConfig
+     *            passing this conf object gives each client the flexibility of
+     *            configuring properties differently compared to other instances
+     * @return this
+     * @since 3.5.2
+     */
+    public ZooKeeperBuilder withClientConfig(ZKClientConfig clientConfig) {
+        this.clientConfig = clientConfig;
+        return this;
+    }
+
+    /**
+     * Creates a {@link ZooKeeperOptions} with configured options.
+     *
+     * <p>This is private and export for internal usage.
+     *
+     * @apiNote helper to delegate existing constructors to {@link ZooKeeper#ZooKeeper(ZooKeeperOptions)}
+     */
+    @InterfaceAudience.Private
+    public ZooKeeperOptions toOptions() {
+        return new ZooKeeperOptions(
+            connectString,
+            sessionTimeout,
+            newSessionTimeout,
+            defaultWatcher,
+            hostProvider,
+            canBeReadOnly,
+            sessionId,
+            sessionPasswd,
+            clientConfig
+        );
+    }
+
+    /**
+     * Constructs an instance of {@link ZooKeeper}.
+     *
+     * @return an instance of {@link ZooKeeper}
+     * @throws IOException from constructor of {@link ZooKeeper}
+     */
+    public ZooKeeper build() throws IOException {
+        return new ZooKeeper(toOptions());
+    }
+
+    /**
+     * Constructs an instance of {@link ZooKeeperAdmin}.
+     *
+     * @return an instance of {@link ZooKeeperAdmin}
+     * @throws IOException from constructor of {@link ZooKeeperAdmin}
+     */
+    public ZooKeeperAdmin buildAdmin() throws IOException {
+        return new ZooKeeperAdmin(toOptions());
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperOptions.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperOptions.java
new file mode 100644
index 00000000000..2605cb0f8c4
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperOptions.java
@@ -0,0 +1,104 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.client;
+
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+import java.net.InetSocketAddress;
+import java.time.Duration;
+import java.util.Collection;
+import java.util.function.Function;
+import org.apache.yetus.audience.InterfaceAudience;
+import org.apache.zookeeper.Watcher;
+
+/**
+ * Options to construct {@link org.apache.zookeeper.ZooKeeper} and {@link org.apache.zookeeper.admin.ZooKeeperAdmin}.
+ */
+@InterfaceAudience.Private
+public class ZooKeeperOptions {
+    private final String connectString;
+    private final Duration sessionTimeout;
+    private final Duration newSessionTimeout;
+    private final Watcher defaultWatcher;
+    private final Function<Collection<InetSocketAddress>, HostProvider> hostProvider;
+    private final boolean canBeReadOnly;
+    private final long sessionId;
+    private final byte[] sessionPasswd;
+    private final ZKClientConfig clientConfig;
+
+    ZooKeeperOptions(String connectString,
+                     Duration sessionTimeout,
+                     Duration newSessionTimeout,
+                     Watcher defaultWatcher,
+                     Function<Collection<InetSocketAddress>, HostProvider> hostProvider,
+                     boolean canBeReadOnly,
+                     long sessionId,
+                     byte[] sessionPasswd,
+                     ZKClientConfig clientConfig) {
+        this.connectString = connectString;
+        this.sessionTimeout = sessionTimeout;
+        this.newSessionTimeout = newSessionTimeout;
+        this.hostProvider = hostProvider;
+        this.defaultWatcher = defaultWatcher;
+        this.canBeReadOnly = canBeReadOnly;
+        this.sessionId = sessionId;
+        this.sessionPasswd = sessionPasswd;
+        this.clientConfig = clientConfig;
+    }
+
+    public String getConnectString() {
+        return connectString;
+    }
+
+    public int getSessionTimeoutMs() {
+        return (int) Long.min(Integer.MAX_VALUE, sessionTimeout.toMillis());
+    }
+
+    public long getNewSessionTimeoutMs() {
+        try {
+            return newSessionTimeout.toMillis();
+        } catch (ArithmeticException ignored) {
+            return Long.MAX_VALUE;
+        }
+    }
+
+    public Watcher getDefaultWatcher() {
+        return defaultWatcher;
+    }
+
+    public Function<Collection<InetSocketAddress>, HostProvider> getHostProvider() {
+        return hostProvider;
+    }
+
+    public boolean isCanBeReadOnly() {
+        return canBeReadOnly;
+    }
+
+    public long getSessionId() {
+        return sessionId;
+    }
+
+    @SuppressFBWarnings({"EI_EXPOSE_REP", "EI_EXPOSE_REP2"})
+    public byte[] getSessionPasswd() {
+        return sessionPasswd;
+    }
+
+    public ZKClientConfig getClientConfig() {
+        return clientConfig;
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperSaslClient.java b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperSaslClient.java
index b0598bca87f..7bccbe80ec6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperSaslClient.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/client/ZooKeeperSaslClient.java
@@ -21,7 +21,10 @@
 import java.io.IOException;
 import java.security.PrivilegedActionException;
 import java.security.PrivilegedExceptionAction;
+import java.util.concurrent.atomic.AtomicReference;
+import java.util.function.Supplier;
 import javax.security.auth.Subject;
+import javax.security.auth.callback.CallbackHandler;
 import javax.security.auth.login.AppConfigurationEntry;
 import javax.security.auth.login.Configuration;
 import javax.security.auth.login.LoginException;
@@ -51,20 +54,19 @@ public class ZooKeeperSaslClient {
      *             instead.
      */
     @Deprecated
-    public static final String LOGIN_CONTEXT_NAME_KEY = "zookeeper.sasl.clientconfig";
+    public static final String LOGIN_CONTEXT_NAME_KEY = ZKClientConfig.LOGIN_CONTEXT_NAME_KEY;
     /**
      * @deprecated Use {@link ZKClientConfig#ENABLE_CLIENT_SASL_KEY}
      *             instead.
      */
     @Deprecated
-    public static final String ENABLE_CLIENT_SASL_KEY = "zookeeper.sasl.client";
+    public static final String ENABLE_CLIENT_SASL_KEY = ZKClientConfig.ENABLE_CLIENT_SASL_KEY;
     /**
      * @deprecated Use {@link ZKClientConfig#ENABLE_CLIENT_SASL_DEFAULT}
      *             instead.
      */
     @Deprecated
-    public static final String ENABLE_CLIENT_SASL_DEFAULT = "true";
-    private volatile boolean initializedLogin = false;
+    public static final String ENABLE_CLIENT_SASL_DEFAULT = ZKClientConfig.ENABLE_CLIENT_SASL_DEFAULT;
 
     /**
      * Returns true if the SASL client is enabled. By default, the client
@@ -112,7 +114,7 @@ public String getLoginContext() {
         return null;
     }
 
-    public ZooKeeperSaslClient(final String serverPrincipal, ZKClientConfig clientConfig) throws LoginException {
+    public ZooKeeperSaslClient(final String serverPrincipal, ZKClientConfig clientConfig, AtomicReference<Login> loginRef) throws LoginException {
         /**
          * ZOOKEEPER-1373: allow system property to specify the JAAS
          * configuration section that the zookeeper client should use.
@@ -136,7 +138,8 @@ public ZooKeeperSaslClient(final String serverPrincipal, ZKClientConfig clientCo
         }
         if (entries != null) {
             this.configStatus = "Will attempt to SASL-authenticate using Login Context section '" + clientSection + "'";
-            this.saslClient = createSaslClient(serverPrincipal, clientSection);
+            this.saslClient = createSaslClient(serverPrincipal, clientSection, loginRef);
+            this.login = loginRef.get();
         } else {
             // Handle situation of clientSection's being null: it might simply because the client does not intend to
             // use SASL, so not necessarily an error.
@@ -215,7 +218,7 @@ public void processResult(int rc, String path, Object ctx, byte[] data, Stat sta
             // data[] contains the Zookeeper Server's SASL token.
             // ctx is the ZooKeeperSaslClient object. We use this object's respondToServer() method
             // to reply to the Zookeeper Server's SASL token
-            ZooKeeperSaslClient client = ((ClientCnxn) ctx).zooKeeperSaslClient;
+            ZooKeeperSaslClient client = ((ClientCnxn) ctx).getZooKeeperSaslClient();
             if (client == null) {
                 LOG.warn("sasl client was unexpectedly null: cannot respond to Zookeeper server.");
                 return;
@@ -234,26 +237,26 @@ public void processResult(int rc, String path, Object ctx, byte[] data, Stat sta
 
     private SaslClient createSaslClient(
         final String servicePrincipal,
-        final String loginContext) throws LoginException {
+        final String loginContext,
+        final AtomicReference<Login> loginRef) throws LoginException {
         try {
-            if (!initializedLogin) {
-                synchronized (this) {
-                    if (login == null) {
-                        LOG.debug("JAAS loginContext is: {}", loginContext);
-                        // note that the login object is static: it's shared amongst all zookeeper-related connections.
-                        // in order to ensure the login is initialized only once, it must be synchronized the code snippet.
-                        login = new Login(loginContext, new SaslClientCallbackHandler(null, "Client"), clientConfig);
-                        login.startThreadIfNeeded();
-                        initializedLogin = true;
-                    }
+            if (loginRef.get() == null) {
+                LOG.debug("JAAS loginContext is: {}", loginContext);
+                Supplier<CallbackHandler> callbackHandlerSupplier = () -> {
+                    return new SaslClientCallbackHandler(null, "Client");
+                };
+                Login l = new Login(loginContext, callbackHandlerSupplier, clientConfig);
+                if (loginRef.compareAndSet(null, l)) {
+                    l.startThreadIfNeeded();
                 }
             }
-            return SecurityUtils.createSaslClient(login.getSubject(), servicePrincipal, "zookeeper", "zk-sasl-md5", LOG, "Client");
+            return SecurityUtils.createSaslClient(clientConfig, loginRef.get().getSubject(),
+                servicePrincipal, "zookeeper", "zk-sasl-md5", LOG, "Client");
         } catch (LoginException e) {
             // We throw LoginExceptions...
             throw e;
         } catch (Exception e) {
-            // ..but consume (with a log message) all other types of exceptions.
+            // ...but consume (with a log message) all other types of exceptions.
             LOG.error("Exception while trying to create SASL client.", e);
             return null;
         }
@@ -451,14 +454,4 @@ public boolean clientTunneledAuthenticationInProgress() {
             return false;
         }
     }
-
-    /**
-     * close login thread if running
-     */
-    public void shutdown() {
-        if (null != login) {
-            login.shutdown();
-        }
-    }
-
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/AtomicFileOutputStream.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/AtomicFileOutputStream.java
index 1574815f41a..d6b7cf6a419 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/AtomicFileOutputStream.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/AtomicFileOutputStream.java
@@ -45,7 +45,7 @@
  */
 public class AtomicFileOutputStream extends FilterOutputStream {
 
-    private static final String TMP_EXTENSION = ".tmp";
+    public static final String TMP_EXTENSION = ".tmp";
 
     private static final Logger LOG = LoggerFactory.getLogger(AtomicFileOutputStream.class);
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/AtomicFileWritingIdiom.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/AtomicFileWritingIdiom.java
index 6e20b780546..903f8e493a3 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/AtomicFileWritingIdiom.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/AtomicFileWritingIdiom.java
@@ -59,7 +59,7 @@ private AtomicFileWritingIdiom(
         OutputStreamStatement osStmt,
         WriterStatement wStmt) throws IOException {
         AtomicFileOutputStream out = null;
-        boolean error = true;
+        boolean triedToClose = false;
         try {
             out = new AtomicFileOutputStream(targetFile);
             if (wStmt == null) {
@@ -71,20 +71,18 @@ private AtomicFileWritingIdiom(
                 wStmt.write(bw);
                 bw.flush();
             }
-            out.flush();
+            triedToClose = true;
+            // close() will do the best to clean up file/resources in case of errors
+            // worst case the tmp file may still exist
+            out.close();
             // everything went ok
-            error = false;
         } finally {
             // nothing interesting to do if out == null
             if (out != null) {
-                if (error) {
+                if (!triedToClose) {
                     // worst case here the tmp file/resources(fd) are not cleaned up
                     // and the caller will be notified (IOException)
                     out.abort();
-                } else {
-                    // if the close operation (rename) fails we'll get notified.
-                    // worst case the tmp file may still exist
-                    IOUtils.closeStream(out);
                 }
             }
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/BCFKSFileLoader.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/BCFKSFileLoader.java
new file mode 100644
index 00000000000..d59f40a2056
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/BCFKSFileLoader.java
@@ -0,0 +1,39 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common;
+
+
+/**
+ * Implementation of {@link FileKeyStoreLoader} that loads from BCKFS files.
+ */
+class BCFKSFileLoader extends StandardTypeFileKeyStoreLoader {
+    private BCFKSFileLoader(String keyStorePath,
+                            String trustStorePath,
+                            String keyStorePassword,
+                            String trustStorePassword) {
+        super(keyStorePath, trustStorePath, keyStorePassword, trustStorePassword, SupportedStandardKeyFormat.BCFKS);
+    }
+
+    static class Builder extends FileKeyStoreLoader.Builder<BCFKSFileLoader> {
+        @Override
+        BCFKSFileLoader build() {
+            return new BCFKSFileLoader(keyStorePath, trustStorePath, keyStorePassword, trustStorePassword);
+        }
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java
index 34be0beceb3..1e50b84257c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java
@@ -18,9 +18,30 @@
 
 package org.apache.zookeeper.common;
 
+import io.netty.handler.ssl.DelegatingSslContext;
+import io.netty.handler.ssl.OpenSsl;
+import io.netty.handler.ssl.SslContext;
+import io.netty.handler.ssl.SslContextBuilder;
+import io.netty.handler.ssl.SslProvider;
+import java.security.Security;
+import java.util.Arrays;
+import javax.net.ssl.KeyManager;
+import javax.net.ssl.SSLEngine;
+import javax.net.ssl.SSLException;
+import javax.net.ssl.SSLParameters;
+import javax.net.ssl.TrustManager;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * X509 utilities specific for client-server communication framework.
+ */
 public class ClientX509Util extends X509Util {
 
+    private static final Logger LOG = LoggerFactory.getLogger(ClientX509Util.class);
+
     private final String sslAuthProviderProperty = getConfigPrefix() + "authProvider";
+    private final String sslProviderProperty = getConfigPrefix() + "sslProvider";
 
     @Override
     protected String getConfigPrefix() {
@@ -36,4 +57,129 @@ public String getSslAuthProviderProperty() {
         return sslAuthProviderProperty;
     }
 
+    public String getSslProviderProperty() {
+        return sslProviderProperty;
+    }
+
+    public SslContext createNettySslContextForClient(ZKConfig config)
+        throws X509Exception.KeyManagerException, X509Exception.TrustManagerException, SSLException {
+        SslContextBuilder sslContextBuilder = SslContextBuilder.forClient();
+
+        KeyManager km = buildKeyManager(config);
+        if (km != null) {
+            sslContextBuilder.keyManager(km);
+        }
+
+        TrustManager tm = buildTrustManager(config);
+        if (tm != null) {
+            sslContextBuilder.trustManager(tm);
+        }
+
+        handleTcnativeOcspStapling(sslContextBuilder, config);
+        String[] enabledProtocols = getEnabledProtocols(config);
+        if (enabledProtocols != null) {
+            sslContextBuilder.protocols(enabledProtocols);
+        }
+        Iterable<String> enabledCiphers = getCipherSuites(config);
+        if (enabledCiphers != null) {
+            sslContextBuilder.ciphers(enabledCiphers);
+        }
+        sslContextBuilder.sslProvider(getSslProvider(config));
+
+        SslContext sslContext1 = sslContextBuilder.build();
+
+        if ((getFipsMode(config) || tm == null) && isServerHostnameVerificationEnabled(config)) {
+            return addHostnameVerification(sslContext1, "Server");
+        } else {
+            return sslContext1;
+        }
+    }
+
+    public SslContext createNettySslContextForServer(ZKConfig config)
+        throws X509Exception.SSLContextException, X509Exception.KeyManagerException, X509Exception.TrustManagerException, SSLException {
+        KeyManager km = buildKeyManager(config);
+        if (km == null) {
+            throw new X509Exception.SSLContextException(
+                "Keystore is required for SSL server: " + getSslKeystoreLocationProperty());
+        }
+        return createNettySslContextForServer(config, km, buildTrustManager(config));
+    }
+
+    public SslContext createNettySslContextForServer(ZKConfig config, KeyManager keyManager, TrustManager trustManager) throws SSLException {
+        SslContextBuilder sslContextBuilder = SslContextBuilder.forServer(keyManager);
+
+        if (trustManager != null) {
+            sslContextBuilder.trustManager(trustManager);
+        }
+
+        handleTcnativeOcspStapling(sslContextBuilder, config);
+        String[] enabledProtocols = getEnabledProtocols(config);
+        if (enabledProtocols != null) {
+            sslContextBuilder.protocols(enabledProtocols);
+        }
+        sslContextBuilder.clientAuth(getClientAuth(config).toNettyClientAuth());
+        Iterable<String> enabledCiphers = getCipherSuites(config);
+        if (enabledCiphers != null) {
+            sslContextBuilder.ciphers(enabledCiphers);
+        }
+        sslContextBuilder.sslProvider(getSslProvider(config));
+
+        SslContext sslContext1 = sslContextBuilder.build();
+
+        if ((getFipsMode(config) || trustManager == null) && isClientHostnameVerificationEnabled(config)) {
+            return addHostnameVerification(sslContext1, "Client");
+        } else {
+            return sslContext1;
+        }
+    }
+
+    private SslContextBuilder handleTcnativeOcspStapling(SslContextBuilder builder, ZKConfig config) {
+        SslProvider sslProvider = getSslProvider(config);
+        boolean tcnative = sslProvider == SslProvider.OPENSSL || sslProvider == SslProvider.OPENSSL_REFCNT;
+        boolean ocspEnabled = config.getBoolean(getSslOcspEnabledProperty(), Boolean.parseBoolean(Security.getProperty("ocsp.enable")));
+
+        if (tcnative && ocspEnabled && OpenSsl.isOcspSupported()) {
+            builder.enableOcsp(ocspEnabled);
+        }
+        return builder;
+    }
+
+    private SslContext addHostnameVerification(SslContext sslContext, String clientOrServer) {
+        return new DelegatingSslContext(sslContext) {
+            @Override
+            protected void initEngine(SSLEngine sslEngine) {
+                SSLParameters sslParameters = sslEngine.getSSLParameters();
+                sslParameters.setEndpointIdentificationAlgorithm("HTTPS");
+                sslEngine.setSSLParameters(sslParameters);
+                if (LOG.isDebugEnabled()) {
+                    LOG.debug("{} hostname verification: enabled HTTPS style endpoint identification algorithm", clientOrServer);
+                }
+            }
+        };
+    }
+
+    private String[] getEnabledProtocols(final ZKConfig config) {
+        String enabledProtocolsInput = config.getProperty(getSslEnabledProtocolsProperty());
+        if (enabledProtocolsInput == null) {
+            return null;
+        }
+        return enabledProtocolsInput.split(",");
+    }
+
+    private X509Util.ClientAuth getClientAuth(final ZKConfig config) {
+        return X509Util.ClientAuth.fromPropertyValue(config.getProperty(getSslClientAuthProperty()));
+    }
+
+    private Iterable<String> getCipherSuites(final ZKConfig config) {
+        String cipherSuitesInput = config.getProperty(getSslCipherSuitesProperty());
+        if (cipherSuitesInput == null) {
+            return null;
+        } else {
+            return Arrays.asList(cipherSuitesInput.split(","));
+        }
+    }
+
+    public SslProvider getSslProvider(ZKConfig config) {
+        return SslProvider.valueOf(config.getProperty(getSslProviderProperty(), "JDK"));
+    }
 }
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogIterator.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ConfigException.java
similarity index 74%
rename from zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogIterator.java
rename to zookeeper-server/src/main/java/org/apache/zookeeper/common/ConfigException.java
index 9af440ba1c9..7afedb4923e 100644
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogIterator.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ConfigException.java
@@ -1,4 +1,4 @@
-/**
+/*
  * Licensed to the Apache Software Foundation (ASF) under one
  * or more contributor license agreements.  See the NOTICE file
  * distributed with this work for additional information
@@ -15,12 +15,17 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.apache.zookeeper.graph;
 
-import java.io.Closeable;
-import java.util.Iterator;
-import java.io.IOException;
+package org.apache.zookeeper.common;
 
-public interface LogIterator extends Iterator<LogEntry>, Closeable {
-    long size() throws IOException;;
-};
+/**
+ * Configuration related exception.
+ */
+public class ConfigException extends Exception {
+    public ConfigException(String msg) {
+        super(msg);
+    }
+    public ConfigException(String msg, Exception e) {
+        super(msg, e);
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/FileKeyStoreLoaderBuilderProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/FileKeyStoreLoaderBuilderProvider.java
index 169fb9e5639..f4798af64ae 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/FileKeyStoreLoaderBuilderProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/FileKeyStoreLoaderBuilderProvider.java
@@ -38,6 +38,8 @@ static FileKeyStoreLoader.Builder<? extends FileKeyStoreLoader> getBuilderForKey
             return new PEMFileLoader.Builder();
         case PKCS12:
             return new PKCS12FileLoader.Builder();
+        case BCFKS:
+            return new BCFKSFileLoader.Builder();
         default:
             throw new AssertionError("Unexpected StoreFileType: " + type.name());
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/IOUtils.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/IOUtils.java
index 6dc1ee90364..7267d5420df 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/IOUtils.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/IOUtils.java
@@ -70,7 +70,7 @@ public static void cleanup(Logger log, Closeable... closeables) {
      * Copies from one stream to another.
      *
      * @param in
-     *            InputStrem to read from
+     *            InputStream to read from
      * @param out
      *            OutputStream to write to
      * @param buffSize
@@ -100,7 +100,7 @@ public static void copyBytes(InputStream in, OutputStream out, int buffSize, boo
      * Copies from one stream to another.
      *
      * @param in
-     *            InputStrem to read from
+     *            InputStream to read from
      * @param out
      *            OutputStream to write to
      * @param buffSize
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/JKSFileLoader.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/JKSFileLoader.java
index 8be7c376917..d8709d7bde0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/JKSFileLoader.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/JKSFileLoader.java
@@ -18,8 +18,6 @@
 
 package org.apache.zookeeper.common;
 
-import java.security.KeyStore;
-import java.security.KeyStoreException;
 
 /**
  * Implementation of {@link FileKeyStoreLoader} that loads from JKS files.
@@ -31,12 +29,7 @@ private JKSFileLoader(
         String trustStorePath,
         String keyStorePassword,
         String trustStorePassword) {
-        super(keyStorePath, trustStorePath, keyStorePassword, trustStorePassword);
-    }
-
-    @Override
-    protected KeyStore keyStoreInstance() throws KeyStoreException {
-        return KeyStore.getInstance("JKS");
+        super(keyStorePath, trustStorePath, keyStorePassword, trustStorePassword, SupportedStandardKeyFormat.JKS);
     }
 
     static class Builder extends FileKeyStoreLoader.Builder<JKSFileLoader> {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/KeyStoreFileType.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/KeyStoreFileType.java
index ecc1e5f4c12..69283f31f9d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/KeyStoreFileType.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/KeyStoreFileType.java
@@ -20,12 +20,13 @@
 
 /**
  * This enum represents the file type of a KeyStore or TrustStore.
- * Currently, JKS (Java keystore), PEM, and PKCS12 types are supported.
+ * Currently, JKS (Java keystore), PEM, PKCS12, and BCFKS types are supported.
  */
 public enum KeyStoreFileType {
     JKS(".jks"),
     PEM(".pem"),
-    PKCS12(".p12");
+    PKCS12(".p12"),
+    BCFKS(".bcfks");
 
     private final String defaultFileExtension;
 
@@ -55,7 +56,7 @@ public String getDefaultFileExtension() {
      * @return the KeyStoreFileType, or <code>null</code> if
      *         <code>propertyValue</code> is <code>null</code> or empty.
      * @throws IllegalArgumentException if <code>propertyValue</code> is not
-     *         one of "JKS", "PEM", "PKCS12", or empty/null.
+     *         one of "JKS", "PEM", "BCFKS", "PKCS12", or empty/null.
      */
     public static KeyStoreFileType fromPropertyValue(String propertyValue) {
         if (propertyValue == null || propertyValue.length() == 0) {
@@ -69,11 +70,12 @@ public static KeyStoreFileType fromPropertyValue(String propertyValue) {
      * If the file name ends with ".jks", returns <code>StoreFileType.JKS</code>.
      * If the file name ends with ".pem", returns <code>StoreFileType.PEM</code>.
      * If the file name ends with ".p12", returns <code>StoreFileType.PKCS12</code>.
+     * If the file name ends with ".bckfs", returns <code>StoreFileType.BCKFS</code>.
      * Otherwise, throws an IllegalArgumentException.
      * @param filename the filename of the key store or trust store file.
      * @return a KeyStoreFileType.
      * @throws IllegalArgumentException if the filename does not end with
-     *         ".jks", ".pem", or "p12".
+     *         ".jks", ".pem", "p12" or "bcfks".
      */
     public static KeyStoreFileType fromFilename(String filename) {
         int i = filename.lastIndexOf('.');
@@ -100,7 +102,7 @@ public static KeyStoreFileType fromFilename(String filename) {
      *                 <code>propertyValue</code> is null or empty.
      * @return a KeyStoreFileType.
      * @throws IllegalArgumentException if <code>propertyValue</code> is not
-     *         one of "JKS", "PEM", "PKCS12", or empty/null.
+     *         one of "JKS", "PEM", "PKCS12", "BCFKS", or empty/null.
      * @throws IllegalArgumentException if <code>propertyValue</code>is empty
      *         or null and the type could not be determined from the file name.
      */
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/LogRedactor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/LogRedactor.java
new file mode 100644
index 00000000000..7a9cf1a85d3
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/LogRedactor.java
@@ -0,0 +1,62 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common;
+
+import java.util.Locale;
+import java.util.Map;
+import java.util.Properties;
+
+public class LogRedactor {
+
+    private LogRedactor() {}
+
+    /**
+     * Redacts all values which ends with "password" from the given properties / map.
+     * Other values are not changed.
+     *
+     * @param properties the properties in which all passwords should be redacted.
+     * @return new Properties object containing all values, passwords redacted.
+     */
+    public static Properties redactSensitiveValues(Map<?, ?> properties) {
+        Properties redactedConfig = new Properties();
+        properties.forEach((k, v) -> {
+            if (k != null && v != null) {
+                redactedConfig.put(k, redactValue((String) k, (String) v));
+            }
+        });
+        return redactedConfig;
+    }
+
+    /**
+     * Returns redacted value when the key ends with "password".
+     * Otherwise, just returns the value.
+     *
+     * @param key the key to check if it ends with "password".
+     * @return redacted value when the key ends with "password". Otherwise, the value.
+     */
+    public static String redactValue(String key, String value) {
+        if (key == null) {
+            return value;
+        }
+        if (key.toLowerCase(Locale.ROOT).endsWith("password")) {
+            return "***";
+        }
+        return value;
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/NetUtils.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/NetUtils.java
index cea12cce1bb..a02499a6877 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/NetUtils.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/NetUtils.java
@@ -27,18 +27,63 @@
  */
 public class NetUtils {
 
+    /**
+     * Prefer using the hostname for formatting, but without requesting reverse DNS lookup.
+     * Fall back to IP address if hostname is unavailable and use [] brackets for IPv6 literal.
+     */
     public static String formatInetAddr(InetSocketAddress addr) {
+        String hostString = addr.getHostString();
         InetAddress ia = addr.getAddress();
 
-        if (ia == null) {
-            return String.format("%s:%s", addr.getHostString(), addr.getPort());
+        if (ia instanceof Inet6Address && hostString.contains(":")) {
+            return String.format("[%s]:%s", hostString, addr.getPort());
+        } else {
+            return String.format("%s:%s", hostString, addr.getPort());
         }
+    }
 
-        if (ia instanceof Inet6Address) {
-            return String.format("[%s]:%s", ia.getHostAddress(), addr.getPort());
+    /**
+     * Separates host and port from given host port string if host port string is enclosed
+     * within square bracket.
+     *
+     * @param hostPort host port string
+     * @return String[]{host, port} if host port string is host:port
+     * or String[] {host, port:port} if host port string is host:port:port
+     * or String[] {host} if host port string is host
+     * or String[]{} if not a ipv6 host port string.
+     */
+    public static String[] getIPV6HostAndPort(String hostPort) {
+        if (hostPort.startsWith("[")) {
+            int i = hostPort.lastIndexOf(']');
+            if (i < 0) {
+                throw new IllegalArgumentException(
+                    hostPort + " starts with '[' but has no matching ']'");
+            }
+            String host = hostPort.substring(1, i);
+            if (host.isEmpty()) {
+                throw new IllegalArgumentException(host + " is empty.");
+            }
+            if (hostPort.length() > i + 1) {
+                return getHostPort(hostPort, i, host);
+            }
+            return new String[] { host };
         } else {
-            return String.format("%s:%s", ia.getHostAddress(), addr.getPort());
+            //Not an IPV6 host port string
+            return new String[] {};
         }
     }
 
+    private static String[] getHostPort(String hostPort, int indexOfClosingBracket, String host) {
+        // [127::1]:2181 , check separator : exits
+        if (hostPort.charAt(indexOfClosingBracket + 1) != ':') {
+            throw new IllegalArgumentException(hostPort + " does not have : after ]");
+        }
+        // [127::1]: scenario
+        if (indexOfClosingBracket + 2 == hostPort.length()) {
+            throw new IllegalArgumentException(hostPort + " doesn't have a port after colon.");
+        }
+        //do not include
+        String port = hostPort.substring(indexOfClosingBracket + 2);
+        return new String[] { host, port };
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/NettyUtils.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/NettyUtils.java
index dc1fe78f2fa..297cb377e10 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/NettyUtils.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/NettyUtils.java
@@ -28,6 +28,7 @@
 import io.netty.channel.socket.SocketChannel;
 import io.netty.channel.socket.nio.NioServerSocketChannel;
 import io.netty.channel.socket.nio.NioSocketChannel;
+import io.netty.util.concurrent.DefaultThreadFactory;
 import java.net.InetAddress;
 import java.net.NetworkInterface;
 import java.net.SocketException;
@@ -35,6 +36,7 @@
 import java.util.Enumeration;
 import java.util.HashSet;
 import java.util.Set;
+import java.util.concurrent.ThreadFactory;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -43,10 +45,22 @@
  */
 public class NettyUtils {
 
+    public static final String THREAD_POOL_NAME_PREFIX = "zkNetty-";
     private static final Logger LOG = LoggerFactory.getLogger(NettyUtils.class);
-
     private static final int DEFAULT_INET_ADDRESS_COUNT = 1;
 
+    /**
+     * Returns a ThreadFactory which generates daemon threads, and uses
+     * the passed class's name to generate the thread names.
+     *
+     * @param clazz Class name to use for generating thread names
+     * @return Netty DefaultThreadFactory configured to create daemon threads
+     */
+    private static ThreadFactory createThreadFactory(String clazz) {
+        final String poolName = THREAD_POOL_NAME_PREFIX + clazz;
+        return new DefaultThreadFactory(poolName, true);
+    }
+
     /**
      * If {@link Epoll#isAvailable()} <code>== true</code>, returns a new
      * {@link EpollEventLoopGroup}, otherwise returns a new
@@ -55,11 +69,7 @@ public class NettyUtils {
      * @return a new {@link EventLoopGroup}.
      */
     public static EventLoopGroup newNioOrEpollEventLoopGroup() {
-        if (Epoll.isAvailable()) {
-            return new EpollEventLoopGroup();
-        } else {
-            return new NioEventLoopGroup();
-        }
+        return newNioOrEpollEventLoopGroup(0);
     }
 
     /**
@@ -72,9 +82,13 @@ public static EventLoopGroup newNioOrEpollEventLoopGroup() {
      */
     public static EventLoopGroup newNioOrEpollEventLoopGroup(int nThreads) {
         if (Epoll.isAvailable()) {
-            return new EpollEventLoopGroup(nThreads);
+            final String clazz = EpollEventLoopGroup.class.getSimpleName();
+            final ThreadFactory factory = createThreadFactory(clazz);
+            return new EpollEventLoopGroup(nThreads, factory);
         } else {
-            return new NioEventLoopGroup(nThreads);
+            final String clazz = NioEventLoopGroup.class.getSimpleName();
+            final ThreadFactory factory = createThreadFactory(clazz);
+            return new NioEventLoopGroup(nThreads, factory);
         }
     }
 
@@ -145,7 +159,7 @@ public static int getClientReachableLocalInetAddressCount() {
                 }
             }
             LOG.debug("Detected {} local network addresses: {}", validInetAddresses.size(), validInetAddresses);
-            return validInetAddresses.size() > 0 ? validInetAddresses.size() : DEFAULT_INET_ADDRESS_COUNT;
+            return !validInetAddresses.isEmpty() ? validInetAddresses.size() : DEFAULT_INET_ADDRESS_COUNT;
         } catch (SocketException ex) {
             LOG.warn("Failed to list all network interfaces, assuming 1", ex);
             return DEFAULT_INET_ADDRESS_COUNT;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/PKCS12FileLoader.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/PKCS12FileLoader.java
index 35e89a18935..8903f288e95 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/PKCS12FileLoader.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/PKCS12FileLoader.java
@@ -18,8 +18,6 @@
 
 package org.apache.zookeeper.common;
 
-import java.security.KeyStore;
-import java.security.KeyStoreException;
 
 /**
  * Implementation of {@link FileKeyStoreLoader} that loads from PKCS12 files.
@@ -31,12 +29,7 @@ private PKCS12FileLoader(
         String trustStorePath,
         String keyStorePassword,
         String trustStorePassword) {
-        super(keyStorePath, trustStorePath, keyStorePassword, trustStorePassword);
-    }
-
-    @Override
-    protected KeyStore keyStoreInstance() throws KeyStoreException {
-        return KeyStore.getInstance("PKCS12");
+        super(keyStorePath, trustStorePath, keyStorePassword, trustStorePassword, SupportedStandardKeyFormat.PKCS12);
     }
 
     static class Builder extends FileKeyStoreLoader.Builder<PKCS12FileLoader> {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/PathTrie.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/PathTrie.java
index 95258b2a4ae..86acdd9f9a5 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/PathTrie.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/PathTrie.java
@@ -27,7 +27,7 @@
  import java.util.concurrent.locks.Lock;
  import java.util.concurrent.locks.ReadWriteLock;
  import java.util.concurrent.locks.ReentrantReadWriteLock;
- import org.apache.commons.lang.StringUtils;
+ import java.util.stream.Stream;
  import org.slf4j.Logger;
  import org.slf4j.LoggerFactory;
 
@@ -203,10 +203,10 @@ public PathTrie() {
      public void addPath(final String path) {
          Objects.requireNonNull(path, "Path cannot be null");
 
-         final String[] pathComponents = StringUtils.split(path, '/');
-         if (pathComponents.length == 0) {
+         if (path.length() == 0) {
              throw new IllegalArgumentException("Invalid path: " + path);
          }
+         final String[] pathComponents = split(path);
 
          writeLock.lock();
          try {
@@ -233,10 +233,11 @@ public void addPath(final String path) {
      public void deletePath(final String path) {
          Objects.requireNonNull(path, "Path cannot be null");
 
-         final String[] pathComponents = StringUtils.split(path, '/');
-         if (pathComponents.length == 0) {
+         if (path.length() == 0) {
              throw new IllegalArgumentException("Invalid path: " + path);
          }
+         final String[] pathComponents = split(path);
+
 
          writeLock.lock();
          try {
@@ -267,10 +268,10 @@ public void deletePath(final String path) {
      public boolean existsNode(final String path) {
          Objects.requireNonNull(path, "Path cannot be null");
 
-         final String[] pathComponents = StringUtils.split(path, '/');
-         if (pathComponents.length == 0) {
+         if (path.length() == 0) {
              throw new IllegalArgumentException("Invalid path: " + path);
          }
+         final String[] pathComponents = split(path);
 
          readLock.lock();
          try {
@@ -299,7 +300,7 @@ public boolean existsNode(final String path) {
      public String findMaxPrefix(final String path) {
          Objects.requireNonNull(path, "Path cannot be null");
 
-         final String[] pathComponents = StringUtils.split(path, '/');
+         final String[] pathComponents = split(path);
 
          readLock.lock();
          try {
@@ -344,4 +345,10 @@ public void clear() {
          }
      }
 
+     private static String[] split(final String path){
+         return Stream.of(path.split("/"))
+                 .filter(t -> !t.trim().isEmpty())
+                 .toArray(String[]::new);
+     }
+
  }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/PathUtils.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/PathUtils.java
index 114df6e6e94..7ddc5576db6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/PathUtils.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/PathUtils.java
@@ -109,4 +109,18 @@ public static String normalizeFileSystemPath(String path) {
          return path;
      }
 
+     /**
+      * return the top namespace of a znode path
+      *
+      * @param path znode path string
+      *
+      * @return the top namespace. If not exist, return null
+      */
+     public static String getTopNamespace(final String path) {
+         if (path == null) {
+             return null;
+         }
+         final String[] parts = path.split("/");
+         return parts.length > 1 ? parts[1] : null;
+     }
  }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/QuorumX509Util.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/QuorumX509Util.java
index d4cf19f5306..af3ee1bdeab 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/QuorumX509Util.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/QuorumX509Util.java
@@ -18,6 +18,9 @@
 
 package org.apache.zookeeper.common;
 
+/**
+ * X509 utilities specific for server-server (quorum) communication framework.
+ */
 public class QuorumX509Util extends X509Util {
 
     @Override
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/SSLContextAndOptions.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/SSLContextAndOptions.java
index 01e97c3f594..c712f6acb6c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/SSLContextAndOptions.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/SSLContextAndOptions.java
@@ -19,15 +19,10 @@
 package org.apache.zookeeper.common;
 
 import static java.util.Objects.requireNonNull;
-import io.netty.handler.ssl.IdentityCipherSuiteFilter;
-import io.netty.handler.ssl.JdkSslContext;
-import io.netty.handler.ssl.SslContext;
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.net.Socket;
 import java.util.Arrays;
-import java.util.Collections;
-import java.util.List;
 import javax.net.ssl.SSLContext;
 import javax.net.ssl.SSLParameters;
 import javax.net.ssl.SSLServerSocket;
@@ -49,11 +44,11 @@ public class SSLContextAndOptions {
     private final X509Util x509Util;
     private final String[] enabledProtocols;
     private final String[] cipherSuites;
-    private final List<String> cipherSuitesAsList;
     private final X509Util.ClientAuth clientAuth;
     private final SSLContext sslContext;
     private final int handshakeDetectionTimeoutMillis;
 
+
     /**
      * Note: constructor is intentionally package-private, only the X509Util class should be creating instances of this
      * class.
@@ -65,9 +60,7 @@ public class SSLContextAndOptions {
         this.x509Util = requireNonNull(x509Util);
         this.sslContext = requireNonNull(sslContext);
         this.enabledProtocols = getEnabledProtocols(requireNonNull(config), sslContext);
-        String[] ciphers = getCipherSuites(config);
-        this.cipherSuites = ciphers;
-        this.cipherSuitesAsList = Collections.unmodifiableList(Arrays.asList(ciphers));
+        this.cipherSuites = getCipherSuites(config);
         this.clientAuth = getClientAuth(config);
         this.handshakeDetectionTimeoutMillis = getHandshakeDetectionTimeoutMillis(config);
     }
@@ -101,20 +94,6 @@ public SSLServerSocket createSSLServerSocket(int port) throws IOException {
         return configureSSLServerSocket(sslServerSocket);
     }
 
-    public SslContext createNettyJdkSslContext(SSLContext sslContext, boolean isClientSocket) {
-        return new JdkSslContext(
-                sslContext,
-                isClientSocket,
-                cipherSuitesAsList,
-                IdentityCipherSuiteFilter.INSTANCE,
-                null,
-                isClientSocket
-                        ? X509Util.ClientAuth.NONE.toNettyClientAuth()
-                        : clientAuth.toNettyClientAuth(),
-                enabledProtocols,
-                false);
-    }
-
     public int getHandshakeDetectionTimeoutMillis() {
         return handshakeDetectionTimeoutMillis;
     }
@@ -170,7 +149,10 @@ private void configureSslParameters(SSLParameters sslParameters, boolean isClien
     private String[] getEnabledProtocols(final ZKConfig config, final SSLContext sslContext) {
         String enabledProtocolsInput = config.getProperty(x509Util.getSslEnabledProtocolsProperty());
         if (enabledProtocolsInput == null) {
-            return new String[]{sslContext.getProtocol()};
+            // Use JDK defaults for enabled protocols:
+            // Protocol TLSv1.3 -> enabled protocols TLSv1.3 and TLSv1.2
+            // Protocol TLSv1.2 -> enabled protocols TLSv1.2
+            return sslContext.getDefaultSSLParameters().getProtocols();
         }
         return enabledProtocolsInput.split(",");
     }
@@ -178,7 +160,7 @@ private String[] getEnabledProtocols(final ZKConfig config, final SSLContext ssl
     private String[] getCipherSuites(final ZKConfig config) {
         String cipherSuitesInput = config.getProperty(x509Util.getSslCipherSuitesProperty());
         if (cipherSuitesInput == null) {
-            return X509Util.getDefaultCipherSuites();
+            return null;
         } else {
             return cipherSuitesInput.split(",");
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/SecretUtils.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/SecretUtils.java
new file mode 100644
index 00000000000..f20c9ce4291
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/SecretUtils.java
@@ -0,0 +1,53 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common;
+
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Paths;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Utility class for handling secret such as key/trust store password
+ */
+public final class SecretUtils {
+    private static final Logger LOG = LoggerFactory.getLogger(SecretUtils.class);
+
+    private SecretUtils() {
+    }
+
+    public static char[] readSecret(final String pathToFile) {
+        LOG.info("Reading secret from {}", pathToFile);
+
+        try {
+            final String secretValue = new String(
+                    Files.readAllBytes(Paths.get(pathToFile)), StandardCharsets.UTF_8);
+
+            if (secretValue.endsWith(System.lineSeparator())) {
+                return secretValue.substring(0, secretValue.length() - System.lineSeparator().length()).toCharArray();
+            }
+
+            return secretValue.toCharArray();
+        } catch (final Throwable e) {
+            LOG.error("Exception occurred when reading secret from file {}", pathToFile, e);
+            throw new IllegalStateException("Exception occurred when reading secret from file " + pathToFile, e);
+        }
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/StandardTypeFileKeyStoreLoader.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/StandardTypeFileKeyStoreLoader.java
index b32ee073038..8f068f7befc 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/StandardTypeFileKeyStoreLoader.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/StandardTypeFileKeyStoreLoader.java
@@ -35,12 +35,17 @@ abstract class StandardTypeFileKeyStoreLoader extends FileKeyStoreLoader {
 
     private static final char[] EMPTY_CHAR_ARRAY = new char[0];
 
-    StandardTypeFileKeyStoreLoader(
-        String keyStorePath,
-        String trustStorePath,
-        String keyStorePassword,
-        String trustStorePassword) {
+    protected final SupportedStandardKeyFormat format;
+
+    protected enum SupportedStandardKeyFormat {
+        JKS, PKCS12, BCFKS
+    }
+
+
+    StandardTypeFileKeyStoreLoader(String keyStorePath, String trustStorePath, String keyStorePassword,
+        String trustStorePassword, SupportedStandardKeyFormat format) {
         super(keyStorePath, trustStorePath, keyStorePassword, trustStorePassword);
+        this.format = format;
     }
 
     @Override
@@ -61,7 +66,9 @@ public KeyStore loadTrustStore() throws IOException, GeneralSecurityException {
         }
     }
 
-    protected abstract KeyStore keyStoreInstance() throws KeyStoreException;
+    private KeyStore keyStoreInstance() throws KeyStoreException {
+        return KeyStore.getInstance(format.name());
+    }
 
     private static char[] passwordStringToCharArray(String password) {
         return password == null ? EMPTY_CHAR_ARRAY : password.toCharArray();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/StringUtils.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/StringUtils.java
index 36ee2d75019..481a3aa2b42 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/StringUtils.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/StringUtils.java
@@ -20,6 +20,7 @@
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
+import java.util.Objects;
 
 public class StringUtils {
 
@@ -33,7 +34,7 @@ private StringUtils() {/** non instantiable and non inheritable **/}
      */
     public static List<String> split(String value, String separator) {
         String[] splits = value.split(separator);
-        List<String> results = new ArrayList<String>();
+        List<String> results = new ArrayList<>();
         for (int i = 0; i < splits.length; i++) {
             splits[i] = splits[i].trim();
             if (splits[i].length() > 0) {
@@ -44,22 +45,51 @@ public static List<String> split(String value, String separator) {
     }
 
     /**
-     * This method takes a List&lt;String&gt; and a delimiter and joins the strings
-     * into a single string, where the original strings are separated using
-     * the given delimiter.
+     * This method takes a List&lt;String&gt; and a delimiter and joins the
+     * strings into a single string, where the original strings are separated
+     * using the given delimiter. This method is a null-safe version of
+     * {@link String#join(CharSequence, Iterable)}
      *
+     * <p>
+     * Note that if an individual element is null, then "null" is added.
+     * </p>
+     * @param list a {@code List} that will have its elements joined together
+     * @param delim a sequence of characters that is used to separate each of the
+     *          elements in the resulting String
+     * @return a new String that is composed from the elements argument or
+     *         {@code null} if list is {@code null}
+     * @throws NullPointerException if delim is {@code null}
      */
     public static String joinStrings(List<String> list, String delim) {
-        if (list == null) {
-            return null;
-        }
+        Objects.requireNonNull(delim);
+        return list == null ? null : String.join(delim, list);
+    }
 
-        StringBuilder builder = new StringBuilder(list.get(0));
-        for (String s : list.subList(1, list.size())) {
-            builder.append(delim).append(s);
-        }
+    /**
+     * Returns true if the string is null or it does not contain any non space characters.
+     * @param s the string
+     * @return true if the string is null or it does not contain any non space characters.
+     */
+    public static boolean isBlank(String s) {
+        return s == null || s.trim().isEmpty();
+    }
 
-        return builder.toString();
+    /**
+     * <p>Checks if a String is empty ("") or null.</p>
+     *
+     * <pre>
+     * StringUtils.isEmpty(null)      = true
+     * StringUtils.isEmpty("")        = true
+     * StringUtils.isEmpty(" ")       = false
+     * StringUtils.isEmpty("bob")     = false
+     * StringUtils.isEmpty("  bob  ") = false
+     * </pre>
+     *
+     * @param str  the String to check, may be null
+     * @return <code>true</code> if the String is empty or null
+     */
+    public static boolean isEmpty(String str) {
+        return str == null || str.length() == 0;
     }
 
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/Time.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/Time.java
index 08891f73a80..5916cd22926 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/Time.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/Time.java
@@ -22,6 +22,12 @@
 
 public class Time {
 
+    public static final int MILLISECOND = 1;
+    public static final int SECOND = 1000 * MILLISECOND;
+    public static final int MINUTE = 60 * SECOND;
+    public static final int HOUR = 60 * MINUTE;
+    public static final int DAY = 24 * HOUR;
+
     /**
      * Returns time in milliseconds as does System.currentTimeMillis(),
      * but uses elapsed time from an arbitrary epoch more like System.nanoTime().
@@ -51,4 +57,64 @@ public static Date elapsedTimeToDate(long elapsedTime) {
         return new Date(wallTime);
     }
 
+    /** Parse a string as a time interval.  An interval is specified as an
+     * integer with an optional suffix.  No suffix means milliseconds, s, m,
+     * h, d indicates seconds, minutes, hours, and days respectively.
+     * As a special case, "ms" means milliseconds.
+     * @param str the interval string
+     * @return interval in milliseconds
+     */
+    public static int parseTimeInterval(String str) {
+        try {
+            int len = str.length();
+            char suffix = str.charAt(len - 1);
+            if (Character.isDigit(suffix)) {
+                return Integer.parseInt(str);
+            } else {
+                if (str.endsWith("ms") || str.endsWith("MS")) {
+                    return Integer.parseInt(str.substring(0, len - 2));
+                } else {
+                    String numstr = str.substring(0, len - 1);
+                    switch (Character.toUpperCase(suffix)) {
+                    case 'S':
+                        return Integer.parseInt(numstr) * SECOND;
+                    case 'M':
+                        return Integer.parseInt(numstr) * MINUTE;
+                    case 'H':
+                        return Integer.parseInt(numstr) * HOUR;
+                    case 'D':
+                        return Integer.parseInt(numstr) * DAY;
+                    default:
+                        throw new NumberFormatException("Illegal time interval suffix: " + str);
+                    }
+                }
+            }
+        } catch (IndexOutOfBoundsException e) {
+            throw new NumberFormatException("empty string");
+        }
+    }
+
+    /**
+     * Format milliseconds time interval with the highest time unit suffix.
+     *
+     * <p>See {@link #parseTimeInterval(String)} for supported suffixes.
+     *
+     * @param ms milliseconds
+     * @return string formatted with the highest time unit suffix or "0" if {@code ms} is 0
+     */
+    public static String formatTimeIntervalMs(long ms) {
+        if (ms == 0) {
+            return "0";
+        } else if (ms % DAY == 0) {
+            return ms / DAY + "d";
+        } else if (ms % HOUR == 0) {
+            return ms / HOUR + "h";
+        } else if (ms % MINUTE == 0) {
+            return ms / MINUTE + "m";
+        } else if (ms % SECOND == 0) {
+            return ms / SECOND + "s";
+        } else {
+            return ms + "ms";
+        }
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
index 24c7f351bdd..460a6f3ac55 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
@@ -31,9 +31,14 @@
 import java.security.KeyStore;
 import java.security.NoSuchAlgorithmException;
 import java.security.Security;
+import java.security.cert.CertPathValidator;
 import java.security.cert.PKIXBuilderParameters;
+import java.security.cert.PKIXRevocationChecker;
 import java.security.cert.X509CertSelector;
-import java.util.Objects;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
 import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.Supplier;
 import javax.net.ssl.CertPathTrustManagerParameters;
@@ -50,22 +55,24 @@
 import org.apache.zookeeper.common.X509Exception.KeyManagerException;
 import org.apache.zookeeper.common.X509Exception.SSLContextException;
 import org.apache.zookeeper.common.X509Exception.TrustManagerException;
+import org.apache.zookeeper.server.NettyServerCnxnFactory;
+import org.apache.zookeeper.server.auth.ProviderRegistry;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 /**
  * Utility code for X509 handling
- *
- * Default cipher suites:
- *
- *   Performance testing done by Facebook engineers shows that on Intel x86_64 machines, Java9 performs better with
- *   GCM and Java8 performs better with CBC, so these seem like reasonable defaults.
  */
 public abstract class X509Util implements Closeable, AutoCloseable {
 
     private static final Logger LOG = LoggerFactory.getLogger(X509Util.class);
 
     private static final String REJECT_CLIENT_RENEGOTIATION_PROPERTY = "jdk.tls.rejectClientInitiatedRenegotiation";
+    public static final String FIPS_MODE_PROPERTY = "zookeeper.fips-mode";
+    private static final boolean FIPS_MODE_DEFAULT = true;
+    public static final String TLS_1_1 = "TLSv1.1";
+    public static final String TLS_1_2 = "TLSv1.2";
+    public static final String TLS_1_3 = "TLSv1.3";
 
     static {
         // Client-initiated renegotiation in TLS is unsafe and
@@ -79,27 +86,39 @@ public abstract class X509Util implements Closeable, AutoCloseable {
         }
     }
 
-    public static final String DEFAULT_PROTOCOL = "TLSv1.2";
-    private static String[] getGCMCiphers() {
-        return new String[]{"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"};
-    }
+    private static final AtomicReference<String> defaultProtocol = new AtomicReference<>();
 
-    private static String[] getCBCCiphers() {
-        return new String[]{"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"};
-    }
+    /**
+     * Return TLSv1.2 when FIPS mode is enabled.
+     * Otherwise, returns TLSv1.3 or TLSv1.2 depending on Java runtime version being used.
+     * TLSv1.3 was first introduced in JDK11 and back-ported to OpenJDK 8u272.
+     */
+    public static String defaultTlsProtocol(ZKConfig config) {
+        if (getFipsMode(config)) {
+            return TLS_1_2;
+        }
 
-    private static String[] concatArrays(String[] left, String[] right) {
-        String[] result = new String[left.length + right.length];
-        System.arraycopy(left, 0, result, 0, left.length);
-        System.arraycopy(right, 0, result, left.length, right.length);
-        return result;
-    }
+        String proto = defaultProtocol.get();
+        if (proto != null) {
+            return proto;
+        }
 
-    // On Java 8, prefer CBC ciphers since AES-NI support is lacking and GCM is slower than CBC.
-    private static final String[] DEFAULT_CIPHERS_JAVA8 = concatArrays(getCBCCiphers(), getGCMCiphers());
-    // On Java 9 and later, prefer GCM ciphers due to improved AES-NI support.
-    // Note that this performance assumption might not hold true for architectures other than x86_64.
-    private static final String[] DEFAULT_CIPHERS_JAVA9 = concatArrays(getGCMCiphers(), getCBCCiphers());
+        proto = TLS_1_2;
+        try {
+            List<String> supported = Arrays.asList(SSLContext.getDefault().getSupportedSSLParameters().getProtocols());
+            if (supported.contains(TLS_1_3)) {
+                proto = TLS_1_3;
+            }
+            if (defaultProtocol.compareAndSet(null, proto)) {
+                LOG.info("Supported TLS protocols are {}, default TLS protocol is {}", supported, proto);
+            } else {
+                proto = defaultProtocol.get();
+            }
+        } catch (NoSuchAlgorithmException e) {
+            // Ignore.
+        }
+        return proto;
+    }
 
     public static final int DEFAULT_HANDSHAKE_DETECTION_TIMEOUT_MILLIS = 5000;
 
@@ -143,34 +162,32 @@ public io.netty.handler.ssl.ClientAuth toNettyClientAuth() {
         }
     }
 
-    private String sslProtocolProperty = getConfigPrefix() + "protocol";
-    private String sslEnabledProtocolsProperty = getConfigPrefix() + "enabledProtocols";
-    private String cipherSuitesProperty = getConfigPrefix() + "ciphersuites";
-    private String sslKeystoreLocationProperty = getConfigPrefix() + "keyStore.location";
-    private String sslKeystorePasswdProperty = getConfigPrefix() + "keyStore.password";
-    private String sslKeystoreTypeProperty = getConfigPrefix() + "keyStore.type";
-    private String sslTruststoreLocationProperty = getConfigPrefix() + "trustStore.location";
-    private String sslTruststorePasswdProperty = getConfigPrefix() + "trustStore.password";
-    private String sslTruststoreTypeProperty = getConfigPrefix() + "trustStore.type";
-    private String sslContextSupplierClassProperty = getConfigPrefix() + "context.supplier.class";
-    private String sslHostnameVerificationEnabledProperty = getConfigPrefix() + "hostnameVerification";
-    private String sslCrlEnabledProperty = getConfigPrefix() + "crl";
-    private String sslOcspEnabledProperty = getConfigPrefix() + "ocsp";
-    private String sslClientAuthProperty = getConfigPrefix() + "clientAuth";
-    private String sslHandshakeDetectionTimeoutMillisProperty = getConfigPrefix() + "handshakeDetectionTimeoutMillis";
-
-    private ZKConfig zkConfig;
-    private AtomicReference<SSLContextAndOptions> defaultSSLContextAndOptions = new AtomicReference<>(null);
+    private final String sslProtocolProperty = getConfigPrefix() + "protocol";
+    private final String sslEnabledProtocolsProperty = getConfigPrefix() + "enabledProtocols";
+    private final String cipherSuitesProperty = getConfigPrefix() + "ciphersuites";
+    private final String sslKeystoreLocationProperty = getConfigPrefix() + "keyStore.location";
+    private final String sslKeystorePasswdProperty = getConfigPrefix() + "keyStore.password";
+    private final String sslKeystorePasswdPathProperty = getConfigPrefix() + "keyStore.passwordPath";
+    private final String sslKeystoreTypeProperty = getConfigPrefix() + "keyStore.type";
+    private final String sslTruststoreLocationProperty = getConfigPrefix() + "trustStore.location";
+    private final String sslTruststorePasswdProperty = getConfigPrefix() + "trustStore.password";
+    private final String sslTruststorePasswdPathProperty = getConfigPrefix() + "trustStore.passwordPath";
+    private final String sslTruststoreTypeProperty = getConfigPrefix() + "trustStore.type";
+    private final String sslContextSupplierClassProperty = getConfigPrefix() + "context.supplier.class";
+    private final String sslHostnameVerificationEnabledProperty = getConfigPrefix() + "hostnameVerification";
+    private final String sslClientHostnameVerificationEnabledProperty = getConfigPrefix() + "clientHostnameVerification";
+    private final String sslAllowReverseDnsLookupProperty = getConfigPrefix() + "allowReverseDnsLookup";
+    private final String sslCrlEnabledProperty = getConfigPrefix() + "crl";
+    private final String sslOcspEnabledProperty = getConfigPrefix() + "ocsp";
+    private final String sslClientAuthProperty = getConfigPrefix() + "clientAuth";
+    private final String sslHandshakeDetectionTimeoutMillisProperty = getConfigPrefix() + "handshakeDetectionTimeoutMillis";
+
+    private final AtomicReference<SSLContextAndOptions> defaultSSLContextAndOptions = new AtomicReference<>(null);
 
     private FileChangeWatcher keyStoreFileWatcher;
     private FileChangeWatcher trustStoreFileWatcher;
 
     public X509Util() {
-        this(null);
-    }
-
-    public X509Util(ZKConfig zkConfig) {
-        this.zkConfig = zkConfig;
         keyStoreFileWatcher = trustStoreFileWatcher = null;
     }
 
@@ -202,6 +219,10 @@ public String getSslKeystorePasswdProperty() {
         return sslKeystorePasswdProperty;
     }
 
+    public String getSslKeystorePasswdPathProperty() {
+        return sslKeystorePasswdPathProperty;
+    }
+
     public String getSslKeystoreTypeProperty() {
         return sslKeystoreTypeProperty;
     }
@@ -214,6 +235,10 @@ public String getSslTruststorePasswdProperty() {
         return sslTruststorePasswdProperty;
     }
 
+    public String getSslTruststorePasswdPathProperty() {
+        return sslTruststorePasswdPathProperty;
+    }
+
     public String getSslTruststoreTypeProperty() {
         return sslTruststoreTypeProperty;
     }
@@ -226,6 +251,14 @@ public String getSslHostnameVerificationEnabledProperty() {
         return sslHostnameVerificationEnabledProperty;
     }
 
+    public String getSslClientHostnameVerificationEnabledProperty() {
+        return sslClientHostnameVerificationEnabledProperty;
+    }
+
+    public String getSslAllowReverseDnsLookupProperty() {
+        return sslAllowReverseDnsLookupProperty;
+    }
+
     public String getSslCrlEnabledProperty() {
         return sslCrlEnabledProperty;
     }
@@ -248,6 +281,27 @@ public String getSslHandshakeDetectionTimeoutMillisProperty() {
         return sslHandshakeDetectionTimeoutMillisProperty;
     }
 
+    public String getFipsModeProperty() {
+        return FIPS_MODE_PROPERTY;
+    }
+
+    public static boolean getFipsMode(ZKConfig config) {
+        return config.getBoolean(FIPS_MODE_PROPERTY, FIPS_MODE_DEFAULT);
+    }
+
+    public boolean isServerHostnameVerificationEnabled(ZKConfig config) {
+        return config.getBoolean(this.getSslHostnameVerificationEnabledProperty(), true);
+    }
+
+    public boolean isClientHostnameVerificationEnabled(ZKConfig config) {
+        return isServerHostnameVerificationEnabled(config)
+            && config.getBoolean(this.getSslClientHostnameVerificationEnabledProperty(), shouldVerifyClientHostname());
+    }
+
+    public boolean allowReverseDnsLookup(ZKConfig config) {
+        return config.getBoolean(this.getSslAllowReverseDnsLookupProperty(), false);
+    }
+
     public SSLContext getDefaultSSLContext() throws X509Exception.SSLContextException {
         return getDefaultSSLContextAndOptions().getSSLContext();
     }
@@ -271,6 +325,10 @@ public SSLContextAndOptions getDefaultSSLContextAndOptions() throws X509Exceptio
     private void resetDefaultSSLContextAndOptions() throws X509Exception.SSLContextException {
         SSLContextAndOptions newContext = createSSLContextAndOptions();
         defaultSSLContextAndOptions.set(newContext);
+
+        if (Boolean.getBoolean(NettyServerCnxnFactory.CLIENT_CERT_RELOAD_KEY)) {
+            ProviderRegistry.addOrUpdateProvider(ProviderRegistry.AUTHPROVIDER_PROPERTY_PREFIX + "x509");
+        }
     }
 
     private SSLContextAndOptions createSSLContextAndOptions() throws SSLContextException {
@@ -279,7 +337,7 @@ private SSLContextAndOptions createSSLContextAndOptions() throws SSLContextExcep
          * configuration from system property. Reading property from
          * configuration will be same reading from system property
          */
-        return createSSLContextAndOptions(zkConfig == null ? new ZKConfig() : zkConfig);
+        return createSSLContextAndOptions(new ZKConfig());
     }
 
     /**
@@ -330,54 +388,40 @@ public SSLContextAndOptions createSSLContextAndOptions(ZKConfig config) throws S
     }
 
     public SSLContextAndOptions createSSLContextAndOptionsFromConfig(ZKConfig config) throws SSLContextException {
-        KeyManager[] keyManagers = null;
-        TrustManager[] trustManagers = null;
-
-        String keyStoreLocationProp = config.getProperty(sslKeystoreLocationProperty, "");
-        String keyStorePasswordProp = config.getProperty(sslKeystorePasswdProperty, "");
-        String keyStoreTypeProp = config.getProperty(sslKeystoreTypeProperty);
-
         // There are legal states in some use cases for null KeyManager or TrustManager.
         // But if a user wanna specify one, location is required. Password defaults to empty string if it is not
         // specified by the user.
+        KeyManager[] keyManagers = null;
+        TrustManager[] trustManagers = null;
 
-        if (keyStoreLocationProp.isEmpty()) {
-            LOG.warn("{} not specified", getSslKeystoreLocationProperty());
-        } else {
-            try {
-                keyManagers = new KeyManager[]{createKeyManager(keyStoreLocationProp, keyStorePasswordProp, keyStoreTypeProp)};
-            } catch (KeyManagerException keyManagerException) {
-                throw new SSLContextException("Failed to create KeyManager", keyManagerException);
-            } catch (IllegalArgumentException e) {
-                throw new SSLContextException("Bad value for " + sslKeystoreTypeProperty + ": " + keyStoreTypeProp, e);
+        try {
+            KeyManager km = buildKeyManager(config);
+            if (km != null) {
+                keyManagers = new KeyManager[]{km};
             }
+        } catch (KeyManagerException keyManagerException) {
+            throw new SSLContextException("Failed to create KeyManager", keyManagerException);
+        } catch (IllegalArgumentException e) {
+            String keyStoreTypeProp = config.getProperty(sslKeystoreTypeProperty);
+            throw new SSLContextException("Bad value for " + sslKeystoreTypeProperty + ": " + keyStoreTypeProp, e);
         }
 
-        String trustStoreLocationProp = config.getProperty(sslTruststoreLocationProperty, "");
-        String trustStorePasswordProp = config.getProperty(sslTruststorePasswdProperty, "");
-        String trustStoreTypeProp = config.getProperty(sslTruststoreTypeProperty);
-
-        boolean sslCrlEnabled = config.getBoolean(this.sslCrlEnabledProperty);
-        boolean sslOcspEnabled = config.getBoolean(this.sslOcspEnabledProperty);
-        boolean sslServerHostnameVerificationEnabled = config.getBoolean(this.getSslHostnameVerificationEnabledProperty(), true);
-        boolean sslClientHostnameVerificationEnabled = sslServerHostnameVerificationEnabled && shouldVerifyClientHostname();
-
-        if (trustStoreLocationProp.isEmpty()) {
-            LOG.warn("{} not specified", getSslTruststoreLocationProperty());
-        } else {
-            try {
-                trustManagers = new TrustManager[]{createTrustManager(trustStoreLocationProp, trustStorePasswordProp, trustStoreTypeProp, sslCrlEnabled, sslOcspEnabled, sslServerHostnameVerificationEnabled, sslClientHostnameVerificationEnabled)};
-            } catch (TrustManagerException trustManagerException) {
-                throw new SSLContextException("Failed to create TrustManager", trustManagerException);
-            } catch (IllegalArgumentException e) {
-                throw new SSLContextException("Bad value for "
-                                              + sslTruststoreTypeProperty
-                                              + ": "
-                                              + trustStoreTypeProp, e);
+        try {
+            TrustManager tm = buildTrustManager(config);
+            if (tm != null) {
+                trustManagers = new TrustManager[]{tm};
             }
+        } catch (TrustManagerException trustManagerException) {
+            throw new SSLContextException("Failed to create TrustManager", trustManagerException);
+        } catch (IllegalArgumentException e) {
+            String trustStoreTypeProp = config.getProperty(sslTruststoreTypeProperty);
+            throw new SSLContextException("Bad value for "
+                    + sslTruststoreTypeProperty
+                    + ": "
+                    + trustStoreTypeProp, e);
         }
-
-        String protocol = config.getProperty(sslProtocolProperty, DEFAULT_PROTOCOL);
+        String defaultTlsProtocol = defaultTlsProtocol(config);
+        String protocol = config.getProperty(sslProtocolProperty, defaultTlsProtocol);
         try {
             SSLContext sslContext = SSLContext.getInstance(protocol);
             sslContext.init(keyManagers, trustManagers, null);
@@ -413,15 +457,47 @@ public static KeyStore loadTrustStore(
             .loadTrustStore();
     }
 
+    /**
+     * Returns the password specified by the given property or from the file specified by the given path property.
+     * If both are specified, the value stored in the file will be returned.
+     *
+     * @param config  Zookeeper configuration
+     * @param propertyName  property name
+     * @param pathPropertyName path property name
+     * @return the password value
+     */
+    public String getPasswordFromConfigPropertyOrFile(final ZKConfig config,
+                                                      final String propertyName,
+                                                      final String pathPropertyName) {
+        String value = config.getProperty(propertyName, "");
+        final String pathProperty = config.getProperty(pathPropertyName, "");
+        if (!pathProperty.isEmpty()) {
+            value = String.valueOf(SecretUtils.readSecret(pathProperty));
+        }
+        return value;
+    }
+
+    public X509KeyManager buildKeyManager(ZKConfig config) throws KeyManagerException {
+        String keyStoreLocation = config.getProperty(getSslKeystoreLocationProperty(), "");
+        if (keyStoreLocation.isEmpty()) {
+            LOG.warn("{} not specified for X509KeyManager", getSslKeystoreLocationProperty());
+            return null;
+        }
+        String keyStorePassword = getPasswordFromConfigPropertyOrFile(config, getSslKeystorePasswdProperty(),
+                getSslKeystorePasswdPathProperty());
+        String keyStoreType = config.getProperty(getSslKeystoreTypeProperty());
+        return createKeyManager(keyStoreLocation, keyStorePassword, keyStoreType);
+    }
+
     /**
      * Creates a key manager by loading the key store from the given file of
      * the given type, optionally decrypting it using the given password.
      * @param keyStoreLocation the location of the key store file.
      * @param keyStorePassword optional password to decrypt the key store. If
      *                         empty, assumes the key store is not encrypted.
-     * @param keyStoreTypeProp must be JKS, PEM, or null. If null, attempts to
-     *                         autodetect the key store type from the file
-     *                         extension (.jks / .pem).
+     * @param keyStoreTypeProp must be JKS, PEM, PKCS12, BCFKS or null. If null,
+     *                         attempts to autodetect the key store type from
+     *                         the file extension (e.g. .jks / .pem).
      * @return the key manager.
      * @throws KeyManagerException if something goes wrong.
      */
@@ -448,19 +524,73 @@ public static X509KeyManager createKeyManager(
         }
     }
 
+    public X509TrustManager buildTrustManager(ZKConfig config) throws TrustManagerException {
+        String trustStoreLocationProp = config.getProperty(sslTruststoreLocationProperty, "");
+        if (trustStoreLocationProp.isEmpty()) {
+            LOG.warn("{} not specified for X509TrustManager", sslTruststoreLocationProperty);
+            return null;
+        }
+
+        String trustStorePasswordProp = getPasswordFromConfigPropertyOrFile(config, sslTruststorePasswdProperty, sslTruststorePasswdPathProperty);
+        String trustStoreTypeProp = config.getProperty(sslTruststoreTypeProperty);
+
+        boolean sslCrlEnabled = config.getBoolean(this.sslCrlEnabledProperty, Boolean.getBoolean("com.sun.net.ssl.checkRevocation"));
+        boolean sslOcspEnabled = config.getBoolean(this.sslOcspEnabledProperty, Boolean.parseBoolean(Security.getProperty("ocsp.enable")));
+
+        boolean sslServerHostnameVerificationEnabled = isServerHostnameVerificationEnabled(config);
+        boolean sslClientHostnameVerificationEnabled = isClientHostnameVerificationEnabled(config);
+        boolean allowReverseDnsLookup = allowReverseDnsLookup(config);
+        boolean fipsMode = getFipsMode(config);
+
+        return createTrustManagerInternal(
+                trustStoreLocationProp,
+                trustStorePasswordProp,
+                trustStoreTypeProp,
+                sslCrlEnabled,
+                sslOcspEnabled,
+                sslServerHostnameVerificationEnabled,
+                sslClientHostnameVerificationEnabled,
+                allowReverseDnsLookup,
+                fipsMode);
+    }
+
+    // @VisibleForTesting
+    protected X509TrustManager createTrustManagerInternal(
+            String trustStoreLocation,
+            String trustStorePassword,
+            String trustStoreTypeProp,
+            boolean crlEnabled,
+            boolean ocspEnabled,
+            final boolean serverHostnameVerificationEnabled,
+            final boolean clientHostnameVerificationEnabled,
+            final boolean allowReverseDnsLookup,
+            final boolean fipsMode) throws TrustManagerException {
+        return createTrustManager(
+                trustStoreLocation,
+                trustStorePassword,
+                trustStoreTypeProp,
+                crlEnabled,
+                ocspEnabled,
+                serverHostnameVerificationEnabled,
+                clientHostnameVerificationEnabled,
+                allowReverseDnsLookup,
+                fipsMode);
+    }
+
     /**
      * Creates a trust manager by loading the trust store from the given file
      * of the given type, optionally decrypting it using the given password.
-     * @param trustStoreLocation the location of the trust store file.
-     * @param trustStorePassword optional password to decrypt the trust store
-     *                           (only applies to JKS trust stores). If empty,
-     *                           assumes the trust store is not encrypted.
-     * @param trustStoreTypeProp must be JKS, PEM, or null. If null, attempts
-     *                           to autodetect the trust store type from the
-     *                           file extension (.jks / .pem).
-     * @param crlEnabled enable CRL (certificate revocation list) checks.
-     * @param ocspEnabled enable OCSP (online certificate status protocol)
-     *                    checks.
+     *
+     * @param trustStoreLocation                the location of the trust store file.
+     * @param trustStorePassword                optional password to decrypt the trust store
+     *                                          (only applies to JKS trust stores). If empty,
+     *                                          assumes the trust store is not encrypted.
+     * @param trustStoreTypeProp                must be JKS, PEM, PKCS12, BCFKS or null. If
+     *                                          null, attempts to autodetect the trust store
+     *                                          type from the file extension (e.g. .jks / .pem).
+     * @param crlEnabled                        enable CRL (certificate revocation list) checks.
+     * @param ocspEnabled                       enable OCSP (online certificate status protocol)
+     *                                          checks.
      * @param serverHostnameVerificationEnabled if true, verify hostnames of
      *                                          remote servers that client
      *                                          sockets created by this
@@ -480,20 +610,46 @@ public static X509TrustManager createTrustManager(
         boolean crlEnabled,
         boolean ocspEnabled,
         final boolean serverHostnameVerificationEnabled,
-        final boolean clientHostnameVerificationEnabled) throws TrustManagerException {
+        final boolean clientHostnameVerificationEnabled,
+        final boolean allowReverseDnsLookup,
+        final boolean fipsMode) throws TrustManagerException {
         if (trustStorePassword == null) {
             trustStorePassword = "";
         }
         try {
             KeyStore ts = loadTrustStore(trustStoreLocation, trustStorePassword, trustStoreTypeProp);
             PKIXBuilderParameters pbParams = new PKIXBuilderParameters(ts, new X509CertSelector());
-            if (crlEnabled || ocspEnabled) {
-                pbParams.setRevocationEnabled(true);
-                System.setProperty("com.sun.net.ssl.checkRevocation", "true");
-                System.setProperty("com.sun.security.enableCRLDP", "true");
-                if (ocspEnabled) {
-                    Security.setProperty("ocsp.enable", "true");
+            if (crlEnabled) {
+                // See [RevocationChecker][1] for details. Basically, we are mimicking the legacy path,
+                // which relies significantly on jvm wide properties[2], as that is the path we are routing
+                // before (i.e. no explicit `PKIXRevocationChecker`).
+                //
+                // By reading but not writing these properties, we conform to but not interfere with what
+                // admin set while still keep backward compatibility.
+                // 1. Default "zookeeper.ssl.crl" to jvm property "com.sun.net.ssl.checkRevocation" if it is unset.
+                // 2. Default "zookeeper.ssl.ocsp" to jvm security property "ocsp.enable" if it is unset.
+                // 3. Set `Option.ONLY_END_ENTITY` for jvm security property "com.sun.security.onlyCheckRevocationOfEECert".
+                // 4. Don't set "com.sun.security.enableCRLDP" as it is always enabled in no legacy path.
+                //
+                // See also:
+                // * https://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/ocsp.html
+                // * https://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/JSSERefGuide.html
+                // * https://docs.oracle.com/javase/8/docs/technotes/guides/security/certpath/CertPathProgGuide.html#PKIXRevocationChecker
+                //
+                // [1]: https://github.com/openjdk/jdk/blob/jdk-11%2B28/src/java.base/share/classes/sun/security/provider/certpath/RevocationChecker.java#L124
+                // [2]: https://github.com/openjdk/jdk/blob/jdk-11%2B28/src/java.base/share/classes/sun/security/provider/certpath/RevocationChecker.java#L179
+                Set<PKIXRevocationChecker.Option> options = new HashSet<>();
+                if (!ocspEnabled) {
+                    options.add(PKIXRevocationChecker.Option.NO_FALLBACK);
+                    options.add(PKIXRevocationChecker.Option.PREFER_CRLS);
+                }
+                if (Boolean.parseBoolean(Security.getProperty("com.sun.security.onlyCheckRevocationOfEECert")))  {
+                    options.add(PKIXRevocationChecker.Option.ONLY_END_ENTITY);
                 }
+
+                PKIXRevocationChecker revocationChecker = (PKIXRevocationChecker) CertPathValidator.getInstance("PKIX").getRevocationChecker();
+                revocationChecker.setOptions(options);
+                pbParams.addCertPathChecker(revocationChecker);
             } else {
                 pbParams.setRevocationEnabled(false);
             }
@@ -504,7 +660,17 @@ public static X509TrustManager createTrustManager(
 
             for (final TrustManager tm : tmf.getTrustManagers()) {
                 if (tm instanceof X509ExtendedTrustManager) {
-                    return new ZKTrustManager((X509ExtendedTrustManager) tm, serverHostnameVerificationEnabled, clientHostnameVerificationEnabled);
+                    if (fipsMode) {
+                        if (LOG.isDebugEnabled()) {
+                            LOG.debug("FIPS mode is ON: selecting standard x509 trust manager {}", tm);
+                        }
+                        return (X509TrustManager) tm;
+                    }
+                    if (LOG.isDebugEnabled()) {
+                        LOG.debug("FIPS mode is OFF: creating ZKTrustManager");
+                    }
+                    return new ZKTrustManager((X509ExtendedTrustManager) tm, serverHostnameVerificationEnabled,
+                        clientHostnameVerificationEnabled, allowReverseDnsLookup);
                 }
             }
             throw new TrustManagerException("Couldn't find X509TrustManager");
@@ -529,26 +695,6 @@ public SSLServerSocket createSSLServerSocket(int port) throws X509Exception, IOE
         return getDefaultSSLContextAndOptions().createSSLServerSocket(port);
     }
 
-    static String[] getDefaultCipherSuites() {
-        return getDefaultCipherSuitesForJavaVersion(System.getProperty("java.specification.version"));
-    }
-
-    static String[] getDefaultCipherSuitesForJavaVersion(String javaVersion) {
-        Objects.requireNonNull(javaVersion);
-        if (javaVersion.matches("\\d+")) {
-            // Must be Java 9 or later
-            LOG.debug("Using Java9+ optimized cipher suites for Java version {}", javaVersion);
-            return DEFAULT_CIPHERS_JAVA9;
-        } else if (javaVersion.startsWith("1.")) {
-            // Must be Java 1.8 or earlier
-            LOG.debug("Using Java8 optimized cipher suites for Java version {}", javaVersion);
-            return DEFAULT_CIPHERS_JAVA8;
-        } else {
-            LOG.debug("Could not parse java version {}, using Java8 optimized cipher suites", javaVersion);
-            return DEFAULT_CIPHERS_JAVA8;
-        }
-    }
-
     private FileChangeWatcher newFileChangeWatcher(String fileLocation) throws IOException {
         if (fileLocation == null || fileLocation.isEmpty()) {
             return null;
@@ -570,7 +716,7 @@ private FileChangeWatcher newFileChangeWatcher(String fileLocation) throws IOExc
      */
     public void enableCertFileReloading() throws IOException {
         LOG.info("enabling cert file reloading");
-        ZKConfig config = zkConfig == null ? new ZKConfig() : zkConfig;
+        ZKConfig config = new ZKConfig();
         FileChangeWatcher newKeyStoreFileWatcher = newFileChangeWatcher(config.getProperty(sslKeystoreLocationProperty));
         if (newKeyStoreFileWatcher != null) {
             // stop old watcher if there is one
@@ -597,6 +743,7 @@ public void enableCertFileReloading() throws IOException {
      */
     @Override
     public void close() {
+        defaultSSLContextAndOptions.set(null);
         if (keyStoreFileWatcher != null) {
             keyStoreFileWatcher.stop();
             keyStoreFileWatcher = null;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
index 6bbe698e3d2..442d8e7221d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java
@@ -18,15 +18,19 @@
 
 package org.apache.zookeeper.common;
 
+import static org.apache.zookeeper.common.LogRedactor.redactSensitiveValues;
+import static org.apache.zookeeper.common.LogRedactor.redactValue;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.IOException;
+import java.lang.reflect.Constructor;
+import java.nio.file.Path;
+import java.nio.file.Paths;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Map.Entry;
 import java.util.Properties;
 import org.apache.zookeeper.Environment;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
 import org.apache.zookeeper.server.util.VerifyingFileFactory;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -51,7 +55,7 @@ public class ZKConfig {
     public static final String KINIT_COMMAND = "zookeeper.kinit";
     public static final String JGSS_NATIVE = "sun.security.jgss.native";
 
-    private final Map<String, String> properties = new HashMap<String, String>();
+    private final Map<String, String> properties = new HashMap<>();
 
     /**
      * properties, which are common to both client and server, are initialized
@@ -62,26 +66,47 @@ public ZKConfig() {
     }
 
     /**
+     * <p><b>Use {@link ZKConfig#ZKConfig(Path configPath)} instead.</b>
+     *
+     * <p><b>The signature of this method has been changed to throw {@link ConfigException}
+     * instead of {@code QuorumPeerConfig.ConfigException}.</b>
+     *
      * @param configPath
      *            Configuration file path
      * @throws ConfigException
      *             if failed to load configuration properties
      */
-
+    @Deprecated
     public ZKConfig(String configPath) throws ConfigException {
-        this(new File(configPath));
+        this(Paths.get(configPath));
     }
 
     /**
+     * <p><b>Use {@link ZKConfig#ZKConfig(Path configPath)} instead.</b>
+     *
+     * <p><b>The signature of this method has been changed to throw {@link ConfigException}
+     * instead of {@code QuorumPeerConfig.ConfigException}.</b>
      *
      * @param configFile
      *            Configuration file
      * @throws ConfigException
      *             if failed to load configuration properties
      */
+    @Deprecated
     public ZKConfig(File configFile) throws ConfigException {
+        this(configFile.toPath());
+    }
+
+    /**
+     * Constructs a {@link ZKConfig} with properties from file.
+     *
+     * @param configPath path to configuration file
+     * @throws ConfigException
+     */
+    public ZKConfig(Path configPath) throws ConfigException {
         this();
-        addConfiguration(configFile);
+        addConfiguration(configPath);
+        LOG.info("ZK Config {}", redactSensitiveValues(properties));
     }
 
     private void init() {
@@ -105,6 +130,7 @@ protected void handleBackwardCompatibility() {
         try (ClientX509Util clientX509Util = new ClientX509Util()) {
             putSSLProperties(clientX509Util);
             properties.put(clientX509Util.getSslAuthProviderProperty(), System.getProperty(clientX509Util.getSslAuthProviderProperty()));
+            properties.put(clientX509Util.getSslProviderProperty(), System.getProperty(clientX509Util.getSslProviderProperty()));
         }
 
         try (X509Util x509Util = new QuorumX509Util()) {
@@ -118,16 +144,21 @@ private void putSSLProperties(X509Util x509Util) {
         properties.put(x509Util.getSslCipherSuitesProperty(), System.getProperty(x509Util.getSslCipherSuitesProperty()));
         properties.put(x509Util.getSslKeystoreLocationProperty(), System.getProperty(x509Util.getSslKeystoreLocationProperty()));
         properties.put(x509Util.getSslKeystorePasswdProperty(), System.getProperty(x509Util.getSslKeystorePasswdProperty()));
+        properties.put(x509Util.getSslKeystorePasswdPathProperty(), System.getProperty(x509Util.getSslKeystorePasswdPathProperty()));
         properties.put(x509Util.getSslKeystoreTypeProperty(), System.getProperty(x509Util.getSslKeystoreTypeProperty()));
         properties.put(x509Util.getSslTruststoreLocationProperty(), System.getProperty(x509Util.getSslTruststoreLocationProperty()));
         properties.put(x509Util.getSslTruststorePasswdProperty(), System.getProperty(x509Util.getSslTruststorePasswdProperty()));
+        properties.put(x509Util.getSslTruststorePasswdPathProperty(), System.getProperty(x509Util.getSslTruststorePasswdPathProperty()));
         properties.put(x509Util.getSslTruststoreTypeProperty(), System.getProperty(x509Util.getSslTruststoreTypeProperty()));
         properties.put(x509Util.getSslContextSupplierClassProperty(), System.getProperty(x509Util.getSslContextSupplierClassProperty()));
+        properties.put(x509Util.getSslClientHostnameVerificationEnabledProperty(), System.getProperty(x509Util.getSslClientHostnameVerificationEnabledProperty()));
         properties.put(x509Util.getSslHostnameVerificationEnabledProperty(), System.getProperty(x509Util.getSslHostnameVerificationEnabledProperty()));
+        properties.put(x509Util.getSslAllowReverseDnsLookupProperty(), System.getProperty(x509Util.getSslAllowReverseDnsLookupProperty()));
         properties.put(x509Util.getSslCrlEnabledProperty(), System.getProperty(x509Util.getSslCrlEnabledProperty()));
         properties.put(x509Util.getSslOcspEnabledProperty(), System.getProperty(x509Util.getSslOcspEnabledProperty()));
         properties.put(x509Util.getSslClientAuthProperty(), System.getProperty(x509Util.getSslClientAuthProperty()));
         properties.put(x509Util.getSslHandshakeDetectionTimeoutMillisProperty(), System.getProperty(x509Util.getSslHandshakeDetectionTimeoutMillisProperty()));
+        properties.put(x509Util.getFipsModeProperty(), System.getProperty(x509Util.getFipsModeProperty()));
     }
 
     /**
@@ -177,7 +208,7 @@ public void setProperty(String key, String value) {
         }
         String oldValue = properties.put(key, value);
         if (null != oldValue && !oldValue.equals(value)) {
-            LOG.debug("key {}'s value {} is replaced with new value {}", key, oldValue, value);
+            LOG.debug("key {}'s value {} is replaced with new value {}", key, redactValue(key, oldValue), redactValue(key, value));
         }
     }
 
@@ -185,38 +216,68 @@ public void setProperty(String key, String value) {
      * Add a configuration resource. The properties form this configuration will
      * overwrite corresponding already loaded property and system property
      *
-     * @param configFile
-     *            Configuration file.
+     * @param configPath path to Configuration file.
      */
-    public void addConfiguration(File configFile) throws ConfigException {
-        LOG.info("Reading configuration from: {}", configFile.getAbsolutePath());
+    public void addConfiguration(Path configPath) throws ConfigException {
+        Path absoluteConfigPath = configPath.toAbsolutePath();
+        LOG.info("Reading configuration from: {}", absoluteConfigPath);
         try {
-            configFile = (new VerifyingFileFactory.Builder(LOG).warnForRelativePath()
+            File configFile = (new VerifyingFileFactory.Builder(LOG).warnForRelativePath()
                                                                .failForNonExistingPath()
-                                                               .build()).validate(configFile);
+                                                               .build()).validate(configPath.toFile());
             Properties cfg = new Properties();
-            FileInputStream in = new FileInputStream(configFile);
-            try {
+            try (FileInputStream in = new FileInputStream(configFile)) {
                 cfg.load(in);
-            } finally {
-                in.close();
             }
             parseProperties(cfg);
         } catch (IOException | IllegalArgumentException e) {
-            LOG.error("Error while configuration from: {}", configFile.getAbsolutePath(), e);
-            throw new ConfigException("Error while processing " + configFile.getAbsolutePath(), e);
+            LOG.error("Error while configuration from: {}", absoluteConfigPath, e);
+            String msg = "Error while processing " + absoluteConfigPath;
+            try {
+                Class<?> clazz = Class.forName("org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException");
+                Class<? extends ConfigException> exceptionClass = clazz.asSubclass(ConfigException.class);
+                Constructor<? extends ConfigException> constructor = exceptionClass.getDeclaredConstructor(String.class, Exception.class);
+                throw constructor.newInstance(msg, e);
+            } catch (ClassNotFoundException ignored) {
+            } catch (Exception ignored) {
+                LOG.warn("Fail to construct QuorumPeerConfig.ConfigException", e);
+            }
+            throw new ConfigException(msg, e);
         }
     }
 
     /**
-     * Add a configuration resource. The properties form this configuration will
+     * <p><b>Use {@link #addConfiguration(Path)} instead.</b></p>
+     *
+     * <p><b>The signature of this method has been changed to throw {@link ConfigException}
+     * instead of {@code QuorumPeerConfig.ConfigException}.</b>
+     *
+     * <p>Add a configuration resource. The properties form this configuration will
+     * overwrite corresponding already loaded property and system property
+     *
+     * @param configFile
+     *            Configuration file.
+     */
+    @Deprecated
+    public void addConfiguration(File configFile) throws ConfigException {
+        addConfiguration(configFile.toPath());
+    }
+
+    /**
+     * <p><b>Use {@link #addConfiguration(Path)} instead.</b></p>
+     *
+     * <p><b>The signature of this method has been changed to throw {@link ConfigException}
+     * instead of {@code QuorumPeerConfig.ConfigException}.</b>
+     *
+     * <p>Add a configuration resource. The properties form this configuration will
      * overwrite corresponding already loaded property and system property
      *
      * @param configPath
      *            Configuration file path.
      */
+    @Deprecated
     public void addConfiguration(String configPath) throws ConfigException {
-        addConfiguration(new File(configPath));
+        addConfiguration(Paths.get(configPath));
     }
 
     private void parseProperties(Properties cfg) {
@@ -277,5 +338,4 @@ public int getInt(String key, int defaultValue) {
         }
         return defaultValue;
     }
-
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKHostnameVerifier.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKHostnameVerifier.java
index 6415989ddb9..2c5ef2ef7ca 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKHostnameVerifier.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKHostnameVerifier.java
@@ -49,7 +49,7 @@
  * Note: copied from Apache httpclient with some modifications. We want host verification, but depending
  * on the httpclient jar caused unexplained performance regressions (even when the code was not used).
  */
-final class ZKHostnameVerifier implements HostnameVerifier {
+class ZKHostnameVerifier implements HostnameVerifier {
 
     /**
      * Note: copied from Apache httpclient with some minor modifications. We want host verification, but depending
@@ -320,12 +320,18 @@ private static List<SubjectName> getSubjectAltNames(final X509Certificate cert)
             if (entries == null) {
                 return Collections.emptyList();
             }
-            final List<SubjectName> result = new ArrayList<SubjectName>();
+            final List<SubjectName> result = new ArrayList<>();
             for (List<?> entry : entries) {
                 final Integer type = entry.size() >= 2 ? (Integer) entry.get(0) : null;
                 if (type != null) {
-                    final String s = (String) entry.get(1);
-                    result.add(new SubjectName(s, type));
+                    if (type == SubjectName.DNS || type == SubjectName.IP) {
+                        final Object o = entry.get(1);
+                        if (o instanceof String) {
+                            result.add(new SubjectName((String) o, type));
+                        } else if (o instanceof byte[]) {
+                            // TODO ASN.1 DER encoded form
+                        }
+                    }
                 }
             }
             return result;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKTrustManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKTrustManager.java
index 34bf4dc977b..e2af9f6f077 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKTrustManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKTrustManager.java
@@ -39,11 +39,12 @@ public class ZKTrustManager extends X509ExtendedTrustManager {
 
     private static final Logger LOG = LoggerFactory.getLogger(ZKTrustManager.class);
 
-    private X509ExtendedTrustManager x509ExtendedTrustManager;
-    private boolean serverHostnameVerificationEnabled;
-    private boolean clientHostnameVerificationEnabled;
+    private final X509ExtendedTrustManager x509ExtendedTrustManager;
+    private final boolean serverHostnameVerificationEnabled;
+    private final boolean clientHostnameVerificationEnabled;
+    private final boolean allowReverseDnsLookup;
 
-    private ZKHostnameVerifier hostnameVerifier;
+    private final ZKHostnameVerifier hostnameVerifier;
 
     /**
      * Instantiate a new ZKTrustManager.
@@ -57,11 +58,26 @@ public class ZKTrustManager extends X509ExtendedTrustManager {
     ZKTrustManager(
         X509ExtendedTrustManager x509ExtendedTrustManager,
         boolean serverHostnameVerificationEnabled,
-        boolean clientHostnameVerificationEnabled) {
+        boolean clientHostnameVerificationEnabled,
+        boolean allowReverseDnsLookup) {
+        this(x509ExtendedTrustManager,
+                serverHostnameVerificationEnabled,
+                clientHostnameVerificationEnabled,
+                new ZKHostnameVerifier(),
+                allowReverseDnsLookup);
+    }
+
+    ZKTrustManager(
+            X509ExtendedTrustManager x509ExtendedTrustManager,
+            boolean serverHostnameVerificationEnabled,
+            boolean clientHostnameVerificationEnabled,
+            ZKHostnameVerifier hostnameVerifier,
+            boolean allowReverseDnsLookup) {
         this.x509ExtendedTrustManager = x509ExtendedTrustManager;
         this.serverHostnameVerificationEnabled = serverHostnameVerificationEnabled;
         this.clientHostnameVerificationEnabled = clientHostnameVerificationEnabled;
-        hostnameVerifier = new ZKHostnameVerifier();
+        this.hostnameVerifier = hostnameVerifier;
+        this.allowReverseDnsLookup = allowReverseDnsLookup;
     }
 
     @Override
@@ -76,6 +92,9 @@ public void checkClientTrusted(
         Socket socket) throws CertificateException {
         x509ExtendedTrustManager.checkClientTrusted(chain, authType, socket);
         if (clientHostnameVerificationEnabled) {
+            if (LOG.isDebugEnabled()) {
+                LOG.debug("Check client trusted socket.getInetAddress(): {}, {}", socket.getInetAddress(), socket);
+            }
             performHostVerification(socket.getInetAddress(), chain[0]);
         }
     }
@@ -87,6 +106,9 @@ public void checkServerTrusted(
         Socket socket) throws CertificateException {
         x509ExtendedTrustManager.checkServerTrusted(chain, authType, socket);
         if (serverHostnameVerificationEnabled) {
+            if (LOG.isDebugEnabled()) {
+                LOG.debug("Check server trusted socket.getInetAddress(): {}, {}", socket.getInetAddress(), socket);
+            }
             performHostVerification(socket.getInetAddress(), chain[0]);
         }
     }
@@ -99,6 +121,9 @@ public void checkClientTrusted(
         x509ExtendedTrustManager.checkClientTrusted(chain, authType, engine);
         if (clientHostnameVerificationEnabled) {
             try {
+                if (LOG.isDebugEnabled()) {
+                    LOG.debug("Check client trusted engine.getPeerHost(): {}, {}", engine.getPeerHost(), engine);
+                }
                 performHostVerification(InetAddress.getByName(engine.getPeerHost()), chain[0]);
             } catch (UnknownHostException e) {
                 throw new CertificateException("Failed to verify host", e);
@@ -115,6 +140,9 @@ public void checkServerTrusted(
         x509ExtendedTrustManager.checkServerTrusted(chain, authType, engine);
         if (serverHostnameVerificationEnabled) {
             try {
+                if (LOG.isDebugEnabled()) {
+                    LOG.debug("Check server trusted engine.getPeerHost(): {}, {}", engine.getPeerHost(), engine);
+                }
                 performHostVerification(InetAddress.getByName(engine.getPeerHost()), chain[0]);
             } catch (UnknownHostException e) {
                 throw new CertificateException("Failed to verify host", e);
@@ -133,36 +161,57 @@ public void checkServerTrusted(X509Certificate[] chain, String authType) throws
     }
 
     /**
-     * Compares peer's hostname with the one stored in the provided client certificate. Performs verification
+     * Compares peer's hostname with the one stored in the provided certificate. Performs verification
      * with the help of provided HostnameVerifier.
      *
+     * Attempts to verify the IP address first, if it fails, check the hostname. Performs reverse DNS lookup
+     * if hostname is not available. (Mostly the case in client verifications.)
+     *
      * @param inetAddress Peer's inet address.
      * @param certificate Peer's certificate
      * @throws CertificateException Thrown if the provided certificate doesn't match the peer hostname.
      */
-    private void performHostVerification(
-        InetAddress inetAddress,
-        X509Certificate certificate
-                                        ) throws CertificateException {
+    private void performHostVerification(InetAddress inetAddress, X509Certificate certificate)
+        throws CertificateException {
         String hostAddress = "";
         String hostName = "";
         try {
             hostAddress = inetAddress.getHostAddress();
             hostnameVerifier.verify(hostAddress, certificate);
         } catch (SSLException addressVerificationException) {
-            try {
+            // If we fail with hostAddress, we should try the hostname.
+            // The inetAddress may have been created with a hostname, in which case getHostName() will
+            // return quickly below. If not, a reverse lookup will happen, which can be expensive.
+            // We provide the option to skip the reverse lookup if preferring to fail fast.
+
+            // Handle logging here to aid debugging. The easiest way to check for an existing
+            // hostname is through toString, see javadoc.
+            String inetAddressString = inetAddress.toString();
+            if (!inetAddressString.startsWith("/")) {
+                LOG.debug(
+                    "Failed to verify host address: {}, but inetAddress {} has a hostname, trying that",
+                    hostAddress, inetAddressString, addressVerificationException);
+            } else if (allowReverseDnsLookup) {
                 LOG.debug(
-                    "Failed to verify host address: {} attempting to verify host name with reverse dns lookup",
-                    hostAddress,
+                    "Failed to verify host address: {}, attempting to verify host name with reverse dns",
+                    hostAddress, addressVerificationException);
+            } else {
+                LOG.debug("Failed to verify host address: {}, but reverse dns lookup is disabled",
+                    hostAddress, addressVerificationException);
+                throw new CertificateException(
+                    "Failed to verify host address, and reverse lookup is disabled",
                     addressVerificationException);
+            }
+
+            try {
                 hostName = inetAddress.getHostName();
                 hostnameVerifier.verify(hostName, certificate);
             } catch (SSLException hostnameVerificationException) {
                 LOG.error("Failed to verify host address: {}", hostAddress, addressVerificationException);
                 LOG.error("Failed to verify hostname: {}", hostName, hostnameVerificationException);
-                throw new CertificateException("Failed to verify both host address and host name", hostnameVerificationException);
+                throw new CertificateException("Failed to verify both host address and host name",
+                    hostnameVerificationException);
             }
         }
     }
-
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/compat/ProtocolManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/compat/ProtocolManager.java
new file mode 100644
index 00000000000..50038e5cbb2
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/compat/ProtocolManager.java
@@ -0,0 +1,156 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.compat;
+
+import java.io.IOException;
+import org.apache.jute.InputArchive;
+import org.apache.jute.OutputArchive;
+import org.apache.zookeeper.proto.ConnectRequest;
+import org.apache.zookeeper.proto.ConnectResponse;
+
+/**
+ * A manager for switching behaviours between difference wire protocol.
+ * <p>
+ * Basically, wire protocol should be backward and forward compatible between minor versions.
+ * However, there are several cases that it's different due to Jute's limitations.
+ */
+public final class ProtocolManager {
+    private volatile Boolean isReadonlyAvailable = null;
+
+    public boolean isReadonlyAvailable() {
+        return isReadonlyAvailable != null && isReadonlyAvailable;
+    }
+
+    /**
+     * Deserializing {@link ConnectRequest} should be specially handled for request from client
+     * version before and including ZooKeeper 3.3 which doesn't understand readOnly field.
+     */
+    public ConnectRequest deserializeConnectRequest(InputArchive inputArchive) throws IOException {
+        if (isReadonlyAvailable != null) {
+            if (isReadonlyAvailable) {
+                return deserializeConnectRequestWithReadonly(inputArchive);
+            } else {
+                return deserializeConnectRequestWithoutReadonly(inputArchive);
+            }
+        }
+
+        final ConnectRequest request = deserializeConnectRequestWithoutReadonly(inputArchive);
+        try {
+            request.setReadOnly(inputArchive.readBool("readOnly"));
+            this.isReadonlyAvailable = true;
+        } catch (Exception e) {
+            request.setReadOnly(false); // old version doesn't have readonly concept
+            this.isReadonlyAvailable = false;
+        }
+        return request;
+    }
+
+    private ConnectRequest deserializeConnectRequestWithReadonly(InputArchive inputArchive) throws IOException {
+        final ConnectRequest request = new ConnectRequest();
+        request.deserialize(inputArchive, "connect");
+        return request;
+    }
+
+    private ConnectRequest deserializeConnectRequestWithoutReadonly(InputArchive inputArchive) throws IOException {
+        final ConnectRequest request = new ConnectRequest();
+        inputArchive.startRecord("connect");
+        request.setProtocolVersion(inputArchive.readInt("protocolVersion"));
+        request.setLastZxidSeen(inputArchive.readLong("lastZxidSeen"));
+        request.setTimeOut(inputArchive.readInt("timeOut"));
+        request.setSessionId(inputArchive.readLong("sessionId"));
+        request.setPasswd(inputArchive.readBuffer("passwd"));
+        inputArchive.endRecord("connect");
+        return request;
+    }
+
+    /**
+     * Deserializing {@link ConnectResponse} should be specially handled for response from server
+     * version before and including ZooKeeper 3.3 which doesn't understand readOnly field.
+     */
+    public ConnectResponse deserializeConnectResponse(InputArchive inputArchive) throws IOException {
+        if (isReadonlyAvailable != null) {
+            if (isReadonlyAvailable) {
+                return deserializeConnectResponseWithReadonly(inputArchive);
+            } else {
+                return deserializeConnectResponseWithoutReadonly(inputArchive);
+            }
+        }
+
+        final ConnectResponse response = deserializeConnectResponseWithoutReadonly(inputArchive);
+        try {
+            response.setReadOnly(inputArchive.readBool("readOnly"));
+            this.isReadonlyAvailable = true;
+        } catch (Exception e) {
+            response.setReadOnly(false); // old version doesn't have readonly concept
+            this.isReadonlyAvailable = false;
+        }
+        return response;
+    }
+
+    private ConnectResponse deserializeConnectResponseWithReadonly(InputArchive inputArchive) throws IOException {
+        final ConnectResponse response = new ConnectResponse();
+        response.deserialize(inputArchive, "connect");
+        return response;
+    }
+
+    private ConnectResponse deserializeConnectResponseWithoutReadonly(InputArchive inputArchive) throws IOException {
+        final ConnectResponse response = new ConnectResponse();
+        inputArchive.startRecord("connect");
+        response.setProtocolVersion(inputArchive.readInt("protocolVersion"));
+        response.setTimeOut(inputArchive.readInt("timeOut"));
+        response.setSessionId(inputArchive.readLong("sessionId"));
+        response.setPasswd(inputArchive.readBuffer("passwd"));
+        inputArchive.endRecord("connect");
+        return response;
+    }
+
+    /**
+     * The serialization of {@link ConnectResponse} has to be handled
+     * specially as clients earlier than 3.5 might not expect the
+     * {@code readOnly} flag.
+     *
+     * @param response the response to serialize
+     * @param outputArchive the serialization destination
+     * @see #deserializeConnectRequest(InputArchive)
+     */
+    public void serializeConnectResponse(final ConnectResponse response, OutputArchive outputArchive) throws IOException {
+        serializeConnectResponse(response, outputArchive, isReadonlyAvailable());
+    }
+
+    private static void serializeConnectResponse(final ConnectResponse response, OutputArchive outputArchive, boolean withReadonly) throws IOException {
+        if (withReadonly) {
+            serializeConnectResponseWithReadonly(response, outputArchive);
+        } else {
+            serializeConnectResponseWithoutReadonly(response, outputArchive);
+        }
+    }
+
+    private static void serializeConnectResponseWithReadonly(ConnectResponse response, OutputArchive outputArchive) throws IOException {
+        response.serialize(outputArchive, "connect");
+    }
+
+    private static void serializeConnectResponseWithoutReadonly(ConnectResponse response, OutputArchive outputArchive) throws IOException {
+        outputArchive.startRecord(response, "connect");
+        outputArchive.writeInt(response.getProtocolVersion(), "protocolVersion");
+        outputArchive.writeInt(response.getTimeOut(), "timeOut");
+        outputArchive.writeLong(response.getSessionId(), "sessionId");
+        outputArchive.writeBuffer(response.getPasswd(), "passwd");
+        outputArchive.endRecord(response, "connect");
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/jmx/MBeanRegistry.java b/zookeeper-server/src/main/java/org/apache/zookeeper/jmx/MBeanRegistry.java
index 5bfa8bb5c00..f91b9674a04 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/jmx/MBeanRegistry.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/jmx/MBeanRegistry.java
@@ -47,7 +47,7 @@ public class MBeanRegistry {
 
     private final Object LOCK = new Object();
 
-    private Map<ZKMBeanInfo, String> mapBean2Path = new ConcurrentHashMap<ZKMBeanInfo, String>();
+    private Map<ZKMBeanInfo, String> mapBean2Path = new ConcurrentHashMap<>();
 
     private MBeanServer mBeanServer;
 
@@ -135,7 +135,7 @@ private void unregister(String path, ZKMBeanInfo bean) throws JMException {
      *         unregistered. Mainly for testing purposes.
      */
     public Set<ZKMBeanInfo> getRegisteredBeans() {
-        return new HashSet<ZKMBeanInfo>(mapBean2Path.keySet());
+        return new HashSet<>(mapBean2Path.keySet());
     }
 
     /**
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/jmx/ManagedUtil.java b/zookeeper-server/src/main/java/org/apache/zookeeper/jmx/ManagedUtil.java
index 633cb17c2e1..9591f6c2f42 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/jmx/ManagedUtil.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/jmx/ManagedUtil.java
@@ -53,7 +53,7 @@ private static boolean isLog4jJmxEnabled() {
     /**
      * Register the log4j JMX mbeans. Set system property
      * "zookeeper.jmx.log4j.disable" to true to disable registration.
-     * @see http://logging.apache.org/log4j/1.2/apidocs/index.html?org/apache/log4j/jmx/package-summary.html
+     * @see <a href="http://logging.apache.org/log4j/1.2/apidocs/index.html?org/apache/log4j/jmx/package-summary.html">Log4J 1.2 API docs</a>
      * @throws JMException if registration fails
      */
     @SuppressWarnings("rawtypes")
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/CounterSet.java b/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/CounterSet.java
new file mode 100644
index 00000000000..c9c7c13c489
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/CounterSet.java
@@ -0,0 +1,47 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.metrics;
+
+/**
+ * A counter refers to a value which can only increase.
+ * Usually the value is reset when the process starts.
+ *
+ *  A CounterSet is a set of {@link Counter} grouped by keys.
+ */
+
+public interface CounterSet {
+    /**
+     * Increment the value by one for the given key
+     * <p>This method is thread safe, The MetricsProvider will take care of synchronization.</p>
+     *
+     * @param key the key to increment the count
+     */
+    default void inc(String key) {
+        add(key, 1L);
+    }
+
+    /**
+     * Increment the value by a given amount for the given key
+     * <p>This method is thread safe, The MetricsProvider will take care of synchronization.</p>
+     *
+     * @param key the key to increment the count for the given key
+     * @param delta amount to increment, this cannot be a negative number.
+     */
+    void add(String key, long delta);
+}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/Log4JEntry.java b/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/GaugeSet.java
similarity index 58%
rename from zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/Log4JEntry.java
rename to zookeeper-server/src/main/java/org/apache/zookeeper/metrics/GaugeSet.java
index 0edc1460244..15fd93f3c39 100644
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/Log4JEntry.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/GaugeSet.java
@@ -1,4 +1,4 @@
-/**
+/*
  * Licensed to the Apache Software Foundation (ASF) under one
  * or more contributor license agreements.  See the NOTICE file
  * distributed with this work for additional information
@@ -15,26 +15,23 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.apache.zookeeper.graph;
-
-public class Log4JEntry extends LogEntry {
-    public Log4JEntry(long timestamp, int node, String entry) { 
-	super(timestamp);
-	setAttribute("log-text", entry);
-	setAttribute("node", new Integer(node));
-    }
-
-    public String getEntry() {
-	return (String) getAttribute("log-text");
-    }
 
-    public String toString() {
-	return "" + getTimestamp() + "::::" + getNode() + "::::"  + getEntry();
-    }
+package org.apache.zookeeper.metrics;
 
-    public int getNode() {
-	return (Integer) getAttribute("node");
-    }
+import java.util.Map;
 
-    public Type getType() { return LogEntry.Type.LOG4J; }
+/**
+ * A Gauge is an application provided object which will be called by the metrics framework to sample a numeric value.
+ *
+ * A GaugeSet is a set of {@link Gauge} grouped by keys.
+ */
+public interface GaugeSet {
+    /**
+     * Returns all values and the associated keys of the GaugeSet.
+     * The MetricsProvider will call this callback without taking care of synchronization, it is up to the application
+     * to handle thread safety.
+     *
+     * @return all the values and keys
+     */
+    Map<String, Number> values();
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/MetricsContext.java b/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/MetricsContext.java
index 3ea8f8c058a..18ff1180cf7 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/MetricsContext.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/MetricsContext.java
@@ -50,6 +50,15 @@ public interface MetricsContext {
      */
     Counter getCounter(String name);
 
+    /**
+     * Returns the CounterSet identified by the given name
+     * Null name is not allowed
+     *
+     * @param name
+     * @return CounterSet identified by the name in this context.
+     */
+    CounterSet getCounterSet(String name);
+
     /**
      * Registers an user provided {@link Gauge} which will be called by the
      * MetricsProvider in order to sample an integer value.
@@ -71,6 +80,27 @@ public interface MetricsContext {
      */
     void unregisterGauge(String name);
 
+    /**
+     * Registers a user provided {@link GaugeSet} which will be called by the
+     * MetricsProvider in order to sample number values.
+     * If another GaugeSet was already registered, the new one will take its place.
+     * Registering with a null name or null callback is not allowed.
+     *
+     * @param name unique name of the GaugeSet in this context
+     * @param gaugeSet the implementation of the GaugeSet
+     *
+     */
+    void registerGaugeSet(String name, GaugeSet gaugeSet);
+
+    /**
+     * Unregisters the user provided {@link GaugeSet} bound to the given name.
+     *
+     * Unregistering with a null name is not allowed.
+     * @param name unique name of the GaugeSet in this context
+     *
+     */
+    void unregisterGaugeSet(String name);
+
     enum DetailLevel {
         /**
          * The returned Summary is expected to track only simple aggregated
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/MetricsProviderLifeCycleException.java b/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/MetricsProviderLifeCycleException.java
index 24a88ef0fd3..f79bdccd6e9 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/MetricsProviderLifeCycleException.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/MetricsProviderLifeCycleException.java
@@ -19,7 +19,7 @@
 package org.apache.zookeeper.metrics;
 
 /**
- * A generic exception thrown during the licecycle of a MetricsProvider.
+ * A generic exception thrown during the lifecycle of a MetricsProvider.
  * <p>These exception will prevent the system from booting.</p>
  * <p>Normally these exception will be ignored during shutdown.</p>
  */
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/Summary.java b/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/Summary.java
index f8280dabd22..0dddfd3d623 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/Summary.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/Summary.java
@@ -20,7 +20,7 @@
 
 /**
  * Summaries track the size and number of events.
- * They are able to publish minumum, maximum, average values, depending on the capabilities of the MetricsProvider.
+ * They are able to publish minimum, maximum, average values, depending on the capabilities of the MetricsProvider.
  */
 public interface Summary {
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/SummarySet.java b/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/SummarySet.java
index 8386d185fa0..905402b318e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/SummarySet.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/SummarySet.java
@@ -20,7 +20,7 @@
 
 /**
  * Summaries track the size and number of events.
- * They are able to publish minumum, maximum, average values, depending on the capabilities of the MetricsProvider.
+ * They are able to publish minimum, maximum, average values, depending on the capabilities of the MetricsProvider.
  * A SummarySet is a set of {@link Summary}.
  */
 public interface SummarySet {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/impl/DefaultMetricsProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/impl/DefaultMetricsProvider.java
index 85f86db97d0..634ec25d30f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/impl/DefaultMetricsProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/impl/DefaultMetricsProvider.java
@@ -24,7 +24,9 @@
 import java.util.concurrent.ConcurrentMap;
 import java.util.function.BiConsumer;
 import org.apache.zookeeper.metrics.Counter;
+import org.apache.zookeeper.metrics.CounterSet;
 import org.apache.zookeeper.metrics.Gauge;
+import org.apache.zookeeper.metrics.GaugeSet;
 import org.apache.zookeeper.metrics.MetricsContext;
 import org.apache.zookeeper.metrics.MetricsProvider;
 import org.apache.zookeeper.metrics.MetricsProviderLifeCycleException;
@@ -35,6 +37,7 @@
 import org.apache.zookeeper.server.metric.AvgMinMaxPercentileCounter;
 import org.apache.zookeeper.server.metric.AvgMinMaxPercentileCounterSet;
 import org.apache.zookeeper.server.metric.SimpleCounter;
+import org.apache.zookeeper.server.metric.SimpleCounterSet;
 
 /**
  * Default implementation of {@link MetricsProvider}.<br>
@@ -64,6 +67,7 @@ public MetricsContext getRootContext() {
     public void stop() {
         // release all references to external objects
         rootMetricsContext.gauges.clear();
+        rootMetricsContext.gaugeSets.clear();
     }
 
     @Override
@@ -79,7 +83,9 @@ public void resetAllValues() {
     private static final class DefaultMetricsContext implements MetricsContext {
 
         private final ConcurrentMap<String, Gauge> gauges = new ConcurrentHashMap<>();
+        private final ConcurrentMap<String, GaugeSet> gaugeSets = new ConcurrentHashMap<>();
         private final ConcurrentMap<String, SimpleCounter> counters = new ConcurrentHashMap<>();
+        private final ConcurrentMap<String, SimpleCounterSet> counterSets = new ConcurrentHashMap<>();
         private final ConcurrentMap<String, AvgMinMaxCounter> basicSummaries = new ConcurrentHashMap<>();
         private final ConcurrentMap<String, AvgMinMaxPercentileCounter> summaries = new ConcurrentHashMap<>();
         private final ConcurrentMap<String, AvgMinMaxCounterSet> basicSummarySets = new ConcurrentHashMap<>();
@@ -98,6 +104,12 @@ public Counter getCounter(String name) {
             });
         }
 
+        @Override
+        public CounterSet getCounterSet(final String name) {
+            Objects.requireNonNull(name, "Cannot register a CounterSet with null name");
+            return counterSets.computeIfAbsent(name, SimpleCounterSet::new);
+        }
+
         @Override
         public void registerGauge(String name, Gauge gauge) {
             Objects.requireNonNull(gauge, "Cannot register a null Gauge for " + name);
@@ -109,6 +121,19 @@ public void unregisterGauge(String name) {
             gauges.remove(name);
         }
 
+        @Override
+        public void registerGaugeSet(final String name, final GaugeSet gaugeSet) {
+            Objects.requireNonNull(name, "Cannot register a GaugeSet with null name");
+            Objects.requireNonNull(gaugeSet, "Cannot register a null GaugeSet for " + name);
+            gaugeSets.put(name, gaugeSet);
+        }
+
+        @Override
+        public void unregisterGaugeSet(final String name) {
+            Objects.requireNonNull(name, "Cannot unregister GaugeSet with null name");
+            gaugeSets.remove(name);
+        }
+
         @Override
         public Summary getSummary(String name, DetailLevel detailLevel) {
             if (detailLevel == DetailLevel.BASIC) {
@@ -154,9 +179,21 @@ void dump(BiConsumer<String, Object> sink) {
                     sink.accept(name, value);
                 }
             });
+
+            gaugeSets.forEach((name, gaugeSet) ->
+                gaugeSet.values().forEach((key, value) -> {
+                    if (key != null) {
+                        sink.accept(key + "_" + name, value != null ? value : 0);
+                    }
+                })
+            );
+
             counters.values().forEach(metric -> {
                 metric.values().forEach(sink);
             });
+            counterSets.values().forEach(metric -> {
+                metric.values().forEach(sink);
+            });
             basicSummaries.values().forEach(metric -> {
                 metric.values().forEach(sink);
             });
@@ -175,6 +212,9 @@ void reset() {
             counters.values().forEach(metric -> {
                 metric.reset();
             });
+            counterSets.values().forEach(metric -> {
+                metric.reset();
+            });
             basicSummaries.values().forEach(metric -> {
                 metric.reset();
             });
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/impl/NullMetricsProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/impl/NullMetricsProvider.java
index 30a10795fa8..8d07e91865d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/impl/NullMetricsProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/metrics/impl/NullMetricsProvider.java
@@ -21,7 +21,9 @@
 import java.util.Properties;
 import java.util.function.BiConsumer;
 import org.apache.zookeeper.metrics.Counter;
+import org.apache.zookeeper.metrics.CounterSet;
 import org.apache.zookeeper.metrics.Gauge;
+import org.apache.zookeeper.metrics.GaugeSet;
 import org.apache.zookeeper.metrics.MetricsContext;
 import org.apache.zookeeper.metrics.MetricsProvider;
 import org.apache.zookeeper.metrics.MetricsProviderLifeCycleException;
@@ -77,6 +79,11 @@ public Counter getCounter(String name) {
             return NullCounter.INSTANCE;
         }
 
+        @Override
+        public CounterSet getCounterSet(final String name) {
+            return NullCounterSet.INSTANCE;
+        }
+
         @Override
         public void registerGauge(String name, Gauge gauge) {
         }
@@ -85,6 +92,14 @@ public void registerGauge(String name, Gauge gauge) {
         public void unregisterGauge(String name) {
         }
 
+        @Override
+        public void registerGaugeSet(final String name, final GaugeSet gaugeSet) {
+        }
+
+        @Override
+        public void unregisterGaugeSet(final String name) {
+        }
+
         @Override
         public Summary getSummary(String name, DetailLevel detailLevel) {
             return NullSummary.INSTANCE;
@@ -112,6 +127,15 @@ public long get() {
 
     }
 
+    private static final class NullCounterSet implements CounterSet {
+
+        private static final NullCounterSet INSTANCE = new NullCounterSet();
+
+        @Override
+        public void add(final String key, final long delta) {
+        }
+    }
+
     private static final class NullSummary implements Summary {
 
         private static final NullSummary INSTANCE = new NullSummary();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/AuthenticationHelper.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/AuthenticationHelper.java
new file mode 100644
index 00000000000..61aebb343be
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/AuthenticationHelper.java
@@ -0,0 +1,141 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.server;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+import java.util.stream.Collectors;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.data.Id;
+import org.apache.zookeeper.proto.ReplyHeader;
+import org.apache.zookeeper.server.auth.ProviderRegistry;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Contains helper methods to enforce authentication
+ */
+public class AuthenticationHelper {
+    private static final Logger LOG = LoggerFactory.getLogger(AuthenticationHelper.class);
+
+    public static final String ENFORCE_AUTH_ENABLED = "zookeeper.enforce.auth.enabled";
+    public static final String ENFORCE_AUTH_SCHEMES = "zookeeper.enforce.auth.schemes";
+    public static final String SESSION_REQUIRE_CLIENT_SASL_AUTH =
+        "zookeeper.sessionRequireClientSASLAuth";
+    public static final String SASL_AUTH_SCHEME = "sasl";
+
+    private boolean enforceAuthEnabled;
+    private List<String> enforceAuthSchemes = new ArrayList<>();
+    private boolean saslAuthRequired;
+
+    public AuthenticationHelper() {
+        initConfigurations();
+    }
+
+    private void initConfigurations() {
+        if (Boolean.parseBoolean(System.getProperty(SESSION_REQUIRE_CLIENT_SASL_AUTH, "false"))) {
+            enforceAuthEnabled = true;
+            enforceAuthSchemes.add(SASL_AUTH_SCHEME);
+        } else {
+            enforceAuthEnabled =
+                Boolean.parseBoolean(System.getProperty(ENFORCE_AUTH_ENABLED, "false"));
+            String enforceAuthSchemesProp = System.getProperty(ENFORCE_AUTH_SCHEMES);
+            if (enforceAuthSchemesProp != null) {
+                Arrays.stream(enforceAuthSchemesProp.split(",")).forEach(s -> {
+                    enforceAuthSchemes.add(s.trim());
+                });
+            }
+        }
+        LOG.info("{} = {}", ENFORCE_AUTH_ENABLED, enforceAuthEnabled);
+        LOG.info("{} = {}", ENFORCE_AUTH_SCHEMES, enforceAuthSchemes);
+        validateConfiguredProperties();
+        saslAuthRequired = enforceAuthEnabled && enforceAuthSchemes.contains(SASL_AUTH_SCHEME);
+    }
+
+    private void validateConfiguredProperties() {
+        if (enforceAuthEnabled) {
+            if (enforceAuthSchemes.isEmpty()) {
+                String msg =
+                    ENFORCE_AUTH_ENABLED + " is true " + ENFORCE_AUTH_SCHEMES + " must be  "
+                        + "configured.";
+                LOG.error(msg);
+                throw new IllegalArgumentException(msg);
+            }
+            enforceAuthSchemes.forEach(scheme -> {
+                if (ProviderRegistry.getProvider(scheme) == null) {
+                    String msg = "Authentication scheme " + scheme + " is not available.";
+                    LOG.error(msg);
+                    throw new IllegalArgumentException(msg);
+                }
+            });
+        }
+    }
+
+    /**
+     * Checks if connection is authenticated or not.
+     *
+     * @param cnxn server connection
+     * @return boolean
+     */
+    private boolean isCnxnAuthenticated(ServerCnxn cnxn) {
+        for (Id id : cnxn.getAuthInfo()) {
+            if (enforceAuthSchemes.contains(id.getScheme())) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    public boolean isEnforceAuthEnabled() {
+        return enforceAuthEnabled;
+    }
+
+    /**
+     * Returns true when authentication enforcement was success otherwise returns false
+     * also closes the connection
+     *
+     * @param connection server connection
+     * @param xid        current operation xid
+     * @return true when authentication enforcement is success otherwise false
+     */
+    public boolean enforceAuthentication(ServerCnxn connection, int xid) throws IOException {
+        if (isEnforceAuthEnabled() && !isCnxnAuthenticated(connection)) {
+            //Un authenticated connection, lets inform user with response and then close the session
+            LOG.error("Client authentication scheme(s) {} does not match with any of the expected "
+                    + "authentication scheme {}, closing session.", getAuthSchemes(connection),
+                enforceAuthSchemes);
+            ReplyHeader replyHeader = new ReplyHeader(xid, 0,
+                KeeperException.Code.SESSIONCLOSEDREQUIRESASLAUTH.intValue());
+            connection.sendResponse(replyHeader, null, "response");
+            connection.sendCloseSession();
+            connection.disableRecv();
+            return false;
+        }
+        return true;
+    }
+
+    private List<String> getAuthSchemes(ServerCnxn connection) {
+        return connection.getAuthInfo().stream().map(Id::getScheme).collect(Collectors.toList());
+    }
+
+    public boolean isSaslAuthRequired() {
+        return saslAuthRequired;
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/BlueThrottle.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/BlueThrottle.java
index 90be270e8e9..f2d249fc895 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/BlueThrottle.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/BlueThrottle.java
@@ -204,7 +204,7 @@ private static void logWeighedThrottlingSetting() {
         logWeighedThrottlingSetting();
     }
 
-    /* Varation of Integer.getInteger for real number properties */
+    /* Variation of Integer.getInteger for real number properties */
     private static double getDoubleProp(String name, double def) {
         String val = System.getProperty(name);
         if (val != null) {
@@ -325,8 +325,13 @@ public synchronized boolean checkLimit(int need) {
         long diff = now - lastTime;
 
         if (diff > fillTime) {
-            int refill = (int) (diff * fillCount / fillTime);
-            tokens = Math.min(tokens + refill, maxTokens);
+            long refill = diff * fillCount / fillTime;
+            tokens = (int) Math.min(tokens + refill, maxTokens);
+            if (tokens < 0) {
+                tokens = maxTokens;
+                LOG.error("Throttle config values {}({}) and {}({}) are insane and cause long integer overflow after {}ms",
+                        CONNECTION_THROTTLE_FILL_TIME, fillTime, CONNECTION_THROTTLE_FILL_COUNT, fillCount, diff);
+            }
             lastTime = now;
         }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ByteBufferInputStream.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ByteBufferInputStream.java
index 9a93abd6115..8fe8b6fc94e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ByteBufferInputStream.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ByteBufferInputStream.java
@@ -21,12 +21,13 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.nio.ByteBuffer;
+import javax.annotation.Nonnull;
 import org.apache.jute.BinaryInputArchive;
 import org.apache.jute.Record;
 
 public class ByteBufferInputStream extends InputStream {
 
-    ByteBuffer bb;
+    private final ByteBuffer bb;
 
     public ByteBufferInputStream(ByteBuffer bb) {
         this.bb = bb;
@@ -46,7 +47,7 @@ public int available() throws IOException {
     }
 
     @Override
-    public int read(byte[] b, int off, int len) throws IOException {
+    public int read(@Nonnull byte[] b, int off, int len) throws IOException {
         if (bb.remaining() == 0) {
             return -1;
         }
@@ -58,7 +59,7 @@ public int read(byte[] b, int off, int len) throws IOException {
     }
 
     @Override
-    public int read(byte[] b) throws IOException {
+    public int read(@Nonnull byte[] b) throws IOException {
         return read(b, 0, b.length);
     }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ByteBufferRequestRecord.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ByteBufferRequestRecord.java
new file mode 100644
index 00000000000..73f068d995a
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ByteBufferRequestRecord.java
@@ -0,0 +1,64 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server;
+
+import java.io.IOException;
+import java.nio.ByteBuffer;
+import java.util.function.Supplier;
+import org.apache.jute.Record;
+
+public class ByteBufferRequestRecord implements RequestRecord {
+
+    private final ByteBuffer request;
+
+    private volatile Record record;
+
+    public ByteBufferRequestRecord(ByteBuffer request) {
+        this.request = request;
+    }
+
+    @SuppressWarnings("unchecked")
+    @Override
+    public <T extends Record> T readRecord(Supplier<T> constructor) throws IOException {
+        if (record != null) {
+            return (T) record;
+        }
+
+        record = constructor.get();
+        request.rewind();
+        ByteBufferInputStream.byteBuffer2Record(request, record);
+        request.rewind();
+        return (T) record;
+    }
+
+    @Override
+    public byte[] readBytes() {
+        request.rewind();
+        int len = request.remaining();
+        byte[] b = new byte[len];
+        request.get(b);
+        request.rewind();
+        return b;
+    }
+
+    @Override
+    public int limit() {
+        return request.limit();
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ConnectionMXBean.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ConnectionMXBean.java
index 7d4831311a7..817eb92e1d1 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ConnectionMXBean.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ConnectionMXBean.java
@@ -48,7 +48,7 @@ public interface ConnectionMXBean {
      */
     long getPacketsSent();
     /**
-     * @return number of requets being processed
+     * @return number of requests being processed
      */
     long getOutstandingRequests();
     /**
@@ -62,7 +62,7 @@ public interface ConnectionMXBean {
      */
     void terminateSession();
     /**
-     * Terminate thei client connection. The client will immediately attempt to
+     * Terminate the client connection. The client will immediately attempt to
      * reconnect with the same session id.
      */
     void terminateConnection();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ContainerManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ContainerManager.java
index 63f750d3da0..31fd34fd602 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ContainerManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ContainerManager.java
@@ -18,7 +18,6 @@
 
 package org.apache.zookeeper.server;
 
-import java.nio.ByteBuffer;
 import java.util.Collection;
 import java.util.HashSet;
 import java.util.Set;
@@ -26,6 +25,7 @@
 import java.util.TimerTask;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicReference;
+import org.apache.zookeeper.DeleteContainerRequest;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.common.Time;
 import org.slf4j.Logger;
@@ -48,11 +48,25 @@ public class ContainerManager {
     private final int maxPerMinute;
     private final long maxNeverUsedIntervalMs;
     private final Timer timer;
-    private final AtomicReference<TimerTask> task = new AtomicReference<TimerTask>(null);
+    private final AtomicReference<TimerTask> task = new AtomicReference<>(null);
 
     /**
      * @param zkDb the ZK database
-     * @param requestProcessor request processer - used to inject delete
+     * @param requestProcessor request processor - used to inject delete
+     *                         container requests
+     */
+    public ContainerManager(ZKDatabase zkDb, RequestProcessor requestProcessor) {
+        this(
+            zkDb, requestProcessor,
+            Integer.getInteger("znode.container.checkIntervalMs", (int) TimeUnit.MINUTES.toMillis(1)),
+            Integer.getInteger("znode.container.maxPerMinute", 10000),
+            Long.getLong("znode.container.maxNeverUsedIntervalMs", TimeUnit.MINUTES.toMillis(5))
+        );
+    }
+
+    /**
+     * @param zkDb the ZK database
+     * @param requestProcessor request processor - used to inject delete
      *                         container requests
      * @param checkIntervalMs how often to check containers in milliseconds
      * @param maxPerMinute the max containers to delete per second - avoids
@@ -64,7 +78,7 @@ public ContainerManager(ZKDatabase zkDb, RequestProcessor requestProcessor, int
 
     /**
      * @param zkDb the ZK database
-     * @param requestProcessor request processer - used to inject delete
+     * @param requestProcessor request processor - used to inject delete
      *                         container requests
      * @param checkIntervalMs how often to check containers in milliseconds
      * @param maxPerMinute the max containers to delete per second - avoids
@@ -128,8 +142,8 @@ public void checkContainers() throws InterruptedException {
         for (String containerPath : getCandidates()) {
             long startMs = Time.currentElapsedTime();
 
-            ByteBuffer path = ByteBuffer.wrap(containerPath.getBytes());
-            Request request = new Request(null, 0, 0, ZooDefs.OpCode.deleteContainer, path, null);
+            DeleteContainerRequest record = new DeleteContainerRequest(containerPath);
+            Request request = new Request(null, 0, 0, ZooDefs.OpCode.deleteContainer, RequestRecord.fromRecord(record), null);
             try {
                 LOG.info("Attempting to delete candidate container: {}", containerPath);
                 postDeleteRequest(request);
@@ -155,9 +169,21 @@ protected long getMinIntervalMs() {
         return TimeUnit.MINUTES.toMillis(1) / maxPerMinute;
     }
 
+    int getMaxPerMinute() {
+        return maxPerMinute;
+    }
+
+    int getCheckIntervalMs() {
+        return checkIntervalMs;
+    }
+
+    long getMaxNeverUsedIntervalMs() {
+        return maxNeverUsedIntervalMs;
+    }
+
     // VisibleForTesting
     protected Collection<String> getCandidates() {
-        Set<String> candidates = new HashSet<String>();
+        Set<String> candidates = new HashSet<>();
         for (String containerPath : zkDb.getDataTree().getContainers()) {
             DataNode node = zkDb.getDataTree().getNode(containerPath);
             if ((node != null) && node.getChildren().isEmpty()) {
@@ -180,9 +206,6 @@ protected Collection<String> getCandidates() {
                     }
                 }
             }
-            if ((node != null) && (node.stat.getCversion() > 0) && (node.getChildren().isEmpty())) {
-                candidates.add(containerPath);
-            }
         }
         for (String ttlPath : zkDb.getDataTree().getTtls()) {
             DataNode node = zkDb.getDataTree().getNode(ttlPath);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataNode.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataNode.java
index 8ac8f618522..44e89c90351 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataNode.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataNode.java
@@ -101,7 +101,7 @@ public DataNode(byte[] data, Long acl, StatPersisted stat) {
     public synchronized boolean addChild(String child) {
         if (children == null) {
             // let's be conservative on the typical number of children
-            children = new HashSet<String>(8);
+            children = new HashSet<>(8);
         }
         return children.add(child);
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
index d3529cf94e6..1f93f18c778 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java
@@ -21,7 +21,6 @@
 import java.io.EOFException;
 import java.io.IOException;
 import java.io.PrintWriter;
-import java.nio.ByteBuffer;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Collections;
@@ -34,6 +33,7 @@
 import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.atomic.AtomicLong;
+import java.util.function.Supplier;
 import org.apache.jute.InputArchive;
 import org.apache.jute.OutputArchive;
 import org.apache.jute.Record;
@@ -56,6 +56,7 @@
 import org.apache.zookeeper.audit.AuditEvent.Result;
 import org.apache.zookeeper.audit.ZKAuditProvider;
 import org.apache.zookeeper.common.PathTrie;
+import org.apache.zookeeper.common.PathUtils;
 import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.data.StatPersisted;
@@ -85,10 +86,9 @@
 
 /**
  * This class maintains the tree data structure. It doesn't have any networking
- * or client connection code in it so that it can be tested in a stand alone
- * way.
- * <p>
- * The tree maintains two parallel data structures: a hashtable that maps from
+ * or client connection code in it so that it can be tested in a standalone way.
+ *
+ * <p>The tree maintains two parallel data structures: a hashtable that maps from
  * full paths to DataNodes and a tree of DataNodes. All accesses to a path is
  * through the hashtable. The tree is traversed only when serializing to disk.
  */
@@ -99,7 +99,7 @@ public class DataTree {
     private final RateLogger RATE_LOGGER = new RateLogger(LOG, 15 * 60 * 1000);
 
     /**
-     * This map provides a fast lookup to the datanodes. The tree is the
+     * This map provides a fast lookup to the data nodes. The tree is the
      * source of truth and is where all the locking occurs
      */
     private final NodeHashMap nodes;
@@ -117,7 +117,7 @@ public class DataTree {
     /** the zookeeper nodes that acts as the management and status node **/
     private static final String procZookeeper = Quotas.procZookeeper;
 
-    /** this will be the string thats stored as a child of root */
+    /** this will be the string that's stored as a child of root */
     private static final String procChildZookeeper = procZookeeper.substring(1);
 
     /**
@@ -126,7 +126,7 @@ public class DataTree {
      */
     private static final String quotaZookeeper = Quotas.quotaZookeeper;
 
-    /** this will be the string thats stored as a child of /zookeeper */
+    /** this will be the string that's stored as a child of /zookeeper */
     private static final String quotaChildZookeeper = quotaZookeeper.substring(procZookeeper.length() + 1);
 
     /**
@@ -135,7 +135,7 @@ public class DataTree {
      */
     private static final String configZookeeper = ZooDefs.CONFIG_NODE;
 
-    /** this will be the string thats stored as a child of /zookeeper */
+    /** this will be the string that's stored as a child of /zookeeper */
     private static final String configChildZookeeper = configZookeeper.substring(procZookeeper.length() + 1);
 
     /**
@@ -144,24 +144,24 @@ public class DataTree {
     private final PathTrie pTrie = new PathTrie();
 
     /**
-     * over-the-wire size of znode's stat. Counting the fields of Stat class
+     * over-the-wire size of znode stat. Counting the fields of Stat class
      */
     public static final int STAT_OVERHEAD_BYTES = (6 * 8) + (5 * 4);
 
     /**
      * This hashtable lists the paths of the ephemeral nodes of a session.
      */
-    private final Map<Long, HashSet<String>> ephemerals = new ConcurrentHashMap<Long, HashSet<String>>();
+    private final Map<Long, HashSet<String>> ephemerals = new ConcurrentHashMap<>();
 
     /**
      * This set contains the paths of all container nodes
      */
-    private final Set<String> containers = Collections.newSetFromMap(new ConcurrentHashMap<String, Boolean>());
+    private final Set<String> containers = Collections.newSetFromMap(new ConcurrentHashMap<>());
 
     /**
      * This set contains the paths of all ttl nodes
      */
-    private final Set<String> ttls = Collections.newSetFromMap(new ConcurrentHashMap<String, Boolean>());
+    private final Set<String> ttls = Collections.newSetFromMap(new ConcurrentHashMap<>());
 
     private final ReferenceCountedACLCache aclCache = new ReferenceCountedACLCache();
 
@@ -185,29 +185,27 @@ public class DataTree {
     private final List<DigestWatcher> digestWatchers = new ArrayList<>();
 
     // The historical digests list.
-    private LinkedList<ZxidDigest> digestLog = new LinkedList<>();
+    private final LinkedList<ZxidDigest> digestLog = new LinkedList<>();
 
     private final DigestCalculator digestCalculator;
 
     @SuppressWarnings("unchecked")
     public Set<String> getEphemerals(long sessionId) {
-        HashSet<String> retv = ephemerals.get(sessionId);
-        if (retv == null) {
-            return new HashSet<String>();
+        HashSet<String> ret = ephemerals.get(sessionId);
+        if (ret == null) {
+            return new HashSet<>();
         }
-        Set<String> cloned = null;
-        synchronized (retv) {
-            cloned = (HashSet<String>) retv.clone();
+        synchronized (ret) {
+            return (HashSet<String>) ret.clone();
         }
-        return cloned;
     }
 
     public Set<String> getContainers() {
-        return new HashSet<String>(containers);
+        return new HashSet<>(containers);
     }
 
     public Set<String> getTtls() {
-        return new HashSet<String>(ttls);
+        return new HashSet<>(ttls);
     }
 
     public Collection<Long> getSessions() {
@@ -286,11 +284,11 @@ public DataTree() {
         this.digestCalculator = digestCalculator;
         nodes = new NodeHashMapImpl(digestCalculator);
 
-        /* Rather than fight it, let root have an alias */
+        // rather than fight it, let root have an alias
         nodes.put("", root);
         nodes.putWithoutDigest(rootZookeeper, root);
 
-        /** add the proc node and quota node */
+        // add the proc node and quota node
         root.addChild(procChildZookeeper);
         nodes.put(procZookeeper, procDataNode);
 
@@ -325,7 +323,7 @@ public void addConfigNode() {
         try {
             // Reconfig node is access controlled by default (ZOOKEEPER-2014).
             setACL(configZookeeper, ZooDefs.Ids.READ_ACL_UNSAFE, -1);
-        } catch (KeeperException.NoNodeException e) {
+        } catch (NoNodeException e) {
             assert false : "There's no " + configZookeeper + " znode - this should never happen.";
         }
     }
@@ -344,83 +342,51 @@ boolean isSpecialPath(String path) {
                || configZookeeper.equals(path);
     }
 
+    /**
+     * Use {@link StatPersisted#copyFrom(StatPersisted)} instead.
+     *
+     * <p>Apache Curator uses it, let's keep it for now to let them and their clients to react.
+     */
+    @Deprecated
     public static void copyStatPersisted(StatPersisted from, StatPersisted to) {
-        to.setAversion(from.getAversion());
-        to.setCtime(from.getCtime());
-        to.setCversion(from.getCversion());
-        to.setCzxid(from.getCzxid());
-        to.setMtime(from.getMtime());
-        to.setMzxid(from.getMzxid());
-        to.setPzxid(from.getPzxid());
-        to.setVersion(from.getVersion());
-        to.setEphemeralOwner(from.getEphemeralOwner());
+        to.copyFrom(from);
     }
 
+    /**
+     * Use {@link Stat#copyFrom(Stat)} instead.
+     *
+     * <p> Apache Curator uses it, let's keep it for now to let them and their clients to react.
+     */
+    @Deprecated
     public static void copyStat(Stat from, Stat to) {
-        to.setAversion(from.getAversion());
-        to.setCtime(from.getCtime());
-        to.setCversion(from.getCversion());
-        to.setCzxid(from.getCzxid());
-        to.setMtime(from.getMtime());
-        to.setMzxid(from.getMzxid());
-        to.setPzxid(from.getPzxid());
-        to.setVersion(from.getVersion());
-        to.setEphemeralOwner(from.getEphemeralOwner());
-        to.setDataLength(from.getDataLength());
-        to.setNumChildren(from.getNumChildren());
+        to.copyFrom(from);
     }
 
     /**
-     * update the count/count of bytes of this stat datanode
+     * update the count/bytes of this stat data node
      *
      * @param lastPrefix
-     *            the path of the node that is quotaed.
+     *            the path of the node that has a quota.
      * @param bytesDiff
      *            the diff to be added to number of bytes
      * @param countDiff
      *            the diff to be added to the count
      */
-    public void updateCountBytes(String lastPrefix, long bytesDiff, int countDiff) {
-        String statNode = Quotas.statPath(lastPrefix);
-        DataNode node = nodes.get(statNode);
+    public void updateQuotaStat(String lastPrefix, long bytesDiff, int countDiff) {
+        String statNodePath = Quotas.statPath(lastPrefix);
+        DataNode statNode = nodes.get(statNodePath);
 
-        StatsTrack updatedStat = null;
-        if (node == null) {
+        if (statNode == null) {
             // should not happen
-            LOG.error("Missing count node for stat {}", statNode);
+            LOG.error("Missing node for stat {}", statNodePath);
             return;
         }
-        synchronized (node) {
-            updatedStat = new StatsTrack(new String(node.data));
+
+        synchronized (statNode) {
+            StatsTrack updatedStat = new StatsTrack(statNode.data);
             updatedStat.setCount(updatedStat.getCount() + countDiff);
             updatedStat.setBytes(updatedStat.getBytes() + bytesDiff);
-            node.data = updatedStat.toString().getBytes();
-        }
-        // now check if the counts match the quota
-        String quotaNode = Quotas.quotaPath(lastPrefix);
-        node = nodes.get(quotaNode);
-        StatsTrack thisStats = null;
-        if (node == null) {
-            // should not happen
-            LOG.error("Missing count node for quota {}", quotaNode);
-            return;
-        }
-        synchronized (node) {
-            thisStats = new StatsTrack(new String(node.data));
-        }
-        if (thisStats.getCount() > -1 && (thisStats.getCount() < updatedStat.getCount())) {
-            LOG.warn(
-                "Quota exceeded: {} count={} limit={}",
-                lastPrefix,
-                updatedStat.getCount(),
-                thisStats.getCount());
-        }
-        if (thisStats.getBytes() > -1 && (thisStats.getBytes() < updatedStat.getBytes())) {
-            LOG.warn(
-                "Quota exceeded: {} bytes={} limit={}",
-                lastPrefix,
-                updatedStat.getBytes(),
-                thisStats.getBytes());
+            statNode.data = updatedStat.getStatsBytes();
         }
     }
 
@@ -464,32 +430,36 @@ public void createNode(final String path, byte[] data, List<ACL> acl, long ephem
      * @throws NodeExistsException
      * @throws NoNodeException
      */
-    public void createNode(final String path, byte[] data, List<ACL> acl, long ephemeralOwner, int parentCVersion, long zxid, long time, Stat outputStat) throws KeeperException.NoNodeException, KeeperException.NodeExistsException {
+    public void createNode(final String path, byte[] data, List<ACL> acl, long ephemeralOwner, int parentCVersion, long zxid, long time, Stat outputStat) throws NoNodeException, NodeExistsException {
         int lastSlash = path.lastIndexOf('/');
         String parentName = path.substring(0, lastSlash);
         String childName = path.substring(lastSlash + 1);
         StatPersisted stat = createStat(zxid, time, ephemeralOwner);
         DataNode parent = nodes.get(parentName);
         if (parent == null) {
-            throw new KeeperException.NoNodeException();
+            throw new NoNodeException();
         }
+        List<ACL> parentAcl;
         synchronized (parent) {
+            parentAcl = getACL(parent);
+
             // Add the ACL to ACL cache first, to avoid the ACL not being
             // created race condition during fuzzy snapshot sync.
             //
             // This is the simplest fix, which may add ACL reference count
-            // again if it's already counted in in the ACL map of fuzzy
+            // again if it's already counted in the ACL map of fuzzy
             // snapshot, which might also happen for deleteNode txn, but
             // at least it won't cause the ACL not exist issue.
             //
             // Later we can audit and delete all non-referenced ACLs from
             // ACL map when loading the snapshot/txns from disk, like what
             // we did for the global sessions.
-            Long longval = aclCache.convertAcls(acl);
+            Long acls = aclCache.convertAcls(acl);
 
-            Set<String> children = parent.getChildren();
-            if (children.contains(childName)) {
-                throw new KeeperException.NodeExistsException();
+            DataNode existingChild = nodes.get(path);
+            if (existingChild != null) {
+                existingChild.acl = acls;
+                throw new NodeExistsException();
             }
 
             nodes.preChange(parentName, parent);
@@ -506,7 +476,7 @@ public void createNode(final String path, byte[] data, List<ACL> acl, long ephem
                 parent.stat.setCversion(parentCVersion);
                 parent.stat.setPzxid(zxid);
             }
-            DataNode child = new DataNode(data, longval, stat);
+            DataNode child = new DataNode(data, acls, stat);
             parent.addChild(childName);
             nodes.postChange(parentName, parent);
             nodeDataSize.addAndGet(getNodeSize(path, child.data));
@@ -516,12 +486,9 @@ public void createNode(final String path, byte[] data, List<ACL> acl, long ephem
                 containers.add(path);
             } else if (ephemeralType == EphemeralType.TTL) {
                 ttls.add(path);
+                ServerMetrics.getMetrics().TTL_NODE_CREATED_COUNT.add(1);
             } else if (ephemeralOwner != 0) {
-                HashSet<String> list = ephemerals.get(ephemeralOwner);
-                if (list == null) {
-                    list = new HashSet<String>();
-                    ephemerals.put(ephemeralOwner, list);
-                }
+                HashSet<String> list = ephemerals.computeIfAbsent(ephemeralOwner, k -> new HashSet<>());
                 synchronized (list) {
                     list.add(path);
                 }
@@ -532,26 +499,27 @@ public void createNode(final String path, byte[] data, List<ACL> acl, long ephem
         }
         // now check if its one of the zookeeper node child
         if (parentName.startsWith(quotaZookeeper)) {
-            // now check if its the limit node
+            // now check if it's the limit node
             if (Quotas.limitNode.equals(childName)) {
                 // this is the limit node
                 // get the parent and add it to the trie
-                pTrie.addPath(parentName.substring(quotaZookeeper.length()));
+                pTrie.addPath(Quotas.trimQuotaPath(parentName));
             }
             if (Quotas.statNode.equals(childName)) {
-                updateQuotaForPath(parentName.substring(quotaZookeeper.length()));
+                updateQuotaForPath(Quotas.trimQuotaPath(parentName));
             }
         }
-        // also check to update the quotas for this node
+
         String lastPrefix = getMaxPrefixWithQuota(path);
         long bytes = data == null ? 0 : data.length;
-        if (lastPrefix != null) {
-            // ok we have some match and need to update
-            updateCountBytes(lastPrefix, bytes, 1);
+        // also check to update the quotas for this node
+        if (lastPrefix != null) {    // ok we have some match and need to update
+            updateQuotaStat(lastPrefix, bytes, 1);
         }
         updateWriteStat(path, bytes);
-        dataWatches.triggerWatch(path, Event.EventType.NodeCreated);
-        childWatches.triggerWatch(parentName.equals("") ? "/" : parentName, Event.EventType.NodeChildrenChanged);
+        dataWatches.triggerWatch(path, Event.EventType.NodeCreated, zxid, acl);
+        childWatches.triggerWatch(parentName.equals("") ? "/" : parentName,
+            Event.EventType.NodeChildrenChanged, zxid, parentAcl);
     }
 
     /**
@@ -561,9 +529,9 @@ public void createNode(final String path, byte[] data, List<ACL> acl, long ephem
      *            the path to of the node to be deleted
      * @param zxid
      *            the current zxid
-     * @throws KeeperException.NoNodeException
+     * @throws NoNodeException
      */
-    public void deleteNode(String path, long zxid) throws KeeperException.NoNodeException {
+    public void deleteNode(String path, long zxid) throws NoNodeException {
         int lastSlash = path.lastIndexOf('/');
         String parentName = path.substring(0, lastSlash);
         String childName = path.substring(lastSlash + 1);
@@ -573,14 +541,14 @@ public void deleteNode(String path, long zxid) throws KeeperException.NoNodeExce
         // for no such child
         DataNode parent = nodes.get(parentName);
         if (parent == null) {
-            throw new KeeperException.NoNodeException();
+            throw new NoNodeException();
         }
         synchronized (parent) {
             nodes.preChange(parentName, parent);
             parent.removeChild(childName);
             // Only update pzxid when the zxid is larger than the current pzxid,
-            // otherwise we might override some higher pzxid set by a create
-            // Txn, which could cause the cversion and pzxid inconsistent
+            // otherwise we might override some higher pzxid set by a CreateTxn,
+            // which could cause the cversion and pzxid inconsistent
             if (zxid > parent.stat.getPzxid()) {
                 parent.stat.setPzxid(zxid);
             }
@@ -589,10 +557,12 @@ public void deleteNode(String path, long zxid) throws KeeperException.NoNodeExce
 
         DataNode node = nodes.get(path);
         if (node == null) {
-            throw new KeeperException.NoNodeException();
+            throw new NoNodeException();
         }
+        List<ACL> acl;
         nodes.remove(path);
         synchronized (node) {
+            acl = getACL(node);
             aclCache.removeUsage(node.acl);
             nodeDataSize.addAndGet(-getNodeSize(path, node.data));
         }
@@ -600,15 +570,18 @@ public void deleteNode(String path, long zxid) throws KeeperException.NoNodeExce
         // Synchronized to sync the containers and ttls change, probably
         // only need to sync on containers and ttls, will update it in a
         // separate patch.
+        List<ACL> parentAcl;
         synchronized (parent) {
-            long eowner = node.stat.getEphemeralOwner();
-            EphemeralType ephemeralType = EphemeralType.get(eowner);
+            parentAcl = getACL(parent);
+            long owner = node.stat.getEphemeralOwner();
+            EphemeralType ephemeralType = EphemeralType.get(owner);
             if (ephemeralType == EphemeralType.CONTAINER) {
                 containers.remove(path);
             } else if (ephemeralType == EphemeralType.TTL) {
                 ttls.remove(path);
-            } else if (eowner != 0) {
-                Set<String> nodes = ephemerals.get(eowner);
+                ServerMetrics.getMetrics().TTL_NODE_DELETED_COUNT.add(1);
+            } else if (owner != 0) {
+                Set<String> nodes = ephemerals.get(owner);
                 if (nodes != null) {
                     synchronized (nodes) {
                         nodes.remove(path);
@@ -620,18 +593,18 @@ public void deleteNode(String path, long zxid) throws KeeperException.NoNodeExce
         if (parentName.startsWith(procZookeeper) && Quotas.limitNode.equals(childName)) {
             // delete the node in the trie.
             // we need to update the trie as well
-            pTrie.deletePath(parentName.substring(quotaZookeeper.length()));
+            pTrie.deletePath(Quotas.trimQuotaPath(parentName));
         }
 
         // also check to update the quotas for this node
         String lastPrefix = getMaxPrefixWithQuota(path);
         if (lastPrefix != null) {
             // ok we have some match and need to update
-            int bytes = 0;
+            long bytes;
             synchronized (node) {
                 bytes = (node.data == null ? 0 : -(node.data.length));
             }
-            updateCountBytes(lastPrefix, bytes, -1);
+            updateQuotaStat(lastPrefix, bytes, -1);
         }
 
         updateWriteStat(path, 0L);
@@ -647,20 +620,23 @@ public void deleteNode(String path, long zxid) throws KeeperException.NoNodeExce
                 "childWatches.triggerWatch " + parentName);
         }
 
-        WatcherOrBitSet processed = dataWatches.triggerWatch(path, EventType.NodeDeleted);
-        childWatches.triggerWatch(path, EventType.NodeDeleted, processed);
-        childWatches.triggerWatch("".equals(parentName) ? "/" : parentName, EventType.NodeChildrenChanged);
+        WatcherOrBitSet processed = dataWatches.triggerWatch(path, EventType.NodeDeleted, zxid, acl);
+        childWatches.triggerWatch(path, EventType.NodeDeleted, zxid, acl, processed);
+        childWatches.triggerWatch("".equals(parentName) ? "/" : parentName,
+            EventType.NodeChildrenChanged, zxid, parentAcl);
     }
 
-    public Stat setData(String path, byte[] data, int version, long zxid, long time) throws KeeperException.NoNodeException {
+    public Stat setData(String path, byte[] data, int version, long zxid, long time) throws NoNodeException {
         Stat s = new Stat();
         DataNode n = nodes.get(path);
         if (n == null) {
-            throw new KeeperException.NoNodeException();
+            throw new NoNodeException();
         }
-        byte[] lastdata = null;
+        List<ACL> acl;
+        byte[] lastData;
         synchronized (n) {
-            lastdata = n.data;
+            acl = getACL(n);
+            lastData = n.data;
             nodes.preChange(path, n);
             n.data = data;
             n.stat.setMtime(time);
@@ -669,16 +645,19 @@ public Stat setData(String path, byte[] data, int version, long zxid, long time)
             n.copyStat(s);
             nodes.postChange(path, n);
         }
-        // now update if the path is in a quota subtree.
+
+        // first do a quota check if the path is in a quota subtree.
         String lastPrefix = getMaxPrefixWithQuota(path);
+        long bytesDiff = (data == null ? 0 : data.length) - (lastData == null ? 0 : lastData.length);
+        // now update if the path is in a quota subtree.
         long dataBytes = data == null ? 0 : data.length;
         if (lastPrefix != null) {
-            this.updateCountBytes(lastPrefix, dataBytes - (lastdata == null ? 0 : lastdata.length), 0);
+            updateQuotaStat(lastPrefix, bytesDiff, 0);
         }
-        nodeDataSize.addAndGet(getNodeSize(path, data) - getNodeSize(path, lastdata));
+        nodeDataSize.addAndGet(getNodeSize(path, data) - getNodeSize(path, lastData));
 
         updateWriteStat(path, dataBytes);
-        dataWatches.triggerWatch(path, EventType.NodeDataChanged);
+        dataWatches.triggerWatch(path, EventType.NodeDataChanged, zxid, acl);
         return s;
     }
 
@@ -704,15 +683,17 @@ public String getMaxPrefixWithQuota(String path) {
     public void addWatch(String basePath, Watcher watcher, int mode) {
         WatcherMode watcherMode = WatcherMode.fromZooDef(mode);
         dataWatches.addWatch(basePath, watcher, watcherMode);
-        childWatches.addWatch(basePath, watcher, watcherMode);
+        if (watcherMode != WatcherMode.PERSISTENT_RECURSIVE) {
+            childWatches.addWatch(basePath, watcher, watcherMode);
+        }
     }
 
-    public byte[] getData(String path, Stat stat, Watcher watcher) throws KeeperException.NoNodeException {
+    public byte[] getData(String path, Stat stat, Watcher watcher) throws NoNodeException {
         DataNode n = nodes.get(path);
-        byte[] data = null;
         if (n == null) {
-            throw new KeeperException.NoNodeException();
+            throw new NoNodeException();
         }
+        byte[] data;
         synchronized (n) {
             n.copyStat(stat);
             if (watcher != null) {
@@ -724,15 +705,15 @@ public byte[] getData(String path, Stat stat, Watcher watcher) throws KeeperExce
         return data;
     }
 
-    public Stat statNode(String path, Watcher watcher) throws KeeperException.NoNodeException {
-        Stat stat = new Stat();
-        DataNode n = nodes.get(path);
+    public Stat statNode(String path, Watcher watcher) throws NoNodeException {
         if (watcher != null) {
             dataWatches.addWatch(path, watcher);
         }
+        DataNode n = nodes.get(path);
         if (n == null) {
-            throw new KeeperException.NoNodeException();
+            throw new NoNodeException();
         }
+        Stat stat = new Stat();
         synchronized (n) {
             n.copyStat(stat);
         }
@@ -740,17 +721,17 @@ public Stat statNode(String path, Watcher watcher) throws KeeperException.NoNode
         return stat;
     }
 
-    public List<String> getChildren(String path, Stat stat, Watcher watcher) throws KeeperException.NoNodeException {
+    public List<String> getChildren(String path, Stat stat, Watcher watcher) throws NoNodeException {
         DataNode n = nodes.get(path);
         if (n == null) {
-            throw new KeeperException.NoNodeException();
+            throw new NoNodeException();
         }
         List<String> children;
         synchronized (n) {
             if (stat != null) {
                 n.copyStat(stat);
             }
-            children = new ArrayList<String>(n.getChildren());
+            children = new ArrayList<>(n.getChildren());
 
             if (watcher != null) {
                 childWatches.addWatch(path, watcher);
@@ -767,7 +748,7 @@ public List<String> getChildren(String path, Stat stat, Watcher watcher) throws
     }
 
     public int getAllChildrenNumber(String path) {
-        //cull out these two keys:"", "/"
+        // cull out these two keys:"", "/"
         if ("/".equals(path)) {
             return nodes.size() - 2;
         }
@@ -775,13 +756,13 @@ public int getAllChildrenNumber(String path) {
         return (int) nodes.entrySet().parallelStream().filter(entry -> entry.getKey().startsWith(path + "/")).count();
     }
 
-    public Stat setACL(String path, List<ACL> acl, int version) throws KeeperException.NoNodeException {
-        Stat stat = new Stat();
+    public Stat setACL(String path, List<ACL> acl, int version) throws NoNodeException {
         DataNode n = nodes.get(path);
         if (n == null) {
-            throw new KeeperException.NoNodeException();
+            throw new NoNodeException();
         }
         synchronized (n) {
+            Stat stat = new Stat();
             aclCache.removeUsage(n.acl);
             nodes.preChange(path, n);
             n.stat.setAversion(version);
@@ -792,16 +773,16 @@ public Stat setACL(String path, List<ACL> acl, int version) throws KeeperExcepti
         }
     }
 
-    public List<ACL> getACL(String path, Stat stat) throws KeeperException.NoNodeException {
+    public List<ACL> getACL(String path, Stat stat) throws NoNodeException {
         DataNode n = nodes.get(path);
         if (n == null) {
-            throw new KeeperException.NoNodeException();
+            throw new NoNodeException();
         }
         synchronized (n) {
             if (stat != null) {
                 n.copyStat(stat);
             }
-            return new ArrayList<ACL>(aclCache.convertLong(n.acl));
+            return new ArrayList<>(aclCache.convertLong(n.acl));
         }
     }
 
@@ -849,7 +830,7 @@ public boolean equals(Object o) {
         }
 
         /**
-         * See equals() to find the rational for how this hashcode is generated.
+         * See equals() to find the rationale for how this hashcode is generated.
          *
          * @see ProcessTxnResult#equals(Object)
          * @see java.lang.Object#hashCode()
@@ -985,7 +966,7 @@ public ProcessTxnResult processTxn(TxnHeader header, Record txn, boolean isSubTx
             case OpCode.multi:
                 MultiTxn multiTxn = (MultiTxn) txn;
                 List<Txn> txns = multiTxn.getTxns();
-                rc.multiResult = new ArrayList<ProcessTxnResult>();
+                rc.multiResult = new ArrayList<>();
                 boolean failed = false;
                 for (Txn subtxn : txns) {
                     if (subtxn.getType() == OpCode.error) {
@@ -996,44 +977,43 @@ public ProcessTxnResult processTxn(TxnHeader header, Record txn, boolean isSubTx
 
                 boolean post_failed = false;
                 for (Txn subtxn : txns) {
-                    ByteBuffer bb = ByteBuffer.wrap(subtxn.getData());
-                    Record record = null;
+                    final Supplier<Record> supplier;
                     switch (subtxn.getType()) {
                     case OpCode.create:
-                        record = new CreateTxn();
+                    case OpCode.create2:
+                        supplier = CreateTxn::new;
                         break;
                     case OpCode.createTTL:
-                        record = new CreateTTLTxn();
+                        supplier = CreateTTLTxn::new;
                         break;
                     case OpCode.createContainer:
-                        record = new CreateContainerTxn();
+                        supplier = CreateContainerTxn::new;
                         break;
                     case OpCode.delete:
                     case OpCode.deleteContainer:
-                        record = new DeleteTxn();
+                        supplier = DeleteTxn::new;
                         break;
                     case OpCode.setData:
-                        record = new SetDataTxn();
+                        supplier = SetDataTxn::new;
                         break;
                     case OpCode.error:
-                        record = new ErrorTxn();
+                        supplier = ErrorTxn::new;
                         post_failed = true;
                         break;
                     case OpCode.check:
-                        record = new CheckVersionTxn();
+                        supplier = CheckVersionTxn::new;
                         break;
                     default:
                         throw new IOException("Invalid type of op: " + subtxn.getType());
                     }
-                    assert (record != null);
-
-                    ByteBufferInputStream.byteBuffer2Record(bb, record);
 
+                    final Record record;
                     if (failed && subtxn.getType() != OpCode.error) {
                         int ec = post_failed ? Code.RUNTIMEINCONSISTENCY.intValue() : Code.OK.intValue();
-
                         subtxn.setType(OpCode.error);
                         record = new ErrorTxn(ec);
+                    } else {
+                        record = RequestRecord.fromBytes(subtxn.getData()).readRecord(supplier);
                     }
 
                     assert !failed || (subtxn.getType() == OpCode.error);
@@ -1069,7 +1049,7 @@ record = new ErrorTxn(ec);
          * But there is a tricky scenario that if the child is deleted due
          * to session close and re-created in a different global session
          * after that the parent is serialized, then when replay the txn
-         * because the node is belonging to a different session, replay the
+         * because the node belongs to a different session, replay the
          * closeSession txn won't delete it anymore, and we'll get NODEEXISTS
          * error when replay the createNode txn. In this case, we need to
          * update the cversion and pzxid to the new value.
@@ -1084,7 +1064,7 @@ record = new ErrorTxn(ec);
             CreateTxn cTxn = (CreateTxn) txn;
             try {
                 setCversionPzxid(parentName, cTxn.getParentCVersion(), header.getZxid());
-            } catch (KeeperException.NoNodeException e) {
+            } catch (NoNodeException e) {
                 LOG.error("Failed to set parent cversion for: {}", parentName, e);
                 rc.err = e.code().intValue();
             }
@@ -1138,7 +1118,7 @@ record = new ErrorTxn(ec);
     }
 
     void killSession(long session, long zxid) {
-        // the list is already removed from the ephemerals
+        // The list is already removed from the ephemerals,
         // so we do not have to worry about synchronizing on
         // the list. This is only called from FinalRequestProcessor
         // so there is no need for synchronization. The list is not
@@ -1202,33 +1182,28 @@ void deleteNodes(long session, long zxid, Iterable<String> paths2Delete) {
     }
 
     /**
-     * a encapsultaing class for return value
+     * An encapsulation class for return value
      */
     private static class Counts {
-
         long bytes;
         int count;
-
     }
 
     /**
      * this method gets the count of nodes and the bytes under a subtree
      *
-     * @param path
-     *            the path to be used
-     * @param counts
-     *            the int count
+     * @param path the path to be used
+     * @param counts the int count
      */
     private void getCounts(String path, Counts counts) {
         DataNode node = getNode(path);
         if (node == null) {
             return;
         }
-        String[] children = null;
-        int len = 0;
+        String[] children;
+        int len;
         synchronized (node) {
-            Set<String> childs = node.getChildren();
-            children = childs.toArray(new String[childs.size()]);
+            children = node.getChildren().toArray(new String[0]);
             len = (node.data == null ? 0 : node.data.length);
         }
         // add itself
@@ -1242,16 +1217,15 @@ private void getCounts(String path, Counts counts) {
     /**
      * update the quota for the given path
      *
-     * @param path
-     *            the path to be used
+     * @param path the path to be used
      */
     private void updateQuotaForPath(String path) {
         Counts c = new Counts();
         getCounts(path, c);
-        StatsTrack strack = new StatsTrack();
-        strack.setBytes(c.bytes);
-        strack.setCount(c.count);
-        String statPath = Quotas.quotaZookeeper + path + "/" + Quotas.statNode;
+        StatsTrack statsTrack = new StatsTrack();
+        statsTrack.setBytes(c.bytes);
+        statsTrack.setCount(c.count);
+        String statPath = Quotas.statPath(path);
         DataNode node = getNode(statPath);
         // it should exist
         if (node == null) {
@@ -1260,7 +1234,7 @@ private void updateQuotaForPath(String path) {
         }
         synchronized (node) {
             nodes.preChange(statPath, node);
-            node.data = strack.toString().getBytes();
+            node.data = statsTrack.getStatsBytes();
             nodes.postChange(statPath, node);
         }
     }
@@ -1268,19 +1242,18 @@ private void updateQuotaForPath(String path) {
     /**
      * this method traverses the quota path and update the path trie and sets
      *
-     * @param path
+     * @param path the path to be used
      */
     private void traverseNode(String path) {
         DataNode node = getNode(path);
-        String[] children = null;
+        String[] children;
         synchronized (node) {
-            Set<String> childs = node.getChildren();
-            children = childs.toArray(new String[childs.size()]);
+            children = node.getChildren().toArray(new String[0]);
         }
         if (children.length == 0) {
             // this node does not have a child
             // is the leaf node
-            // check if its the leaf node
+            // check if it's the leaf node
             String endString = "/" + Quotas.limitNode;
             if (path.endsWith(endString)) {
                 // ok this is the limit node
@@ -1313,10 +1286,8 @@ private void setupQuota() {
      * this method uses a stringbuilder to create a new path for children. This
      * is faster than string appends ( str1 + str2).
      *
-     * @param oa
-     *            OutputArchive to write to.
-     * @param path
-     *            a string builder.
+     * @param oa OutputArchive to write to.
+     * @param path a string builder.
      * @throws IOException
      */
     void serializeNode(OutputArchive oa, StringBuilder path) throws IOException {
@@ -1325,31 +1296,28 @@ void serializeNode(OutputArchive oa, StringBuilder path) throws IOException {
         if (node == null) {
             return;
         }
-        String[] children = null;
+        String[] children;
         DataNode nodeCopy;
         synchronized (node) {
             StatPersisted statCopy = new StatPersisted();
-            copyStatPersisted(node.stat, statCopy);
+            statCopy.copyFrom(node.stat);
             //we do not need to make a copy of node.data because the contents
             //are never changed
             nodeCopy = new DataNode(node.data, node.acl, statCopy);
-            Set<String> childs = node.getChildren();
-            children = childs.toArray(new String[childs.size()]);
+            children = node.getChildren().toArray(new String[0]);
         }
         serializeNodeData(oa, pathString, nodeCopy);
         path.append('/');
         int off = path.length();
         for (String child : children) {
-            // since this is single buffer being resused
-            // we need
-            // to truncate the previous bytes of string.
+            // Since this is single buffer being reused, we need to truncate the previous bytes of string.
             path.delete(off, Integer.MAX_VALUE);
             path.append(child);
             serializeNode(oa, path);
         }
     }
 
-    // visiable for test
+    // visible for test
     public void serializeNodeData(OutputArchive oa, String path, DataNode node) throws IOException {
         oa.writeString(path, "path");
         oa.writeRecord(node, "node");
@@ -1393,25 +1361,18 @@ public void deserialize(InputArchive ia, String tag) throws IOException {
                 String parentPath = path.substring(0, lastSlash);
                 DataNode parent = nodes.get(parentPath);
                 if (parent == null) {
-                    throw new IOException("Invalid Datatree, unable to find "
-                                          + "parent "
-                                          + parentPath
-                                          + " of path "
-                                          + path);
+                    throw new IOException(
+                            "Invalid Datatree, unable to find parent " + parentPath + " of path " + path);
                 }
                 parent.addChild(path.substring(lastSlash + 1));
-                long eowner = node.stat.getEphemeralOwner();
-                EphemeralType ephemeralType = EphemeralType.get(eowner);
+                long owner = node.stat.getEphemeralOwner();
+                EphemeralType ephemeralType = EphemeralType.get(owner);
                 if (ephemeralType == EphemeralType.CONTAINER) {
                     containers.add(path);
                 } else if (ephemeralType == EphemeralType.TTL) {
                     ttls.add(path);
-                } else if (eowner != 0) {
-                    HashSet<String> list = ephemerals.get(eowner);
-                    if (list == null) {
-                        list = new HashSet<String>();
-                        ephemerals.put(eowner, list);
-                    }
+                } else if (owner != 0) {
+                    HashSet<String> list = ephemerals.computeIfAbsent(owner, k -> new HashSet<>());
                     list.add(path);
                 }
             }
@@ -1423,8 +1384,7 @@ public void deserialize(InputArchive ia, String tag) throws IOException {
 
         nodeDataSize.set(approximateDataSize());
 
-        // we are done with deserializing the
-        // the datatree
+        // we are done with deserializing the datatree
         // update the quotas - create path trie
         // and also update the stat nodes
         setupQuota();
@@ -1434,19 +1394,19 @@ public void deserialize(InputArchive ia, String tag) throws IOException {
 
     /**
      * Summary of the watches on the datatree.
-     * @param pwriter the output to write to
+     * @param writer the output to write to
      */
-    public synchronized void dumpWatchesSummary(PrintWriter pwriter) {
-        pwriter.print(dataWatches.toString());
+    public synchronized void dumpWatchesSummary(PrintWriter writer) {
+        writer.print(dataWatches.toString());
     }
 
     /**
      * Write a text dump of all the watches on the datatree.
      * Warning, this is expensive, use sparingly!
-     * @param pwriter the output to write to
+     * @param writer the output to write to
      */
-    public synchronized void dumpWatches(PrintWriter pwriter, boolean byPath) {
-        dataWatches.dumpWatches(pwriter, byPath);
+    public synchronized void dumpWatches(PrintWriter writer, boolean byPath) {
+        dataWatches.dumpWatches(writer, byPath);
     }
 
     /**
@@ -1481,18 +1441,18 @@ public synchronized WatchesSummary getWatchesSummary() {
 
     /**
      * Write a text dump of all the ephemerals in the datatree.
-     * @param pwriter the output to write to
+     * @param writer the output to write to
      */
-    public void dumpEphemerals(PrintWriter pwriter) {
-        pwriter.println("Sessions with Ephemerals (" + ephemerals.keySet().size() + "):");
+    public void dumpEphemerals(PrintWriter writer) {
+        writer.println("Sessions with Ephemerals (" + ephemerals.keySet().size() + "):");
         for (Entry<Long, HashSet<String>> entry : ephemerals.entrySet()) {
-            pwriter.print("0x" + Long.toHexString(entry.getKey()));
-            pwriter.println(":");
+            writer.print("0x" + Long.toHexString(entry.getKey()));
+            writer.println(":");
             Set<String> tmp = entry.getValue();
             if (tmp != null) {
                 synchronized (tmp) {
                     for (String path : tmp) {
-                        pwriter.println("\t" + path);
+                        writer.println("\t" + path);
                     }
                 }
             }
@@ -1510,10 +1470,10 @@ public void shutdownWatcher() {
      * @return map of session ID to sets of ephemeral znodes
      */
     public Map<Long, Set<String>> getEphemerals() {
-        Map<Long, Set<String>> ephemeralsCopy = new HashMap<Long, Set<String>>();
+        Map<Long, Set<String>> ephemeralsCopy = new HashMap<>();
         for (Entry<Long, HashSet<String>> e : ephemerals.entrySet()) {
             synchronized (e.getValue()) {
-                ephemeralsCopy.put(e.getKey(), new HashSet<String>(e.getValue()));
+                ephemeralsCopy.put(e.getKey(), new HashSet<>(e.getValue()));
             }
         }
         return ephemeralsCopy;
@@ -1528,7 +1488,6 @@ public void setWatches(long relativeZxid, List<String> dataWatches, List<String>
                            List<String> persistentWatches, List<String> persistentRecursiveWatches, Watcher watcher) {
         for (String path : dataWatches) {
             DataNode node = getNode(path);
-            WatchedEvent e = null;
             if (node == null) {
                 watcher.process(new WatchedEvent(EventType.NodeDeleted, KeeperState.SyncConnected, path));
             } else if (node.stat.getMzxid() > relativeZxid) {
@@ -1560,7 +1519,6 @@ public void setWatches(long relativeZxid, List<String> dataWatches, List<String>
             this.dataWatches.addWatch(path, watcher, WatcherMode.PERSISTENT);
         }
         for (String path : persistentRecursiveWatches) {
-            this.childWatches.addWatch(path, watcher, WatcherMode.PERSISTENT_RECURSIVE);
             this.dataWatches.addWatch(path, watcher, WatcherMode.PERSISTENT_RECURSIVE);
         }
     }
@@ -1578,16 +1536,16 @@ public void setWatches(long relativeZxid, List<String> dataWatches, List<String>
      *     Value to be assigned to Cversion
      * @param zxid
      *     Value to be assigned to Pzxid
-     * @throws KeeperException.NoNodeException
+     * @throws NoNodeException
      *     If znode not found.
      **/
-    public void setCversionPzxid(String path, int newCversion, long zxid) throws KeeperException.NoNodeException {
+    public void setCversionPzxid(String path, int newCversion, long zxid) throws NoNodeException {
         if (path.endsWith("/")) {
             path = path.substring(0, path.length() - 1);
         }
         DataNode node = nodes.get(path);
         if (node == null) {
-            throw new KeeperException.NoNodeException(path);
+            throw new NoNodeException(path);
         }
         synchronized (node) {
             if (newCversion == -1) {
@@ -1606,16 +1564,21 @@ public boolean containsWatcher(String path, WatcherType type, Watcher watcher) {
         boolean containsWatcher = false;
         switch (type) {
         case Children:
-            containsWatcher = this.childWatches.containsWatcher(path, watcher);
+            containsWatcher = this.childWatches.containsWatcher(path, watcher, WatcherMode.STANDARD);
             break;
         case Data:
-            containsWatcher = this.dataWatches.containsWatcher(path, watcher);
+            containsWatcher = this.dataWatches.containsWatcher(path, watcher, WatcherMode.STANDARD);
+            break;
+        case Persistent:
+            containsWatcher = this.dataWatches.containsWatcher(path, watcher, WatcherMode.PERSISTENT);
+            break;
+        case PersistentRecursive:
+            containsWatcher = this.dataWatches.containsWatcher(path, watcher, WatcherMode.PERSISTENT_RECURSIVE);
             break;
         case Any:
-            if (this.childWatches.containsWatcher(path, watcher)) {
+            if (this.childWatches.containsWatcher(path, watcher, null)) {
                 containsWatcher = true;
-            }
-            if (this.dataWatches.containsWatcher(path, watcher)) {
+            } else if (this.dataWatches.containsWatcher(path, watcher, null)) {
                 containsWatcher = true;
             }
             break;
@@ -1627,16 +1590,27 @@ public boolean removeWatch(String path, WatcherType type, Watcher watcher) {
         boolean removed = false;
         switch (type) {
         case Children:
-            removed = this.childWatches.removeWatcher(path, watcher);
+            removed = this.childWatches.removeWatcher(path, watcher, WatcherMode.STANDARD);
             break;
         case Data:
-            removed = this.dataWatches.removeWatcher(path, watcher);
+            removed = this.dataWatches.removeWatcher(path, watcher, WatcherMode.STANDARD);
+            break;
+        case Persistent:
+            if (this.childWatches.removeWatcher(path, watcher, WatcherMode.PERSISTENT)) {
+                removed = true;
+            }
+            if (this.dataWatches.removeWatcher(path, watcher, WatcherMode.PERSISTENT)) {
+                removed = true;
+            }
+            break;
+        case PersistentRecursive:
+            removed = this.dataWatches.removeWatcher(path, watcher, WatcherMode.PERSISTENT_RECURSIVE);
             break;
         case Any:
-            if (this.childWatches.removeWatcher(path, watcher)) {
+            if (this.childWatches.removeWatcher(path, watcher, null)) {
                 removed = true;
             }
-            if (this.dataWatches.removeWatcher(path, watcher)) {
+            if (this.dataWatches.removeWatcher(path, watcher, null)) {
                 removed = true;
             }
             break;
@@ -1649,13 +1623,8 @@ public ReferenceCountedACLCache getReferenceCountedAclCache() {
         return aclCache;
     }
 
-    private String getTopNamespace(String path) {
-        String[] parts = path.split("/");
-        return parts.length > 1 ? parts[1] : null;
-    }
-
     private void updateReadStat(String path, long bytes) {
-        String namespace = getTopNamespace(path);
+        final String namespace = PathUtils.getTopNamespace(path);
         if (namespace == null) {
             return;
         }
@@ -1664,7 +1633,7 @@ private void updateReadStat(String path, long bytes) {
     }
 
     private void updateWriteStat(String path, long bytes) {
-        String namespace = getTopNamespace(path);
+        final String namespace = PathUtils.getTopNamespace(path);
         if (namespace == null) {
             return;
         }
@@ -1689,7 +1658,7 @@ private void logZxidDigest(long zxid, long digest) {
 
     /**
      * Serializing the digest to snapshot, this is done after the data tree
-     * is being serialized, so when we replay the txns and it hits this zxid
+     * is being serialized, so when we replay the txns, and it hits this zxid
      * we know we should be in a non-fuzzy state, and have the same digest.
      *
      * @param oa the output stream to write to
@@ -1728,7 +1697,7 @@ public boolean deserializeZxidDigest(InputArchive ia, long startZxidOfSnapshot)
             if (zxidDigest.zxid > 0) {
                 digestFromLoadedSnapshot = zxidDigest;
                 LOG.info("The digest in the snapshot has digest version of {}, "
-                        + ", with zxid as 0x{}, and digest value as {}",
+                        + "with zxid as 0x{}, and digest value as {}",
                         digestFromLoadedSnapshot.digestVersion,
                         Long.toHexString(digestFromLoadedSnapshot.zxid),
                         digestFromLoadedSnapshot.digest);
@@ -1746,12 +1715,12 @@ public boolean deserializeZxidDigest(InputArchive ia, long startZxidOfSnapshot)
             // epoch + 0, which is not mapping to any txn, and it uses
             // this to take snapshot, which is possible if we don't
             // clean database before switching to LOOKING. In this case
-            // the currentZxidDigest will be the zxid of last epoch and
+            // the currentZxidDigest will be the zxid of last epoch, and
             // it's smaller than the zxid of the snapshot file.
             //
             // It's safe to reset the targetZxidDigest to null and start
             // to compare digest when replaying the first txn, since it's
-            // a non fuzzy snapshot.
+            // a non-fuzzy snapshot.
             if (digestFromLoadedSnapshot != null && digestFromLoadedSnapshot.zxid < startZxidOfSnapshot) {
                 LOG.info("The zxid of snapshot digest 0x{} is smaller "
                         + "than the known snapshot highest zxid, the snapshot "
@@ -1769,9 +1738,45 @@ public boolean deserializeZxidDigest(InputArchive ia, long startZxidOfSnapshot)
         }
     }
 
+    /**
+     * Serializes the lastProcessedZxid so we can get it from snapshot instead the snapshot file name.
+     * This is needed for performing snapshot and restore via admin server commands.
+     *
+     * @param oa the output stream to write to
+     * @return true if the lastProcessedZxid is serialized successfully, otherwise false
+     * @throws IOException if there is an I/O error
+     */
+    public boolean serializeLastProcessedZxid(final OutputArchive oa) throws IOException {
+        if (!ZooKeeperServer.isSerializeLastProcessedZxidEnabled()) {
+            return false;
+        }
+        oa.writeLong(lastProcessedZxid, "lastZxid");
+        return true;
+    }
+
+    /**
+     * Deserializes the lastProcessedZxid from the input stream and updates the lastProcessedZxid field.
+     *
+     * @param ia the input stream to read from
+     * @return true if lastProcessedZxid is deserialized successfully, otherwise false
+     * @throws IOException if there is an I/O error
+     */
+    public boolean deserializeLastProcessedZxid(final InputArchive ia)  throws IOException {
+        if (!ZooKeeperServer.isSerializeLastProcessedZxidEnabled()) {
+            return false;
+        }
+        try {
+            lastProcessedZxid = ia.readLong("lastZxid");
+        } catch (final EOFException e) {
+            LOG.warn("Got EOFException while reading the last processed zxid, likely due to reading an older snapshot.");
+            return false;
+        }
+        return true;
+    }
+
     /**
      * Compares the actual tree's digest with that in the snapshot.
-     * Resets digestFromLoadedSnapshot after comparision.
+     * Resets digestFromLoadedSnapshot after comparison.
      *
      * @param zxid zxid
      */
@@ -1790,8 +1795,9 @@ public void compareSnapshotDigests(long zxid) {
             }
             digestFromLoadedSnapshot = null;
         } else if (digestFromLoadedSnapshot.zxid != 0 && zxid > digestFromLoadedSnapshot.zxid) {
-            RATE_LOGGER.rateLimitLog("The txn 0x{} of snapshot digest does not "
-                    + "exist.", Long.toHexString(digestFromLoadedSnapshot.zxid));
+            RATE_LOGGER.rateLimitLog(
+                    "The txn 0x{} of snapshot digest does not exist.",
+                    Long.toHexString(digestFromLoadedSnapshot.zxid));
         }
     }
 
@@ -1803,8 +1809,7 @@ public void compareSnapshotDigests(long zxid) {
      * @param txn    transaction
      * @param digest transaction digest
      *
-     * @return false if digest in the txn doesn't match what we have now in
-     *               the data tree
+     * @return false if digest in the txn doesn't match what we have now in the data tree
      */
     public boolean compareDigest(TxnHeader header, Record txn, TxnDigest digest) {
         long zxid = header.getZxid();
@@ -1818,8 +1823,7 @@ public boolean compareDigest(TxnHeader header, Record txn, TxnDigest digest) {
         }
         // do not compare digest if there is digest version change
         if (digestCalculator.getDigestVersion() != digest.getVersion()) {
-            RATE_LOGGER.rateLimitLog("Digest version not the same on zxid.",
-                    String.valueOf(zxid));
+            RATE_LOGGER.rateLimitLog("Digest version not the same on zxid.", String.valueOf(zxid));
             return true;
         }
 
@@ -1829,16 +1833,17 @@ public boolean compareDigest(TxnHeader header, Record txn, TxnDigest digest) {
             reportDigestMismatch(zxid);
             LOG.debug("Digest in log: {}, actual tree: {}", logDigest, actualDigest);
             if (firstMismatchTxn) {
-                LOG.error("First digest mismatch on txn: {}, {}, "
-                        + "expected digest is {}, actual digest is {}, ",
+                LOG.error(
+                        "First digest mismatch on txn: {}, {}, expected digest is {}, actual digest is {}, ",
                         header, txn, digest, actualDigest);
                 firstMismatchTxn = false;
             }
             return false;
         } else {
             RATE_LOGGER.flush();
-            LOG.debug("Digests are matching for Zxid: {}, Digest in log "
-                    + "and actual tree: {}", Long.toHexString(zxid), logDigest);
+            LOG.debug(
+                    "Digests are matching for Zxid: {}, Digest in log and actual tree: {}",
+                    Long.toHexString(zxid), logDigest);
             return true;
         }
     }
@@ -1883,7 +1888,7 @@ public void addDigestWatcher(DigestWatcher digestWatcher) {
     public List<ZxidDigest> getDigestLog() {
         synchronized (digestLog) {
             // Return a copy of current digest log
-            return new LinkedList<ZxidDigest>(digestLog);
+            return new LinkedList<>(digestLog);
         }
     }
 
@@ -1962,4 +1967,18 @@ public static StatPersisted createStat(long zxid, long time, long ephemeralOwner
         stat.setEphemeralOwner(ephemeralOwner);
         return stat;
     }
+
+    // for test only
+    static StatPersisted createStat(int version) {
+        StatPersisted stat = new StatPersisted();
+        stat.setCtime(0);
+        stat.setMtime(0);
+        stat.setCzxid(0);
+        stat.setMzxid(0);
+        stat.setPzxid(0);
+        stat.setVersion(version);
+        stat.setAversion(0);
+        stat.setEphemeralOwner(0);
+        return stat;
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DatadirCleanupManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DatadirCleanupManager.java
index 2f9e7578392..acb6e6ad60e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DatadirCleanupManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DatadirCleanupManager.java
@@ -21,7 +21,7 @@
 import java.io.File;
 import java.util.Timer;
 import java.util.TimerTask;
-import java.util.concurrent.TimeUnit;
+import org.apache.zookeeper.common.Time;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -53,7 +53,7 @@ public enum PurgeTaskStatus {
 
     private final int snapRetainCount;
 
-    private final int purgeInterval;
+    private final int purgeIntervalInMs;
 
     private Timer timer;
 
@@ -67,16 +67,16 @@ public enum PurgeTaskStatus {
      *            transaction log directory
      * @param snapRetainCount
      *            number of snapshots to be retained after purge
-     * @param purgeInterval
-     *            purge interval in hours
+     * @param purgeIntervalInMs
+     *            purge interval in milliseconds
      */
-    public DatadirCleanupManager(File snapDir, File dataLogDir, int snapRetainCount, int purgeInterval) {
+    public DatadirCleanupManager(File snapDir, File dataLogDir, int snapRetainCount, int purgeIntervalInMs) {
         this.snapDir = snapDir;
         this.dataLogDir = dataLogDir;
         this.snapRetainCount = snapRetainCount;
-        this.purgeInterval = purgeInterval;
+        this.purgeIntervalInMs = purgeIntervalInMs;
         LOG.info("autopurge.snapRetainCount set to {}", snapRetainCount);
-        LOG.info("autopurge.purgeInterval set to {}", purgeInterval);
+        LOG.info("autopurge.purgeInterval set to {}", Time.formatTimeIntervalMs(purgeIntervalInMs));
     }
 
     /**
@@ -97,14 +97,14 @@ public void start() {
             return;
         }
         // Don't schedule the purge task with zero or negative purge interval.
-        if (purgeInterval <= 0) {
+        if (purgeIntervalInMs <= 0) {
             LOG.info("Purge task is not scheduled.");
             return;
         }
 
         timer = new Timer("PurgeTask", true);
         TimerTask task = new PurgeTask(dataLogDir, snapDir, snapRetainCount);
-        timer.scheduleAtFixedRate(task, 0, TimeUnit.HOURS.toMillis(purgeInterval));
+        timer.scheduleAtFixedRate(task, 0, purgeIntervalInMs);
 
         purgeTaskStatus = PurgeTaskStatus.STARTED;
     }
@@ -175,12 +175,12 @@ public File getDataLogDir() {
     }
 
     /**
-     * Returns purge interval in hours.
+     * Returns purge interval in milliseconds.
      *
-     * @return the purge interval in hours.
+     * @return the purge interval in milliseconds.
      */
-    public int getPurgeInterval() {
-        return purgeInterval;
+    public int getPurgeIntervalInMs() {
+        return purgeIntervalInMs;
     }
 
     /**
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DumbWatcher.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DumbWatcher.java
index 9b9672a850b..fc4648758cf 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DumbWatcher.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DumbWatcher.java
@@ -22,8 +22,10 @@
 import java.net.InetSocketAddress;
 import java.nio.ByteBuffer;
 import java.security.cert.Certificate;
+import java.util.List;
 import org.apache.jute.Record;
 import org.apache.zookeeper.WatchedEvent;
+import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.proto.ReplyHeader;
 
@@ -33,6 +35,9 @@
 public class DumbWatcher extends ServerCnxn {
 
     private long sessionId;
+    private String mostRecentPath;
+    private Event.EventType mostRecentEventType;
+    private long mostRecentZxid = WatchedEvent.NO_ZXID;
 
     public DumbWatcher() {
         this(0);
@@ -48,9 +53,25 @@ void setSessionTimeout(int sessionTimeout) {
     }
 
     @Override
-    public void process(WatchedEvent event) {
+    public void process(WatchedEvent event, List<ACL> znodeAcl) {
+        mostRecentEventType = event.getType();
+        mostRecentZxid = event.getZxid();
+        mostRecentPath = event.getPath();
     }
 
+    public String getMostRecentPath() {
+        return mostRecentPath;
+    }
+
+    public Event.EventType getMostRecentEventType() {
+        return mostRecentEventType;
+    }
+
+    public long getMostRecentZxid() {
+        return mostRecentZxid;
+    }
+
+
     @Override
     int getSessionTimeout() {
         return 0;
@@ -61,8 +82,9 @@ public void close(DisconnectReason reason) {
     }
 
     @Override
-    public void sendResponse(ReplyHeader h, Record r, String tag,
+    public int sendResponse(ReplyHeader h, Record r, String tag,
                              String cacheKey, Stat stat, int opCode) throws IOException {
+        return 0;
     }
 
     @Override
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ExpiryQueue.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ExpiryQueue.java
index abc2e5d14b8..cf176dc2cc1 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ExpiryQueue.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ExpiryQueue.java
@@ -34,13 +34,13 @@
  */
 public class ExpiryQueue<E> {
 
-    private final ConcurrentHashMap<E, Long> elemMap = new ConcurrentHashMap<E, Long>();
+    private final ConcurrentHashMap<E, Long> elemMap = new ConcurrentHashMap<>();
     /**
      * The maximum number of buckets is equal to max timeout/expirationInterval,
      * so the expirationInterval should not be too small compared to the
      * max timeout that this expiry queue needs to maintain.
      */
-    private final ConcurrentHashMap<Long, Set<E>> expiryMap = new ConcurrentHashMap<Long, Set<E>>();
+    private final ConcurrentHashMap<Long, Set<E>> expiryMap = new ConcurrentHashMap<>();
 
     private final AtomicLong nextExpirationTime = new AtomicLong();
     private final int expirationInterval;
@@ -77,7 +77,7 @@ public Long remove(E elem) {
      * Adds or updates expiration time for element in queue, rounding the
      * timeout to the expiry interval bucketed used by this queue.
      * @param elem     element to add/update
-     * @param timeout  timout in milliseconds
+     * @param timeout  timeout in milliseconds
      * @return time at which the element is now set to expire if
      *                 changed, or null if unchanged
      */
@@ -95,7 +95,7 @@ public Long update(E elem, int timeout) {
         Set<E> set = expiryMap.get(newExpiryTime);
         if (set == null) {
             // Construct a ConcurrentHashSet using a ConcurrentHashMap
-            set = Collections.newSetFromMap(new ConcurrentHashMap<E, Boolean>());
+            set = Collections.newSetFromMap(new ConcurrentHashMap<>());
             // Put the new set in the map, but only if another thread
             // hasn't beaten us to it
             Set<E> existingSet = expiryMap.putIfAbsent(newExpiryTime, set);
@@ -158,7 +158,7 @@ public void dump(PrintWriter pwriter) {
         pwriter.print(")/(");
         pwriter.print(elemMap.size());
         pwriter.println("):");
-        ArrayList<Long> keys = new ArrayList<Long>(expiryMap.keySet());
+        ArrayList<Long> keys = new ArrayList<>(expiryMap.keySet());
         Collections.sort(keys);
         for (long time : keys) {
             Set<E> set = expiryMap.get(time);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
index 9ffde55c10c..9861f5ffe35 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/FinalRequestProcessor.java
@@ -18,14 +18,13 @@
 
 package org.apache.zookeeper.server;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.io.IOException;
-import java.nio.ByteBuffer;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
 import java.util.Locale;
 import java.util.Set;
-import org.apache.commons.lang.StringUtils;
 import org.apache.jute.Record;
 import org.apache.zookeeper.ClientCnxn;
 import org.apache.zookeeper.KeeperException;
@@ -50,6 +49,7 @@
 import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.data.Stat;
+import org.apache.zookeeper.metrics.Counter;
 import org.apache.zookeeper.proto.AddWatchRequest;
 import org.apache.zookeeper.proto.CheckWatchesRequest;
 import org.apache.zookeeper.proto.Create2Response;
@@ -77,8 +77,10 @@
 import org.apache.zookeeper.proto.SetWatches2;
 import org.apache.zookeeper.proto.SyncRequest;
 import org.apache.zookeeper.proto.SyncResponse;
+import org.apache.zookeeper.proto.WhoAmIResponse;
 import org.apache.zookeeper.server.DataTree.ProcessTxnResult;
 import org.apache.zookeeper.server.quorum.QuorumZooKeeperServer;
+import org.apache.zookeeper.server.util.AuthUtil;
 import org.apache.zookeeper.server.util.RequestPathMetricsCollector;
 import org.apache.zookeeper.txn.ErrorTxn;
 import org.slf4j.Logger;
@@ -106,18 +108,7 @@ public FinalRequestProcessor(ZooKeeperServer zks) {
         this.requestPathMetricsCollector = zks.getRequestPathMetricsCollector();
     }
 
-    public void processRequest(Request request) {
-        LOG.debug("Processing request:: {}", request);
-
-        // request.addRQRec(">final");
-        long traceMask = ZooTrace.CLIENT_REQUEST_TRACE_MASK;
-        if (request.type == OpCode.ping) {
-            traceMask = ZooTrace.SERVER_PING_TRACE_MASK;
-        }
-        if (LOG.isTraceEnabled()) {
-            ZooTrace.logRequest(LOG, traceMask, 'E', request, "");
-        }
-
+    private ProcessTxnResult applyRequest(Request request) {
         ProcessTxnResult rc = zks.processTxn(request);
 
         // ZOOKEEPER-558:
@@ -131,7 +122,7 @@ public void processRequest(Request request) {
             // we are just playing diffs from the leader.
             if (closeSession(zks.serverCnxnFactory, request.sessionId)
                 || closeSession(zks.secureServerCnxnFactory, request.sessionId)) {
-                return;
+                return rc;
             }
         }
 
@@ -150,6 +141,23 @@ public void processRequest(Request request) {
             }
         }
 
+        return rc;
+    }
+
+    public void processRequest(Request request) {
+        LOG.debug("Processing request:: {}", request);
+
+        if (LOG.isTraceEnabled()) {
+            long traceMask = ZooTrace.CLIENT_REQUEST_TRACE_MASK;
+            if (request.type == OpCode.ping) {
+                traceMask = ZooTrace.SERVER_PING_TRACE_MASK;
+            }
+            ZooTrace.logRequest(LOG, traceMask, 'E', request, "");
+        }
+        ProcessTxnResult rc = null;
+        if (!request.isThrottled()) {
+          rc = applyRequest(request);
+        }
         if (request.cnxn == null) {
             return;
         }
@@ -165,6 +173,7 @@ public void processRequest(Request request) {
         Code err = Code.OK;
         Record rsp = null;
         String path = null;
+        int responseSize = 0;
         try {
             if (request.getHdr() != null && request.getHdr().getType() == OpCode.error) {
                 AuditHelper.addAuditLog(request, rc, true);
@@ -195,17 +204,25 @@ public void processRequest(Request request) {
             if (request.isStale()) {
                 ServerMetrics.getMetrics().STALE_REPLIES.add(1);
             }
+
+            if (request.isThrottled()) {
+              throw KeeperException.create(Code.THROTTLEDOP);
+            }
+
             AuditHelper.addAuditLog(request, rc);
+
             switch (request.type) {
             case OpCode.ping: {
                 lastOp = "PING";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_PING);
                 updateStats(request, lastOp, lastZxid);
 
-                cnxn.sendResponse(new ReplyHeader(ClientCnxn.PING_XID, lastZxid, 0), null, "response");
+                responseSize = cnxn.sendResponse(new ReplyHeader(ClientCnxn.PING_XID, lastZxid, 0), null, "response");
                 return;
             }
             case OpCode.createSession: {
                 lastOp = "SESS";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_CREATE_SESSION);
                 updateStats(request, lastOp, lastZxid);
 
                 zks.finishSessionInit(request.cnxn, true);
@@ -213,6 +230,7 @@ public void processRequest(Request request) {
             }
             case OpCode.multi: {
                 lastOp = "MULT";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_MULTI);
                 rsp = new MultiResponse();
 
                 for (ProcessTxnResult subTxnResult : rc.multiResult) {
@@ -255,8 +273,8 @@ public void processRequest(Request request) {
             }
             case OpCode.multiRead: {
                 lastOp = "MLTR";
-                MultiOperationRecord multiReadRecord = new MultiOperationRecord();
-                ByteBufferInputStream.byteBuffer2Record(request.request, multiReadRecord);
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_MULTI_READ);
+                MultiOperationRecord multiReadRecord = request.readRequestRecord(MultiOperationRecord::new);
                 rsp = new MultiResponse();
                 OpResult subResult;
                 for (Op readOp : multiReadRecord) {
@@ -284,6 +302,7 @@ public void processRequest(Request request) {
             }
             case OpCode.create: {
                 lastOp = "CREA";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_CREATE);
                 rsp = new CreateResponse(rc.path);
                 err = Code.get(rc.err);
                 requestPathMetricsCollector.registerRequest(request.type, rc.path);
@@ -293,6 +312,7 @@ public void processRequest(Request request) {
             case OpCode.createTTL:
             case OpCode.createContainer: {
                 lastOp = "CREA";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_CREATE);
                 rsp = new Create2Response(rc.path, rc.stat);
                 err = Code.get(rc.err);
                 requestPathMetricsCollector.registerRequest(request.type, rc.path);
@@ -301,12 +321,14 @@ public void processRequest(Request request) {
             case OpCode.delete:
             case OpCode.deleteContainer: {
                 lastOp = "DELE";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_DELETE);
                 err = Code.get(rc.err);
                 requestPathMetricsCollector.registerRequest(request.type, rc.path);
                 break;
             }
             case OpCode.setData: {
                 lastOp = "SETD";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_SET_DATA);
                 rsp = new SetDataResponse(rc.stat);
                 err = Code.get(rc.err);
                 requestPathMetricsCollector.registerRequest(request.type, rc.path);
@@ -314,14 +336,16 @@ public void processRequest(Request request) {
             }
             case OpCode.reconfig: {
                 lastOp = "RECO";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_RECONFIG);
                 rsp = new GetDataResponse(
-                    ((QuorumZooKeeperServer) zks).self.getQuorumVerifier().toString().getBytes(),
-                    rc.stat);
+                        ((QuorumZooKeeperServer) zks).self.getQuorumVerifier().toString().getBytes(UTF_8),
+                        rc.stat);
                 err = Code.get(rc.err);
                 break;
             }
             case OpCode.setACL: {
                 lastOp = "SETA";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_SET_ACL);
                 rsp = new SetACLResponse(rc.stat);
                 err = Code.get(rc.err);
                 requestPathMetricsCollector.registerRequest(request.type, rc.path);
@@ -329,32 +353,43 @@ public void processRequest(Request request) {
             }
             case OpCode.closeSession: {
                 lastOp = "CLOS";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_CLOSE_SESSION);
                 err = Code.get(rc.err);
                 break;
             }
             case OpCode.sync: {
                 lastOp = "SYNC";
-                SyncRequest syncRequest = new SyncRequest();
-                ByteBufferInputStream.byteBuffer2Record(request.request, syncRequest);
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_SYNC);
+                SyncRequest syncRequest = request.readRequestRecord(SyncRequest::new);
                 rsp = new SyncResponse(syncRequest.getPath());
                 requestPathMetricsCollector.registerRequest(request.type, syncRequest.getPath());
                 break;
             }
             case OpCode.check: {
                 lastOp = "CHEC";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_CHECK);
                 rsp = new SetDataResponse(rc.stat);
                 err = Code.get(rc.err);
                 break;
             }
             case OpCode.exists: {
                 lastOp = "EXIS";
-                // TODO we need to figure out the security requirement for this!
-                ExistsRequest existsRequest = new ExistsRequest();
-                ByteBufferInputStream.byteBuffer2Record(request.request, existsRequest);
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_EXISTS);
+                ExistsRequest existsRequest = request.readRequestRecord(ExistsRequest::new);
                 path = existsRequest.getPath();
                 if (path.indexOf('\0') != -1) {
                     throw new KeeperException.BadArgumentsException();
                 }
+                DataNode n = zks.getZKDatabase().getNode(path);
+                if (n != null) {
+                    zks.checkACL(
+                        request.cnxn,
+                        zks.getZKDatabase().aclForNode(n),
+                        ZooDefs.Perms.READ,
+                        request.authInfo,
+                        path,
+                        null);
+                }
                 Stat stat = zks.getZKDatabase().statNode(path, existsRequest.getWatch() ? cnxn : null);
                 rsp = new ExistsResponse(stat);
                 requestPathMetricsCollector.registerRequest(request.type, path);
@@ -362,8 +397,8 @@ public void processRequest(Request request) {
             }
             case OpCode.getData: {
                 lastOp = "GETD";
-                GetDataRequest getDataRequest = new GetDataRequest();
-                ByteBufferInputStream.byteBuffer2Record(request.request, getDataRequest);
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_GET_DATA);
+                GetDataRequest getDataRequest = request.readRequestRecord(GetDataRequest::new);
                 path = getDataRequest.getPath();
                 rsp = handleGetDataRequest(getDataRequest, cnxn, request.authInfo);
                 requestPathMetricsCollector.registerRequest(request.type, path);
@@ -371,10 +406,8 @@ public void processRequest(Request request) {
             }
             case OpCode.setWatches: {
                 lastOp = "SETW";
-                SetWatches setWatches = new SetWatches();
-                // TODO we really should not need this
-                request.request.rewind();
-                ByteBufferInputStream.byteBuffer2Record(request.request, setWatches);
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_SET_WATCHES);
+                SetWatches setWatches = request.readRequestRecord(SetWatches::new);
                 long relativeZxid = setWatches.getRelativeZxid();
                 zks.getZKDatabase()
                    .setWatches(
@@ -389,10 +422,8 @@ public void processRequest(Request request) {
             }
             case OpCode.setWatches2: {
                 lastOp = "STW2";
-                SetWatches2 setWatches = new SetWatches2();
-                // TODO we really should not need this
-                request.request.rewind();
-                ByteBufferInputStream.byteBuffer2Record(request.request, setWatches);
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_SET_WATCHES);
+                SetWatches2 setWatches = request.readRequestRecord(SetWatches2::new);
                 long relativeZxid = setWatches.getRelativeZxid();
                 zks.getZKDatabase().setWatches(relativeZxid,
                         setWatches.getDataWatches(),
@@ -405,17 +436,16 @@ public void processRequest(Request request) {
             }
             case OpCode.addWatch: {
                 lastOp = "ADDW";
-                AddWatchRequest addWatcherRequest = new AddWatchRequest();
-                ByteBufferInputStream.byteBuffer2Record(request.request,
-                        addWatcherRequest);
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_ADD_WATCH);
+                AddWatchRequest addWatcherRequest = request.readRequestRecord(AddWatchRequest::new);
                 zks.getZKDatabase().addWatch(addWatcherRequest.getPath(), cnxn, addWatcherRequest.getMode());
                 rsp = new ErrorResponse(0);
                 break;
             }
             case OpCode.getACL: {
                 lastOp = "GETA";
-                GetACLRequest getACLRequest = new GetACLRequest();
-                ByteBufferInputStream.byteBuffer2Record(request.request, getACLRequest);
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_GET_ACL);
+                GetACLRequest getACLRequest = request.readRequestRecord(GetACLRequest::new);
                 path = getACLRequest.getPath();
                 DataNode n = zks.getZKDatabase().getNode(path);
                 if (n == null) {
@@ -441,7 +471,7 @@ public void processRequest(Request request) {
                         null);
                     rsp = new GetACLResponse(acl, stat);
                 } catch (KeeperException.NoAuthException e) {
-                    List<ACL> acl1 = new ArrayList<ACL>(acl.size());
+                    List<ACL> acl1 = new ArrayList<>(acl.size());
                     for (ACL a : acl) {
                         if ("digest".equals(a.getId().getScheme())) {
                             Id id = a.getId();
@@ -457,8 +487,8 @@ public void processRequest(Request request) {
             }
             case OpCode.getChildren: {
                 lastOp = "GETC";
-                GetChildrenRequest getChildrenRequest = new GetChildrenRequest();
-                ByteBufferInputStream.byteBuffer2Record(request.request, getChildrenRequest);
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_GET_CHILDREN);
+                GetChildrenRequest getChildrenRequest = request.readRequestRecord(GetChildrenRequest::new);
                 path = getChildrenRequest.getPath();
                 rsp = handleGetChildrenRequest(getChildrenRequest, cnxn, request.authInfo);
                 requestPathMetricsCollector.registerRequest(request.type, path);
@@ -466,8 +496,8 @@ public void processRequest(Request request) {
             }
             case OpCode.getAllChildrenNumber: {
                 lastOp = "GETACN";
-                GetAllChildrenNumberRequest getAllChildrenNumberRequest = new GetAllChildrenNumberRequest();
-                ByteBufferInputStream.byteBuffer2Record(request.request, getAllChildrenNumberRequest);
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_GET_ALL_CHILDREN_NUMBER);
+                GetAllChildrenNumberRequest getAllChildrenNumberRequest = request.readRequestRecord(GetAllChildrenNumberRequest::new);
                 path = getAllChildrenNumberRequest.getPath();
                 DataNode n = zks.getZKDatabase().getNode(path);
                 if (n == null) {
@@ -486,8 +516,8 @@ public void processRequest(Request request) {
             }
             case OpCode.getChildren2: {
                 lastOp = "GETC";
-                GetChildren2Request getChildren2Request = new GetChildren2Request();
-                ByteBufferInputStream.byteBuffer2Record(request.request, getChildren2Request);
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_GET_CHILDREN);
+                GetChildren2Request getChildren2Request = request.readRequestRecord(GetChildren2Request::new);
                 Stat stat = new Stat();
                 path = getChildren2Request.getPath();
                 DataNode n = zks.getZKDatabase().getNode(path);
@@ -508,8 +538,8 @@ public void processRequest(Request request) {
             }
             case OpCode.checkWatches: {
                 lastOp = "CHKW";
-                CheckWatchesRequest checkWatches = new CheckWatchesRequest();
-                ByteBufferInputStream.byteBuffer2Record(request.request, checkWatches);
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_CHECK_WATCHES);
+                CheckWatchesRequest checkWatches = request.readRequestRecord(CheckWatchesRequest::new);
                 WatcherType type = WatcherType.fromInt(checkWatches.getType());
                 path = checkWatches.getPath();
                 boolean containsWatcher = zks.getZKDatabase().containsWatcher(path, type, cnxn);
@@ -522,8 +552,8 @@ public void processRequest(Request request) {
             }
             case OpCode.removeWatches: {
                 lastOp = "REMW";
-                RemoveWatchesRequest removeWatches = new RemoveWatchesRequest();
-                ByteBufferInputStream.byteBuffer2Record(request.request, removeWatches);
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_REMOVE_WATCHES);
+                RemoveWatchesRequest removeWatches = request.readRequestRecord(RemoveWatchesRequest::new);
                 WatcherType type = WatcherType.fromInt(removeWatches.getType());
                 path = removeWatches.getPath();
                 boolean removed = zks.getZKDatabase().removeWatch(path, type, cnxn);
@@ -534,14 +564,20 @@ public void processRequest(Request request) {
                 requestPathMetricsCollector.registerRequest(request.type, removeWatches.getPath());
                 break;
             }
+            case OpCode.whoAmI: {
+                lastOp = "HOMI";
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_WHO_AM_I);
+                rsp = new WhoAmIResponse(AuthUtil.getClientInfos(request.authInfo));
+                break;
+             }
             case OpCode.getEphemerals: {
                 lastOp = "GETE";
-                GetEphemeralsRequest getEphemerals = new GetEphemeralsRequest();
-                ByteBufferInputStream.byteBuffer2Record(request.request, getEphemerals);
+                incrementOpCount(ServerMetrics.getMetrics().OP_COUNT_GET_EPHEMERALS);
+                GetEphemeralsRequest getEphemerals = request.readRequestRecord(GetEphemeralsRequest::new);
                 String prefixPath = getEphemerals.getPrefixPath();
                 Set<String> allEphems = zks.getZKDatabase().getDataTree().getEphemerals(request.sessionId);
                 List<String> ephemerals = new ArrayList<>();
-                if (StringUtils.isBlank(prefixPath) || "/".equals(prefixPath.trim())) {
+                if (prefixPath == null || prefixPath.trim().isEmpty() || "/".equals(prefixPath.trim())) {
                     ephemerals.addAll(allEphems);
                 } else {
                     for (String p : allEphems) {
@@ -571,13 +607,8 @@ public void processRequest(Request request) {
             // log at error level as we are returning a marshalling
             // error to the user
             LOG.error("Failed to process {}", request, e);
-            StringBuilder sb = new StringBuilder();
-            ByteBuffer bb = request.request;
-            bb.rewind();
-            while (bb.hasRemaining()) {
-                sb.append(Integer.toHexString(bb.get() & 0xff));
-            }
-            LOG.error("Dumping request buffer: 0x{}", sb.toString());
+            String digest = request.requestDigest();
+            LOG.error("Dumping request buffer for request type {}: 0x{}", Request.op2String(request.type), digest);
             err = Code.MARSHALLINGERROR;
         }
 
@@ -587,7 +618,7 @@ public void processRequest(Request request) {
 
         try {
             if (path == null || rsp == null) {
-                cnxn.sendResponse(hdr, rsp, "response");
+                responseSize = cnxn.sendResponse(hdr, rsp, "response");
             } else {
                 int opCode = request.type;
                 Stat stat = null;
@@ -598,17 +629,17 @@ public void processRequest(Request request) {
                     case OpCode.getData : {
                         GetDataResponse getDataResponse = (GetDataResponse) rsp;
                         stat = getDataResponse.getStat();
-                        cnxn.sendResponse(hdr, rsp, "response", path, stat, opCode);
+                        responseSize = cnxn.sendResponse(hdr, rsp, "response", path, stat, opCode);
                         break;
                     }
                     case OpCode.getChildren2 : {
                         GetChildren2Response getChildren2Response = (GetChildren2Response) rsp;
                         stat = getChildren2Response.getStat();
-                        cnxn.sendResponse(hdr, rsp, "response", path, stat, opCode);
+                        responseSize = cnxn.sendResponse(hdr, rsp, "response", path, stat, opCode);
                         break;
                     }
                     default:
-                        cnxn.sendResponse(hdr, rsp, "response");
+                        responseSize = cnxn.sendResponse(hdr, rsp, "response");
                 }
             }
 
@@ -617,6 +648,8 @@ public void processRequest(Request request) {
             }
         } catch (IOException e) {
             LOG.error("FIXMSG", e);
+        } finally {
+            ServerMetrics.getMetrics().RESPONSE_BYTES.add(responseSize);
         }
     }
 
@@ -671,4 +704,9 @@ private void updateStats(Request request, String lastOp, long lastZxid) {
         request.cnxn.updateStatsForResponse(request.cxid, lastZxid, lastOp, request.createTime, currentTime);
     }
 
+    private void incrementOpCount(final Counter specificCounter) {
+        final ServerMetrics metrics = ServerMetrics.getMetrics();
+        specificCounter.add(1);
+        metrics.OP_COUNT_TOTAL.add(1);
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
index 86fe85de4d0..d35cf97edad 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxn.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.io.BufferedWriter;
 import java.io.IOException;
 import java.io.PrintWriter;
@@ -29,17 +30,22 @@
 import java.nio.channels.SelectionKey;
 import java.nio.channels.SocketChannel;
 import java.security.cert.Certificate;
+import java.util.List;
 import java.util.Queue;
 import java.util.concurrent.LinkedBlockingQueue;
 import java.util.concurrent.atomic.AtomicBoolean;
 import org.apache.jute.BinaryInputArchive;
 import org.apache.jute.Record;
 import org.apache.zookeeper.ClientCnxn;
+import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.WatchedEvent;
 import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.data.Stat;
+import org.apache.zookeeper.proto.ConnectRequest;
 import org.apache.zookeeper.proto.ReplyHeader;
+import org.apache.zookeeper.proto.RequestHeader;
 import org.apache.zookeeper.proto.WatcherEvent;
 import org.apache.zookeeper.server.NIOServerCnxnFactory.SelectorThread;
 import org.apache.zookeeper.server.command.CommandExecutor;
@@ -69,9 +75,9 @@ public class NIOServerCnxn extends ServerCnxn {
 
     private final ByteBuffer lenBuffer = ByteBuffer.allocate(4);
 
-    private ByteBuffer incomingBuffer = lenBuffer;
+    protected ByteBuffer incomingBuffer = lenBuffer;
 
-    private final Queue<ByteBuffer> outgoingBuffers = new LinkedBlockingQueue<ByteBuffer>();
+    private final Queue<ByteBuffer> outgoingBuffers = new LinkedBlockingQueue<>();
 
     private int sessionTimeout;
 
@@ -329,7 +335,15 @@ void doIO(SelectionKey k) throws InterruptedException {
             if (k.isReadable()) {
                 int rc = sock.read(incomingBuffer);
                 if (rc < 0) {
-                    handleFailedRead();
+                    try {
+                        handleFailedRead();
+                    } catch (EndOfStreamException e) {
+                        // no stacktrace. this case is very common, and it is usually not a problem.
+                        LOG.info("{}", e.getMessage());
+                        // expecting close to log session closure
+                        close(e.getReason());
+                        return;
+                    }
                 }
                 if (incomingBuffer.remaining() == 0) {
                     boolean isPayload;
@@ -381,8 +395,11 @@ void doIO(SelectionKey k) throws InterruptedException {
         }
     }
 
-    private void readRequest() throws IOException {
-        zkServer.processPacket(this, incomingBuffer);
+    protected void readRequest() throws IOException {
+        RequestHeader h = new RequestHeader();
+        ByteBufferInputStream.byteBuffer2Record(incomingBuffer, h);
+        RequestRecord request = RequestRecord.fromBytes(incomingBuffer.slice());
+        zkServer.processPacket(this, h, request);
     }
 
     // returns whether we are interested in writing, which is determined
@@ -418,11 +435,13 @@ public void enableRecv() {
         }
     }
 
-    private void readConnectRequest() throws IOException, InterruptedException, ClientCnxnLimitException {
+    private void readConnectRequest() throws IOException, ClientCnxnLimitException {
         if (!isZKServerRunning()) {
             throw new IOException("ZooKeeperServer not running");
         }
-        zkServer.processConnectRequest(this, incomingBuffer);
+        BinaryInputArchive bia = BinaryInputArchive.getArchive(new ByteBufferInputStream(incomingBuffer));
+        ConnectRequest request = protocolManager.deserializeConnectRequest(bia);
+        zkServer.processConnectRequest(this, request);
         initialized = true;
     }
 
@@ -442,7 +461,7 @@ private class SendBufferWriter extends Writer {
          */
         private void checkFlush(boolean force) {
             if ((force && sb.length() > 0) || sb.length() > 2048) {
-                sendBufferSync(ByteBuffer.wrap(sb.toString().getBytes()));
+                sendBufferSync(ByteBuffer.wrap(sb.toString().getBytes(UTF_8)));
                 // clear our internal buffer
                 sb.setLength(0);
             }
@@ -544,7 +563,10 @@ private boolean readLength(SelectionKey k) throws IOException {
             return false;
         }
         if (len < 0 || len > BinaryInputArchive.maxBuffer) {
-            throw new IOException("Len error " + len);
+            throw new IOException("Len error. "
+                    + "A message from " +  this.getRemoteSocketAddress() + " with advertised length of " + len
+                    + " is either a malformed message or too large to process"
+                    + " (length is greater than jute.maxbuffer=" + BinaryInputArchive.maxBuffer + ")");
         }
         if (!isZKServerRunning()) {
             throw new IOException("ZooKeeperServer not running");
@@ -665,13 +687,18 @@ public static void closeSock(SocketChannel sock) {
     private static final ByteBuffer packetSentinel = ByteBuffer.allocate(0);
 
     @Override
-    public void sendResponse(ReplyHeader h, Record r, String tag, String cacheKey, Stat stat, int opCode) {
+    public int sendResponse(ReplyHeader h, Record r, String tag, String cacheKey, Stat stat, int opCode) {
+        int responseSize = 0;
         try {
-            sendBuffer(serialize(h, r, tag, cacheKey, stat, opCode));
+            ByteBuffer[] bb = serialize(h, r, cacheKey, stat, opCode);
+            responseSize = bb[0].getInt();
+            bb[0].rewind();
+            sendBuffer(bb);
             decrOutstandingAndCheckThrottle(h);
         } catch (Exception e) {
             LOG.warn("Unexpected exception. Destruction averted.", e);
         }
+        return responseSize;
     }
 
     /*
@@ -680,8 +707,19 @@ public void sendResponse(ReplyHeader h, Record r, String tag, String cacheKey, S
      * @see org.apache.zookeeper.server.ServerCnxnIface#process(org.apache.zookeeper.proto.WatcherEvent)
      */
     @Override
-    public void process(WatchedEvent event) {
-        ReplyHeader h = new ReplyHeader(ClientCnxn.NOTIFICATION_XID, -1L, 0);
+    public void process(WatchedEvent event, List<ACL> znodeAcl) {
+        try {
+            zkServer.checkACL(this, znodeAcl, ZooDefs.Perms.READ, getAuthInfo(), event.getPath(), null);
+        } catch (KeeperException.NoAuthException e) {
+            if (LOG.isTraceEnabled()) {
+                ZooTrace.logTraceMessage(
+                    LOG,
+                    ZooTrace.EVENT_DELIVERY_TRACE_MASK,
+                    "Not delivering event " + event + " to 0x" + Long.toHexString(this.sessionId) + " (filtered by ACL)");
+            }
+            return;
+        }
+        ReplyHeader h = new ReplyHeader(ClientCnxn.NOTIFICATION_XID, event.getZxid(), 0);
         if (LOG.isTraceEnabled()) {
             ZooTrace.logTraceMessage(
                 LOG,
@@ -695,7 +733,8 @@ public void process(WatchedEvent event) {
         // The last parameter OpCode here is used to select the response cache.
         // Passing OpCode.error (with a value of -1) means we don't care, as we don't need
         // response cache on delivering watcher events.
-        sendResponse(h, e, "notification", null, null, ZooDefs.OpCode.error);
+        int responseSize = sendResponse(h, e, "notification", null, null, ZooDefs.OpCode.error);
+        ServerMetrics.getMetrics().WATCH_BYTES.add(responseSize);
     }
 
     /*
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxnFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxnFactory.java
index de29fa2424d..800b76f2ac9 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxnFactory.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NIOServerCnxnFactory.java
@@ -82,21 +82,7 @@ public class NIOServerCnxnFactory extends ServerCnxnFactory {
     public static final String ZOOKEEPER_NIO_SHUTDOWN_TIMEOUT = "zookeeper.nio.shutdownTimeout";
 
     static {
-        Thread.setDefaultUncaughtExceptionHandler(new Thread.UncaughtExceptionHandler() {
-            public void uncaughtException(Thread t, Throwable e) {
-                LOG.error("Thread {} died", t, e);
-            }
-        });
-        /**
-         * this is to avoid the jvm bug:
-         * NullPointerException in Selector.open()
-         * http://bugs.sun.com/view_bug.do?bug_id=6427854
-         */
-        try {
-            Selector.open().close();
-        } catch (IOException ie) {
-            LOG.error("Selector failed to open", ie);
-        }
+        Thread.setDefaultUncaughtExceptionHandler((t, e) -> LOG.error("Thread {} died", t, e));
 
         /**
          * Value of 0 disables use of direct buffers and instead uses
@@ -206,7 +192,7 @@ public void run() {
                 if (!reconfiguring) {
                     NIOServerCnxnFactory.this.stop();
                 }
-                LOG.info("accept thread exitted run method");
+                LOG.info("accept thread exited run method");
             }
         }
 
@@ -329,7 +315,7 @@ private boolean doAccept() {
      * If there is no worker thread pool, the SelectorThread performs the I/O
      * directly.
      */
-    class SelectorThread extends AbstractSelectThread {
+    public class SelectorThread extends AbstractSelectThread {
 
         private final int id;
         private final Queue<SocketChannel> acceptedQueue;
@@ -338,8 +324,8 @@ class SelectorThread extends AbstractSelectThread {
         public SelectorThread(int id) throws IOException {
             super("NIOServerCxnFactory.SelectorThread-" + id);
             this.id = id;
-            acceptedQueue = new LinkedBlockingQueue<SocketChannel>();
-            updateQueue = new LinkedBlockingQueue<SelectionKey>();
+            acceptedQueue = new LinkedBlockingQueue<>();
+            updateQueue = new LinkedBlockingQueue<>();
         }
 
         /**
@@ -408,7 +394,7 @@ public void run() {
                 // This will wake up the accept thread and the other selector
                 // threads, and tell the worker thread pool to begin shutdown.
                 NIOServerCnxnFactory.this.stop();
-                LOG.info("selector thread exitted run method");
+                LOG.info("selector thread exited run method");
             }
         }
 
@@ -417,7 +403,7 @@ private void select() {
                 selector.select();
 
                 Set<SelectionKey> selected = selector.selectedKeys();
-                ArrayList<SelectionKey> selectedList = new ArrayList<SelectionKey>(selected);
+                ArrayList<SelectionKey> selectedList = new ArrayList<>(selected);
                 Collections.shuffle(selectedList);
                 Iterator<SelectionKey> selectedKeys = selectedList.iterator();
                 while (!stopped && selectedKeys.hasNext()) {
@@ -557,7 +543,7 @@ public void cleanup() {
     private class ConnectionExpirerThread extends ZooKeeperThread {
 
         ConnectionExpirerThread() {
-            super("ConnnectionExpirer");
+            super("ConnectionExpirer");
         }
 
         public void run() {
@@ -575,7 +561,7 @@ public void run() {
                 }
 
             } catch (InterruptedException e) {
-                LOG.info("ConnnectionExpirerThread interrupted");
+                LOG.info("ConnectionExpirerThread interrupted");
             }
         }
 
@@ -601,7 +587,7 @@ public static ByteBuffer getDirectBuffer() {
     }
 
     // ipMap is used to limit connections per IP
-    private final ConcurrentHashMap<InetAddress, Set<NIOServerCnxn>> ipMap = new ConcurrentHashMap<InetAddress, Set<NIOServerCnxn>>();
+    private final ConcurrentHashMap<InetAddress, Set<NIOServerCnxn>> ipMap = new ConcurrentHashMap<>();
 
     protected int maxClientCnxns = 60;
     int listenBacklog = -1;
@@ -627,7 +613,7 @@ public NIOServerCnxnFactory() {
     private volatile boolean stopped = true;
     private ConnectionExpirerThread expirerThread;
     private AcceptThread acceptThread;
-    private final Set<SelectorThread> selectorThreads = new HashSet<SelectorThread>();
+    private final Set<SelectorThread> selectorThreads = new HashSet<>();
 
     @Override
     public void configure(InetSocketAddress addr, int maxcc, int backlog, boolean secure) throws IOException {
@@ -643,7 +629,7 @@ public void configure(InetSocketAddress addr, int maxcc, int backlog, boolean se
         // cnxnExpiryQueue. These don't need to be the same, but the expiring
         // interval passed into the ExpiryQueue() constructor below should be
         // less than or equal to the timeout.
-        cnxnExpiryQueue = new ExpiryQueue<NIOServerCnxn>(sessionlessCnxnTimeout);
+        cnxnExpiryQueue = new ExpiryQueue<>(sessionlessCnxnTimeout);
         expirerThread = new ConnectionExpirerThread();
 
         int numCores = Runtime.getRuntime().availableProcessors();
@@ -677,6 +663,10 @@ public void configure(InetSocketAddress addr, int maxcc, int backlog, boolean se
         } else {
             ss.socket().bind(addr, listenBacklog);
         }
+        if (addr.getPort() == 0) {
+            // We're likely bound to a different port than was requested, so log that too
+            LOG.info("bound to port {}", ss.getLocalAddress());
+        }
         ss.configureBlocking(false);
         acceptThread = new AcceptThread(ss, addr, selectorThreads);
     }
@@ -819,7 +809,7 @@ private void addCnxn(NIOServerCnxn cnxn) throws IOException {
             // of 1 entry --  we need to set the initial cap
             // to 2 to avoid rehash when the first entry is added
             // Construct a ConcurrentHashSet using a ConcurrentHashMap
-            set = Collections.newSetFromMap(new ConcurrentHashMap<NIOServerCnxn, Boolean>(2));
+            set = Collections.newSetFromMap(new ConcurrentHashMap<>(2));
             // Put the new set in the map, but only if another thread
             // hasn't beaten us to it
             Set<NIOServerCnxn> existingSet = ipMap.putIfAbsent(addr, set);
@@ -956,7 +946,7 @@ public void resetAllConnectionStats() {
 
     @Override
     public Iterable<Map<String, Object>> getAllConnectionInfo(boolean brief) {
-        HashSet<Map<String, Object>> info = new HashSet<Map<String, Object>>();
+        HashSet<Map<String, Object>> info = new HashSet<>();
         // No need to synchronize since cnxns is backed by a ConcurrentHashMap
         for (ServerCnxn c : cnxns) {
             info.add(c.getConnectionInfo(brief));
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
index 442f39d173a..d6acb90fb1f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxn.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import io.netty.buffer.ByteBuf;
 import io.netty.buffer.ByteBufUtil;
 import io.netty.buffer.CompositeByteBuf;
@@ -37,14 +38,20 @@
 import java.nio.channels.SelectionKey;
 import java.security.cert.Certificate;
 import java.util.Arrays;
+import java.util.List;
 import java.util.concurrent.atomic.AtomicBoolean;
 import org.apache.jute.BinaryInputArchive;
 import org.apache.jute.Record;
 import org.apache.zookeeper.ClientCnxn;
+import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.WatchedEvent;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.data.Stat;
+import org.apache.zookeeper.proto.ConnectRequest;
 import org.apache.zookeeper.proto.ReplyHeader;
+import org.apache.zookeeper.proto.RequestHeader;
 import org.apache.zookeeper.proto.WatcherEvent;
 import org.apache.zookeeper.server.command.CommandExecutor;
 import org.apache.zookeeper.server.command.FourLetterCommands;
@@ -115,6 +122,9 @@ public void close() {
         // if this is not in cnxns then it's already closed
         if (!factory.cnxns.remove(this)) {
             LOG.debug("cnxns size:{}", factory.cnxns.size());
+            if (channel.isOpen()) {
+                channel.close();
+            }
             return;
         }
 
@@ -155,8 +165,19 @@ public int getSessionTimeout() {
     }
 
     @Override
-    public void process(WatchedEvent event) {
-        ReplyHeader h = new ReplyHeader(ClientCnxn.NOTIFICATION_XID, -1L, 0);
+    public void process(WatchedEvent event, List<ACL> znodeAcl) {
+        try {
+            zkServer.checkACL(this, znodeAcl, ZooDefs.Perms.READ, getAuthInfo(), event.getPath(), null);
+        } catch (KeeperException.NoAuthException e) {
+            if (LOG.isTraceEnabled()) {
+                ZooTrace.logTraceMessage(
+                    LOG,
+                    ZooTrace.EVENT_DELIVERY_TRACE_MASK,
+                    "Not delivering event " + event + " to 0x" + Long.toHexString(this.sessionId) + " (filtered by ACL)");
+            }
+            return;
+        }
+        ReplyHeader h = new ReplyHeader(ClientCnxn.NOTIFICATION_XID, event.getZxid(), 0);
         if (LOG.isTraceEnabled()) {
             ZooTrace.logTraceMessage(
                 LOG,
@@ -168,7 +189,8 @@ public void process(WatchedEvent event) {
         WatcherEvent e = event.getWrapper();
 
         try {
-            sendResponse(h, e, "notification");
+            int responseSize = sendResponse(h, e, "notification");
+            ServerMetrics.getMetrics().WATCH_BYTES.add(responseSize);
         } catch (IOException e1) {
             LOG.debug("Problem sending to {}", getRemoteSocketAddress(), e1);
             close();
@@ -176,15 +198,19 @@ public void process(WatchedEvent event) {
     }
 
     @Override
-    public void sendResponse(ReplyHeader h, Record r, String tag,
+    public int sendResponse(ReplyHeader h, Record r, String tag,
                              String cacheKey, Stat stat, int opCode) throws IOException {
         // cacheKey and stat are used in caching, which is not
         // implemented here. Implementation example can be found in NIOServerCnxn.
         if (closingChannel || !channel.isOpen()) {
-            return;
+            return 0;
         }
-        sendBuffer(serialize(h, r, tag, cacheKey, stat, opCode));
+        ByteBuffer[] bb = serialize(h, r, cacheKey, stat, opCode);
+        int responseSize = bb[0].getInt();
+        bb[0].rewind();
+        sendBuffer(bb);
         decrOutstandingAndCheckThrottle(h);
+        return responseSize;
     }
 
     @Override
@@ -225,7 +251,7 @@ private class SendBufferWriter extends Writer {
          */
         private void checkFlush(boolean force) {
             if ((force && sb.length() > 0) || sb.length() > 2048) {
-                sendBuffer(ByteBuffer.wrap(sb.toString().getBytes()));
+                sendBuffer(ByteBuffer.wrap(sb.toString().getBytes(UTF_8)));
                 // clear our internal buffer
                 sb.setLength(0);
             }
@@ -341,6 +367,11 @@ void processMessage(ByteBuf buf) {
         checkIsInEventLoop("processMessage");
         LOG.debug("0x{} queuedBuffer: {}", Long.toHexString(sessionId), queuedBuffer);
 
+        if (closingChannel) {
+            LOG.debug("Drop incoming message during connection closing for session 0x{}", Long.toHexString(sessionId));
+            return;
+        }
+
         if (LOG.isTraceEnabled()) {
             LOG.trace("0x{} buf {}", Long.toHexString(sessionId), ByteBufUtil.hexDump(buf));
         }
@@ -468,12 +499,15 @@ private void receiveMessage(ByteBuf message) {
                             throw new IOException("ZK down");
                         }
                         if (initialized) {
-                            // TODO: if zks.processPacket() is changed to take a ByteBuffer[],
-                            // we could implement zero-copy queueing.
-                            zks.processPacket(this, bb);
+                            RequestHeader h = new RequestHeader();
+                            ByteBufferInputStream.byteBuffer2Record(bb, h);
+                            RequestRecord request = RequestRecord.fromBytes(bb.slice());
+                            zks.processPacket(this, h, request);
                         } else {
                             LOG.debug("got conn req request from {}", getRemoteSocketAddress());
-                            zks.processConnectRequest(this, bb);
+                            BinaryInputArchive bia = BinaryInputArchive.getArchive(new ByteBufferInputStream(bb));
+                            ConnectRequest request = protocolManager.deserializeConnectRequest(bia);
+                            zks.processConnectRequest(this, request);
                             initialized = true;
                         }
                         bb = null;
@@ -511,8 +545,15 @@ private void receiveMessage(ByteBuf message) {
                         if (len < 0 || len > BinaryInputArchive.maxBuffer) {
                             throw new IOException("Len error " + len);
                         }
+                        ZooKeeperServer zks = this.zkServer;
+                        if (zks == null || !zks.isRunning()) {
+                            LOG.info("Closing connection to {} because the server is not ready (server state is: {})",
+                                getRemoteSocketAddress(), zks == null ? "unknown" : zks.getState());
+                            close(DisconnectReason.IO_EXCEPTION);
+                            return;
+                        }
                         // checkRequestSize will throw IOException if request is rejected
-                        zkServer.checkRequestSizeWhenReceivingMessage(len);
+                        zks.checkRequestSizeWhenReceivingMessage(len);
                         bb = ByteBuffer.allocate(len);
                     }
                 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
index 5d236ee8b81..6f65787442c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/NettyServerCnxnFactory.java
@@ -47,8 +47,7 @@
 import java.io.IOException;
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
-import java.security.KeyManagementException;
-import java.security.NoSuchAlgorithmException;
+import java.net.SocketAddress;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
@@ -57,18 +56,17 @@
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.atomic.AtomicInteger;
 import java.util.concurrent.atomic.AtomicReference;
-import javax.net.ssl.SSLContext;
 import javax.net.ssl.SSLEngine;
+import javax.net.ssl.SSLException;
 import javax.net.ssl.SSLPeerUnverifiedException;
 import javax.net.ssl.SSLSession;
-import javax.net.ssl.X509KeyManager;
-import javax.net.ssl.X509TrustManager;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.common.ClientX509Util;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.common.NettyUtils;
-import org.apache.zookeeper.common.SSLContextAndOptions;
 import org.apache.zookeeper.common.X509Exception;
 import org.apache.zookeeper.common.X509Exception.SSLContextException;
+import org.apache.zookeeper.common.ZKConfig;
 import org.apache.zookeeper.server.NettyServerCnxn.HandshakeState;
 import org.apache.zookeeper.server.auth.ProviderRegistry;
 import org.apache.zookeeper.server.auth.X509AuthenticationProvider;
@@ -84,6 +82,7 @@ public class NettyServerCnxnFactory extends ServerCnxnFactory {
      * Allow client-server sockets to accept both SSL and plaintext connections
      */
     public static final String PORT_UNIFICATION_KEY = "zookeeper.client.portUnification";
+    public static final String EARLY_DROP_SECURE_CONNECTION_HANDSHAKES = "zookeeper.netty.server.earlyDropSecureConnectionHandshakes";
     private final boolean shouldUsePortUnification;
 
     /**
@@ -122,6 +121,8 @@ public void setOutstandingHandshakeLimit(int limit) {
 
     private static final AtomicReference<ByteBufAllocator> TEST_ALLOCATOR = new AtomicReference<>(null);
 
+    public static final String CLIENT_CERT_RELOAD_KEY = "zookeeper.client.certReload";
+
     /**
      * A handler that detects whether the client would like to use
      * TLS or not and responds in kind. The first bytes are examined
@@ -226,11 +227,15 @@ public void channelActive(ChannelHandlerContext ctx) throws Exception {
 
             // Check the zkServer assigned to the cnxn is still running,
             // close it before starting the heavy TLS handshake
-            if (!cnxn.isZKServerRunning()) {
-                LOG.warn("Zookeeper server is not running, close the connection before starting the TLS handshake");
-                ServerMetrics.getMetrics().CNXN_CLOSED_WITHOUT_ZK_SERVER_RUNNING.add(1);
-                channel.close();
-                return;
+            if (secure && !cnxn.isZKServerRunning()) {
+                boolean earlyDropSecureConnectionHandshakes = Boolean.getBoolean(EARLY_DROP_SECURE_CONNECTION_HANDSHAKES);
+                if (earlyDropSecureConnectionHandshakes) {
+                    LOG.info("Zookeeper server is not running, close the connection to {} before starting the TLS handshake",
+                            cnxn.getChannel().remoteAddress());
+                    ServerMetrics.getMetrics().CNXN_CLOSED_WITHOUT_ZK_SERVER_RUNNING.add(1);
+                    channel.close();
+                    return;
+                }
             }
 
             if (handshakeThrottlingEnabled) {
@@ -258,6 +263,22 @@ public void channelActive(ChannelHandlerContext ctx) throws Exception {
                 allChannels.add(ctx.channel());
                 addCnxn(cnxn);
             }
+
+            if (ctx.channel().pipeline().get(SslHandler.class) == null) {
+                if (zkServer != null) {
+                    SocketAddress remoteAddress = cnxn.getChannel().remoteAddress();
+                    if (remoteAddress != null
+                            && !((InetSocketAddress) remoteAddress).getAddress().isLoopbackAddress()) {
+                        LOG.trace("NettyChannelHandler channelActive: remote={} local={}", remoteAddress, cnxn.getChannel().localAddress());
+                        zkServer.serverStats().incrementNonMTLSRemoteConnCount();
+                    } else {
+                        zkServer.serverStats().incrementNonMTLSLocalConnCount();
+                    }
+                } else {
+                    LOG.trace("Opened non-TLS connection from {} but zkServer is not running",
+                            cnxn.getChannel().remoteAddress());
+                }
+            }
         }
 
         @Override
@@ -429,7 +450,9 @@ public void operationComplete(Future<Channel> future) {
                         return;
                     }
 
-                    if (KeeperException.Code.OK != authProvider.handleAuthentication(cnxn, null)) {
+                    KeeperException.Code code = authProvider.handleAuthentication(cnxn, null);
+                    if (KeeperException.Code.OK != code) {
+                        zkServer.serverStats().incrementAuthFailedCount();
                         LOG.error("Authentication failed for session 0x{}", Long.toHexString(cnxn.getSessionId()));
                         cnxn.close(ServerCnxn.DisconnectReason.SASL_AUTH_FAILURE);
                         return;
@@ -440,7 +463,9 @@ public void operationComplete(Future<Channel> future) {
                 allChannels.add(Objects.requireNonNull(futureChannel));
                 addCnxn(cnxn);
             } else {
+                zkServer.serverStats().incrementAuthFailedCount();
                 LOG.error("Unsuccessful handshake with session 0x{}", Long.toHexString(cnxn.getSessionId()));
+                ServerMetrics.getMetrics().UNSUCCESSFUL_HANDSHAKE.add(1);
                 cnxn.close(ServerCnxn.DisconnectReason.FAILED_HANDSHAKE);
             }
         }
@@ -488,12 +513,24 @@ private ServerBootstrap configureBootstrapAllocator(ServerBootstrap bootstrap) {
     NettyServerCnxnFactory() {
         x509Util = new ClientX509Util();
 
+        boolean useClientReload = Boolean.getBoolean(CLIENT_CERT_RELOAD_KEY);
+        LOG.info("{}={}", CLIENT_CERT_RELOAD_KEY, useClientReload);
+        if (useClientReload) {
+            try {
+                x509Util.enableCertFileReloading();
+            } catch (IOException e) {
+                LOG.error("unable to set up client certificate reload filewatcher", e);
+                useClientReload = false;
+            }
+        }
+
         boolean usePortUnification = Boolean.getBoolean(PORT_UNIFICATION_KEY);
+
         LOG.info("{}={}", PORT_UNIFICATION_KEY, usePortUnification);
         if (usePortUnification) {
             try {
                 QuorumPeerConfig.configureSSLAuth();
-            } catch (QuorumPeerConfig.ConfigException e) {
+            } catch (ConfigException e) {
                 LOG.error("unable to set up SslAuthProvider, turning off client port unification", e);
                 usePortUnification = false;
             }
@@ -533,14 +570,13 @@ protected void initChannel(SocketChannel ch) throws Exception {
         this.bootstrap.validate();
     }
 
-    private synchronized void initSSL(ChannelPipeline p, boolean supportPlaintext) throws X509Exception, KeyManagementException, NoSuchAlgorithmException {
+    private synchronized void initSSL(ChannelPipeline p, boolean supportPlaintext)
+        throws X509Exception, SSLException {
         String authProviderProp = System.getProperty(x509Util.getSslAuthProviderProperty());
         SslContext nettySslContext;
         if (authProviderProp == null) {
-            SSLContextAndOptions sslContextAndOptions = x509Util.getDefaultSSLContextAndOptions();
-            nettySslContext = sslContextAndOptions.createNettyJdkSslContext(sslContextAndOptions.getSSLContext(), false);
+            nettySslContext = x509Util.createNettySslContextForServer(new ZKConfig());
         } else {
-            SSLContext sslContext = SSLContext.getInstance(ClientX509Util.DEFAULT_PROTOCOL);
             X509AuthenticationProvider authProvider = (X509AuthenticationProvider) ProviderRegistry.getProvider(
                 System.getProperty(x509Util.getSslAuthProviderProperty(), "x509"));
 
@@ -549,8 +585,8 @@ private synchronized void initSSL(ChannelPipeline p, boolean supportPlaintext) t
                 throw new SSLContextException("Could not create SSLContext with specified auth provider: " + authProviderProp);
             }
 
-            sslContext.init(new X509KeyManager[]{authProvider.getKeyManager()}, new X509TrustManager[]{authProvider.getTrustManager()}, null);
-            nettySslContext = x509Util.getDefaultSSLContextAndOptions().createNettyJdkSslContext(sslContext, false);
+            nettySslContext = x509Util.createNettySslContextForServer(
+                new ZKConfig(), authProvider.getKeyManager(), authProvider.getTrustManager());
         }
 
         if (supportPlaintext) {
@@ -588,6 +624,7 @@ public void configure(InetSocketAddress addr, int maxClientCnxns, int backlog, b
         this.maxClientCnxns = maxClientCnxns;
         this.secure = secure;
         this.listenBacklog = backlog;
+        LOG.info("configure {} secure: {} on addr {}", this, secure, addr);
     }
 
     /** {@inheritDoc} */
@@ -768,7 +805,7 @@ public void resetAllConnectionStats() {
 
     @Override
     public Iterable<Map<String, Object>> getAllConnectionInfo(boolean brief) {
-        Set<Map<String, Object>> info = new HashSet<Map<String, Object>>();
+        Set<Map<String, Object>> info = new HashSet<>();
         // No need to synchronize since cnxns is backed by a ConcurrentHashMap
         for (ServerCnxn c : cnxns) {
             info.add(c.getConnectionInfo(brief));
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
index 74720ed4a1b..d263fd75c43 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PrepRequestProcessor.java
@@ -18,10 +18,8 @@
 
 package org.apache.zookeeper.server;
 
-import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.StringReader;
-import java.nio.ByteBuffer;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.HashMap;
@@ -32,9 +30,9 @@
 import java.util.Properties;
 import java.util.Set;
 import java.util.concurrent.LinkedBlockingQueue;
-import org.apache.jute.BinaryOutputArchive;
 import org.apache.jute.Record;
 import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.DeleteContainerRequest;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.KeeperException.BadArgumentsException;
 import org.apache.zookeeper.KeeperException.Code;
@@ -42,6 +40,7 @@
 import org.apache.zookeeper.Op;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooDefs.OpCode;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.common.PathUtils;
 import org.apache.zookeeper.common.StringUtils;
 import org.apache.zookeeper.common.Time;
@@ -62,8 +61,8 @@
 import org.apache.zookeeper.server.quorum.LeaderZooKeeperServer;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
 import org.apache.zookeeper.server.quorum.flexible.QuorumMaj;
+import org.apache.zookeeper.server.quorum.flexible.QuorumOracleMaj;
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
 import org.apache.zookeeper.txn.CheckVersionTxn;
 import org.apache.zookeeper.txn.CloseSessionTxn;
@@ -99,7 +98,7 @@ public class PrepRequestProcessor extends ZooKeeperCriticalThread implements Req
      */
     private static boolean failCreate = false;
 
-    LinkedBlockingQueue<Request> submittedRequests = new LinkedBlockingQueue<Request>();
+    LinkedBlockingQueue<Request> submittedRequests = new LinkedBlockingQueue<>();
 
     private final RequestProcessor nextProcessor;
     private final boolean digestEnabled;
@@ -133,17 +132,18 @@ public static void setFailCreate(boolean b) {
     }
     @Override
     public void run() {
+        LOG.info(String.format("PrepRequestProcessor (sid:%d) started, reconfigEnabled=%s", zks.getServerId(), zks.reconfigEnabled));
         try {
             while (true) {
                 ServerMetrics.getMetrics().PREP_PROCESSOR_QUEUE_SIZE.add(submittedRequests.size());
                 Request request = submittedRequests.take();
                 ServerMetrics.getMetrics().PREP_PROCESSOR_QUEUE_TIME
                     .add(Time.currentElapsedTime() - request.prepQueueStartTime);
-                long traceMask = ZooTrace.CLIENT_REQUEST_TRACE_MASK;
-                if (request.type == OpCode.ping) {
-                    traceMask = ZooTrace.CLIENT_PING_TRACE_MASK;
-                }
                 if (LOG.isTraceEnabled()) {
+                    long traceMask = ZooTrace.CLIENT_REQUEST_TRACE_MASK;
+                    if (request.type == OpCode.ping) {
+                        traceMask = ZooTrace.CLIENT_PING_TRACE_MASK;
+                    }
                     ZooTrace.logRequest(LOG, traceMask, 'P', request, "");
                 }
                 if (Request.requestOfDeath == request) {
@@ -211,7 +211,7 @@ protected void addChangeRecord(ChangeRecord c) {
      *         rolled back in any failure.
      */
     private Map<String, ChangeRecord> getPendingChanges(MultiOperationRecord multiRequest) {
-        Map<String, ChangeRecord> pendingChangeRecords = new HashMap<String, ChangeRecord>();
+        Map<String, ChangeRecord> pendingChangeRecords = new HashMap<>();
 
         for (Op op : multiRequest) {
             String path = op.getPath();
@@ -308,29 +308,24 @@ private String validatePathForCreate(String path, long sessionId) throws BadArgu
     /**
      * This method will be called inside the ProcessRequestThread, which is a
      * singleton, so there will be a single thread calling this code.
-     *
-     * @param type
-     * @param zxid
-     * @param request
-     * @param record
      */
-    protected void pRequest2Txn(int type, long zxid, Request request, Record record, boolean deserialize) throws KeeperException, IOException, RequestProcessorException {
+    protected void pRequest2Txn(int type, long zxid, Request request, Record record) throws KeeperException, IOException, RequestProcessorException {
         if (request.getHdr() == null) {
             request.setHdr(new TxnHeader(request.sessionId, request.cxid, zxid,
                     Time.currentWallTime(), type));
         }
 
-        PrecalculatedDigest precalculatedDigest;
         switch (type) {
         case OpCode.create:
         case OpCode.create2:
         case OpCode.createTTL:
         case OpCode.createContainer: {
-            pRequest2TxnCreate(type, request, record, deserialize);
+            pRequest2TxnCreate(type, request, record);
             break;
         }
         case OpCode.deleteContainer: {
-            String path = new String(request.request.array());
+            DeleteContainerRequest txn = (DeleteContainerRequest) record;
+            String path = txn.getPath();
             String parentPath = getParentPathAndValidate(path);
             ChangeRecord nodeRecord = getRecordForPath(path);
             if (nodeRecord.childCount > 0) {
@@ -357,9 +352,6 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
         case OpCode.delete:
             zks.sessionTracker.checkSession(request.sessionId, request.getOwner());
             DeleteRequest deleteRequest = (DeleteRequest) record;
-            if (deserialize) {
-                ByteBufferInputStream.byteBuffer2Record(request.request, deleteRequest);
-            }
             String path = deleteRequest.getPath();
             String parentPath = getParentPathAndValidate(path);
             ChangeRecord parentRecord = getRecordForPath(parentPath);
@@ -385,13 +377,11 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
         case OpCode.setData:
             zks.sessionTracker.checkSession(request.sessionId, request.getOwner());
             SetDataRequest setDataRequest = (SetDataRequest) record;
-            if (deserialize) {
-                ByteBufferInputStream.byteBuffer2Record(request.request, setDataRequest);
-            }
             path = setDataRequest.getPath();
             validatePath(path, request.sessionId);
             nodeRecord = getRecordForPath(path);
             zks.checkACL(request.cnxn, nodeRecord.acl, ZooDefs.Perms.WRITE, request.authInfo, path, null);
+            zks.checkQuota(path, nodeRecord.data, setDataRequest.getData(), OpCode.setData);
             int newVersion = checkAndIncVersion(nodeRecord.stat.getVersion(), setDataRequest.getVersion(), path);
             request.setTxn(new SetDataTxn(path, setDataRequest.getData(), newVersion));
             nodeRecord = nodeRecord.duplicate(request.getHdr().getZxid());
@@ -405,7 +395,7 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
             addChangeRecord(nodeRecord);
             break;
         case OpCode.reconfig:
-            if (!QuorumPeerConfig.isReconfigEnabled()) {
+            if (!zks.isReconfigEnabled()) {
                 LOG.error("Reconfig operation requested but reconfig feature is disabled.");
                 throw new KeeperException.ReconfigDisabledException();
             }
@@ -449,7 +439,7 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
                 try {
                     Properties props = new Properties();
                     props.load(new StringReader(newMembers));
-                    request.qv = QuorumPeerConfig.parseDynamicConfig(props, lzks.self.getElectionType(), true, false);
+                    request.qv = QuorumPeerConfig.parseDynamicConfig(props, lzks.self.getElectionType(), true, false, lastSeenQV.getOraclePath());
                     request.qv.setVersion(request.getHdr().getZxid());
                 } catch (IOException | ConfigException e) {
                     throw new KeeperException.BadArgumentsException(e.getMessage());
@@ -469,12 +459,12 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
                     leavingServers = StringUtils.split(leavingServersString, ",");
                 }
 
-                if (!(lastSeenQV instanceof QuorumMaj)) {
+                if (!(lastSeenQV instanceof QuorumMaj) && !(lastSeenQV instanceof QuorumOracleMaj)) {
                     String msg = "Incremental reconfiguration requested but last configuration seen has a non-majority quorum system";
                     LOG.warn(msg);
                     throw new KeeperException.BadArgumentsException(msg);
                 }
-                Map<Long, QuorumServer> nextServers = new HashMap<Long, QuorumServer>(lastSeenQV.getAllMembers());
+                Map<Long, QuorumServer> nextServers = new HashMap<>(lastSeenQV.getAllMembers());
                 try {
                     if (leavingServers != null) {
                         for (String leaving : leavingServers) {
@@ -492,8 +482,8 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
                             // extract server id x from first part of joiner: server.x
                             Long sid = Long.parseLong(parts[0].substring(parts[0].lastIndexOf('.') + 1));
                             QuorumServer qs = new QuorumServer(sid, parts[1]);
-                            if (qs.clientAddr == null || qs.electionAddr == null || qs.addr == null) {
-                                throw new KeeperException.BadArgumentsException("Wrong format of server string - each server should have 3 ports specified");
+                            if ((qs.clientAddr == null && qs.secureClientAddr == null) || qs.electionAddr == null || qs.addr == null) {
+                                throw new KeeperException.BadArgumentsException("Wrong format of server string - each server should have at least 3 ports specified");
                             }
 
                             // check duplication of addresses and ports
@@ -511,7 +501,13 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
                 } catch (ConfigException e) {
                     throw new KeeperException.BadArgumentsException("Reconfiguration failed");
                 }
-                request.qv = new QuorumMaj(nextServers);
+
+                if (lastSeenQV instanceof QuorumMaj) {
+                    request.qv = new QuorumMaj(nextServers);
+                } else {
+                    request.qv = new QuorumOracleMaj(nextServers, lastSeenQV.getOraclePath());
+                }
+
                 request.qv.setVersion(request.getHdr().getZxid());
             }
             if (QuorumPeerConfig.isStandaloneEnabled() && request.qv.getVotingMembers().size() < 2) {
@@ -550,9 +546,6 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
         case OpCode.setACL:
             zks.sessionTracker.checkSession(request.sessionId, request.getOwner());
             SetACLRequest setAclRequest = (SetACLRequest) record;
-            if (deserialize) {
-                ByteBufferInputStream.byteBuffer2Record(request.request, setAclRequest);
-            }
             path = setAclRequest.getPath();
             validatePath(path, request.sessionId);
             List<ACL> listACL = fixupACL(path, request.authInfo, setAclRequest.getAcl());
@@ -568,12 +561,10 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
             addChangeRecord(nodeRecord);
             break;
         case OpCode.createSession:
-            request.request.rewind();
-            int to = request.request.getInt();
-            request.setTxn(new CreateSessionTxn(to));
-            request.request.rewind();
+            CreateSessionTxn createSessionTxn = request.readRequestRecord(CreateSessionTxn::new);
+            request.setTxn(createSessionTxn);
             // only add the global session tracker but not to ZKDb
-            zks.sessionTracker.trackSession(request.sessionId, to);
+            zks.sessionTracker.trackSession(request.sessionId, createSessionTxn.getTimeOut());
             zks.setOwner(request.sessionId, request.getOwner());
             break;
         case OpCode.closeSession:
@@ -622,9 +613,6 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
         case OpCode.check:
             zks.sessionTracker.checkSession(request.sessionId, request.getOwner());
             CheckVersionRequest checkVersionRequest = (CheckVersionRequest) record;
-            if (deserialize) {
-                ByteBufferInputStream.byteBuffer2Record(request.request, checkVersionRequest);
-            }
             path = checkVersionRequest.getPath();
             validatePath(path, request.sessionId);
             nodeRecord = getRecordForPath(path);
@@ -645,11 +633,7 @@ protected void pRequest2Txn(int type, long zxid, Request request, Record record,
         }
     }
 
-    private void pRequest2TxnCreate(int type, Request request, Record record, boolean deserialize) throws IOException, KeeperException {
-        if (deserialize) {
-            ByteBufferInputStream.byteBuffer2Record(request.request, record);
-        }
-
+    private void pRequest2TxnCreate(int type, Request request, Record record) throws IOException, KeeperException {
         int flags;
         String path;
         List<ACL> acl;
@@ -695,6 +679,7 @@ private void pRequest2TxnCreate(int type, Request request, Record record, boolea
             throw new KeeperException.NoChildrenForEphemeralsException(path);
         }
         int newCversion = parentRecord.stat.getCversion() + 1;
+        zks.checkQuota(path, null, data, OpCode.create);
         if (type == OpCode.createContainer) {
             request.setTxn(new CreateContainerTxn(path, data, listACL, newCversion));
         } else if (type == OpCode.createTTL) {
@@ -750,7 +735,18 @@ private static int checkAndIncVersion(int currentVersion, int expectedVersion, S
         if (expectedVersion != -1 && expectedVersion != currentVersion) {
             throw new KeeperException.BadVersionException(path);
         }
-        return currentVersion + 1;
+        // Increase once more when going back to -1 from Integer.MIN_VALUE. Otherwise, the client will
+        // receive a new data version -1. And Now, if the client wants to check the data version, it can
+        // only pass -1 as the next expected version, but -1 as the expected version means do not check
+        // the data version. So the client is unable to express the expected manner.
+        //
+        // See also https://issues.apache.org/jira/browse/ZOOKEEPER-4743.
+        int nextVersion = currentVersion + 1;
+        if (nextVersion == -1) {
+            return 0;
+        } else {
+            return nextVersion;
+        }
     }
 
     /**
@@ -760,54 +756,69 @@ private static int checkAndIncVersion(int currentVersion, int expectedVersion, S
      * @param request
      */
     protected void pRequest(Request request) throws RequestProcessorException {
-        // LOG.info("Prep>>> cxid = " + request.cxid + " type = " +
-        // request.type + " id = 0x" + Long.toHexString(request.sessionId));
         request.setHdr(null);
         request.setTxn(null);
 
+        if (!request.isThrottled()) {
+          pRequestHelper(request);
+        }
+
+        request.zxid = zks.getZxid();
+        long timeFinishedPrepare = Time.currentElapsedTime();
+        ServerMetrics.getMetrics().PREP_PROCESS_TIME.add(timeFinishedPrepare - request.prepStartTime);
+        nextProcessor.processRequest(request);
+        ServerMetrics.getMetrics().PROPOSAL_PROCESS_TIME.add(Time.currentElapsedTime() - timeFinishedPrepare);
+    }
+
+    /**
+     * This method is a helper to pRequest method
+     */
+    private void pRequestHelper(Request request) {
         try {
             switch (request.type) {
             case OpCode.createContainer:
             case OpCode.create:
             case OpCode.create2:
-                CreateRequest create2Request = new CreateRequest();
-                pRequest2Txn(request.type, zks.getNextZxid(), request, create2Request, true);
+                CreateRequest create2Request = request.readRequestRecord(CreateRequest::new);
+                pRequest2Txn(request.type, zks.getNextZxid(), request, create2Request);
                 break;
             case OpCode.createTTL:
-                CreateTTLRequest createTtlRequest = new CreateTTLRequest();
-                pRequest2Txn(request.type, zks.getNextZxid(), request, createTtlRequest, true);
+                CreateTTLRequest createTtlRequest = request.readRequestRecord(CreateTTLRequest::new);
+                pRequest2Txn(request.type, zks.getNextZxid(), request, createTtlRequest);
                 break;
             case OpCode.deleteContainer:
+                DeleteContainerRequest deleteContainerRequest = request.readRequestRecord(DeleteContainerRequest::new);
+                pRequest2Txn(request.type, zks.getNextZxid(), request, deleteContainerRequest);
+                break;
             case OpCode.delete:
-                DeleteRequest deleteRequest = new DeleteRequest();
-                pRequest2Txn(request.type, zks.getNextZxid(), request, deleteRequest, true);
+                DeleteRequest deleteRequest = request.readRequestRecord(DeleteRequest::new);
+                pRequest2Txn(request.type, zks.getNextZxid(), request, deleteRequest);
                 break;
             case OpCode.setData:
-                SetDataRequest setDataRequest = new SetDataRequest();
-                pRequest2Txn(request.type, zks.getNextZxid(), request, setDataRequest, true);
+                SetDataRequest setDataRequest = request.readRequestRecord(SetDataRequest::new);
+                pRequest2Txn(request.type, zks.getNextZxid(), request, setDataRequest);
                 break;
             case OpCode.reconfig:
-                ReconfigRequest reconfigRequest = new ReconfigRequest();
-                ByteBufferInputStream.byteBuffer2Record(request.request, reconfigRequest);
-                pRequest2Txn(request.type, zks.getNextZxid(), request, reconfigRequest, true);
+                ReconfigRequest reconfigRequest = request.readRequestRecord(ReconfigRequest::new);
+                pRequest2Txn(request.type, zks.getNextZxid(), request, reconfigRequest);
                 break;
             case OpCode.setACL:
-                SetACLRequest setAclRequest = new SetACLRequest();
-                pRequest2Txn(request.type, zks.getNextZxid(), request, setAclRequest, true);
+                SetACLRequest setAclRequest = request.readRequestRecord(SetACLRequest::new);
+                pRequest2Txn(request.type, zks.getNextZxid(), request, setAclRequest);
                 break;
             case OpCode.check:
-                CheckVersionRequest checkRequest = new CheckVersionRequest();
-                pRequest2Txn(request.type, zks.getNextZxid(), request, checkRequest, true);
+                CheckVersionRequest checkRequest = request.readRequestRecord(CheckVersionRequest::new);
+                pRequest2Txn(request.type, zks.getNextZxid(), request, checkRequest);
                 break;
             case OpCode.multi:
-                MultiOperationRecord multiRequest = new MultiOperationRecord();
+                MultiOperationRecord multiRequest;
                 try {
-                    ByteBufferInputStream.byteBuffer2Record(request.request, multiRequest);
+                    multiRequest = request.readRequestRecord(MultiOperationRecord::new);
                 } catch (IOException e) {
                     request.setHdr(new TxnHeader(request.sessionId, request.cxid, zks.getNextZxid(), Time.currentWallTime(), OpCode.multi));
                     throw e;
                 }
-                List<Txn> txns = new ArrayList<Txn>();
+                List<Txn> txns = new ArrayList<>();
                 //Each op in a multi-op must have the same zxid!
                 long zxid = zks.getNextZxid();
                 KeeperException ke = null;
@@ -832,7 +843,7 @@ protected void pRequest(Request request) throws RequestProcessorException {
                     } else {
                         /* Prep the request and convert to a Txn */
                         try {
-                            pRequest2Txn(op.getType(), zxid, request, subrequest, false);
+                            pRequest2Txn(op.getType(), zxid, request, subrequest);
                             type = op.getType();
                             txn = request.getTxn();
                         } catch (KeeperException e) {
@@ -858,12 +869,8 @@ protected void pRequest(Request request) throws RequestProcessorException {
                     // TODO: I don't want to have to serialize it here and then
                     //       immediately deserialize in next processor. But I'm
                     //       not sure how else to get the txn stored into our list.
-                    try (ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
-                        BinaryOutputArchive boa = BinaryOutputArchive.getArchive(baos);
-                        txn.serialize(boa, "request");
-                        ByteBuffer bb = ByteBuffer.wrap(baos.toByteArray());
-                        txns.add(new Txn(type, bb.array()));
-                    }
+                    byte[] bb = RequestRecord.fromRecord(txn).readBytes();
+                    txns.add(new Txn(type, bb));
                 }
 
                 request.setTxn(new MultiTxn(txns));
@@ -877,7 +884,7 @@ protected void pRequest(Request request) throws RequestProcessorException {
             case OpCode.createSession:
             case OpCode.closeSession:
                 if (!request.isLocalSession()) {
-                    pRequest2Txn(request.type, zks.getNextZxid(), request, null, true);
+                    pRequest2Txn(request.type, zks.getNextZxid(), request, null);
                 }
                 break;
 
@@ -897,6 +904,7 @@ protected void pRequest(Request request) throws RequestProcessorException {
             case OpCode.getEphemerals:
             case OpCode.multiRead:
             case OpCode.addWatch:
+            case OpCode.whoAmI:
                 zks.sessionTracker.checkSession(request.sessionId, request.getOwner());
                 break;
             default:
@@ -921,27 +929,15 @@ protected void pRequest(Request request) throws RequestProcessorException {
             // log at error level as we are returning a marshalling
             // error to the user
             LOG.error("Failed to process {}", request, e);
-
-            StringBuilder sb = new StringBuilder();
-            ByteBuffer bb = request.request;
-            if (bb != null) {
-                bb.rewind();
-                while (bb.hasRemaining()) {
-                    sb.append(Integer.toHexString(bb.get() & 0xff));
-                }
-            } else {
-                sb.append("request buffer is null");
+            String digest = request.requestDigest();
+            LOG.error("Dumping request buffer for request type {}: 0x{}", Request.op2String(request.type), digest);
+            if (request.getHdr() == null) {
+                request.setHdr(new TxnHeader(request.sessionId, request.cxid, zks.getZxid(), Time.currentWallTime(), request.type));
             }
 
-            LOG.error("Dumping request buffer: 0x{}", sb.toString());
-            if (request.getHdr() != null) {
-                request.getHdr().setType(OpCode.error);
-                request.setTxn(new ErrorTxn(Code.MARSHALLINGERROR.intValue()));
-            }
+            request.getHdr().setType(OpCode.error);
+            request.setTxn(new ErrorTxn(Code.MARSHALLINGERROR.intValue()));
         }
-        request.zxid = zks.getZxid();
-        ServerMetrics.getMetrics().PREP_PROCESS_TIME.add(Time.currentElapsedTime() - request.prepStartTime);
-        nextProcessor.processRequest(request);
     }
 
     private static List<ACL> removeDuplicates(final List<ACL> acls) {
@@ -984,7 +980,7 @@ private void validateCreateRequest(String path, CreateMode createMode, Request r
     /**
      * This method checks out the acl making sure it isn't null or empty,
      * it has valid schemes and ids, and expanding any relative ids that
-     * depend on the requestor's authentication information.
+     * depend on the requester's authentication information.
      *
      * @param authInfo list of ACL IDs associated with the client connection
      * @param acls list of ACLs being assigned to the node (create or setACL operation)
@@ -1012,7 +1008,7 @@ public static List<ACL> fixupACL(String path, List<Id> authInfo, List<ACL> acls)
                 rv.add(a);
             } else if (id.getScheme().equals("auth")) {
                 // This is the "auth" id, so we have to expand it to the
-                // authenticated ids of the requestor
+                // authenticated ids of the requester
                 boolean authIdValid = false;
                 for (Id cid : authInfo) {
                     ServerAuthenticationProvider ap = ProviderRegistry.getServerProvider(cid.getScheme());
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PurgeTxnLog.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PurgeTxnLog.java
index d152fabd8dd..299071348be 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/PurgeTxnLog.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/PurgeTxnLog.java
@@ -109,7 +109,7 @@ static void purgeOlderSnapshots(FileTxnSnapLog txnLog, File snapShot) {
          * recoverability of all snapshots being retained.  We determine that log file here by
          * calling txnLog.getSnapshotLogs().
          */
-        final Set<File> retainedTxnLogs = new HashSet<File>();
+        final Set<File> retainedTxnLogs = new HashSet<>();
         retainedTxnLogs.addAll(Arrays.asList(txnLog.getSnapshotLogs(leastZxidToBeRetain)));
 
         /**
@@ -135,7 +135,7 @@ public boolean accept(File f) {
 
         }
         // add all non-excluded log files
-        File[] logs = txnLog.getDataDir().listFiles(new MyFileFilter(PREFIX_LOG));
+        File[] logs = txnLog.getDataLogDir().listFiles(new MyFileFilter(PREFIX_LOG));
         List<File> files = new ArrayList<>();
         if (logs != null) {
             files.addAll(Arrays.asList(logs));
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/RateLogger.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/RateLogger.java
index 1cae4482d7a..33908c72eef 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/RateLogger.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/RateLogger.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server;
 
+import java.util.Objects;
 import org.apache.zookeeper.common.Time;
 import org.slf4j.Logger;
 
@@ -45,15 +46,20 @@ public RateLogger(Logger log, long interval) {
 
     public void flush() {
         if (msg != null && count > 0) {
-            String log = "";
+            // Optimized logging using parameterized messages to reduce string concatenation overhead
             if (count > 1) {
-                log = "[" + count + " times] ";
+                if (value != null) {
+                    LOG.warn("[{} times] Message: {} Last value:{}", count, msg, value);
+                } else {
+                    LOG.warn("[{} times] Message: {}", count, msg);
+                }
+            } else {
+                if (value != null) {
+                    LOG.warn("Message: {} Value:{}", msg, value);
+                } else {
+                    LOG.warn("Message: {}", msg);
+                }
             }
-            log += "Message: " + msg;
-            if (value != null) {
-                log += " Last value:" + value;
-            }
-            LOG.warn(log);
         }
         msg = null;
         value = null;
@@ -67,21 +73,22 @@ public void rateLimitLog(String newMsg) {
     /**
      * In addition to the message, it also takes a value.
      */
-    public void rateLimitLog(String newMsg, String value) {
+    public void rateLimitLog(String newMsg, String newValue) {
         long now = Time.currentElapsedTime();
-        if (newMsg.equals(msg)) {
+        // Optimized string comparison: use reference equality first for constant strings
+        if (newMsg == msg || Objects.equals(newMsg, msg)) {
             ++count;
-            this.value = value;
+            value = newValue;
             if (now - timestamp >= LOG_INTERVAL) {
                 flush();
                 msg = newMsg;
                 timestamp = now;
-                this.value = value;
+                value = newValue;
             }
         } else {
             flush();
             msg = newMsg;
-            this.value = value;
+            value = newValue;
             timestamp = now;
             LOG.warn("Message:{} Value:{}", msg, value);
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ReferenceCountedACLCache.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ReferenceCountedACLCache.java
index 307a53de52a..78977000ca2 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ReferenceCountedACLCache.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ReferenceCountedACLCache.java
@@ -38,11 +38,11 @@ public class ReferenceCountedACLCache {
 
     private static final Logger LOG = LoggerFactory.getLogger(ReferenceCountedACLCache.class);
 
-    final Map<Long, List<ACL>> longKeyMap = new HashMap<Long, List<ACL>>();
+    final Map<Long, List<ACL>> longKeyMap = new HashMap<>();
 
-    final Map<List<ACL>, Long> aclKeyMap = new HashMap<List<ACL>, Long>();
+    final Map<List<ACL>, Long> aclKeyMap = new HashMap<>();
 
-    final Map<Long, AtomicLongWithEquals> referenceCounter = new HashMap<Long, AtomicLongWithEquals>();
+    final Map<Long, AtomicLongWithEquals> referenceCounter = new HashMap<>();
     private static final long OPEN_UNSAFE_ACL_ID = -1L;
 
     /**
@@ -107,10 +107,10 @@ public void deserialize(InputArchive ia) throws IOException {
         // keep read operations out of synchronization block
         while (i > 0) {
             Long val = ia.readLong("long");
-            List<ACL> aclList = new ArrayList<ACL>();
+            List<ACL> aclList = new ArrayList<>();
             Index j = ia.startVector("acls");
             if (j == null) {
-                throw new RuntimeException("Incorrent format of InputArchive when deserialize DataTree - missing acls");
+                throw new RuntimeException("Incorrect format of InputArchive when deserialize DataTree - missing acls");
             }
             while (!j.done()) {
                 ACL acl = new ACL();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
index d0fb7da4d2e..8b61091719d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/Request.java
@@ -8,9 +8,9 @@
  * with the License.  You may obtain a copy of the License at
  *
  *     http://www.apache.org/licenses/LICENSE-2.0
- *uuuuu
+ *
  * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "/RequuuAS IS" BASIS,
+ * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
@@ -18,8 +18,11 @@
 
 package org.apache.zookeeper.server;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
+import java.io.IOException;
 import java.nio.ByteBuffer;
 import java.util.List;
+import java.util.function.Supplier;
 import org.apache.jute.Record;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZooDefs.OpCode;
@@ -27,10 +30,14 @@
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.metrics.Summary;
 import org.apache.zookeeper.metrics.SummarySet;
+import org.apache.zookeeper.server.persistence.Util;
+import org.apache.zookeeper.server.quorum.LearnerHandler;
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
 import org.apache.zookeeper.server.util.AuthUtil;
 import org.apache.zookeeper.txn.TxnDigest;
 import org.apache.zookeeper.txn.TxnHeader;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 /**
  * This is the structure that represents a request moving through a chain of
@@ -38,6 +45,7 @@
  * onto the request as it is processed.
  */
 public class Request {
+    private static final Logger LOG = LoggerFactory.getLogger(Request.class);
 
     public static final Request requestOfDeath = new Request(null, 0, 0, 0, null, null);
 
@@ -49,12 +57,12 @@ public class Request {
     // associated session timeout. Disabled by default.
     private static volatile boolean staleLatencyCheck = Boolean.parseBoolean(System.getProperty("zookeeper.request_stale_latency_check", "false"));
 
-    public Request(ServerCnxn cnxn, long sessionId, int xid, int type, ByteBuffer bb, List<Id> authInfo) {
+    public Request(ServerCnxn cnxn, long sessionId, int xid, int type, RequestRecord request, List<Id> authInfo) {
         this.cnxn = cnxn;
         this.sessionId = sessionId;
         this.cxid = xid;
         this.type = type;
-        this.request = bb;
+        this.request = request;
         this.authInfo = authInfo;
     }
 
@@ -70,13 +78,60 @@ public Request(long sessionId, int xid, int type, TxnHeader hdr, Record txn, lon
         this.authInfo = null;
     }
 
+    public Request(TxnHeader hdr, Record txn, TxnDigest digest) {
+        this.sessionId = hdr.getClientId();
+        this.cxid = hdr.getCxid();
+        this.type = hdr.getType();
+        this.hdr = hdr;
+        this.txn = txn;
+        this.zxid = hdr.getZxid();
+        this.request = null;
+        this.cnxn = null;
+        this.authInfo = null;
+        this.txnDigest = digest;
+    }
+
     public final long sessionId;
 
     public final int cxid;
 
     public final int type;
 
-    public final ByteBuffer request;
+    private final RequestRecord request;
+
+    public <T extends Record> T readRequestRecord(Supplier<T> constructor) throws IOException {
+        if (request != null) {
+            return request.readRecord(constructor);
+        }
+        throw new IOException(new NullPointerException("request"));
+    }
+
+    public <T extends Record> T readRequestRecordNoException(Supplier<T> constructor) {
+        try {
+            return readRequestRecord(constructor);
+        } catch (IOException e) {
+            return null;
+        }
+    }
+
+    public byte[] readRequestBytes() {
+        if (request != null) {
+            return request.readBytes();
+        }
+        return null;
+    }
+
+    public String requestDigest() {
+        if (request != null) {
+            final StringBuilder sb = new StringBuilder();
+            final byte[] payload = request.readBytes();
+            for (byte b : payload) {
+                sb.append(String.format("%02x", (0xff & b)));
+            }
+            return sb.toString();
+        }
+        return "request buffer is null";
+    }
 
     public final ServerCnxn cnxn;
 
@@ -100,6 +155,8 @@ public Request(long sessionId, int xid, int type, TxnHeader hdr, Record txn, lon
 
     public long syncQueueStartTime;
 
+    public long requestThrottleQueueTime;
+
     private Object owner;
 
     private KeeperException e;
@@ -108,6 +165,34 @@ public Request(long sessionId, int xid, int type, TxnHeader hdr, Record txn, lon
 
     private TxnDigest txnDigest;
 
+    private boolean isThrottledFlag = false;
+
+    public boolean isThrottled() {
+      return isThrottledFlag;
+    }
+
+    public void setIsThrottled(boolean val) {
+      isThrottledFlag = val;
+    }
+
+    public boolean isThrottlable() {
+        return this.type != OpCode.ping
+                && this.type != OpCode.closeSession
+                && this.type != OpCode.createSession;
+    }
+
+    public byte[] getSerializeData() {
+        if (this.hdr == null) {
+            return null;
+        }
+        try {
+            return Util.marshallTxnEntry(this.hdr, this.txn, this.txnDigest);
+        } catch (IOException e) {
+            LOG.error("This really should be impossible.", e);
+            return new byte[32];
+        }
+    }
+
     /**
      * If this is a create or close request for a local-only session.
      */
@@ -223,8 +308,8 @@ static boolean isValid(int type) {
         // make sure this is always synchronized with Zoodefs!!
         switch (type) {
         case OpCode.notification:
-            return false;
         case OpCode.check:
+            return false;
         case OpCode.closeSession:
         case OpCode.create:
         case OpCode.create2:
@@ -252,6 +337,7 @@ static boolean isValid(int type) {
         case OpCode.checkWatches:
         case OpCode.removeWatches:
         case OpCode.addWatch:
+        case OpCode.whoAmI:
             return true;
         default:
             return false;
@@ -268,6 +354,7 @@ public boolean isQuorum() {
         case OpCode.getData:
         case OpCode.getEphemerals:
         case OpCode.multiRead:
+        case OpCode.whoAmI:
             return false;
         case OpCode.create:
         case OpCode.create2:
@@ -333,7 +420,7 @@ public static String op2String(int op) {
             case OpCode.deleteContainer:
                 return "deleteContainer";
             case OpCode.createTTL:
-                return "createTtl";
+                return "createTTL";
             case OpCode.multiRead:
                 return "multiRead";
             case OpCode.auth:
@@ -342,6 +429,8 @@ public static String op2String(int op) {
                 return "setWatches";
             case OpCode.setWatches2:
                 return "setWatches2";
+            case OpCode.addWatch:
+                return "addWatch";
             case OpCode.sasl:
                 return "sasl";
             case OpCode.getEphemerals:
@@ -354,6 +443,8 @@ public static String op2String(int op) {
                 return "closeSession";
             case OpCode.error:
                 return "error";
+            case OpCode.whoAmI:
+                return "whoAmI";
             default:
                 return "unknown " + op;
         }
@@ -374,18 +465,19 @@ public String toString() {
             && type != OpCode.setWatches
             && type != OpCode.setWatches2
             && type != OpCode.closeSession
-            && request != null
-            && request.remaining() >= 4) {
+            && request != null) {
             try {
                 // make sure we don't mess with request itself
-                ByteBuffer rbuf = request.asReadOnlyBuffer();
-                rbuf.clear();
-                int pathLen = rbuf.getInt();
-                // sanity check
-                if (pathLen >= 0 && pathLen < 4096 && rbuf.remaining() >= pathLen) {
-                    byte[] b = new byte[pathLen];
-                    rbuf.get(b);
-                    path = new String(b);
+                byte[] bytes = request.readBytes();
+                if (bytes != null && bytes.length >= 4) {
+                    ByteBuffer buf = ByteBuffer.wrap(bytes);
+                    int pathLen = buf.getInt();
+                    // sanity check
+                    if (pathLen >= 0 && pathLen < 4096 && buf.remaining() >= pathLen) {
+                        byte[] b = new byte[pathLen];
+                        buf.get(b);
+                        path = new String(b, UTF_8);
+                    }
                 }
             } catch (Exception e) {
                 // ignore - can't find the path, will output "n/a" instead
@@ -439,30 +531,20 @@ public void logLatency(SummarySet metric, String key) {
     }
 
     /**
-     * Returns comma separated list of users authenticated in the current
-     * session
+     * Returns a formatted, comma-separated list of the user IDs
+     * associated with this {@code Request}, or {@code null} if no
+     * user IDs were found.
+     *
+     * The return value is used for audit logging.  While it may be
+     * easy on the eyes, it is underspecified: it does not mention the
+     * corresponding {@code scheme}, nor are its components escaped.
+     * This is not a security feature.
+     *
+     * @return a comma-separated list of user IDs, or {@code null} if
+     * no user IDs were found.
      */
-    public String getUsers() {
-        if (authInfo == null) {
-            return (String) null;
-        }
-        if (authInfo.size() == 1) {
-            return AuthUtil.getUser(authInfo.get(0));
-        }
-        StringBuilder users = new StringBuilder();
-        boolean first = true;
-        for (Id id : authInfo) {
-            String user = AuthUtil.getUser(id);
-            if (user != null) {
-                if (first) {
-                    first = false;
-                } else {
-                    users.append(",");
-                }
-                users.append(user);
-            }
-        }
-        return users.toString();
+    public String getUsersForAudit() {
+        return AuthUtil.getUsers(authInfo);
     }
 
     public TxnDigest getTxnDigest() {
@@ -472,4 +554,8 @@ public TxnDigest getTxnDigest() {
     public void setTxnDigest(TxnDigest txnDigest) {
         this.txnDigest = txnDigest;
     }
+
+    public boolean isFromLearner() {
+        return owner instanceof LearnerHandler;
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestRecord.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestRecord.java
new file mode 100644
index 00000000000..c18e4ce2a6b
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestRecord.java
@@ -0,0 +1,46 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server;
+
+import java.io.IOException;
+import java.nio.ByteBuffer;
+import java.util.function.Supplier;
+import org.apache.jute.Record;
+
+public interface RequestRecord {
+
+    static RequestRecord fromBytes(ByteBuffer buffer) {
+        return new ByteBufferRequestRecord(buffer);
+    }
+
+    static RequestRecord fromBytes(byte[] bytes) {
+        return fromBytes(ByteBuffer.wrap(bytes));
+    }
+
+    static RequestRecord fromRecord(Record record) {
+        return new SimpleRequestRecord(record);
+    }
+
+    <T extends Record> T readRecord(Supplier<T> clazz) throws IOException;
+
+    byte[] readBytes();
+
+    int limit();
+
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestThrottler.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestThrottler.java
index 16a1c6f1517..c76767bfd55 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestThrottler.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/RequestThrottler.java
@@ -20,6 +20,7 @@
 
 import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import java.util.concurrent.LinkedBlockingQueue;
+import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.util.ServiceUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -35,7 +36,7 @@
  * the connection layer always allows a connection to send at least one request
  * before disabling selection on that connection. Thus, in a scenario with 40000
  * client connections, the total number of requests inflight may be as high as
- * 40000 even if the <code>globalOustandingLimit</code> was set lower.
+ * 40000 even if the <code>globalOutstandingLimit</code> was set lower.
  *
  * The RequestThrottler addresses this issue by adding additional queueing. When
  * enabled, client connections no longer submit requests directly to the request
@@ -60,18 +61,18 @@ public class RequestThrottler extends ZooKeeperCriticalThread {
 
     private static final Logger LOG = LoggerFactory.getLogger(RequestThrottler.class);
 
-    private final LinkedBlockingQueue<Request> submittedRequests = new LinkedBlockingQueue<Request>();
+    private final LinkedBlockingQueue<Request> submittedRequests = new LinkedBlockingQueue<>();
 
     private final ZooKeeperServer zks;
     private volatile boolean stopping;
     private volatile boolean killed;
 
     private static final String SHUTDOWN_TIMEOUT = "zookeeper.request_throttler.shutdownTimeout";
-    private static int shutdownTimeout = 10000;
+    private static int shutdownTimeout;
 
     static {
         shutdownTimeout = Integer.getInteger(SHUTDOWN_TIMEOUT, 10000);
-        LOG.info("{} = {}", SHUTDOWN_TIMEOUT, shutdownTimeout);
+        LOG.info("{} = {} ms", SHUTDOWN_TIMEOUT, shutdownTimeout);
     }
 
     /**
@@ -97,6 +98,13 @@ public class RequestThrottler extends ZooKeeperCriticalThread {
      */
     private static volatile boolean dropStaleRequests = Boolean.parseBoolean(System.getProperty("zookeeper.request_throttle_drop_stale", "true"));
 
+    protected boolean shouldThrottleOp(Request request, long elapsedTime) {
+        return request.isThrottlable()
+                && ZooKeeperServer.getThrottledOpWaitTime() > 0
+                && elapsedTime > ZooKeeperServer.getThrottledOpWaitTime();
+    }
+
+
     public RequestThrottler(ZooKeeperServer zks) {
         super("RequestThrottler", zks.getZooKeeperServerListener());
         this.zks = zks;
@@ -171,6 +179,12 @@ public void run() {
                     if (request.isStale()) {
                         ServerMetrics.getMetrics().STALE_REQUESTS.add(1);
                     }
+                    final long elapsedTime = Time.currentElapsedTime() - request.requestThrottleQueueTime;
+                    ServerMetrics.getMetrics().REQUEST_THROTTLE_QUEUE_TIME.add(elapsedTime);
+                    if (shouldThrottleOp(request, elapsedTime)) {
+                      request.setIsThrottled(true);
+                      ServerMetrics.getMetrics().THROTTLED_OPS.add(1);
+                    }
                     zks.submitRequestNow(request);
                 }
             }
@@ -181,13 +195,11 @@ public void run() {
         LOG.info("RequestThrottler shutdown. Dropped {} requests", dropped);
     }
 
-    private synchronized void throttleSleep(int stallTime) {
-        try {
-            ServerMetrics.getMetrics().REQUEST_THROTTLE_WAIT_COUNT.add(1);
-            this.wait(stallTime);
-        } catch (InterruptedException ie) {
-            return;
-        }
+
+    // @VisibleForTesting
+    synchronized void throttleSleep(int stallTime) throws InterruptedException {
+        ServerMetrics.getMetrics().REQUEST_THROTTLE_WAIT_COUNT.add(1);
+        this.wait(stallTime);
     }
 
     @SuppressFBWarnings(value = "NN_NAKED_NOTIFY", justification = "state change is in ZooKeeperServer.decInProgress() ")
@@ -230,6 +242,7 @@ public void submitRequest(Request request) {
             LOG.debug("Shutdown in progress. Request cannot be processed");
             dropRequest(request);
         } else {
+            request.requestThrottleQueueTime = Time.currentElapsedTime();
             submittedRequests.add(request);
         }
     }
@@ -238,7 +251,6 @@ public int getInflight() {
         return submittedRequests.size();
     }
 
-    @SuppressFBWarnings("DM_EXIT")
     public void shutdown() {
         // Try to shutdown gracefully
         LOG.info("Shutting down");
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ResponseCache.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ResponseCache.java
index 4a76a0f89e4..4a1f87d4939 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ResponseCache.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ResponseCache.java
@@ -33,16 +33,21 @@ public class ResponseCache {
     public static final int DEFAULT_RESPONSE_CACHE_SIZE = 400;
     private final int cacheSize;
     private static class Entry {
-        public Stat stat;
-        public byte[] data;
+        public final Stat stat;
+        public final byte[] data;
+
+        Entry(Stat stat, byte[] data) {
+            this.stat = stat;
+            this.data = data;
+        }
     }
 
     private final Map<String, Entry> cache;
 
-    public ResponseCache(int cacheSize) {
+    public ResponseCache(int cacheSize, String requestType) {
         this.cacheSize = cacheSize;
         cache = Collections.synchronizedMap(new LRUCache<>(cacheSize));
-        LOG.info("Response cache size is initialized with value {}.", cacheSize);
+        LOG.info("{} response cache size is initialized with value {}.", requestType, cacheSize);
     }
 
     public int getCacheSize() {
@@ -50,10 +55,7 @@ public int getCacheSize() {
     }
 
     public void put(String path, byte[] data, Stat stat) {
-        Entry entry = new Entry();
-        entry.data = data;
-        entry.stat = stat;
-        cache.put(path, entry);
+        cache.put(path, new Entry(stat, data));
     }
 
     public byte[] get(String key, Stat stat) {
@@ -76,10 +78,10 @@ public boolean isEnabled() {
 
     private static class LRUCache<K, V> extends LinkedHashMap<K, V> {
 
-        private int cacheSize;
+        private final int cacheSize;
 
         LRUCache(int cacheSize) {
-            super(cacheSize / 4);
+            super(cacheSize / 4, 0.75f, true);
             this.cacheSize = cacheSize;
         }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java
index d70551ac009..eb31b5e9254 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxn.java
@@ -18,7 +18,6 @@
 
 package org.apache.zookeeper.server;
 
-import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.PrintWriter;
 import java.io.StringWriter;
@@ -35,12 +34,12 @@
 import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.atomic.AtomicLong;
-import org.apache.jute.BinaryOutputArchive;
 import org.apache.jute.Record;
 import org.apache.zookeeper.Quotas;
 import org.apache.zookeeper.WatchedEvent;
-import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.ZooDefs.OpCode;
+import org.apache.zookeeper.compat.ProtocolManager;
+import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.metrics.Counter;
@@ -53,25 +52,16 @@
  * Interface to a Server connection - represents a connection from a client
  * to the server.
  */
-public abstract class ServerCnxn implements Stats, Watcher {
+public abstract class ServerCnxn implements Stats, ServerWatcher {
 
     // This is just an arbitrary object to represent requests issued by
     // (aka owned by) this class
     public static final Object me = new Object();
     private static final Logger LOG = LoggerFactory.getLogger(ServerCnxn.class);
 
-    private Set<Id> authInfo = Collections.newSetFromMap(new ConcurrentHashMap<Id, Boolean>());
-
-    private static final byte[] fourBytes = new byte[4];
-
-    /**
-     * If the client is of old version, we don't send r-o mode info to it.
-     * The reason is that if we would, old C client doesn't read it, which
-     * results in TCP RST packet, i.e. "connection reset by peer".
-     */
-    boolean isOldClient = true;
-
-    AtomicLong outstandingCount = new AtomicLong();
+    public final ProtocolManager protocolManager = new ProtocolManager();
+    private final Set<Id> authInfo = Collections.newSetFromMap(new ConcurrentHashMap<>());
+    private final AtomicLong outstandingCount = new AtomicLong();
 
     /** The ZooKeeperServer for this connection. May be null if the server
      * is not currently serving requests (for example if the server is not
@@ -101,13 +91,15 @@ public enum DisconnectReason {
         CLOSE_CONNECTION_COMMAND("close_connection_command"),
         CLEAN_UP("clean_up"),
         CONNECTION_MODE_CHANGED("connection_mode_changed"),
+        RENEW_GLOBAL_SESSION_IN_RO_MODE("renew a global session in readonly mode"),
         // Below reasons are NettyServerCnxnFactory only
         CHANNEL_DISCONNECTED("channel disconnected"),
         CHANNEL_CLOSED_EXCEPTION("channel_closed_exception"),
         AUTH_PROVIDER_NOT_FOUND("auth provider not found"),
         FAILED_HANDSHAKE("Unsuccessful handshake"),
         CLIENT_RATE_LIMIT("Client hits rate limiting threshold"),
-        CLIENT_CNX_LIMIT("Client hits connection limiting threshold");
+        CLIENT_CNX_LIMIT("Client hits connection limiting threshold"),
+        SHED_CONNECTIONS_COMMAND("shed_connections_command");
 
         String disconnectReason;
 
@@ -180,29 +172,27 @@ public void decrOutstandingAndCheckThrottle(ReplyHeader h) {
      * @param r reply payload, can be null
      * @param tag Jute serialization tag, can be null
      * @param cacheKey Key for caching the serialized payload. A null value prevents caching.
-     * @param stat Stat information for the the reply payload, used for cache invalidation.
+     * @param stat Stat information for the reply payload, used for cache invalidation.
      *             A value of 0 prevents caching.
      * @param opCode The op code appertains to the corresponding request of the response,
      *               used to decide which cache (e.g. read response cache,
      *               list of children response cache, ...) object to look up to when applicable.
      */
-    public abstract void sendResponse(ReplyHeader h, Record r, String tag,
-                                      String cacheKey, Stat stat, int opCode) throws IOException;
+    public abstract int sendResponse(
+            ReplyHeader h,
+            Record r,
+            String tag,
+            String cacheKey,
+            Stat stat,
+            int opCode
+    ) throws IOException;
 
-    public void sendResponse(ReplyHeader h, Record r, String tag) throws IOException {
-        sendResponse(h, r, tag, null, null, -1);
+    public int sendResponse(ReplyHeader h, Record r, String tag) throws IOException {
+        return sendResponse(h, r, tag, null, null, -1);
     }
 
-    protected byte[] serializeRecord(Record record) throws IOException {
-        ByteArrayOutputStream baos = new ByteArrayOutputStream(ZooKeeperServer.intBufferStartingSizeBytes);
-        BinaryOutputArchive bos = BinaryOutputArchive.getArchive(baos);
-        bos.writeRecord(record, null);
-        return baos.toByteArray();
-    }
-
-    protected ByteBuffer[] serialize(ReplyHeader h, Record r, String tag,
-                                     String cacheKey, Stat stat, int opCode) throws IOException {
-        byte[] header = serializeRecord(h);
+    protected ByteBuffer[] serialize(ReplyHeader h, Record r, String cacheKey, Stat stat, int opCode) throws IOException {
+        byte[] header = RequestRecord.fromRecord(h).readBytes();
         byte[] data = null;
         if (r != null) {
             ResponseCache cache = null;
@@ -228,18 +218,18 @@ protected ByteBuffer[] serialize(ReplyHeader h, Record r, String tag,
                 // Use cache to get serialized data.
                 //
                 // NB: Tag is ignored both during cache lookup and serialization,
-                // since is is not used in read responses, which are being cached.
+                // since it is not used in read responses, which are being cached.
                 data = cache.get(cacheKey, stat);
                 if (data == null) {
                     // Cache miss, serialize the response and put it in cache.
-                    data = serializeRecord(r);
+                    data = RequestRecord.fromRecord(r).readBytes();
                     cache.put(cacheKey, data, stat);
                     cacheMiss.add(1);
                 } else {
                     cacheHit.add(1);
                 }
             } else {
-                data = serializeRecord(r);
+                data = RequestRecord.fromRecord(r).readBytes();
             }
         }
         int dataLength = data == null ? 0 : data.length;
@@ -265,7 +255,11 @@ protected ByteBuffer[] serialize(ReplyHeader h, Record r, String tag,
     /* notify the client the session is closing and close/cleanup socket */
     public abstract void sendCloseSession();
 
-    public abstract void process(WatchedEvent event);
+    public void process(WatchedEvent event) {
+        process(event, null);
+    }
+
+    public abstract void process(WatchedEvent event, List<ACL> znodeAcl);
 
     public abstract long getSessionId();
 
@@ -298,7 +292,7 @@ void disableRecv() {
 
     protected ZooKeeperSaslServer zooKeeperSaslServer = null;
 
-    protected static class CloseRequestException extends IOException {
+    public static class CloseRequestException extends IOException {
 
         private static final long serialVersionUID = -7854505709816442681L;
         private DisconnectReason reason;
@@ -387,7 +381,6 @@ protected void packetSent() {
 
     protected long count;
     protected long totalLatency;
-    protected long requestsProcessedCount;
     protected DisconnectReason disconnectReason = DisconnectReason.UNKNOWN;
 
     public synchronized void resetStats() {
@@ -555,7 +548,7 @@ public synchronized void dumpConnectionInfo(PrintWriter pwriter, boolean brief)
     }
 
     public synchronized Map<String, Object> getConnectionInfo(boolean brief) {
-        Map<String, Object> info = new LinkedHashMap<String, Object>();
+        Map<String, Object> info = new LinkedHashMap<>();
         info.put("remote_socket_address", getRemoteSocketAddress());
         info.put("interest_ops", getInterestOps());
         info.put("outstanding_requests", getOutstandingRequests());
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxnFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxnFactory.java
index 3db1ca12ddb..f63c1eec4ba 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxnFactory.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerCnxnFactory.java
@@ -22,10 +22,14 @@
 import java.net.InetSocketAddress;
 import java.nio.ByteBuffer;
 import java.util.Collections;
+import java.util.HashMap;
 import java.util.Map;
 import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.ThreadLocalRandom;
+import java.util.function.Supplier;
 import javax.management.JMException;
+import javax.security.auth.callback.CallbackHandler;
 import javax.security.auth.login.AppConfigurationEntry;
 import javax.security.auth.login.Configuration;
 import javax.security.auth.login.LoginException;
@@ -41,6 +45,7 @@ public abstract class ServerCnxnFactory {
 
     public static final String ZOOKEEPER_SERVER_CNXN_FACTORY = "zookeeper.serverCnxnFactory";
     private static final String ZOOKEEPER_MAX_CONNECTION = "zookeeper.maxCnxns";
+    private static final String DIGEST_MD5_USER_PREFIX = "user_";
     public static final int ZOOKEEPER_MAX_CONNECTION_DEFAULT = 0;
 
     private static final Logger LOG = LoggerFactory.getLogger(ServerCnxnFactory.class);
@@ -57,7 +62,7 @@ public abstract class ServerCnxnFactory {
     protected int maxCnxns;
 
     // sessionMap is used by closeSession()
-    final ConcurrentHashMap<Long, ServerCnxn> sessionMap = new ConcurrentHashMap<Long, ServerCnxn>();
+    final ConcurrentHashMap<Long, ServerCnxn> sessionMap = new ConcurrentHashMap<>();
 
     private static String loginUser = Login.SYSTEM_USER;
 
@@ -113,7 +118,6 @@ public void configure(InetSocketAddress addr, int maxcc, int backlog) throws IOE
 
     public abstract void reconfigure(InetSocketAddress addr);
 
-    protected SaslServerCallbackHandler saslServerCallbackHandler;
     public Login login;
 
     /** Maximum number of connections allowed from particular host (ip) */
@@ -130,7 +134,7 @@ public void startup(ZooKeeperServer zkServer) throws IOException, InterruptedExc
         startup(zkServer, true);
     }
 
-    // This method is to maintain compatiblity of startup(zks) and enable sharing of zks
+    // This method is to maintain compatibility of startup(zks) and enable sharing of zks
     // when we add secureCnxnFactory.
     public abstract void startup(ZooKeeperServer zkServer, boolean startServer) throws IOException, InterruptedException;
 
@@ -157,6 +161,56 @@ public final void setZooKeeperServer(ZooKeeperServer zks) {
 
     public abstract void closeAll(ServerCnxn.DisconnectReason reason);
 
+    /**
+     * Attempts to shed approximately the specified percentage of connections.
+     *
+     * @param percentage [0-100] percentage of connections to shed
+     * @return actual number of connections successfully closed (may vary due to randomness)
+     * @throws IllegalArgumentException if percentage not in [0, 100]
+     */
+    public int shedConnections(final int percentage) {
+        if (percentage < 0 || percentage > 100) {
+            throw new IllegalArgumentException("percentage must be between 0 and 100, got: " + percentage);
+        }
+
+        final int totalConnections = cnxns.size();
+        if (percentage == 0 || totalConnections == 0) {
+            return 0;
+        }
+
+        int actualShedCount = 0;
+        // For 100%, close all connections deterministically
+        if (percentage == 100) {
+            for (final ServerCnxn cnxn : cnxns) {
+                try {
+                    cnxn.close(ServerCnxn.DisconnectReason.SHED_CONNECTIONS_COMMAND);
+                    actualShedCount++;
+                } catch (final Exception e) {
+                    LOG.warn("Failed to close connection for session 0x{}: {}",
+                            Long.toHexString(cnxn.getSessionId()), e.getMessage());
+                }
+            }
+        } else {
+            // For other percentages, use probabilistic approach
+            final ThreadLocalRandom random = ThreadLocalRandom.current();
+            final double probability = percentage / 100.0;
+
+            for (final ServerCnxn cnxn : cnxns) {
+                if (random.nextDouble() < probability) {
+                    try {
+                        cnxn.close(ServerCnxn.DisconnectReason.SHED_CONNECTIONS_COMMAND);
+                        actualShedCount++;
+                    } catch (final Exception e) {
+                        LOG.warn("Failed to close connection for session 0x{}: {}",
+                                Long.toHexString(cnxn.getSessionId()), e.getMessage());
+                    }
+                }
+            }
+        }
+        LOG.info("Shed {} out of {} connections ({}%)", actualShedCount, totalConnections, percentage);
+        return actualShedCount;
+    }
+
     public static ServerCnxnFactory createFactory() throws IOException {
         String serverCnxnFactoryName = System.getProperty(ZOOKEEPER_SERVER_CNXN_FACTORY);
         if (serverCnxnFactoryName == null) {
@@ -198,11 +252,11 @@ public static ServerCnxnFactory createFactory(InetSocketAddress addr, int maxCli
 
     public abstract Iterable<Map<String, Object>> getAllConnectionInfo(boolean brief);
 
-    private final ConcurrentHashMap<ServerCnxn, ConnectionBean> connectionBeans = new ConcurrentHashMap<ServerCnxn, ConnectionBean>();
+    private final ConcurrentHashMap<ServerCnxn, ConnectionBean> connectionBeans = new ConcurrentHashMap<>();
 
     // Connection set is relied on heavily by four letter commands
     // Construct a ConcurrentHashSet using a ConcurrentHashMap
-    protected final Set<ServerCnxn> cnxns = Collections.newSetFromMap(new ConcurrentHashMap<ServerCnxn, Boolean>());
+    protected final Set<ServerCnxn> cnxns = Collections.newSetFromMap(new ConcurrentHashMap<>());
     public void unregisterConnection(ServerCnxn serverCnxn) {
         ConnectionBean jmxConnectionBean = connectionBeans.remove(serverCnxn);
         if (jmxConnectionBean != null) {
@@ -261,7 +315,7 @@ protected void configureSaslLogin() throws IOException {
                 if (loginContextName != null) {
                     errorMessage += " But " + ZooKeeperSaslServer.LOGIN_CONTEXT_NAME_KEY + " was set.";
                 }
-                LOG.error(errorMessage);
+                LOG.error(errorMessage, securityException);
                 throw new IOException(errorMessage);
             }
             return;
@@ -269,8 +323,11 @@ protected void configureSaslLogin() throws IOException {
 
         // jaas.conf entry available
         try {
-            saslServerCallbackHandler = new SaslServerCallbackHandler(Configuration.getConfiguration());
-            login = new Login(serverSection, saslServerCallbackHandler, new ZKConfig());
+            Map<String, String> credentials = getDigestMd5Credentials(entries);
+            Supplier<CallbackHandler> callbackHandlerSupplier = () -> {
+                return new SaslServerCallbackHandler(credentials);
+            };
+            login = new Login(serverSection, callbackHandlerSupplier, new ZKConfig());
             setLoginUser(login.getUserName());
             login.startThreadIfNeeded();
         } catch (LoginException e) {
@@ -280,6 +337,28 @@ protected void configureSaslLogin() throws IOException {
         }
     }
 
+    /**
+     * make server credentials map from configuration's server section.
+     * @param appConfigurationEntries AppConfigurationEntry List
+     * @return Server credentials map
+     */
+    private static Map<String, String> getDigestMd5Credentials(final  AppConfigurationEntry[] appConfigurationEntries) {
+        Map<String, String> credentials = new HashMap<>();
+        for (AppConfigurationEntry entry : appConfigurationEntries) {
+            Map<String, ?> options = entry.getOptions();
+            // Populate DIGEST-MD5 user -> password map with JAAS configuration entries from the "Server" section.
+            // Usernames are distinguished from other options by prefixing the username with a "user_" prefix.
+            for (Map.Entry<String, ?> pair : options.entrySet()) {
+                String key = pair.getKey();
+                if (key.startsWith(DIGEST_MD5_USER_PREFIX)) {
+                    String userName = key.substring(DIGEST_MD5_USER_PREFIX.length());
+                    credentials.put(userName, (String) pair.getValue());
+                }
+            }
+        }
+        return credentials;
+    }
+
     private static void setLoginUser(String name) {
         //Created this method to avoid ST_WRITE_TO_STATIC_FROM_INSTANCE_METHOD find bug issue
         loginUser = name;
@@ -303,7 +382,7 @@ protected void initMaxCnxns() {
         maxCnxns = Integer.getInteger(ZOOKEEPER_MAX_CONNECTION, ZOOKEEPER_MAX_CONNECTION_DEFAULT);
         if (maxCnxns < 0) {
             maxCnxns = ZOOKEEPER_MAX_CONNECTION_DEFAULT;
-            LOG.warn("maxCnxns should be greater than or equal to 0, using default vlaue {}.",
+            LOG.warn("maxCnxns should be greater than or equal to 0, using default value {}.",
                     ZOOKEEPER_MAX_CONNECTION_DEFAULT);
         } else if (maxCnxns == ZOOKEEPER_MAX_CONNECTION_DEFAULT) {
             LOG.warn("maxCnxns is not configured, using default value {}.",
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerConfig.java
index 9da0e53a4b6..91cfe7c97e1 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerConfig.java
@@ -23,9 +23,9 @@
 import java.util.Arrays;
 import java.util.Properties;
 import org.apache.yetus.audience.InterfaceAudience;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.metrics.impl.DefaultMetricsProvider;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
 
 /**
  * Server configuration storage.
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
index cbdb2347d6f..dab8446472e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerMetrics.java
@@ -19,6 +19,7 @@
 package org.apache.zookeeper.server;
 
 import org.apache.zookeeper.metrics.Counter;
+import org.apache.zookeeper.metrics.CounterSet;
 import org.apache.zookeeper.metrics.MetricsContext;
 import org.apache.zookeeper.metrics.MetricsContext.DetailLevel;
 import org.apache.zookeeper.metrics.MetricsProvider;
@@ -26,6 +27,7 @@
 import org.apache.zookeeper.metrics.SummarySet;
 import org.apache.zookeeper.metrics.impl.DefaultMetricsProvider;
 import org.apache.zookeeper.metrics.impl.NullMetricsProvider;
+import org.apache.zookeeper.server.util.QuotaMetricsUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -70,11 +72,17 @@ private ServerMetrics(MetricsProvider metricsProvider) {
         FSYNC_TIME = metricsContext.getSummary("fsynctime", DetailLevel.BASIC);
 
         SNAPSHOT_TIME = metricsContext.getSummary("snapshottime", DetailLevel.BASIC);
+        SNAPSHOT_ERROR_COUNT = metricsContext.getCounter("snapshot_error_count");
+        SNAPSHOT_RATE_LIMITED_COUNT = metricsContext.getCounter("snapshot_rate_limited_count");
+        RESTORE_TIME = metricsContext.getSummary("restore_time", DetailLevel.BASIC);
+        RESTORE_ERROR_COUNT = metricsContext.getCounter("restore_error_count");
+        RESTORE_RATE_LIMITED_COUNT = metricsContext.getCounter("restore_rate_limited_count");
         DB_INIT_TIME = metricsContext.getSummary("dbinittime", DetailLevel.BASIC);
         READ_LATENCY = metricsContext.getSummary("readlatency", DetailLevel.ADVANCED);
         UPDATE_LATENCY = metricsContext.getSummary("updatelatency", DetailLevel.ADVANCED);
         PROPAGATION_LATENCY = metricsContext.getSummary("propagation_latency", DetailLevel.ADVANCED);
         FOLLOWER_SYNC_TIME = metricsContext.getSummary("follower_sync_time", DetailLevel.BASIC);
+        OBSERVER_SYNC_TIME = metricsContext.getSummary("observer_sync_time", DetailLevel.BASIC);
         ELECTION_TIME = metricsContext.getSummary("election_time", DetailLevel.BASIC);
         LOOKING_COUNT = metricsContext.getCounter("looking_count");
         DIFF_COUNT = metricsContext.getCounter("diff_count");
@@ -84,6 +92,9 @@ private ServerMetrics(MetricsProvider metricsProvider) {
         CONNECTION_TOKEN_DEFICIT = metricsContext.getSummary("connection_token_deficit", DetailLevel.BASIC);
         CONNECTION_REJECTED = metricsContext.getCounter("connection_rejected");
 
+        INFLIGHT_SNAP_COUNT = metricsContext.getSummary("inflight_snap_count", DetailLevel.BASIC);
+        INFLIGHT_DIFF_COUNT = metricsContext.getSummary("inflight_diff_count", DetailLevel.BASIC);
+
         WRITE_PER_NAMESPACE = metricsContext.getSummarySet("write_per_namespace", DetailLevel.BASIC);
         READ_PER_NAMESPACE = metricsContext.getSummarySet("read_per_namespace", DetailLevel.BASIC);
 
@@ -120,6 +131,7 @@ private ServerMetrics(MetricsProvider metricsProvider) {
         OUTSTANDING_CHANGES_QUEUED = metricsContext.getCounter("outstanding_changes_queued");
         OUTSTANDING_CHANGES_REMOVED = metricsContext.getCounter("outstanding_changes_removed");
         PREP_PROCESS_TIME = metricsContext.getSummary("prep_process_time", DetailLevel.BASIC);
+        PROPOSAL_PROCESS_TIME = metricsContext.getSummary("proposal_process_time", DetailLevel.BASIC);
         CLOSE_SESSION_PREP_TIME = metricsContext.getSummary("close_session_prep_time", DetailLevel.ADVANCED);
 
         REVALIDATE_COUNT = metricsContext.getCounter("revalidate_count");
@@ -130,6 +142,9 @@ private ServerMetrics(MetricsProvider metricsProvider) {
         SESSIONLESS_CONNECTIONS_EXPIRED = metricsContext.getCounter("sessionless_connections_expired");
         STALE_SESSIONS_EXPIRED = metricsContext.getCounter("stale_sessions_expired");
 
+        UNAVAILABLE_TIME = metricsContext.getSummary("unavailable_time", DetailLevel.BASIC);
+        LEADER_UNAVAILABLE_TIME = metricsContext.getSummary("leader_unavailable_time", DetailLevel.BASIC);
+
         /*
          * Number of requests that are in the session queue.
          */
@@ -154,6 +169,8 @@ private ServerMetrics(MetricsProvider metricsProvider) {
         READS_ISSUED_IN_COMMIT_PROC = metricsContext.getSummary("read_commit_proc_issued", DetailLevel.BASIC);
         WRITES_ISSUED_IN_COMMIT_PROC = metricsContext.getSummary("write_commit_proc_issued", DetailLevel.BASIC);
 
+        THROTTLED_OPS = metricsContext.getCounter("throttled_ops");
+
         /**
          * Time spent by a read request in the commit processor.
          */
@@ -223,15 +240,64 @@ private ServerMetrics(MetricsProvider metricsProvider) {
         STALE_REQUESTS = metricsContext.getCounter("stale_requests");
         STALE_REQUESTS_DROPPED = metricsContext.getCounter("stale_requests_dropped");
         STALE_REPLIES = metricsContext.getCounter("stale_replies");
+        REQUEST_THROTTLE_QUEUE_TIME = metricsContext.getSummary("request_throttle_queue_time_ms", DetailLevel.ADVANCED);
         REQUEST_THROTTLE_WAIT_COUNT = metricsContext.getCounter("request_throttle_wait_count");
         LARGE_REQUESTS_REJECTED = metricsContext.getCounter("large_requests_rejected");
 
         NETTY_QUEUED_BUFFER = metricsContext.getSummary("netty_queued_buffer_capacity", DetailLevel.BASIC);
 
         DIGEST_MISMATCHES_COUNT = metricsContext.getCounter("digest_mismatches_count");
+
+        LEARNER_REQUEST_PROCESSOR_QUEUE_SIZE = metricsContext.getSummary("learner_request_processor_queue_size", DetailLevel.BASIC);
+
+        UNSUCCESSFUL_HANDSHAKE = metricsContext.getCounter("unsuccessful_handshake");
+        INSECURE_ADMIN = metricsContext.getCounter("insecure_admin_count");
         TLS_HANDSHAKE_EXCEEDED = metricsContext.getCounter("tls_handshake_exceeded");
 
         CNXN_CLOSED_WITHOUT_ZK_SERVER_RUNNING = metricsContext.getCounter("cnxn_closed_without_zk_server_running");
+
+        SKIP_LEARNER_REQUEST_TO_NEXT_PROCESSOR_COUNT = metricsContext.getCounter("skip_learner_request_to_next_processor_count");
+
+        SOCKET_CLOSING_TIME = metricsContext.getSummary("socket_closing_time", DetailLevel.BASIC);
+
+        REQUESTS_NOT_FORWARDED_TO_COMMIT_PROCESSOR = metricsContext.getCounter(
+                "requests_not_forwarded_to_commit_processor");
+
+        RESPONSE_BYTES = metricsContext.getCounter("response_bytes");
+        WATCH_BYTES = metricsContext.getCounter("watch_bytes");
+
+        JVM_PAUSE_TIME = metricsContext.getSummary("jvm_pause_time_ms", DetailLevel.ADVANCED);
+
+        QUOTA_EXCEEDED_ERROR_PER_NAMESPACE = metricsContext.getCounterSet(QuotaMetricsUtils.QUOTA_EXCEEDED_ERROR_PER_NAMESPACE);
+
+        TTL_NODE_DELETED_COUNT = metricsContext.getCounter("ttl_node_deleted_count");
+        TTL_NODE_CREATED_COUNT = metricsContext.getCounter("ttl_node_created_count");
+
+        // Operation count metrics
+        OP_COUNT_TOTAL = metricsContext.getCounter("op_count_total");
+        OP_COUNT_ADD_WATCH = metricsContext.getCounter("op_count_add_watch");
+        OP_COUNT_CHECK = metricsContext.getCounter("op_count_check");
+        OP_COUNT_CHECK_WATCHES = metricsContext.getCounter("op_count_check_watches");
+        OP_COUNT_CLOSE_SESSION = metricsContext.getCounter("op_count_close_session");
+        OP_COUNT_CREATE = metricsContext.getCounter("op_count_create");
+        OP_COUNT_CREATE_SESSION = metricsContext.getCounter("op_count_create_session");
+        OP_COUNT_DELETE = metricsContext.getCounter("op_count_delete");
+        OP_COUNT_EXISTS = metricsContext.getCounter("op_count_exists");
+        OP_COUNT_GET_ACL = metricsContext.getCounter("op_count_get_acl");
+        OP_COUNT_GET_ALL_CHILDREN_NUMBER = metricsContext.getCounter("op_count_get_all_children_number");
+        OP_COUNT_GET_CHILDREN = metricsContext.getCounter("op_count_get_children");
+        OP_COUNT_GET_DATA = metricsContext.getCounter("op_count_get_data");
+        OP_COUNT_GET_EPHEMERALS = metricsContext.getCounter("op_count_get_ephemerals");
+        OP_COUNT_MULTI = metricsContext.getCounter("op_count_multi");
+        OP_COUNT_MULTI_READ = metricsContext.getCounter("op_count_multi_read");
+        OP_COUNT_PING = metricsContext.getCounter("op_count_ping");
+        OP_COUNT_RECONFIG = metricsContext.getCounter("op_count_reconfig");
+        OP_COUNT_REMOVE_WATCHES = metricsContext.getCounter("op_count_remove_watches");
+        OP_COUNT_SET_ACL = metricsContext.getCounter("op_count_set_acl");
+        OP_COUNT_SET_DATA = metricsContext.getCounter("op_count_set_data");
+        OP_COUNT_SET_WATCHES = metricsContext.getCounter("op_count_set_watches");
+        OP_COUNT_SYNC = metricsContext.getCounter("op_count_sync");
+        OP_COUNT_WHO_AM_I = metricsContext.getCounter("op_count_who_am_i");
     }
 
     /**
@@ -244,6 +310,31 @@ private ServerMetrics(MetricsProvider metricsProvider) {
      */
     public final Summary SNAPSHOT_TIME;
 
+    /**
+     * Snapshot error count
+     */
+    public final Counter SNAPSHOT_ERROR_COUNT;
+
+    /**
+     * Snapshot rate limited count
+     */
+    public final Counter SNAPSHOT_RATE_LIMITED_COUNT;
+
+    /**
+     * Restore time
+     */
+    public final Summary RESTORE_TIME;
+
+    /**
+     * Restore error count
+     */
+    public final Counter RESTORE_ERROR_COUNT;
+
+    /**
+     * Restore rate limited count
+     */
+    public final Counter RESTORE_RATE_LIMITED_COUNT;
+
     /**
      * Db init time (snapshot loading + txnlog replay)
      */
@@ -269,6 +360,7 @@ private ServerMetrics(MetricsProvider metricsProvider) {
     public final Summary PROPAGATION_LATENCY;
 
     public final Summary FOLLOWER_SYNC_TIME;
+    public final Summary OBSERVER_SYNC_TIME;
 
     public final Summary ELECTION_TIME;
 
@@ -286,10 +378,16 @@ private ServerMetrics(MetricsProvider metricsProvider) {
     public final Counter SESSIONLESS_CONNECTIONS_EXPIRED;
     public final Counter STALE_SESSIONS_EXPIRED;
 
+    public final Summary UNAVAILABLE_TIME;
+    public final Summary LEADER_UNAVAILABLE_TIME;
+
     // Connection throttling related
     public final Summary CONNECTION_TOKEN_DEFICIT;
     public final Counter CONNECTION_REJECTED;
 
+    public final Summary INFLIGHT_SNAP_COUNT;
+    public final Summary INFLIGHT_DIFF_COUNT;
+
     public final Counter UNRECOVERABLE_ERROR_COUNT;
     public final SummarySet WRITE_PER_NAMESPACE;
     public final SummarySet READ_PER_NAMESPACE;
@@ -301,6 +399,7 @@ private ServerMetrics(MetricsProvider metricsProvider) {
     public final Counter OUTSTANDING_CHANGES_QUEUED;
     public final Counter OUTSTANDING_CHANGES_REMOVED;
     public final Summary PREP_PROCESS_TIME;
+    public final Summary PROPOSAL_PROCESS_TIME;
     public final Summary CLOSE_SESSION_PREP_TIME;
 
     public final Summary PROPOSAL_LATENCY;
@@ -381,6 +480,9 @@ private ServerMetrics(MetricsProvider metricsProvider) {
     public final Summary READS_ISSUED_IN_COMMIT_PROC;
     public final Summary WRITES_ISSUED_IN_COMMIT_PROC;
 
+    // Request op throttling related
+    public final Counter THROTTLED_OPS;
+
     /**
      * Time spent by a read request in the commit processor.
      */
@@ -435,6 +537,7 @@ private ServerMetrics(MetricsProvider metricsProvider) {
     public final Counter STALE_REQUESTS;
     public final Counter STALE_REQUESTS_DROPPED;
     public final Counter STALE_REPLIES;
+    public final Summary REQUEST_THROTTLE_QUEUE_TIME;
     public final Counter REQUEST_THROTTLE_WAIT_COUNT;
     public final Counter LARGE_REQUESTS_REJECTED;
 
@@ -444,10 +547,68 @@ private ServerMetrics(MetricsProvider metricsProvider) {
     // txns to data tree.
     public final Counter DIGEST_MISMATCHES_COUNT;
 
+    public final Summary LEARNER_REQUEST_PROCESSOR_QUEUE_SIZE;
+
+    public final Counter UNSUCCESSFUL_HANDSHAKE;
+
+    /*
+     * Number of insecure connections to admin port
+     */
+    public final Counter INSECURE_ADMIN;
+
     public final Counter TLS_HANDSHAKE_EXCEEDED;
 
     public final Counter CNXN_CLOSED_WITHOUT_ZK_SERVER_RUNNING;
 
+    public final Counter SKIP_LEARNER_REQUEST_TO_NEXT_PROCESSOR_COUNT;
+
+    public final Summary SOCKET_CLOSING_TIME;
+
+    public final Counter REQUESTS_NOT_FORWARDED_TO_COMMIT_PROCESSOR;
+
+    /**
+     *  Number of response/watch bytes written to clients.
+     */
+    public final Counter RESPONSE_BYTES;
+    public final Counter WATCH_BYTES;
+
+    public final Summary JVM_PAUSE_TIME;
+
+    public final CounterSet QUOTA_EXCEEDED_ERROR_PER_NAMESPACE;
+
+    /**
+     * Count of created and deleted TTL nodes
+     */
+    public final Counter TTL_NODE_DELETED_COUNT;
+    public final Counter TTL_NODE_CREATED_COUNT;
+
+    // Operation count metrics
+    public final Counter OP_COUNT_TOTAL;
+    public final Counter OP_COUNT_ADD_WATCH;
+    public final Counter OP_COUNT_CHECK;
+    public final Counter OP_COUNT_CHECK_WATCHES;
+    public final Counter OP_COUNT_CLOSE_SESSION;
+    public final Counter OP_COUNT_CREATE;
+    public final Counter OP_COUNT_CREATE_SESSION;
+    public final Counter OP_COUNT_DELETE;
+    public final Counter OP_COUNT_EXISTS;
+    public final Counter OP_COUNT_GET_ACL;
+    public final Counter OP_COUNT_GET_ALL_CHILDREN_NUMBER;
+    public final Counter OP_COUNT_GET_CHILDREN;
+    public final Counter OP_COUNT_GET_DATA;
+    public final Counter OP_COUNT_GET_EPHEMERALS;
+    public final Counter OP_COUNT_MULTI;
+    public final Counter OP_COUNT_MULTI_READ;
+    public final Counter OP_COUNT_PING;
+    public final Counter OP_COUNT_RECONFIG;
+    public final Counter OP_COUNT_REMOVE_WATCHES;
+    public final Counter OP_COUNT_SET_ACL;
+    public final Counter OP_COUNT_SET_DATA;
+    public final Counter OP_COUNT_SET_WATCHES;
+    public final Counter OP_COUNT_SYNC;
+    public final Counter OP_COUNT_WHO_AM_I;
+
+
     private final MetricsProvider metricsProvider;
 
     public void resetAll() {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerStats.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerStats.java
index 327c5c29720..5c1a4e7f664 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerStats.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerStats.java
@@ -41,6 +41,12 @@ public class ServerStats {
 
     private final BufferStats clientResponseStats = new BufferStats();
 
+    private AtomicLong nonMTLSRemoteConnCntr = new AtomicLong(0);
+
+    private AtomicLong nonMTLSLocalConnCntr = new AtomicLong(0);
+
+    private AtomicLong authFailedCntr = new AtomicLong(0);
+
     private final Provider provider;
     private final long startTime = Time.currentElapsedTime();
 
@@ -181,6 +187,42 @@ public void resetFsyncThresholdExceedCount() {
         fsyncThresholdExceedCount.set(0);
     }
 
+    public long getNonMTLSLocalConnCount() {
+        return nonMTLSLocalConnCntr.get();
+    }
+
+    public void incrementNonMTLSLocalConnCount() {
+        nonMTLSLocalConnCntr.incrementAndGet();
+    }
+
+    public void resetNonMTLSLocalConnCount() {
+        nonMTLSLocalConnCntr.set(0);
+    }
+
+    public long getNonMTLSRemoteConnCount() {
+        return nonMTLSRemoteConnCntr.get();
+    }
+
+    public void incrementNonMTLSRemoteConnCount() {
+        nonMTLSRemoteConnCntr.incrementAndGet();
+    }
+
+    public void resetNonMTLSRemoteConnCount() {
+        nonMTLSRemoteConnCntr.set(0);
+    }
+
+    public long getAuthFailedCount() {
+        return authFailedCntr.get();
+    }
+
+    public void incrementAuthFailedCount() {
+        authFailedCntr.incrementAndGet();
+    }
+
+    public void resetAuthFailedCount() {
+        authFailedCntr.set(0);
+    }
+
     public void reset() {
         resetLatency();
         resetRequestCounters();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerWatcher.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerWatcher.java
new file mode 100644
index 00000000000..bfd4b2501dc
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ServerWatcher.java
@@ -0,0 +1,29 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.server;
+
+import java.util.List;
+import org.apache.zookeeper.WatchedEvent;
+import org.apache.zookeeper.Watcher;
+import org.apache.zookeeper.data.ACL;
+
+public interface ServerWatcher extends Watcher {
+
+  void process(WatchedEvent event, List<ACL> znodeAcl);
+
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SessionTracker.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SessionTracker.java
index 9cf4774c11d..0d7ce810217 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SessionTracker.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SessionTracker.java
@@ -138,4 +138,14 @@ interface SessionExpirer {
     long getLocalSessionCount();
 
     boolean isLocalSessionsEnabled();
+
+    /**
+     * Get a set of global session IDs
+     */
+    Set<Long> globalSessions();
+
+    /**
+     * Get a set of local session IDs
+     */
+    Set<Long> localSessions();
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SessionTrackerImpl.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SessionTrackerImpl.java
index 488fb662339..7066a6dbeae 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SessionTrackerImpl.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SessionTrackerImpl.java
@@ -21,6 +21,7 @@
 import java.io.PrintWriter;
 import java.io.StringWriter;
 import java.text.MessageFormat;
+import java.util.Collections;
 import java.util.HashSet;
 import java.util.Map;
 import java.util.Map.Entry;
@@ -45,11 +46,11 @@ public class SessionTrackerImpl extends ZooKeeperCriticalThread implements Sessi
 
     private static final Logger LOG = LoggerFactory.getLogger(SessionTrackerImpl.class);
 
-    protected final ConcurrentHashMap<Long, SessionImpl> sessionsById = new ConcurrentHashMap<Long, SessionImpl>();
+    protected final ConcurrentHashMap<Long, SessionImpl> sessionsById = new ConcurrentHashMap<>();
 
     private final ExpiryQueue<SessionImpl> sessionExpiryQueue;
 
-    private final ConcurrentMap<Long, Integer> sessionsWithTimeout;
+    protected final ConcurrentMap<Long, Integer> sessionsWithTimeout;
     private final AtomicLong nextSessionId = new AtomicLong();
 
     public static class SessionImpl implements Session {
@@ -83,11 +84,16 @@ public String toString() {
     }
 
     /**
-     * Generates an initial sessionId. High order 1 byte is serverId, next
-     * 5 bytes are from timestamp, and low order 2 bytes are 0s.
-     * Use ">>> 8", not ">> 8" to make sure that the high order 1 byte is entirely up to the server Id(@see ZOOKEEPER-1622).
+     * Generates an initial sessionId.
+     *
+     * <p>High order 1 byte is serverId, next 5 bytes are from timestamp, and low order 2 bytes are 0s.
+     * Use {@literal ">>> 8"}, not {@literal ">> 8"} to make sure that the high order 1 byte is entirely
+     * up to the server Id.
+     *
+     * <p>See also http://jira.apache.org/jira/browse/ZOOKEEPER-1622
+     *
      * @param id server Id
-     * @return the Session Id
+     * @return the session Id
      */
     public static long initializeNextSessionId(long id) {
         long nextSid;
@@ -104,7 +110,7 @@ public static long initializeNextSessionId(long id) {
     public SessionTrackerImpl(SessionExpirer expirer, ConcurrentMap<Long, Integer> sessionsWithTimeout, int tickTime, long serverId, ZooKeeperServerListener listener) {
         super("SessionTracker", listener);
         this.expirer = expirer;
-        this.sessionExpiryQueue = new ExpiryQueue<SessionImpl>(tickTime);
+        this.sessionExpiryQueue = new ExpiryQueue<>(tickTime);
         this.sessionsWithTimeout = sessionsWithTimeout;
         this.nextSessionId.set(initializeNextSessionId(serverId));
         for (Entry<Long, Integer> e : sessionsWithTimeout.entrySet()) {
@@ -127,9 +133,9 @@ public void dumpSessions(PrintWriter pwriter) {
     public synchronized Map<Long, Set<Long>> getSessionExpiryMap() {
         // Convert time -> sessions map to time -> session IDs map
         Map<Long, Set<SessionImpl>> expiryMap = sessionExpiryQueue.getExpiryMap();
-        Map<Long, Set<Long>> sessionExpiryMap = new TreeMap<Long, Set<Long>>();
+        Map<Long, Set<Long>> sessionExpiryMap = new TreeMap<>();
         for (Entry<Long, Set<SessionImpl>> e : expiryMap.entrySet()) {
-            Set<Long> ids = new HashSet<Long>();
+            Set<Long> ids = new HashSet<>();
             sessionExpiryMap.put(e.getKey(), ids);
             for (SessionImpl s : e.getValue()) {
                 ids.add(s.sessionId);
@@ -342,4 +348,12 @@ public long getLocalSessionCount() {
     public boolean isLocalSessionsEnabled() {
         return false;
     }
+
+    public Set<Long> globalSessions() {
+        return sessionsById.keySet();
+    }
+
+    public Set<Long> localSessions() {
+        return Collections.emptySet();
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SimpleRequestRecord.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SimpleRequestRecord.java
new file mode 100644
index 00000000000..9a49fad8470
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SimpleRequestRecord.java
@@ -0,0 +1,69 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server;
+
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import java.nio.ByteBuffer;
+import java.util.function.Supplier;
+import org.apache.jute.BinaryOutputArchive;
+import org.apache.jute.Record;
+
+public class SimpleRequestRecord implements RequestRecord {
+
+    private final Record record;
+
+    private volatile byte[] bytes;
+
+    public SimpleRequestRecord(Record record) {
+        this.record = record;
+    }
+
+    @SuppressWarnings("unchecked")
+    @Override
+    public <T extends Record> T readRecord(Supplier<T> constructor) {
+        return (T) record;
+    }
+
+    @SuppressFBWarnings("EI_EXPOSE_REP")
+    @Override
+    public byte[] readBytes() {
+        if (bytes != null) {
+            return bytes;
+        }
+
+        try (ByteArrayOutputStream baos = new ByteArrayOutputStream(
+                ZooKeeperServer.intBufferStartingSizeBytes)) {
+            BinaryOutputArchive boa = BinaryOutputArchive.getArchive(baos);
+            record.serialize(boa, "request");
+            bytes = baos.toByteArray();
+            return bytes;
+        } catch (IOException e) {
+            throw new UncheckedIOException(e);
+        }
+    }
+
+    @Override
+    public int limit() {
+        byte[] bytes = readBytes();
+        return ByteBuffer.wrap(bytes).limit();
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotComparer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotComparer.java
index d77261d1f28..7bbb773fa98 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotComparer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotComparer.java
@@ -28,10 +28,10 @@
 import java.util.Map;
 import java.util.Scanner;
 import java.util.zip.CheckedInputStream;
-import org.apache.commons.cli.BasicParser;
 import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.HelpFormatter;
-import org.apache.commons.cli.OptionBuilder;
+import org.apache.commons.cli.Option;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
 import org.apache.jute.BinaryInputArchive;
@@ -59,41 +59,41 @@ public class SnapshotComparer {
   private SnapshotComparer() {
     options = new Options();
     options.addOption(
-        OptionBuilder
+        Option.builder("l")
             .hasArg()
-            .isRequired(true)
-            .withLongOpt(leftOption)
-            .withDescription("(Required) The left snapshot file.")
-            .withArgName("LEFT")
-            .withType(File.class)
-            .create("l"));
+            .required(true)
+            .longOpt(leftOption)
+            .desc("(Required) The left snapshot file.")
+            .argName("LEFT")
+            .type(File.class)
+            .build());
     options.addOption(
-        OptionBuilder
+        Option.builder("r")
             .hasArg()
-            .isRequired(true)
-            .withLongOpt(rightOption)
-            .withDescription("(Required) The right snapshot file.")
-            .withArgName("RIGHT")
-            .withType(File.class)
-            .create("r"));
+            .required(true)
+            .longOpt(rightOption)
+            .desc("(Required) The right snapshot file.")
+            .argName("RIGHT")
+            .type(File.class)
+            .build());
     options.addOption(
-        OptionBuilder
+        Option.builder("b")
             .hasArg()
-            .isRequired(true)
-            .withLongOpt(byteThresholdOption)
-            .withDescription("(Required) The node data delta size threshold, in bytes, for printing the node.")
-            .withArgName("BYTETHRESHOLD")
-            .withType(String.class)
-            .create("b"));
+            .required(true)
+            .longOpt(byteThresholdOption)
+            .desc("(Required) The node data delta size threshold, in bytes, for printing the node.")
+            .argName("BYTETHRESHOLD")
+            .type(String.class)
+            .build());
     options.addOption(
-        OptionBuilder
+        Option.builder("n")
             .hasArg()
-            .isRequired(true)
-            .withLongOpt(nodeThresholdOption)
-            .withDescription("(Required) The descendant node delta size threshold, in nodes, for printing the node.")
-            .withArgName("NODETHRESHOLD")
-            .withType(String.class)
-            .create("n"));
+            .required(true)
+            .longOpt(nodeThresholdOption)
+            .desc("(Required) The descendant node delta size threshold, in nodes, for printing the node.")
+            .argName("NODETHRESHOLD")
+            .type(String.class)
+            .build());
     options.addOption("d", debugOption, false, "Use debug output.");
     options.addOption("i", interactiveOption, false, "Enter interactive mode.");
   }
@@ -117,7 +117,7 @@ public static void main(String[] args) throws Exception {
   private void compareSnapshots(String[] args) throws Exception {
     CommandLine parsedOptions;
     try {
-      parsedOptions = new BasicParser().parse(options, args);
+      parsedOptions = new DefaultParser().parse(options, args);
     } catch (ParseException e) {
       System.err.println(e.getMessage());
       usage();
@@ -169,7 +169,7 @@ public int compare(TreeNode left, TreeNode right) {
       public TreeNode(String label, long size) {
         this.label = label;
         this.size = size;
-        this.children = new ArrayList<TreeNode>();
+        this.children = new ArrayList<>();
       }
 
       void populateChildren(String path, DataTree dataTree, TreeInfo treeInfo) throws Exception {
@@ -208,8 +208,8 @@ void populateChildren(String path, DataTree dataTree, TreeInfo treeInfo, int cur
 
     final TreeNode root;
     long count;
-    List<ArrayList<TreeNode>> nodesAtDepths = new ArrayList<ArrayList<TreeNode>>();
-    Map<String, TreeNode> nodesByName = new HashMap<String, TreeNode>();
+    List<ArrayList<TreeNode>> nodesAtDepths = new ArrayList<>();
+    Map<String, TreeNode> nodesByName = new HashMap<>();
 
     TreeInfo(File snapshot) throws Exception {
       DataTree dataTree = getSnapshot(snapshot);
@@ -229,7 +229,7 @@ void populateChildren(String path, DataTree dataTree, TreeInfo treeInfo, int cur
 
     void registerNode(TreeNode node, int depth) {
       while (depth > nodesAtDepths.size()) {
-        nodesAtDepths.add(new ArrayList<TreeNode>());
+        nodesAtDepths.add(new ArrayList<>());
       }
       nodesAtDepths.get(depth - 1).add(node);
       nodesByName.put(node.label, node);
@@ -259,14 +259,13 @@ public static Comparator<TreeNode> MakeAlphabeticComparator() {
    * @throws Exception
    */
   private static DataTree getSnapshot(File file) throws Exception {
-    FileSnap fileSnap = new FileSnap(null);
     DataTree dataTree = new DataTree();
-    Map<Long, Integer> sessions = new HashMap<Long, Integer>();
+    Map<Long, Integer> sessions = new HashMap<>();
     CheckedInputStream snapIS = SnapStream.getInputStream(file);
 
     long beginning = System.nanoTime();
     InputArchive ia = BinaryInputArchive.getArchive(snapIS);
-    fileSnap.deserialize(dataTree, sessions, ia);
+    FileSnap.deserialize(dataTree, sessions, ia);
     long end = System.nanoTime();
     System.out.println(String.format("Deserialized snapshot in %s in %f seconds", file.getName(),
         (((double) (end - beginning) / 1000000)) / 1000));
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotFormatter.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotFormatter.java
index 5fce206b53f..c7791dafbd0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotFormatter.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotFormatter.java
@@ -19,6 +19,7 @@
 package org.apache.zookeeper.server;
 
 import static org.apache.zookeeper.server.persistence.FileSnap.SNAPSHOT_FILE_PREFIX;
+import com.fasterxml.jackson.core.io.JsonStringEncoder;
 import java.io.File;
 import java.io.IOException;
 import java.io.InputStream;
@@ -36,7 +37,6 @@
 import org.apache.zookeeper.server.persistence.SnapStream;
 import org.apache.zookeeper.server.persistence.Util;
 import org.apache.zookeeper.util.ServiceUtils;
-import org.json.simple.JSONValue;
 
 /**
  * Dump a snapshot file to stdout.
@@ -96,12 +96,10 @@ public void run(String snapshotFileName, boolean dumpData, boolean dumpJson) thr
         try (InputStream is = SnapStream.getInputStream(snapshotFile)) {
             InputArchive ia = BinaryInputArchive.getArchive(is);
 
-            FileSnap fileSnap = new FileSnap(null);
-
             DataTree dataTree = new DataTree();
-            Map<Long, Integer> sessions = new HashMap<Long, Integer>();
+            Map<Long, Integer> sessions = new HashMap<>();
 
-            fileSnap.deserialize(dataTree, sessions, ia);
+            FileSnap.deserialize(dataTree, sessions, ia);
             long fileNameZxid = Util.getZxidFromName(snapshotFile.getName(), SNAPSHOT_FILE_PREFIX);
 
             if (dumpJson) {
@@ -181,14 +179,16 @@ private void printHex(String prefix, long value) {
     }
 
     private void printSnapshotJson(final DataTree dataTree) {
+        JsonStringEncoder encoder = JsonStringEncoder.getInstance();
         System.out.printf(
             "[1,0,{\"progname\":\"SnapshotFormatter.java\",\"progver\":\"0.01\",\"timestamp\":%d}",
             System.currentTimeMillis());
-        printZnodeJson(dataTree, "/");
+        printZnodeJson(dataTree, "/", encoder);
         System.out.print("]");
     }
 
-    private void printZnodeJson(final DataTree dataTree, final String fullPath) {
+    private void printZnodeJson(final DataTree dataTree, final String fullPath, JsonStringEncoder encoder) {
+
 
         final DataNode n = dataTree.getNode(fullPath);
 
@@ -209,7 +209,7 @@ private void printZnodeJson(final DataTree dataTree, final String fullPath) {
         }
         StringBuilder nodeSB = new StringBuilder();
         nodeSB.append("{");
-        nodeSB.append("\"name\":\"").append(JSONValue.escape(name)).append("\"").append(",");
+        nodeSB.append("\"name\":\"").append(encoder.quoteAsString(name)).append("\"").append(",");
         nodeSB.append("\"asize\":").append(dataLen).append(",");
         nodeSB.append("\"dsize\":").append(dataLen).append(",");
         nodeSB.append("\"dev\":").append(0).append(",");
@@ -223,7 +223,7 @@ private void printZnodeJson(final DataTree dataTree, final String fullPath) {
         if (children != null && children.size() > 0) {
             System.out.print("[" + nodeSB);
             for (String child : children) {
-                printZnodeJson(dataTree, fullPath + (fullPath.equals("/") ? "" : "/") + child);
+                printZnodeJson(dataTree, fullPath + (fullPath.equals("/") ? "" : "/") + child, encoder);
             }
             System.out.print("]");
         } else {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotRecursiveSummary.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotRecursiveSummary.java
new file mode 100644
index 00000000000..c0a66de772c
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SnapshotRecursiveSummary.java
@@ -0,0 +1,134 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server;
+
+import java.io.File;
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Set;
+import org.apache.jute.BinaryInputArchive;
+import org.apache.jute.InputArchive;
+import org.apache.yetus.audience.InterfaceAudience;
+import org.apache.zookeeper.server.persistence.FileSnap;
+import org.apache.zookeeper.server.persistence.SnapStream;
+
+/**
+ * Recursively processes a snapshot file collecting child node count and summarizes the data size
+ * below each node.
+ * "starting_node" defines the node where the recursion starts
+ * "max_depth" defines the depth where the tool still writes to the output.
+ * 0 means there is no depth limit, every non-leaf node's stats will be displayed, 1 means it will
+ * only contain the starting node's and it's children's stats, 2 ads another level and so on.
+ * This ONLY affects the level of details displayed, NOT the calculation.
+ */
+@InterfaceAudience.Public public class SnapshotRecursiveSummary {
+
+  /**
+   * USAGE: SnapsotRecursiveSummary snapshot_file starting_node max_depth
+   *
+   */
+  public static void main(String[] args) throws Exception {
+    if (args.length != 3) {
+      System.err.println(getUsage());
+      System.exit(2);
+    }
+    int maxDepth = 0;
+    try {
+      maxDepth = Integer.parseInt(args[2]);
+    } catch (NumberFormatException e) {
+      System.err.println(getUsage());
+      System.exit(2);
+    }
+
+    new SnapshotRecursiveSummary().run(args[0], args[1], maxDepth);
+  }
+
+  public void run(String snapshotFileName, String startingNode, int maxDepth) throws IOException {
+    File snapshotFile = new File(snapshotFileName);
+    try (InputStream is = SnapStream.getInputStream(snapshotFile)) {
+      InputArchive ia = BinaryInputArchive.getArchive(is);
+
+      DataTree dataTree = new DataTree();
+      Map<Long, Integer> sessions = new HashMap<>();
+      FileSnap.deserialize(dataTree, sessions, ia);
+
+      printZnodeDetails(dataTree, startingNode, maxDepth);
+    }
+  }
+
+  private void printZnodeDetails(DataTree dataTree, String startingNode, int maxDepth) {
+    StringBuilder builder = new StringBuilder();
+    printZnode(dataTree, startingNode, builder, 0, maxDepth);
+    System.out.println(builder);
+  }
+
+  private long[] printZnode(DataTree dataTree, String name, StringBuilder builder, int level,
+      int maxDepth) {
+    DataNode n = dataTree.getNode(name);
+    Set<String> children;
+    long dataSum = 0L;
+    synchronized (n) { // keep findbugs happy
+      if (n.data != null) {
+        dataSum += n.data.length;
+      }
+      children = n.getChildren();
+    }
+
+    long[] result = {1L, dataSum};
+    if (children.size() == 0) {
+      return result;
+    }
+    StringBuilder childBuilder = new StringBuilder();
+    for (String child : children) {
+      long[] childResult =
+          printZnode(dataTree, name + (name.equals("/") ? "" : "/") + child, childBuilder,
+              level + 1, maxDepth);
+      result[0] = result[0] + childResult[0];
+      result[1] = result[1] + childResult[1];
+    }
+
+    if (maxDepth == 0 || level <= maxDepth) {
+      String tab = String.join("", Collections.nCopies(level, "--"));
+      builder.append(tab + " " + name + "\n");
+      builder.append(tab + "   children: " + (result[0] - 1) + "\n");
+      builder.append(tab + "   data: " + result[1] + "\n");
+      builder.append(childBuilder);
+    }
+    return result;
+  }
+
+  public static String getUsage() {
+    String newLine = System.getProperty("line.separator");
+    return String.join(newLine,
+        "USAGE:",
+        newLine,
+        "SnapshotRecursiveSummary  <snapshot_file>  <starting_node>  <max_depth>",
+        newLine,
+        "snapshot_file:    path to the zookeeper snapshot",
+        "starting_node:    the path in the zookeeper tree where the traversal should begin",
+        "max_depth:        defines the depth where the tool still writes to the output. "
+            + "0 means there is no depth limit, every non-leaf node's stats will be displayed, "
+            + "1 means it will only contain the starting node's and it's children's stats, "
+            + "2 ads another level and so on. This ONLY affects the level of details displayed, "
+            + "NOT the calculation.");
+  }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SyncRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SyncRequestProcessor.java
index 66e85b14a2d..0dc1a86860e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/SyncRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/SyncRequestProcessor.java
@@ -69,7 +69,7 @@ public class SyncRequestProcessor extends ZooKeeperCriticalThread implements Req
     private int randRoll;
     private long randSize;
 
-    private final BlockingQueue<Request> queuedRequests = new LinkedBlockingQueue<Request>();
+    private final BlockingQueue<Request> queuedRequests = new LinkedBlockingQueue<>();
 
     private final Semaphore snapThreadMutex = new Semaphore(1);
 
@@ -178,7 +178,7 @@ public void run() {
                 ServerMetrics.getMetrics().SYNC_PROCESSOR_QUEUE_TIME.add(startProcessTime - si.syncQueueStartTime);
 
                 // track the number of records written to the log
-                if (zks.getZKDatabase().append(si)) {
+                if (!si.isThrottled() && zks.getZKDatabase().append(si)) {
                     if (shouldSnapshot()) {
                         resetSnapshotStats();
                         // roll the log
@@ -202,9 +202,8 @@ public void run() {
                     }
                 } else if (toFlush.isEmpty()) {
                     // optimization for read heavy workloads
-                    // iff this is a read, and there are no pending
-                    // flushes (writes), then just pass this to the next
-                    // processor
+                    // iff this is a read or a throttled request(which doesn't need to be written to the disk),
+                    // and there are no pending flushes (writes), then just pass this to the next processor
                     if (nextProcessor != null) {
                         nextProcessor.processRequest(si);
                         if (nextProcessor instanceof Flushable) {
@@ -259,7 +258,7 @@ public void shutdown() {
             this.join();
             this.flush();
         } catch (InterruptedException e) {
-            LOG.warn("Interrupted while wating for {} to finish", this);
+            LOG.warn("Interrupted while waiting for {} to finish", this);
             Thread.currentThread().interrupt();
         } catch (IOException e) {
             LOG.warn("Got IO exception during shutdown");
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/TxnLogEntry.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/TxnLogEntry.java
index 352eb81da90..409fd21fa91 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/TxnLogEntry.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/TxnLogEntry.java
@@ -47,4 +47,8 @@ public TxnHeader getHeader() {
     public TxnDigest getDigest() {
         return digest;
     }
+
+    public Request toRequest() {
+        return new Request(header, txn, digest);
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/TxnLogProposalIterator.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/TxnLogProposalIterator.java
index 847e3b2fabe..2d6ecb631fe 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/TxnLogProposalIterator.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/TxnLogProposalIterator.java
@@ -58,20 +58,19 @@ public boolean hasNext() {
     @Override
     public Proposal next() {
 
-        Proposal p = new Proposal();
+        Proposal p;
         try {
             byte[] serializedData = Util.marshallTxnEntry(itr.getHeader(), itr.getTxn(), itr.getDigest());
 
             QuorumPacket pp = new QuorumPacket(Leader.PROPOSAL, itr.getHeader().getZxid(), serializedData, null);
-            p.packet = pp;
-            p.request = null;
-
+            p = new Proposal(pp);
             // This is the only place that can throw IO exception
             hasNext = itr.next();
 
         } catch (IOException e) {
             LOG.error("Unable to read txnlog from disk", e);
             hasNext = false;
+            p = new Proposal();
         }
 
         return p;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/WorkerService.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/WorkerService.java
index 2a396f8ee87..7885068135a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/WorkerService.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/WorkerService.java
@@ -47,12 +47,11 @@ public class WorkerService {
 
     private static final Logger LOG = LoggerFactory.getLogger(WorkerService.class);
 
-    private final ArrayList<ExecutorService> workers = new ArrayList<ExecutorService>();
+    private final ArrayList<ExecutorService> workers = new ArrayList<>();
 
     private final String threadNamePrefix;
     private int numWorkerThreads;
     private boolean threadsAreAssignable;
-    private long shutdownTimeoutMS = 5000;
 
     private volatile boolean stopped = true;
 
@@ -168,7 +167,6 @@ public void run() {
      */
     private static class DaemonThreadFactory implements ThreadFactory {
 
-        final ThreadGroup group;
         final AtomicInteger threadNumber = new AtomicInteger(1);
         final String namePrefix;
 
@@ -178,22 +176,15 @@ private static class DaemonThreadFactory implements ThreadFactory {
 
         DaemonThreadFactory(String name, int firstThreadNum) {
             threadNumber.set(firstThreadNum);
-            SecurityManager s = System.getSecurityManager();
-            group = (s != null) ? s.getThreadGroup() : Thread.currentThread().getThreadGroup();
             namePrefix = name + "-";
         }
 
+        @Override
         public Thread newThread(Runnable r) {
-            Thread t = new Thread(group, r, namePrefix + threadNumber.getAndIncrement(), 0);
-            if (!t.isDaemon()) {
-                t.setDaemon(true);
-            }
-            if (t.getPriority() != Thread.NORM_PRIORITY) {
-                t.setPriority(Thread.NORM_PRIORITY);
-            }
+            Thread t = new Thread(r, namePrefix + threadNumber.getAndIncrement());
+            t.setDaemon(true);
             return t;
         }
-
     }
 
     public void start() {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
index f758f5de5ae..2fd67da5063 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZKDatabase.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.io.File;
 import java.io.IOException;
 import java.io.PrintWriter;
@@ -35,6 +36,7 @@
 import java.util.concurrent.locks.ReentrantReadWriteLock;
 import java.util.concurrent.locks.ReentrantReadWriteLock.ReadLock;
 import java.util.concurrent.locks.ReentrantReadWriteLock.WriteLock;
+import java.util.zip.CheckedInputStream;
 import org.apache.jute.InputArchive;
 import org.apache.jute.OutputArchive;
 import org.apache.jute.Record;
@@ -47,14 +49,16 @@
 import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.server.DataTree.ProcessTxnResult;
+import org.apache.zookeeper.server.persistence.FileSnap;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog.PlayBackListener;
+import org.apache.zookeeper.server.persistence.SnapStream;
 import org.apache.zookeeper.server.persistence.TxnLog.TxnIterator;
-import org.apache.zookeeper.server.quorum.Leader;
 import org.apache.zookeeper.server.quorum.Leader.Proposal;
-import org.apache.zookeeper.server.quorum.QuorumPacket;
+import org.apache.zookeeper.server.quorum.Leader.PureRequestProposal;
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
 import org.apache.zookeeper.server.util.SerializeUtils;
+import org.apache.zookeeper.server.util.ZxidUtils;
 import org.apache.zookeeper.txn.TxnDigest;
 import org.apache.zookeeper.txn.TxnHeader;
 import org.slf4j.Logger;
@@ -79,6 +83,8 @@ public class ZKDatabase {
     protected FileTxnSnapLog snapLog;
     protected long minCommittedLog, maxCommittedLog;
 
+    private final boolean allowDiscontinuousProposals = Boolean.getBoolean("zookeeper.test.allowDiscontinuousProposals");
+
     /**
      * Default value is to use snapshot if txnlog size exceeds 1/3 the size of snapshot
      */
@@ -89,7 +95,6 @@ public class ZKDatabase {
     public static final String COMMIT_LOG_COUNT = "zookeeper.commitLogCount";
     public static final int DEFAULT_COMMIT_LOG_COUNT = 500;
     public int commitLogCount;
-    protected static int commitLogBuffer = 700;
     protected Queue<Proposal> committedLog = new ArrayDeque<>();
     protected ReentrantReadWriteLock logLock = new ReentrantReadWriteLock();
     private volatile boolean initialized = false;
@@ -107,7 +112,7 @@ public class ZKDatabase {
      */
     public ZKDatabase(FileTxnSnapLog snapLog) {
         dataTree = createDataTree();
-        sessionsWithTimeouts = new ConcurrentHashMap<Long, Integer>();
+        sessionsWithTimeouts = new ConcurrentHashMap<>();
         this.snapLog = snapLog;
 
         try {
@@ -168,8 +173,6 @@ public boolean isInitialized() {
      * data structures in zkdatabase.
      */
     public void clear() {
-        minCommittedLog = 0;
-        maxCommittedLog = 0;
         /* to be safe we just create a new
          * datatree.
          */
@@ -180,6 +183,8 @@ public void clear() {
         try {
             lock.lock();
             committedLog.clear();
+            minCommittedLog = 0;
+            maxCommittedLog = 0;
         } finally {
             lock.unlock();
         }
@@ -292,7 +297,7 @@ public long loadDataBase() throws IOException {
     }
 
     /**
-     * Fast forward the database adding transactions from the committed log into memory.
+     * Fast-forward the database adding transactions from the committed log into memory.
      * @return the last valid zxid.
      * @throws IOException
      */
@@ -318,22 +323,30 @@ public void addCommittedProposal(Request request) {
         WriteLock wl = logLock.writeLock();
         try {
             wl.lock();
-            if (committedLog.size() > commitLogCount) {
-                committedLog.remove();
-                minCommittedLog = committedLog.peek().packet.getZxid();
-            }
             if (committedLog.isEmpty()) {
                 minCommittedLog = request.zxid;
                 maxCommittedLog = request.zxid;
+            } else if (request.zxid <= maxCommittedLog) {
+                // This could happen if lastProcessedZxid is rewinded and database is re-synced.
+                // Currently, it only happens in test codes, but it should also be safe for production path.
+                return;
+            } else if (!allowDiscontinuousProposals
+                    && request.zxid != maxCommittedLog + 1
+                    && ZxidUtils.getEpochFromZxid(request.zxid) <= ZxidUtils.getEpochFromZxid(maxCommittedLog)) {
+                String msg = String.format(
+                    "Committed proposal cached out of order: 0x%s is not the next proposal of 0x%s",
+                    ZxidUtils.zxidToString(request.zxid),
+                    ZxidUtils.zxidToString(maxCommittedLog));
+                LOG.error(msg);
+                throw new IllegalStateException(msg);
             }
-
-            byte[] data = SerializeUtils.serializeRequest(request);
-            QuorumPacket pp = new QuorumPacket(Leader.PROPOSAL, request.zxid, data, null);
-            Proposal p = new Proposal();
-            p.packet = pp;
-            p.request = request;
+            PureRequestProposal p = new PureRequestProposal(request);
             committedLog.add(p);
-            maxCommittedLog = p.packet.getZxid();
+            maxCommittedLog = p.getZxid();
+            if (committedLog.size() > commitLogCount) {
+                committedLog.remove();
+                minCommittedLog = committedLog.peek().getZxid();
+            }
         } finally {
             wl.unlock();
         }
@@ -471,7 +484,7 @@ public void setlastProcessedZxid(long zxid) {
     }
 
     /**
-     * the process txn on the data and perform digest comparision.
+     * the process txn on the data and perform digest comparison.
      * @param hdr the txnheader for the txn
      * @param txn the transaction that needs to be processed
      * @param digest the expected digest. A null value would skip the check
@@ -507,7 +520,6 @@ public DataNode getNode(String path) {
      * @param path the path being queried
      * @param stat the stat for this path
      * @param watcher the watcher function
-     * @return
      * @throws KeeperException.NoNodeException
      */
     public byte[] getData(String path, Stat stat, Watcher watcher) throws KeeperException.NoNodeException {
@@ -621,6 +633,42 @@ public void deserializeSnapshot(InputArchive ia) throws IOException {
         initialized = true;
     }
 
+    /**
+     * Deserialize a snapshot that contains FileHeader from an input archive. It is used by
+     * the admin restore command.
+     *
+     * @param ia the input archive to deserialize from
+     * @param is the CheckInputStream to check integrity
+     *
+     * @throws IOException
+     */
+    public void deserializeSnapshot(final InputArchive ia, final CheckedInputStream is) throws IOException {
+        clear();
+
+        // deserialize data tree
+        final DataTree dataTree = getDataTree();
+        FileSnap.deserialize(dataTree, getSessionWithTimeOuts(), ia);
+        SnapStream.checkSealIntegrity(is, ia);
+
+        // deserialize digest and check integrity
+        if (dataTree.deserializeZxidDigest(ia, 0)) {
+            SnapStream.checkSealIntegrity(is, ia);
+        }
+
+        // deserialize lastProcessedZxid and check integrity
+        if (dataTree.deserializeLastProcessedZxid(ia)) {
+            SnapStream.checkSealIntegrity(is, ia);
+        }
+
+        // compare the digest to find inconsistency
+        if (dataTree.getDigestFromLoadedSnapshot() != null) {
+            dataTree.compareSnapshotDigests(dataTree.lastProcessedZxid);
+        }
+
+        initialized = true;
+    }
+
+
     /**
      * serialize the snapshot
      * @param oa the output archive to which the snapshot needs to be serialized
@@ -634,11 +682,14 @@ public void serializeSnapshot(OutputArchive oa) throws IOException, InterruptedE
     /**
      * append to the underlying transaction log
      * @param si the request to append
-     * @return true if the append was succesfull and false if not
+     * @return true if the append was successful and false if not
      */
     public boolean append(Request si) throws IOException {
-        txnCount.incrementAndGet();
-        return this.snapLog.append(si);
+        if (this.snapLog.append(si)) {
+            txnCount.incrementAndGet();
+            return true;
+        }
+        return false;
     }
 
     /**
@@ -677,7 +728,7 @@ public synchronized void initConfigInZKDatabase(QuorumVerifier qv) {
             }
             this.dataTree.setData(
                 ZooDefs.CONFIG_NODE,
-                qv.toString().getBytes(),
+                qv.toString().getBytes(UTF_8),
                 -1,
                 qv.getVersion(),
                 Time.currentWallTime());
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperSaslServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperSaslServer.java
index 5bdabfeda8b..98c8d0e6bb5 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperSaslServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperSaslServer.java
@@ -22,6 +22,7 @@
 import javax.security.sasl.SaslException;
 import javax.security.sasl.SaslServer;
 import org.apache.zookeeper.Login;
+import org.apache.zookeeper.common.ZKConfig;
 import org.apache.zookeeper.util.SecurityUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -32,20 +33,26 @@ public class ZooKeeperSaslServer {
     public static final String DEFAULT_LOGIN_CONTEXT_NAME = "Server";
 
     private static final Logger LOG = LoggerFactory.getLogger(ZooKeeperSaslServer.class);
-    private SaslServer saslServer;
+    private final SaslServer saslServer;
+    private final ZKConfig config;
 
     ZooKeeperSaslServer(final Login login) {
+        config = new ZKConfig();
         saslServer = createSaslServer(login);
     }
 
     private SaslServer createSaslServer(final Login login) {
         synchronized (login) {
             Subject subject = login.getSubject();
-            return SecurityUtils.createSaslServer(subject, "zookeeper", "zk-sasl-md5", login.callbackHandler, LOG);
+            return SecurityUtils.createSaslServer(config, subject, "zookeeper", "zk-sasl-md5", login.newCallbackHandler(), LOG);
         }
     }
 
     public byte[] evaluateResponse(byte[] response) throws SaslException {
+        if (saslServer == null) {
+            LOG.error("SaslServer failed to initialize (FIPS mode may have blocked DIGEST-MD5). Cannot authenticate client.");
+            throw new SaslException("SaslServer is null, cannot evaluate client SASL response.");
+        }
         return saslServer.evaluateResponse(response);
     }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
index 1a2d9a7e06a..080f4f8638d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServer.java
@@ -19,6 +19,7 @@
 package org.apache.zookeeper.server;
 
 import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+import java.io.BufferedInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.IOException;
@@ -32,23 +33,32 @@
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Properties;
 import java.util.Random;
 import java.util.Set;
+import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.atomic.AtomicInteger;
 import java.util.concurrent.atomic.AtomicLong;
 import java.util.function.BiConsumer;
+import java.util.zip.Adler32;
+import java.util.zip.CheckedInputStream;
 import javax.security.sasl.SaslException;
 import org.apache.jute.BinaryInputArchive;
 import org.apache.jute.BinaryOutputArchive;
+import org.apache.jute.InputArchive;
 import org.apache.jute.Record;
 import org.apache.zookeeper.Environment;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.KeeperException.Code;
 import org.apache.zookeeper.KeeperException.SessionExpiredException;
+import org.apache.zookeeper.Quotas;
+import org.apache.zookeeper.StatsTrack;
 import org.apache.zookeeper.Version;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooDefs.OpCode;
 import org.apache.zookeeper.ZookeeperBanner;
+import org.apache.zookeeper.common.PathUtils;
+import org.apache.zookeeper.common.StringUtils;
 import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Id;
@@ -74,9 +84,11 @@
 import org.apache.zookeeper.server.auth.ProviderRegistry;
 import org.apache.zookeeper.server.auth.ServerAuthenticationProvider;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
+import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
 import org.apache.zookeeper.server.quorum.ReadOnlyZooKeeperServer;
 import org.apache.zookeeper.server.util.JvmPauseMonitor;
 import org.apache.zookeeper.server.util.OSMXBean;
+import org.apache.zookeeper.server.util.QuotaMetricsUtils;
 import org.apache.zookeeper.server.util.RequestPathMetricsCollector;
 import org.apache.zookeeper.txn.CreateSessionTxn;
 import org.apache.zookeeper.txn.TxnDigest;
@@ -93,33 +105,44 @@
 public class ZooKeeperServer implements SessionExpirer, ServerStats.Provider {
 
     protected static final Logger LOG;
+    private static final RateLogger RATE_LOGGER;
 
     public static final String GLOBAL_OUTSTANDING_LIMIT = "zookeeper.globalOutstandingLimit";
 
     public static final String ENABLE_EAGER_ACL_CHECK = "zookeeper.enableEagerACLCheck";
     public static final String SKIP_ACL = "zookeeper.skipACL";
+    public static final String ENFORCE_QUOTA = "zookeeper.enforceQuota";
 
     // When enabled, will check ACL constraints appertained to the requests first,
     // before sending the requests to the quorum.
-    static final boolean enableEagerACLCheck;
+    static boolean enableEagerACLCheck;
 
     static final boolean skipACL;
 
-    public static final String ALLOW_SASL_FAILED_CLIENTS = "zookeeper.allowSaslFailedClients";
-    public static final String SESSION_REQUIRE_CLIENT_SASL_AUTH = "zookeeper.sessionRequireClientSASLAuth";
-    public static final String SASL_AUTH_SCHEME = "sasl";
+    public static final boolean enforceQuota;
+
+    public static final String SASL_SUPER_USER = "zookeeper.superUser";
 
+    public static final String ALLOW_SASL_FAILED_CLIENTS = "zookeeper.allowSaslFailedClients";
     public static final String ZOOKEEPER_DIGEST_ENABLED = "zookeeper.digest.enabled";
     private static boolean digestEnabled;
 
+    public static final String ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED = "zookeeper.serializeLastProcessedZxid.enabled";
+    private static boolean serializeLastProcessedZxidEnabled;
+
     // Add a enable/disable option for now, we should remove this one when
     // this feature is confirmed to be stable
     public static final String CLOSE_SESSION_TXN_ENABLED = "zookeeper.closeSessionTxn.enabled";
     private static boolean closeSessionTxnEnabled = true;
+    private volatile CountDownLatch restoreLatch;
+    // exclusive lock for taking snapshot and restore
+    private final Object snapshotAndRestoreLock = new Object();
 
     static {
         LOG = LoggerFactory.getLogger(ZooKeeperServer.class);
 
+        RATE_LOGGER = new RateLogger(LOG);
+
         ZookeeperBanner.printBanner(LOG);
 
         Environment.logEnv("Server environment:", LOG);
@@ -132,12 +155,31 @@ public class ZooKeeperServer implements SessionExpirer, ServerStats.Provider {
             LOG.info("{}==\"yes\", ACL checks will be skipped", SKIP_ACL);
         }
 
+        enforceQuota = Boolean.parseBoolean(System.getProperty(ENFORCE_QUOTA, "false"));
+        if (enforceQuota) {
+            LOG.info("{} = {}, Quota Enforce enables", ENFORCE_QUOTA, enforceQuota);
+        }
+
         digestEnabled = Boolean.parseBoolean(System.getProperty(ZOOKEEPER_DIGEST_ENABLED, "true"));
         LOG.info("{} = {}", ZOOKEEPER_DIGEST_ENABLED, digestEnabled);
 
         closeSessionTxnEnabled = Boolean.parseBoolean(
                 System.getProperty(CLOSE_SESSION_TXN_ENABLED, "true"));
         LOG.info("{} = {}", CLOSE_SESSION_TXN_ENABLED, closeSessionTxnEnabled);
+
+        setSerializeLastProcessedZxidEnabled(Boolean.parseBoolean(
+                System.getProperty(ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED, "true")));
+    }
+
+    // @VisibleForTesting
+    public static boolean isEnableEagerACLCheck() {
+        return enableEagerACLCheck;
+    }
+
+    // @VisibleForTesting
+    public static void setEnableEagerACLCheck(boolean enabled) {
+        ZooKeeperServer.enableEagerACLCheck = enabled;
+        LOG.info("Update {} to {}", ENABLE_EAGER_ACL_CHECK, enabled);
     }
 
     public static boolean isCloseSessionTxnEnabled() {
@@ -155,6 +197,9 @@ public static void setCloseSessionTxnEnabled(boolean enabled) {
 
     public static final int DEFAULT_TICK_TIME = 3000;
     protected int tickTime = DEFAULT_TICK_TIME;
+    public static final int DEFAULT_THROTTLED_OP_WAIT_TIME = 0; // disabled
+    protected static volatile int throttledOpWaitTime =
+        Integer.getInteger("zookeeper.throttled_op_wait_time", DEFAULT_THROTTLED_OP_WAIT_TIME);
     /** value of -1 indicates unset, use default */
     protected int minSessionTimeout = -1;
     /** value of -1 indicates unset, use default */
@@ -174,7 +219,10 @@ public static void setCloseSessionTxnEnabled(boolean enabled) {
     private boolean isResponseCachingEnabled = true;
     /* contains the configuration file content read at startup */
     protected String initialConfig;
+    protected boolean reconfigEnabled;
     private final RequestPathMetricsCollector requestPathMetricsCollector;
+    private static final int DEFAULT_SNAP_COUNT = 100000;
+    private static final int DEFAULT_GLOBAL_OUTSTANDING_LIMIT = 1000;
 
     private boolean localSessionEnabled = false;
     protected enum State {
@@ -195,7 +243,7 @@ protected enum State {
     private final AtomicInteger requestsInProcess = new AtomicInteger(0);
     final Deque<ChangeRecord> outstandingChanges = new ArrayDeque<>();
     // this data structure must be accessed under the outstandingChanges lock
-    final Map<String, ChangeRecord> outstandingChangesForPath = new HashMap<String, ChangeRecord>();
+    final Map<String, ChangeRecord> outstandingChangesForPath = new HashMap<>();
 
     protected ServerCnxnFactory serverCnxnFactory;
     protected ServerCnxnFactory secureServerCnxnFactory;
@@ -213,7 +261,7 @@ protected enum State {
     private static volatile int maxBatchSize;
 
     /**
-     * Starting size of read and write ByteArroyOuputBuffers. Default is 32 bytes.
+     * Starting size of read and write ByteArrayOutputBuffers. Default is 32 bytes.
      * Flag not used for small transfers like connectResponses.
      */
     public static final String INT_BUFFER_STARTING_SIZE_BYTES = "zookeeper.intBufferStartingSizeBytes";
@@ -232,7 +280,7 @@ protected enum State {
         intBufferStartingSizeBytes = Integer.getInteger(INT_BUFFER_STARTING_SIZE_BYTES, DEFAULT_STARTING_BUFFER_SIZE);
 
         if (intBufferStartingSizeBytes < 32) {
-            String msg = "Buffer starting size must be greater than 0."
+            String msg = "Buffer starting size (" + intBufferStartingSizeBytes + ") must be greater than or equal to 32. "
                          + "Configure with \"-Dzookeeper.intBufferStartingSizeBytes=<size>\" ";
             LOG.error(msg);
             throw new IllegalArgumentException(msg);
@@ -242,7 +290,7 @@ protected enum State {
     }
 
     // Connection throttling
-    private BlueThrottle connThrottle = new BlueThrottle();
+    private final BlueThrottle connThrottle = new BlueThrottle();
 
     @SuppressFBWarnings(value = "IS2_INCONSISTENT_SYNC", justification =
         "Internally the throttler has a BlockingQueue so "
@@ -256,17 +304,17 @@ protected enum State {
      * too many large requests such that the JVM runs out of usable heap and
      * ultimately crashes.
      *
-     * The limit is enforced by the {@link checkRequestSize(int, boolean)}
+     * The limit is enforced by the {@link #checkRequestSizeWhenReceivingMessage(int)}
      * method which is called by the connection layer ({@link NIOServerCnxn},
      * {@link NettyServerCnxn}) before allocating a byte buffer and pulling
      * data off the TCP socket. The limit is then checked again by the
-     * ZooKeeper server in {@link processPacket(ServerCnxn, ByteBuffer)} which
-     * also atomically updates {@link currentLargeRequestBytes}. The request is
+     * ZooKeeper server in {@link #processPacket(ServerCnxn, RequestHeader, RequestRecord)} which
+     * also atomically updates {@link #currentLargeRequestBytes}. The request is
      * then marked as a large request, with the request size stored in the Request
-     * object so that it can later be decremented from {@link currentLargeRequestsBytes}.
+     * object so that it can later be decremented from {@link #currentLargeRequestBytes}.
      *
      * When a request is completed or dropped, the relevant code path calls the
-     * {@link requestFinished(Request)} method which performs the decrement if
+     * {@link #requestFinished(Request)} method which performs the decrement if
      * needed.
      */
     private volatile int largeRequestMaxBytes = 100 * 1024 * 1024;
@@ -279,6 +327,8 @@ protected enum State {
 
     private final AtomicInteger currentLargeRequestBytes = new AtomicInteger(0);
 
+    private final AuthenticationHelper authHelper = new AuthenticationHelper();
+
     void removeCnxn(ServerCnxn cnxn) {
         zkDb.removeCnxn(cnxn);
     }
@@ -296,11 +346,18 @@ public ZooKeeperServer() {
     }
 
     /**
-     * Creates a ZooKeeperServer instance. It sets everything up, but doesn't
+     * Keeping this constructor for backward compatibility
+     */
+    public ZooKeeperServer(FileTxnSnapLog txnLogFactory, int tickTime, int minSessionTimeout, int maxSessionTimeout, int clientPortListenBacklog, ZKDatabase zkDb, String initialConfig) {
+        this(txnLogFactory, tickTime, minSessionTimeout, maxSessionTimeout, clientPortListenBacklog, zkDb, initialConfig, QuorumPeerConfig.isReconfigEnabled());
+    }
+
+    /**
+     *  * Creates a ZooKeeperServer instance. It sets everything up, but doesn't
      * actually start listening for clients until run() is invoked.
      *
      */
-    public ZooKeeperServer(FileTxnSnapLog txnLogFactory, int tickTime, int minSessionTimeout, int maxSessionTimeout, int clientPortListenBacklog, ZKDatabase zkDb, String initialConfig) {
+    public ZooKeeperServer(FileTxnSnapLog txnLogFactory, int tickTime, int minSessionTimeout, int maxSessionTimeout, int clientPortListenBacklog, ZKDatabase zkDb, String initialConfig, boolean reconfigEnabled) {
         serverStats = new ServerStats(this);
         this.txnLogFactory = txnLogFactory;
         this.txnLogFactory.setServerStats(this.serverStats);
@@ -309,16 +366,17 @@ public ZooKeeperServer(FileTxnSnapLog txnLogFactory, int tickTime, int minSessio
         setMinSessionTimeout(minSessionTimeout);
         setMaxSessionTimeout(maxSessionTimeout);
         this.listenBacklog = clientPortListenBacklog;
+        this.reconfigEnabled = reconfigEnabled;
 
         listener = new ZooKeeperServerListenerImpl(this);
 
         readResponseCache = new ResponseCache(Integer.getInteger(
             GET_DATA_RESPONSE_CACHE_SIZE,
-            ResponseCache.DEFAULT_RESPONSE_CACHE_SIZE));
+            ResponseCache.DEFAULT_RESPONSE_CACHE_SIZE), "getData");
 
         getChildrenResponseCache = new ResponseCache(Integer.getInteger(
             GET_CHILDREN_RESPONSE_CACHE_SIZE,
-            ResponseCache.DEFAULT_RESPONSE_CACHE_SIZE));
+            ResponseCache.DEFAULT_RESPONSE_CACHE_SIZE), "getChildren");
 
         this.initialConfig = initialConfig;
 
@@ -328,17 +386,17 @@ public ZooKeeperServer(FileTxnSnapLog txnLogFactory, int tickTime, int minSessio
 
         LOG.info(
             "Created server with"
-                + " tickTime {}"
-                + " minSessionTimeout {}"
-                + " maxSessionTimeout {}"
+                + " tickTime {} ms"
+                + " minSessionTimeout {} ms"
+                + " maxSessionTimeout {} ms"
                 + " clientPortListenBacklog {}"
-                + " datadir {}"
+                + " dataLogdir {}"
                 + " snapdir {}",
             tickTime,
             getMinSessionTimeout(),
             getMaxSessionTimeout(),
             getClientPortListenBacklog(),
-            txnLogFactory.getDataDir(),
+            txnLogFactory.getDataLogDir(),
             txnLogFactory.getSnapDir());
     }
 
@@ -352,7 +410,7 @@ public String getInitialConfig() {
      *
      */
     public ZooKeeperServer(JvmPauseMonitor jvmPauseMonitor, FileTxnSnapLog txnLogFactory, int tickTime, int minSessionTimeout, int maxSessionTimeout, int clientPortListenBacklog, ZKDatabase zkDb, String initialConfig) {
-        this(txnLogFactory, tickTime, minSessionTimeout, maxSessionTimeout, clientPortListenBacklog, zkDb, initialConfig);
+        this(txnLogFactory, tickTime, minSessionTimeout, maxSessionTimeout, clientPortListenBacklog, zkDb, initialConfig, QuorumPeerConfig.isReconfigEnabled());
         this.jvmPauseMonitor = jvmPauseMonitor;
         if (jvmPauseMonitor != null) {
             LOG.info("Added JvmPauseMonitor to server");
@@ -365,8 +423,8 @@ public ZooKeeperServer(JvmPauseMonitor jvmPauseMonitor, FileTxnSnapLog txnLogFac
      * @param tickTime the ticktime for the server
      * @throws IOException
      */
-    public ZooKeeperServer(FileTxnSnapLog txnLogFactory, int tickTime, String initialConfig) throws IOException {
-        this(txnLogFactory, tickTime, -1, -1, -1, new ZKDatabase(txnLogFactory), initialConfig);
+    public ZooKeeperServer(FileTxnSnapLog txnLogFactory, int tickTime, String initialConfig) {
+        this(txnLogFactory, tickTime, -1, -1, -1, new ZKDatabase(txnLogFactory), initialConfig, QuorumPeerConfig.isReconfigEnabled());
     }
 
     public ServerStats serverStats() {
@@ -391,7 +449,7 @@ public void dumpConf(PrintWriter pwriter) {
         pwriter.print("dataDirSize=");
         pwriter.println(getDataDirSize());
         pwriter.print("dataLogDir=");
-        pwriter.println(zkDb.snapLog.getDataDir().getAbsolutePath());
+        pwriter.println(zkDb.snapLog.getDataLogDir().getAbsolutePath());
         pwriter.print("dataLogSize=");
         pwriter.println(getLogDirSize());
         pwriter.print("tickTime=");
@@ -413,7 +471,7 @@ public ZooKeeperServerConf getConf() {
         return new ZooKeeperServerConf(
             getClientPort(),
             zkDb.snapLog.getSnapDir().getAbsolutePath(),
-            zkDb.snapLog.getDataDir().getAbsolutePath(),
+            zkDb.snapLog.getDataLogDir().getAbsolutePath(),
             getTickTime(),
             getMaxClientCnxnsPerHost(),
             getMinSessionTimeout(),
@@ -437,7 +495,7 @@ public ZooKeeperServer(File snapDir, File logDir, int tickTime) throws IOExcepti
      * @throws IOException
      */
     public ZooKeeperServer(FileTxnSnapLog txnLogFactory) throws IOException {
-        this(txnLogFactory, DEFAULT_TICK_TIME, -1, -1, -1, new ZKDatabase(txnLogFactory), "");
+        this(txnLogFactory, DEFAULT_TICK_TIME, -1, -1, -1, new ZKDatabase(txnLogFactory), "", QuorumPeerConfig.isReconfigEnabled());
     }
 
     /**
@@ -485,39 +543,111 @@ public void loadData() throws IOException, InterruptedException {
         }
 
         // Clean up dead sessions
-        List<Long> deadSessions = new ArrayList<>();
-        for (Long session : zkDb.getSessions()) {
-            if (zkDb.getSessionWithTimeOuts().get(session) == null) {
-                deadSessions.add(session);
-            }
-        }
-
-        for (long session : deadSessions) {
-            // TODO: Is lastProcessedZxid really the best thing to use?
-            killSession(session, zkDb.getDataTreeLastProcessedZxid());
-        }
+        zkDb.getSessions().stream()
+                        .filter(session -> zkDb.getSessionWithTimeOuts().get(session) == null)
+                        .forEach(session -> killSession(session, zkDb.getDataTreeLastProcessedZxid()));
 
         // Make a clean snapshot
         takeSnapshot();
     }
 
-    public void takeSnapshot() {
-        takeSnapshot(false);
+    public File takeSnapshot() throws IOException {
+        return takeSnapshot(false);
     }
 
-    public void takeSnapshot(boolean syncSnap) {
+    public File takeSnapshot(boolean syncSnap) throws IOException {
+        return takeSnapshot(syncSnap, true);
+    }
+
+    /**
+     * Takes a snapshot on the server.
+     *
+     * @param syncSnap syncSnap sync the snapshot immediately after write
+     * @param isSevere if true system exist, otherwise throw IOException
+     * @return file snapshot file object
+     * @throws IOException
+     */
+    public File takeSnapshot(boolean syncSnap, boolean isSevere) throws IOException {
         long start = Time.currentElapsedTime();
+        File snapFile = null;
         try {
-            txnLogFactory.save(zkDb.getDataTree(), zkDb.getSessionWithTimeOuts(), syncSnap);
+            synchronized (snapshotAndRestoreLock) {
+                snapFile = txnLogFactory.save(zkDb.getDataTree(), zkDb.getSessionWithTimeOuts(), syncSnap);
+            }
         } catch (IOException e) {
-            LOG.error("Severe unrecoverable error, exiting", e);
-            // This is a severe error that we cannot recover from,
-            // so we need to exit
-            ServiceUtils.requestSystemExit(ExitCode.TXNLOG_ERROR_TAKING_SNAPSHOT.getValue());
+            if (isSevere) {
+                LOG.error("Severe unrecoverable error, exiting", e);
+                // This is a severe error that we cannot recover from,
+                // so we need to exit
+                ServiceUtils.requestSystemExit(ExitCode.TXNLOG_ERROR_TAKING_SNAPSHOT.getValue());
+            } else {
+                throw e;
+            }
         }
         long elapsed = Time.currentElapsedTime() - start;
         LOG.info("Snapshot taken in {} ms", elapsed);
         ServerMetrics.getMetrics().SNAPSHOT_TIME.add(elapsed);
+        return snapFile;
+    }
+
+    /**
+     * Restores database from a snapshot. It is used by the restore admin server command.
+     *
+     * @param inputStream input stream of snapshot
+     * @Return last processed zxid
+     * @throws IOException
+     */
+    public long restoreFromSnapshot(final InputStream inputStream) throws IOException {
+        if (inputStream == null) {
+            throw new IllegalArgumentException("InputStream can not be null when restoring from snapshot");
+        }
+
+        long start = Time.currentElapsedTime();
+        LOG.info("Before restore database. lastProcessedZxid={}, nodeCount={}，sessionCount={}",
+            getZKDatabase().getDataTreeLastProcessedZxid(),
+            getZKDatabase().dataTree.getNodeCount(),
+            getZKDatabase().getSessionCount());
+
+        // restore to a new zkDatabase
+        final ZKDatabase newZKDatabase = new ZKDatabase(this.txnLogFactory);
+        final CheckedInputStream cis = new CheckedInputStream(new BufferedInputStream(inputStream), new Adler32());
+        final InputArchive ia = BinaryInputArchive.getArchive(cis);
+        newZKDatabase.deserializeSnapshot(ia, cis);
+        LOG.info("Restored to a new database. lastProcessedZxid={}, nodeCount={}, sessionCount={}",
+            newZKDatabase.getDataTreeLastProcessedZxid(),
+            newZKDatabase.dataTree.getNodeCount(),
+            newZKDatabase.getSessionCount());
+
+        // create a CountDownLatch
+        restoreLatch = new CountDownLatch(1);
+
+        try {
+            synchronized (snapshotAndRestoreLock) {
+                // set to the new zkDatabase
+                setZKDatabase(newZKDatabase);
+            }
+            // re-create SessionTrack
+            createSessionTracker();
+        } finally {
+            // unblock request submission
+            restoreLatch.countDown();
+            restoreLatch = null;
+        }
+
+        LOG.info("After restore database. lastProcessedZxid={}, nodeCount={}, sessionCount={}",
+                getZKDatabase().getDataTreeLastProcessedZxid(),
+                getZKDatabase().dataTree.getNodeCount(),
+                getZKDatabase().getSessionCount());
+
+        long elapsed = Time.currentElapsedTime() - start;
+        LOG.info("Restore taken in {} ms", elapsed);
+        ServerMetrics.getMetrics().RESTORE_TIME.add(elapsed);
+
+        return getLastProcessedZxid();
+    }
+
+    public boolean shouldForceWriteInitialSnapshotAfterLeaderElection() {
+        return txnLogFactory.shouldForceWriteInitialSnapshotAfterLeaderElection();
     }
 
     @Override
@@ -525,7 +655,7 @@ public long getDataDirSize() {
         if (zkDb == null) {
             return 0L;
         }
-        File path = zkDb.snapLog.getDataDir();
+        File path = zkDb.snapLog.getSnapDir();
         return getDirSize(path);
     }
 
@@ -534,7 +664,7 @@ public long getLogDirSize() {
         if (zkDb == null) {
             return 0L;
         }
-        File path = zkDb.snapLog.getSnapDir();
+        File path = zkDb.snapLog.getDataLogDir();
         return getDirSize(path);
     }
 
@@ -604,6 +734,12 @@ public void expire(Session session) {
         close(sessionId);
     }
 
+    public void expire(long sessionId) {
+        LOG.info("forcibly expiring session 0x{}", Long.toHexString(sessionId));
+
+        close(sessionId);
+    }
+
     public static class MissingSessionException extends IOException {
 
         private static final long serialVersionUID = 7467414635467261007L;
@@ -676,6 +812,7 @@ public synchronized void startup() {
         requestPathMetricsCollector.start();
 
         localSessionEnabled = sessionTracker.isLocalSessionsEnabled();
+
         notifyAll();
     }
 
@@ -686,9 +823,12 @@ protected void startJvmPauseMonitor() {
     }
 
     protected void startRequestThrottler() {
-        requestThrottler = new RequestThrottler(this);
+        requestThrottler = createRequestThrottler();
         requestThrottler.start();
+    }
 
+    protected RequestThrottler createRequestThrottler() {
+        return new RequestThrottler(this);
     }
 
     protected void setupRequestProcessors() {
@@ -736,6 +876,9 @@ protected void startSessionTracker() {
      * <li>During shutdown the server sets the state to SHUTDOWN, which
      * corresponds to the server not running.</li></ul>
      *
+     * <li>During maintenance (e.g. restore) the server sets the state to MAINTENANCE
+     * </li></ul>
+     *
      * @param state new server state.
      */
     protected void setState(State state) {
@@ -757,7 +900,7 @@ protected void setState(State state) {
      * @return true if the server is running or server hits an error, false
      *         otherwise.
      */
-    protected boolean canShutdown() {
+    private boolean canShutdown() {
         return state == State.RUNNING || state == State.ERROR;
     }
 
@@ -768,24 +911,49 @@ public boolean isRunning() {
         return state == State.RUNNING;
     }
 
-    public void shutdown() {
+    public final void shutdown() {
         shutdown(false);
     }
 
     /**
      * Shut down the server instance
-     * @param fullyShutDown true if another server using the same database will not replace this one in the same process
+     * @param fullyShutDown true when no other server will use the same database to replace this one
      */
-    public synchronized void shutdown(boolean fullyShutDown) {
-        if (!canShutdown()) {
+    public final synchronized void shutdown(boolean fullyShutDown) {
+        if (canShutdown()) {
+            LOG.info("Shutting down");
+
+            shutdownComponents();
+
+            if (zkDb != null && !fullyShutDown) {
+                // There is no need to clear the database if we are going to reuse it:
+                //  * When a new quorum is established we can still apply the diff
+                //    on top of the same zkDb data
+                //  * If we fetch a new snapshot from leader, the zkDb will be
+                //    cleared anyway before loading the snapshot
+                try {
+                    // This will fast-forward the database to the last recorded transaction
+                    zkDb.fastForwardDataBase();
+                } catch (IOException e) {
+                    LOG.error("Error updating DB", e);
+                    fullyShutDown = true;
+                }
+            }
+            setState(State.SHUTDOWN);
+        } else {
             LOG.debug("ZooKeeper server is not running, so not proceeding to shutdown!");
-            return;
         }
-        LOG.info("shutting down");
-
-        // new RuntimeException("Calling shutdown").printStackTrace();
-        setState(State.SHUTDOWN);
+        if (zkDb != null && fullyShutDown) {
+            zkDb.clear();
+        }
+    }
 
+    /**
+     * @implNote
+     * Shuts down components owned by this class;
+     * remember to call super.shutdownComponents() when overriding!
+     */
+    protected void shutdownComponents() {
         // unregister all metrics that are keeping a strong reference to this object
         // subclasses will do their specific clean up
         unregisterMetrics();
@@ -794,9 +962,8 @@ public synchronized void shutdown(boolean fullyShutDown) {
             requestThrottler.shutdown();
         }
 
-        // Since sessionTracker and syncThreads poll we just have to
-        // set running to false and they will detect it during the poll
-        // interval.
+        // Since sessionTracker and syncThreads poll we just have to set running to false,
+        // and they will detect it during the poll interval.
         if (sessionTracker != null) {
             sessionTracker.shutdown();
         }
@@ -807,25 +974,6 @@ public synchronized void shutdown(boolean fullyShutDown) {
             jvmPauseMonitor.serviceStop();
         }
 
-        if (zkDb != null) {
-            if (fullyShutDown) {
-                zkDb.clear();
-            } else {
-                // else there is no need to clear the database
-                //  * When a new quorum is established we can still apply the diff
-                //    on top of the same zkDb data
-                //  * If we fetch a new snapshot from leader, the zkDb will be
-                //    cleared anyway before loading the snapshot
-                try {
-                    //This will fast forward the database to the latest recorded transactions
-                    zkDb.fastForwardDataBase();
-                } catch (IOException e) {
-                    LOG.error("Error updating DB", e);
-                    zkDb.clear();
-                }
-            }
-        }
-
         requestPathMetricsCollector.shutdown();
         unregisterJMX();
     }
@@ -916,7 +1064,7 @@ static class ChangeRecord {
         ChangeRecord duplicate(long zxid) {
             StatPersisted stat = new StatPersisted();
             if (this.stat != null) {
-                DataTree.copyStatPersisted(this.stat, stat);
+                stat.copyFrom(this.stat);
             }
             ChangeRecord changeRecord = new ChangeRecord(zxid, path, stat, childCount,
                     acl == null ? new ArrayList<>() : new ArrayList<>(acl));
@@ -946,10 +1094,9 @@ long createSession(ServerCnxn cnxn, byte[] passwd, int timeout) {
         long sessionId = sessionTracker.createSession(timeout);
         Random r = new Random(sessionId ^ superSecret);
         r.nextBytes(passwd);
-        ByteBuffer to = ByteBuffer.allocate(4);
-        to.putInt(timeout);
+        CreateSessionTxn txn = new CreateSessionTxn(timeout);
         cnxn.setSessionId(sessionId);
-        Request si = new Request(cnxn, sessionId, 0, OpCode.createSession, to, null);
+        Request si = new Request(cnxn, sessionId, 0, OpCode.createSession, RequestRecord.fromRecord(txn), null);
         submitRequest(si);
         return sessionId;
     }
@@ -1007,14 +1154,12 @@ public void finishSessionInit(ServerCnxn cnxn, boolean valid) {
                 valid ? cnxn.getSessionTimeout() : 0,
                 valid ? cnxn.getSessionId() : 0, // send 0 if session is no
                 // longer valid
-                valid ? generatePasswd(cnxn.getSessionId()) : new byte[16]);
+                valid ? generatePasswd(cnxn.getSessionId()) : new byte[16],
+                this instanceof ReadOnlyZooKeeperServer);
             ByteArrayOutputStream baos = new ByteArrayOutputStream();
             BinaryOutputArchive bos = BinaryOutputArchive.getArchive(baos);
             bos.writeInt(-1, "len");
-            rsp.serialize(bos, "connect");
-            if (!cnxn.isOldClient) {
-                bos.writeBool(this instanceof ReadOnlyZooKeeperServer, "readOnly");
-            }
+            cnxn.protocolManager.serializeConnectResponse(rsp, bos);
             baos.close();
             ByteBuffer bb = ByteBuffer.wrap(baos.toByteArray());
             bb.putInt(bb.remaining() - 4).rewind();
@@ -1061,6 +1206,14 @@ protected void setLocalSessionFlag(Request si) {
     }
 
     public void submitRequest(Request si) {
+        if (restoreLatch != null) {
+            try {
+                LOG.info("Blocking request submission while restore is in progress");
+                restoreLatch.await();
+            } catch (final InterruptedException e) {
+                LOG.warn("Unexpected interruption", e);
+            }
+        }
         enqueueRequest(si);
     }
 
@@ -1132,30 +1285,17 @@ public void submitRequestNow(Request si) {
     }
 
     public static int getSnapCount() {
-        String sc = System.getProperty(SNAP_COUNT);
-        try {
-            int snapCount = Integer.parseInt(sc);
-
-            // snapCount must be 2 or more. See org.apache.zookeeper.server.SyncRequestProcessor
-            if (snapCount < 2) {
-                LOG.warn("SnapCount should be 2 or more. Now, snapCount is reset to 2");
-                snapCount = 2;
-            }
-            return snapCount;
-        } catch (Exception e) {
-            return 100000;
+        int snapCount = Integer.getInteger(SNAP_COUNT, DEFAULT_SNAP_COUNT);
+        // snapCount must be 2 or more. See org.apache.zookeeper.server.SyncRequestProcessor
+        if (snapCount < 2) {
+            LOG.warn("SnapCount should be 2 or more. Now, snapCount is reset to 2");
+            snapCount = 2;
         }
+        return snapCount;
     }
 
     public int getGlobalOutstandingLimit() {
-        String sc = System.getProperty(GLOBAL_OUTSTANDING_LIMIT);
-        int limit;
-        try {
-            limit = Integer.parseInt(sc);
-        } catch (Exception e) {
-            limit = 1000;
-        }
-        return limit;
+        return Integer.getInteger(GLOBAL_OUTSTANDING_LIMIT, DEFAULT_GLOBAL_OUTSTANDING_LIMIT);
     }
 
     public static long getSnapSizeInBytes() {
@@ -1183,7 +1323,7 @@ public void setSecureServerCnxnFactory(ServerCnxnFactory factory) {
     }
 
     /**
-     * return the last proceesed id from the
+     * return the last processed id from the
      * datatree
      */
     public long getLastProcessedZxid() {
@@ -1192,7 +1332,7 @@ public long getLastProcessedZxid() {
 
     /**
      * return the outstanding requests
-     * in the queue, which havent been
+     * in the queue, which haven't been
      * processed yet
      */
     public long getOutstandingRequests() {
@@ -1218,7 +1358,7 @@ public int getNumAliveConnections() {
     }
 
     /**
-     * trunccate the log to get in sync with others
+     * truncate the log to get in sync with others
      * if in a quorum
      * @param zxid the zxid that it needs to get in sync
      * with others
@@ -1233,17 +1373,26 @@ public int getTickTime() {
     }
 
     public void setTickTime(int tickTime) {
-        LOG.info("tickTime set to {}", tickTime);
+        LOG.info("tickTime set to {} ms", tickTime);
         this.tickTime = tickTime;
     }
 
+    public static int getThrottledOpWaitTime() {
+        return throttledOpWaitTime;
+    }
+
+    public static void setThrottledOpWaitTime(int time) {
+        LOG.info("throttledOpWaitTime set to {} ms", time);
+        throttledOpWaitTime = time;
+    }
+
     public int getMinSessionTimeout() {
         return minSessionTimeout;
     }
 
     public void setMinSessionTimeout(int min) {
         this.minSessionTimeout = min == -1 ? tickTime * 2 : min;
-        LOG.info("minSessionTimeout set to {}", this.minSessionTimeout);
+        LOG.info("minSessionTimeout set to {} ms", this.minSessionTimeout);
     }
 
     public int getMaxSessionTimeout() {
@@ -1252,7 +1401,7 @@ public int getMaxSessionTimeout() {
 
     public void setMaxSessionTimeout(int max) {
         this.maxSessionTimeout = max == -1 ? tickTime * 20 : max;
-        LOG.info("maxSessionTimeout set to {}", this.maxSessionTimeout);
+        LOG.info("maxSessionTimeout set to {} ms", this.maxSessionTimeout);
     }
 
     public int getClientPortListenBacklog() {
@@ -1315,18 +1464,13 @@ public double getConnectionDropChance() {
     }
 
     @SuppressFBWarnings(value = "IS2_INCONSISTENT_SYNC", justification = "the value won't change after startup")
-    public void processConnectRequest(ServerCnxn cnxn, ByteBuffer incomingBuffer)
-        throws IOException, ClientCnxnLimitException {
-
-        BinaryInputArchive bia = BinaryInputArchive.getArchive(new ByteBufferInputStream(incomingBuffer));
-        ConnectRequest connReq = new ConnectRequest();
-        connReq.deserialize(bia, "connect");
+    public void processConnectRequest(ServerCnxn cnxn, ConnectRequest request) throws IOException, ClientCnxnLimitException {
         LOG.debug(
             "Session establishment request from client {} client's lastZxid is 0x{}",
             cnxn.getRemoteSocketAddress(),
-            Long.toHexString(connReq.getLastZxidSeen()));
+            Long.toHexString(request.getLastZxidSeen()));
 
-        long sessionId = connReq.getSessionId();
+        long sessionId = request.getSessionId();
         int tokensNeeded = 1;
         if (connThrottle.isConnectionWeightEnabled()) {
             if (sessionId == 0) {
@@ -1344,39 +1488,35 @@ public void processConnectRequest(ServerCnxn cnxn, ByteBuffer incomingBuffer)
             throw new ClientCnxnLimitException();
         }
         ServerMetrics.getMetrics().CONNECTION_TOKEN_DEFICIT.add(connThrottle.getDeficit());
-
         ServerMetrics.getMetrics().CONNECTION_REQUEST_COUNT.add(1);
 
-        boolean readOnly = false;
-        try {
-            readOnly = bia.readBool("readOnly");
-            cnxn.isOldClient = false;
-        } catch (IOException e) {
-            // this is ok -- just a packet from an old client which
-            // doesn't contain readOnly field
+        if (!cnxn.protocolManager.isReadonlyAvailable()) {
             LOG.warn(
                 "Connection request from old client {}; will be dropped if server is in r-o mode",
                 cnxn.getRemoteSocketAddress());
         }
-        if (!readOnly && this instanceof ReadOnlyZooKeeperServer) {
+
+        if (!request.getReadOnly() && this instanceof ReadOnlyZooKeeperServer) {
             String msg = "Refusing session request for not-read-only client " + cnxn.getRemoteSocketAddress();
             LOG.info(msg);
-            throw new CloseRequestException(msg, ServerCnxn.DisconnectReason.CLIENT_ZXID_AHEAD);
+            throw new CloseRequestException(msg, ServerCnxn.DisconnectReason.NOT_READ_ONLY_CLIENT);
         }
-        if (connReq.getLastZxidSeen() > zkDb.dataTree.lastProcessedZxid) {
-            String msg = "Refusing session request for client "
+        if (request.getLastZxidSeen() > zkDb.dataTree.lastProcessedZxid) {
+            String msg = "Refusing session(0x"
+                         + Long.toHexString(sessionId)
+                         + ") request for client "
                          + cnxn.getRemoteSocketAddress()
                          + " as it has seen zxid 0x"
-                         + Long.toHexString(connReq.getLastZxidSeen())
+                         + Long.toHexString(request.getLastZxidSeen())
                          + " our last zxid is 0x"
                          + Long.toHexString(getZKDatabase().getDataTreeLastProcessedZxid())
                          + " client must try another server";
 
             LOG.info(msg);
-            throw new CloseRequestException(msg, ServerCnxn.DisconnectReason.NOT_READ_ONLY_CLIENT);
+            throw new CloseRequestException(msg, ServerCnxn.DisconnectReason.CLIENT_ZXID_AHEAD);
         }
-        int sessionTimeout = connReq.getTimeOut();
-        byte[] passwd = connReq.getPasswd();
+        int sessionTimeout = request.getTimeOut();
+        byte[] passwd = request.getPasswd();
         int minSessionTimeout = getMinSessionTimeout();
         if (sessionTimeout < minSessionTimeout) {
             sessionTimeout = minSessionTimeout;
@@ -1394,17 +1534,17 @@ public void processConnectRequest(ServerCnxn cnxn, ByteBuffer incomingBuffer)
             LOG.debug(
                 "Client attempting to establish new session: session = 0x{}, zxid = 0x{}, timeout = {}, address = {}",
                 Long.toHexString(id),
-                Long.toHexString(connReq.getLastZxidSeen()),
-                connReq.getTimeOut(),
+                Long.toHexString(request.getLastZxidSeen()),
+                request.getTimeOut(),
                 cnxn.getRemoteSocketAddress());
         } else {
-            long clientSessionId = connReq.getSessionId();
-                LOG.debug(
-                    "Client attempting to renew session: session = 0x{}, zxid = 0x{}, timeout = {}, address = {}",
-                    Long.toHexString(clientSessionId),
-                    Long.toHexString(connReq.getLastZxidSeen()),
-                    connReq.getTimeOut(),
-                    cnxn.getRemoteSocketAddress());
+            validateSession(cnxn, sessionId);
+            LOG.debug(
+                "Client attempting to renew session: session = 0x{}, zxid = 0x{}, timeout = {}, address = {}",
+                Long.toHexString(sessionId),
+                Long.toHexString(request.getLastZxidSeen()),
+                request.getTimeOut(),
+                cnxn.getRemoteSocketAddress());
             if (serverCnxnFactory != null) {
                 serverCnxnFactory.closeSession(sessionId, ServerCnxn.DisconnectReason.CLIENT_RECONNECT);
             }
@@ -1418,8 +1558,20 @@ public void processConnectRequest(ServerCnxn cnxn, ByteBuffer incomingBuffer)
         }
     }
 
+    /**
+     * Validate if a particular session can be reestablished.
+     *
+     * @param cnxn
+     * @param sessionId
+     */
+    protected void validateSession(ServerCnxn cnxn, long sessionId)
+            throws IOException {
+        // do nothing
+    }
+
     public boolean shouldThrottle(long outStandingCount) {
-        if (getGlobalOutstandingLimit() < getInflight()) {
+        int globalOutstandingLimit = getGlobalOutstandingLimit();
+        if (globalOutstandingLimit < getInflight() || globalOutstandingLimit < getInProcess()) {
             return outStandingCount > 0;
         }
         return false;
@@ -1430,7 +1582,7 @@ long getFlushDelay() {
     }
 
     static void setFlushDelay(long delay) {
-        LOG.info("{}={}", FLUSH_DELAY, delay);
+        LOG.info("{} = {} ms", FLUSH_DELAY, delay);
         flushDelay = delay;
     }
 
@@ -1439,7 +1591,7 @@ long getMaxWriteQueuePollTime() {
     }
 
     static void setMaxWriteQueuePollTime(long maxTime) {
-        LOG.info("{}={}", MAX_WRITE_QUEUE_POLL_SIZE, maxTime);
+        LOG.info("{} = {} ms", MAX_WRITE_QUEUE_POLL_SIZE, maxTime);
         maxWriteQueuePollTime = maxTime;
     }
 
@@ -1531,13 +1683,7 @@ public void requestFinished(Request request) {
         }
     }
 
-    public void processPacket(ServerCnxn cnxn, ByteBuffer incomingBuffer) throws IOException {
-        // We have the request, now process and setup for next
-        InputStream bais = new ByteBufferInputStream(incomingBuffer);
-        BinaryInputArchive bia = BinaryInputArchive.getArchive(bais);
-        RequestHeader h = new RequestHeader();
-        h.deserialize(bia, "header");
-
+    public void processPacket(ServerCnxn cnxn, RequestHeader h, RequestRecord request) throws IOException {
         // Need to increase the outstanding request count first, otherwise
         // there might be a race condition that it enabled recv after
         // processing request and then disabled when check throttling.
@@ -1549,14 +1695,9 @@ public void processPacket(ServerCnxn cnxn, ByteBuffer incomingBuffer) throws IOE
         // in cnxn, since it will close the cnxn anyway.
         cnxn.incrOutstandingAndCheckThrottle(h);
 
-        // Through the magic of byte buffers, txn will not be
-        // pointing
-        // to the start of the txn
-        incomingBuffer = incomingBuffer.slice();
         if (h.getType() == OpCode.auth) {
             LOG.info("got auth packet {}", cnxn.getRemoteSocketAddress());
-            AuthPacket authPacket = new AuthPacket();
-            ByteBufferInputStream.byteBuffer2Record(incomingBuffer, authPacket);
+            AuthPacket authPacket = request.readRecord(AuthPacket::new);
             String scheme = authPacket.getScheme();
             ServerAuthenticationProvider ap = ProviderRegistry.getServerProvider(scheme);
             Code authReturn = KeeperException.Code.AUTHFAILED;
@@ -1573,8 +1714,9 @@ public void processPacket(ServerCnxn cnxn, ByteBuffer incomingBuffer) throws IOE
                 }
             }
             if (authReturn == KeeperException.Code.OK) {
-                LOG.debug("Authentication succeeded for scheme: {}", scheme);
-                LOG.info("auth success {}", cnxn.getRemoteSocketAddress());
+                LOG.info("Session 0x{}: auth success for scheme {} and address {}",
+                        Long.toHexString(cnxn.getSessionId()), scheme,
+                        cnxn.getRemoteSocketAddress());
                 ReplyHeader rh = new ReplyHeader(h.getXid(), 0, KeeperException.Code.OK.intValue());
                 cnxn.sendResponse(rh, null, null);
             } else {
@@ -1595,16 +1737,15 @@ public void processPacket(ServerCnxn cnxn, ByteBuffer incomingBuffer) throws IOE
             }
             return;
         } else if (h.getType() == OpCode.sasl) {
-            processSasl(incomingBuffer, cnxn, h);
+            processSasl(request, cnxn, h);
         } else {
-            if (shouldRequireClientSaslAuth() && !hasCnxSASLAuthenticated(cnxn)) {
-                ReplyHeader replyHeader = new ReplyHeader(h.getXid(), 0, Code.SESSIONCLOSEDREQUIRESASLAUTH.intValue());
-                cnxn.sendResponse(replyHeader, null, "response");
-                cnxn.sendCloseSession();
-                cnxn.disableRecv();
+            if (!authHelper.enforceAuthentication(cnxn, h.getXid())) {
+                // Authentication enforcement is failed
+                // Already sent response to user about failure and closed the session, lets return
+                return;
             } else {
-                Request si = new Request(cnxn, cnxn.getSessionId(), h.getXid(), h.getType(), incomingBuffer, cnxn.getAuthInfo());
-                int length = incomingBuffer.limit();
+                Request si = new Request(cnxn, cnxn.getSessionId(), h.getXid(), h.getType(), request, cnxn.getAuthInfo());
+                int length = request.limit();
                 if (isLargeRequest(length)) {
                     // checkRequestSize will throw IOException if request is rejected
                     checkRequestSizeWhenMessageReceived(length);
@@ -1616,27 +1757,35 @@ public void processPacket(ServerCnxn cnxn, ByteBuffer incomingBuffer) throws IOE
         }
     }
 
-    private static boolean shouldAllowSaslFailedClientsConnect() {
-        return Boolean.getBoolean(ALLOW_SASL_FAILED_CLIENTS);
-    }
+    private static boolean isSaslSuperUser(String id) {
+        if (id == null || id.isEmpty()) {
+            return false;
+        }
 
-    private static boolean shouldRequireClientSaslAuth() {
-        return Boolean.getBoolean(SESSION_REQUIRE_CLIENT_SASL_AUTH);
-    }
+        Properties properties = System.getProperties();
+        int prefixLen = SASL_SUPER_USER.length();
 
-    private boolean hasCnxSASLAuthenticated(ServerCnxn cnxn) {
-        for (Id id : cnxn.getAuthInfo()) {
-            if (id.getScheme().equals(SASL_AUTH_SCHEME)) {
-                return true;
+        for (String k : properties.stringPropertyNames()) {
+            if (k.startsWith(SASL_SUPER_USER)
+                && (k.length() == prefixLen || k.charAt(prefixLen) == '.')) {
+                String value = properties.getProperty(k);
+
+                if (value != null && value.equals(id)) {
+                    return true;
+                }
             }
         }
+
         return false;
     }
 
-    private void processSasl(ByteBuffer incomingBuffer, ServerCnxn cnxn, RequestHeader requestHeader) throws IOException {
+    private static boolean shouldAllowSaslFailedClientsConnect() {
+        return Boolean.getBoolean(ALLOW_SASL_FAILED_CLIENTS);
+    }
+
+    private void processSasl(RequestRecord request, ServerCnxn cnxn, RequestHeader requestHeader) throws IOException {
         LOG.debug("Responding to client SASL token.");
-        GetSASLRequest clientTokenRecord = new GetSASLRequest();
-        ByteBufferInputStream.byteBuffer2Record(incomingBuffer, clientTokenRecord);
+        GetSASLRequest clientTokenRecord = request.readRecord(GetSASLRequest::new);
         byte[] clientToken = clientTokenRecord.getToken();
         LOG.debug("Size of client SASL token: {}", clientToken.length);
         byte[] responseToken = null;
@@ -1649,22 +1798,27 @@ private void processSasl(ByteBuffer incomingBuffer, ServerCnxn cnxn, RequestHead
                 responseToken = saslServer.evaluateResponse(clientToken);
                 if (saslServer.isComplete()) {
                     String authorizationID = saslServer.getAuthorizationID();
-                    LOG.info("adding SASL authorization for authorizationID: {}", authorizationID);
+                    LOG.info("Session 0x{}: adding SASL authorization for authorizationID: {}",
+                            Long.toHexString(cnxn.getSessionId()), authorizationID);
                     cnxn.addAuthInfo(new Id("sasl", authorizationID));
-                    if (System.getProperty("zookeeper.superUser") != null
-                        && authorizationID.equals(System.getProperty("zookeeper.superUser"))) {
+
+                    if (isSaslSuperUser(authorizationID)) {
                         cnxn.addAuthInfo(new Id("super", ""));
+                        LOG.info(
+                            "Session 0x{}: Authenticated Id '{}' as super user",
+                            Long.toHexString(cnxn.getSessionId()),
+                            authorizationID);
                     }
                 }
             } catch (SaslException e) {
-                LOG.warn("Client {} failed to SASL authenticate: {}", cnxn.getRemoteSocketAddress(), e);
-                if (shouldAllowSaslFailedClientsConnect() && !shouldRequireClientSaslAuth()) {
+                LOG.warn("Client {} failed to SASL authenticate", cnxn.getRemoteSocketAddress(), e);
+                if (shouldAllowSaslFailedClientsConnect() && !authHelper.isSaslAuthRequired()) {
                     LOG.warn("Maintaining client connection despite SASL authentication failure.");
                 } else {
                     int error;
-                    if (shouldRequireClientSaslAuth()) {
+                    if (authHelper.isSaslAuthRequired()) {
                         LOG.warn(
-                            "Closing client connection due to server requires client SASL authenticaiton,"
+                            "Closing client connection due to server requires client SASL authentication,"
                                 + "but client SASL authentication has failed, or client is not configured with SASL "
                                 + "authentication.");
                         error = Code.SESSIONCLOSEDREQUIRESASLAUTH.intValue();
@@ -1692,13 +1846,6 @@ private void processSasl(ByteBuffer incomingBuffer, ServerCnxn cnxn, RequestHead
         cnxn.sendResponse(replyHeader, record, "response");
     }
 
-    // entry point for quorum/Learner.java
-    public ProcessTxnResult processTxn(TxnHeader hdr, Record txn) {
-        processTxnForSessionEvents(null, hdr, txn);
-        return processTxnInDB(hdr, txn, null);
-    }
-
-    // entry point for FinalRequestProcessor.java
     public ProcessTxnResult processTxn(Request request) {
         TxnHeader hdr = request.getHdr();
         processTxnForSessionEvents(request, hdr, request.getTxn());
@@ -1710,8 +1857,10 @@ public ProcessTxnResult processTxn(Request request) {
         if (!writeRequest && !quorumRequest) {
             return new ProcessTxnResult();
         }
+
+        ProcessTxnResult rc;
         synchronized (outstandingChanges) {
-            ProcessTxnResult rc = processTxnInDB(hdr, request.getTxn(), request.getTxnDigest());
+            rc = processTxnInDB(hdr, request.getTxn(), request.getTxnDigest());
 
             // request.hdr is set for write requests, which are the only ones
             // that add to outstandingChanges.
@@ -1732,13 +1881,13 @@ public ProcessTxnResult processTxn(Request request) {
                     }
                 }
             }
+        }
 
-            // do not add non quorum packets to the queue.
-            if (quorumRequest) {
-                getZKDatabase().addCommittedProposal(request);
-            }
-            return rc;
+        // do not add non quorum packets to the queue.
+        if (quorumRequest) {
+            getZKDatabase().addCommittedProposal(request);
         }
+        return rc;
     }
 
     private void processTxnForSessionEvents(Request request, TxnHeader hdr, Record txn) {
@@ -1835,6 +1984,18 @@ protected void registerMetrics() {
         rootContext.registerGauge("min_client_response_size", stats.getClientResponseStats()::getMinBufferSize);
 
         rootContext.registerGauge("outstanding_tls_handshake", this::getOutstandingHandshakeNum);
+        rootContext.registerGauge("auth_failed_count", stats::getAuthFailedCount);
+        rootContext.registerGauge("non_mtls_remote_conn_count", stats::getNonMTLSRemoteConnCount);
+        rootContext.registerGauge("non_mtls_local_conn_count", stats::getNonMTLSLocalConnCount);
+
+        rootContext.registerGaugeSet(QuotaMetricsUtils.QUOTA_COUNT_LIMIT_PER_NAMESPACE,
+                () -> QuotaMetricsUtils.getQuotaCountLimit(zkDb.getDataTree()));
+        rootContext.registerGaugeSet(QuotaMetricsUtils.QUOTA_BYTES_LIMIT_PER_NAMESPACE,
+                () -> QuotaMetricsUtils.getQuotaBytesLimit(zkDb.getDataTree()));
+        rootContext.registerGaugeSet(QuotaMetricsUtils.QUOTA_COUNT_USAGE_PER_NAMESPACE,
+                () -> QuotaMetricsUtils.getQuotaCountUsage(zkDb.getDataTree()));
+        rootContext.registerGaugeSet(QuotaMetricsUtils.QUOTA_BYTES_USAGE_PER_NAMESPACE,
+                () -> QuotaMetricsUtils.getQuotaBytesUsage(zkDb.getDataTree()));
     }
 
     protected void unregisterMetrics() {
@@ -1870,6 +2031,14 @@ protected void unregisterMetrics() {
         rootContext.unregisterGauge("max_client_response_size");
         rootContext.unregisterGauge("min_client_response_size");
 
+        rootContext.unregisterGauge("auth_failed_count");
+        rootContext.unregisterGauge("non_mtls_remote_conn_count");
+        rootContext.unregisterGauge("non_mtls_local_conn_count");
+
+        rootContext.unregisterGaugeSet(QuotaMetricsUtils.QUOTA_COUNT_LIMIT_PER_NAMESPACE);
+        rootContext.unregisterGaugeSet(QuotaMetricsUtils.QUOTA_BYTES_LIMIT_PER_NAMESPACE);
+        rootContext.unregisterGaugeSet(QuotaMetricsUtils.QUOTA_COUNT_USAGE_PER_NAMESPACE);
+        rootContext.unregisterGaugeSet(QuotaMetricsUtils.QUOTA_BYTES_USAGE_PER_NAMESPACE);
     }
 
     /**
@@ -1886,7 +2055,7 @@ public void dumpMonitorValues(BiConsumer<String, Object> response) {
 
     /**
      * Grant or deny authorization to an operation on a node as a function of:
-     * @param cnxn :    the server connection
+     * @param cnxn :    the server connection or null for admin server commands
      * @param acl :     set of ACLs for the node
      * @param perm :    the permission that the client is requesting
      * @param ids :     the credentials supplied by the client
@@ -1932,6 +2101,124 @@ public void checkACL(ServerCnxn cnxn, List<ACL> acl, int perm, List<Id> ids, Str
         throw new KeeperException.NoAuthException();
     }
 
+    /**
+     * check a path whether exceeded the quota.
+     *
+     * @param path
+     *            the path of the node, used for the quota prefix check
+     * @param lastData
+     *            the current node data, {@code null} for none
+     * @param data
+     *            the data to be set, or {@code null} for none
+     * @param type
+     *            currently, create and setData need to check quota
+     */
+    public void checkQuota(String path, byte[] lastData, byte[] data, int type) throws KeeperException.QuotaExceededException {
+        if (!enforceQuota) {
+            return;
+        }
+        long dataBytes = (data == null) ? 0 : data.length;
+        ZKDatabase zkDatabase = getZKDatabase();
+        String lastPrefix = zkDatabase.getDataTree().getMaxPrefixWithQuota(path);
+        if (StringUtils.isEmpty(lastPrefix)) {
+            return;
+        }
+
+        final String namespace = PathUtils.getTopNamespace(path);
+        switch (type) {
+            case OpCode.create:
+                checkQuota(lastPrefix, dataBytes, 1, namespace);
+                break;
+            case OpCode.setData:
+                checkQuota(lastPrefix, dataBytes - (lastData == null ? 0 : lastData.length), 0, namespace);
+                break;
+             default:
+                 throw new IllegalArgumentException("Unsupported OpCode for checkQuota: " + type);
+        }
+    }
+
+    /**
+     * check a path whether exceeded the quota.
+     *
+     * @param lastPrefix
+                  the path of the node which has a quota.
+     * @param bytesDiff
+     *            the diff to be added to number of bytes
+     * @param countDiff
+     *            the diff to be added to the count
+     * @param namespace
+      *           the namespace for collecting quota exceeded errors
+     */
+    private void checkQuota(String lastPrefix, long bytesDiff, long countDiff, String namespace)
+            throws KeeperException.QuotaExceededException {
+        LOG.debug("checkQuota: lastPrefix={}, bytesDiff={}, countDiff={}", lastPrefix, bytesDiff, countDiff);
+
+        // now check the quota we set
+        String limitNode = Quotas.limitPath(lastPrefix);
+        DataNode node = getZKDatabase().getNode(limitNode);
+        StatsTrack limitStats;
+        if (node == null) {
+            // should not happen
+            LOG.error("Missing limit node for quota {}", limitNode);
+            return;
+        }
+        synchronized (node) {
+            limitStats = new StatsTrack(node.data);
+        }
+        //check the quota
+        boolean checkCountQuota = countDiff != 0 && (limitStats.getCount() > -1 || limitStats.getCountHardLimit() > -1);
+        boolean checkByteQuota = bytesDiff != 0 && (limitStats.getBytes() > -1 || limitStats.getByteHardLimit() > -1);
+
+        if (!checkCountQuota && !checkByteQuota) {
+            return;
+        }
+
+        //check the statPath quota
+        String statNode = Quotas.statPath(lastPrefix);
+        node = getZKDatabase().getNode(statNode);
+
+        StatsTrack currentStats;
+        if (node == null) {
+            // should not happen
+            LOG.error("Missing node for stat {}", statNode);
+            return;
+        }
+        synchronized (node) {
+            currentStats = new StatsTrack(node.data);
+        }
+
+        //check the Count Quota
+        if (checkCountQuota) {
+            long newCount = currentStats.getCount() + countDiff;
+            boolean isCountHardLimit = limitStats.getCountHardLimit() > -1;
+            long countLimit = isCountHardLimit ? limitStats.getCountHardLimit() : limitStats.getCount();
+
+            if (newCount > countLimit) {
+                String msg = "Quota exceeded: " + lastPrefix + " [current count=" + newCount + ", " + (isCountHardLimit ? "hard" : "soft") + "CountLimit=" + countLimit + "]";
+                RATE_LOGGER.rateLimitLog(msg);
+                if (isCountHardLimit) {
+                    updateQuotaExceededMetrics(namespace);
+                    throw new KeeperException.QuotaExceededException(lastPrefix);
+                }
+            }
+        }
+
+        //check the Byte Quota
+        if (checkByteQuota) {
+            long newBytes = currentStats.getBytes() + bytesDiff;
+            boolean isByteHardLimit = limitStats.getByteHardLimit() > -1;
+            long byteLimit = isByteHardLimit ? limitStats.getByteHardLimit() : limitStats.getBytes();
+            if (newBytes > byteLimit) {
+                String msg = "Quota exceeded: " + lastPrefix + " [current bytes=" + newBytes + ", " + (isByteHardLimit ? "hard" : "soft") + "ByteLimit=" + byteLimit + "]";
+                RATE_LOGGER.rateLimitLog(msg);
+                if (isByteHardLimit) {
+                    updateQuotaExceededMetrics(namespace);
+                    throw new KeeperException.QuotaExceededException(lastPrefix);
+                }
+            }
+        }
+    }
+
     public static boolean isDigestEnabled() {
         return digestEnabled;
     }
@@ -1941,6 +2228,15 @@ public static void setDigestEnabled(boolean digestEnabled) {
         ZooKeeperServer.digestEnabled = digestEnabled;
     }
 
+    public static boolean isSerializeLastProcessedZxidEnabled() {
+        return serializeLastProcessedZxidEnabled;
+    }
+
+    public static void setSerializeLastProcessedZxidEnabled(boolean serializeLastZxidEnabled) {
+        serializeLastProcessedZxidEnabled = serializeLastZxidEnabled;
+        LOG.info("{} = {}", ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED, serializeLastZxidEnabled);
+    }
+
     /**
      * Trim a path to get the immediate predecessor.
      *
@@ -1964,8 +2260,8 @@ private String effectiveACLPath(Request request) throws KeeperException.BadArgum
         switch (request.type) {
         case OpCode.create:
         case OpCode.create2: {
-            CreateRequest req = new CreateRequest();
-            if (buffer2Record(request.request, req)) {
+            CreateRequest req = request.readRequestRecordNoException(CreateRequest::new);
+            if (req != null) {
                 mustCheckACL = true;
                 acl = req.getAcl();
                 path = parentPath(req.getPath());
@@ -1973,22 +2269,22 @@ private String effectiveACLPath(Request request) throws KeeperException.BadArgum
             break;
         }
         case OpCode.delete: {
-            DeleteRequest req = new DeleteRequest();
-            if (buffer2Record(request.request, req)) {
+            DeleteRequest req = request.readRequestRecordNoException(DeleteRequest::new);
+            if (req != null) {
                 path = parentPath(req.getPath());
             }
             break;
         }
         case OpCode.setData: {
-            SetDataRequest req = new SetDataRequest();
-            if (buffer2Record(request.request, req)) {
+            SetDataRequest req = request.readRequestRecordNoException(SetDataRequest::new);
+            if (req != null) {
                 path = req.getPath();
             }
             break;
         }
         case OpCode.setACL: {
-            SetACLRequest req = new SetACLRequest();
-            if (buffer2Record(request.request, req)) {
+            SetACLRequest req = request.readRequestRecordNoException(SetACLRequest::new);
+            if (req != null) {
                 mustCheckACL = true;
                 acl = req.getAcl();
                 path = req.getPath();
@@ -2074,7 +2370,7 @@ public boolean authWriteRequest(Request request) {
                 try {
                     request.cnxn.sendResponse(rh, null, null);
                 } catch (IOException e) {
-                    LOG.error("IOException : {}", e);
+                    LOG.warn("IOException", e);
                 }
             }
         }
@@ -2082,18 +2378,6 @@ public boolean authWriteRequest(Request request) {
         return err == KeeperException.Code.OK.intValue();
     }
 
-    private boolean buffer2Record(ByteBuffer request, Record record) {
-        boolean rv = false;
-        try {
-            ByteBufferInputStream.byteBuffer2Record(request, record);
-            request.rewind();
-            rv = true;
-        } catch (IOException ex) {
-        }
-
-        return rv;
-    }
-
     public int getOutstandingHandshakeNum() {
         if (serverCnxnFactory instanceof NettyServerCnxnFactory) {
             return ((NettyServerCnxnFactory) serverCnxnFactory).getOutstandingHandshakeNum();
@@ -2101,4 +2385,20 @@ public int getOutstandingHandshakeNum() {
             return 0;
         }
     }
+
+    public boolean isReconfigEnabled() {
+        return this.reconfigEnabled;
+    }
+
+    public ZooKeeperServerShutdownHandler getZkShutdownHandler() {
+        return zkShutdownHandler;
+    }
+
+    static void updateQuotaExceededMetrics(final String namespace) {
+        if (namespace == null) {
+            return;
+        }
+        ServerMetrics.getMetrics().QUOTA_EXCEEDED_ERROR_PER_NAMESPACE.add(namespace, 1);
+    }
 }
+
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerBean.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerBean.java
index bd9b6432440..e85d167a6aa 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerBean.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerBean.java
@@ -133,6 +133,18 @@ public long getFsyncThresholdExceedCount() {
         return zks.serverStats().getFsyncThresholdExceedCount();
     }
 
+    public long getAuthFailedCount() {
+        return zks.serverStats().getAuthFailedCount();
+    }
+
+    public long getNonMTLSRemoteConnCount() {
+        return zks.serverStats().getNonMTLSRemoteConnCount();
+    }
+
+    public long getNonMTLSLocalConnCount() {
+        return zks.serverStats().getNonMTLSLocalConnCount();
+    }
+
     public void resetLatency() {
         zks.serverStats().resetLatency();
     }
@@ -145,11 +157,23 @@ public void resetFsyncThresholdExceedCount() {
         zks.serverStats().resetFsyncThresholdExceedCount();
     }
 
+    public void resetAuthFailedCount() {
+        zks.serverStats().resetAuthFailedCount();
+    }
+
+    public void resetNonMTLSConnCount() {
+        zks.serverStats().resetNonMTLSRemoteConnCount();
+        zks.serverStats().resetNonMTLSLocalConnCount();
+    }
+
     public void resetStatistics() {
         ServerStats serverStats = zks.serverStats();
         serverStats.resetRequestCounters();
         serverStats.resetLatency();
         serverStats.resetFsyncThresholdExceedCount();
+        serverStats.resetAuthFailedCount();
+        serverStats.resetNonMTLSRemoteConnCount();
+        serverStats.resetNonMTLSLocalConnCount();
     }
 
     public long getNumAliveConnections() {
@@ -315,6 +339,16 @@ public void setFlushDelay(long delay) {
     // Request throttling settings
     ///////////////////////////////////////////////////////////////////////////
 
+    public int getThrottledOpWaitTime() {
+        return ZooKeeperServer.getThrottledOpWaitTime();
+    }
+
+    public void setThrottledOpWaitTime(int val) {
+        ZooKeeperServer.setThrottledOpWaitTime(val);
+    }
+
+    ///////////////////////////////////////////////////////////////////////////
+
     public int getRequestThrottleLimit() {
         return RequestThrottler.getMaxRequests();
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerConf.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerConf.java
index 499dd568071..8d0fe9394a8 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerConf.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerConf.java
@@ -187,7 +187,7 @@ public int getClientPortListenBacklog() {
      * @return map representation of configuration
      */
     public Map<String, Object> toMap() {
-        Map<String, Object> conf = new LinkedHashMap<String, Object>();
+        Map<String, Object> conf = new LinkedHashMap<>();
         conf.put(KEY_CLIENT_PORT, clientPort);
         conf.put(KEY_DATA_DIR, dataDir);
         conf.put(KEY_DATA_LOG_DIR, dataLogDir);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMXBean.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMXBean.java
index 71a9d987e04..eed66cca22c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMXBean.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMXBean.java
@@ -59,6 +59,18 @@ public interface ZooKeeperServerMXBean {
      * @return number of fsync threshold exceeds so far
      */
     long getFsyncThresholdExceedCount();
+    /**
+     * @return number of AuthFailedCount so far
+     */
+    long getAuthFailedCount();
+    /**
+     * @return number of NonMTLSLocalConnCount so far
+     */
+    long getNonMTLSLocalConnCount();
+    /**
+     * @return number of NonMTLSRemoteConnCount so far
+     */
+    long getNonMTLSRemoteConnCount();
     /**
      * @return number of outstanding requests.
      */
@@ -136,6 +148,9 @@ public interface ZooKeeperServerMXBean {
     boolean getRequestThrottleDropStale();
     void setRequestThrottleDropStale(boolean drop);
 
+    int getThrottledOpWaitTime();
+    void setThrottledOpWaitTime(int val);
+
     boolean getRequestStaleLatencyCheck();
     void setRequestStaleLatencyCheck(boolean check);
 
@@ -164,6 +179,14 @@ public interface ZooKeeperServerMXBean {
      * Reset Fsync Threshold Exceed Count statistics only.
      */
     void resetFsyncThresholdExceedCount();
+    /**
+     * Reset NonMTLS(Local+Remote)ConnCount statistics only.
+     */
+    void resetNonMTLSConnCount();
+    /**
+     * Reset AuthFailedCount statistics only.
+     */
+    void resetAuthFailedCount();
     /**
      * @return number of alive client connections
      */
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java
index 7ddb1deb9e6..c721e685bb6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java
@@ -20,10 +20,10 @@
 
 import java.io.IOException;
 import java.util.concurrent.CountDownLatch;
-import java.util.concurrent.TimeUnit;
 import javax.management.JMException;
 import org.apache.yetus.audience.InterfaceAudience;
 import org.apache.zookeeper.audit.ZKAuditProvider;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.jmx.ManagedUtil;
 import org.apache.zookeeper.metrics.MetricsProvider;
 import org.apache.zookeeper.metrics.MetricsProviderLifeCycleException;
@@ -31,9 +31,9 @@
 import org.apache.zookeeper.server.admin.AdminServer;
 import org.apache.zookeeper.server.admin.AdminServer.AdminServerException;
 import org.apache.zookeeper.server.admin.AdminServerFactory;
+import org.apache.zookeeper.server.auth.ProviderRegistry;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog.DatadirException;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
 import org.apache.zookeeper.server.util.JvmPauseMonitor;
 import org.apache.zookeeper.util.ServiceUtils;
 import org.slf4j.Logger;
@@ -130,6 +130,7 @@ public void runFromConfig(ServerConfig config) throws IOException, AdminServerEx
                 throw new IOException("Cannot boot MetricsProvider " + config.getMetricsProviderClassName(), error);
             }
             ServerMetrics.metricsProviderInitialized(metricsProvider);
+            ProviderRegistry.initialize();
             // Note that this thread isn't going to be doing anything else,
             // so rather than spawning another thread, we will just call
             // run() in this thread.
@@ -166,16 +167,12 @@ public void runFromConfig(ServerConfig config) throws IOException, AdminServerEx
                 secureCnxnFactory.startup(zkServer, needStartZKServer);
             }
 
-            containerManager = new ContainerManager(
-                zkServer.getZKDatabase(),
-                zkServer.firstProcessor,
-                Integer.getInteger("znode.container.checkIntervalMs", (int) TimeUnit.MINUTES.toMillis(1)),
-                Integer.getInteger("znode.container.maxPerMinute", 10000),
-                Long.getLong("znode.container.maxNeverUsedIntervalMs", 0)
-            );
+            containerManager = new ContainerManager(zkServer.getZKDatabase(), zkServer.firstProcessor);
             containerManager.start();
             ZKAuditProvider.addZKStartStopAuditLog();
 
+            serverStarted();
+
             // Watch status of ZooKeeper server. It will do a graceful shutdown
             // if the server is not running or hits an internal error.
             shutdownLatch.await();
@@ -188,9 +185,7 @@ public void runFromConfig(ServerConfig config) throws IOException, AdminServerEx
             if (secureCnxnFactory != null) {
                 secureCnxnFactory.join();
             }
-            if (zkServer.canShutdown()) {
-                zkServer.shutdown(true);
-            }
+            zkServer.shutdown(true);
         } catch (InterruptedException e) {
             // warn, but generally this is ok
             LOG.warn("Server interrupted", e);
@@ -235,4 +230,60 @@ ServerCnxnFactory getCnxnFactory() {
         return cnxnFactory;
     }
 
+    // VisibleForTesting
+    ServerCnxnFactory getSecureCnxnFactory() {
+        return secureCnxnFactory;
+    }
+
+    public int getClientPort() {
+        if (cnxnFactory != null) {
+            return cnxnFactory.getLocalPort();
+        }
+        return 0;
+    }
+
+    public int getSecureClientPort() {
+        if (secureCnxnFactory != null) {
+            return secureCnxnFactory.getLocalPort();
+        }
+        return 0;
+    }
+
+
+    /**
+     * Shutdowns properly the service, this method is not a public API.
+     */
+    public void close() {
+        ServerCnxnFactory primaryCnxnFactory = this.cnxnFactory;
+        ServerCnxnFactory secondaryCnxnFactory = this.secureCnxnFactory;
+        try {
+            if (primaryCnxnFactory == null) {
+                // in case of pure TLS we can hook into secureCnxnFactory
+                primaryCnxnFactory = secondaryCnxnFactory;
+            }
+            if (primaryCnxnFactory == null || primaryCnxnFactory.getZooKeeperServer() == null) {
+                LOG.info("Connection factory did not start");
+                return;
+            }
+            ZooKeeperServerShutdownHandler zkShutdownHandler = primaryCnxnFactory.getZooKeeperServer().getZkShutdownHandler();
+            zkShutdownHandler.handle(ZooKeeperServer.State.SHUTDOWN);
+            try {
+                // ServerCnxnFactory will call the shutdown
+                primaryCnxnFactory.join();
+            } catch (InterruptedException ex) {
+                Thread.currentThread().interrupt();
+            }
+        } finally {
+            // ensure that we are closing the sockets
+            if (primaryCnxnFactory != null) {
+                primaryCnxnFactory.shutdown();
+            }
+            if (secondaryCnxnFactory != null) {
+                secondaryCnxnFactory.shutdown();
+            }
+        }
+    }
+
+    protected void serverStarted() {
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerShutdownHandler.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerShutdownHandler.java
index 28cbcc98cf6..42e4642f7c3 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerShutdownHandler.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerShutdownHandler.java
@@ -26,9 +26,9 @@
  * SHUTDOWN server state transitions, which in turn releases the associated
  * shutdown latch.
  */
-class ZooKeeperServerShutdownHandler {
+public final class ZooKeeperServerShutdownHandler {
 
-    private final CountDownLatch shutdownLatch;
+        private final CountDownLatch shutdownLatch;
 
     ZooKeeperServerShutdownHandler(CountDownLatch shutdownLatch) {
         this.shutdownLatch = shutdownLatch;
@@ -39,7 +39,7 @@ class ZooKeeperServerShutdownHandler {
      *
      * @param state new server state
      */
-    void handle(State state) {
+    public void handle(State state) {
         if (state == State.ERROR || state == State.SHUTDOWN) {
             shutdownLatch.countDown();
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperThread.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperThread.java
index ab5c5f069b1..137b718db38 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperThread.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperThread.java
@@ -29,13 +29,7 @@ public class ZooKeeperThread extends Thread {
 
     private static final Logger LOG = LoggerFactory.getLogger(ZooKeeperThread.class);
 
-    private UncaughtExceptionHandler uncaughtExceptionalHandler = new UncaughtExceptionHandler() {
-
-        @Override
-        public void uncaughtException(Thread t, Throwable e) {
-            handleException(t.getName(), e);
-        }
-    };
+    private UncaughtExceptionHandler uncaughtExceptionalHandler = (t, e) -> handleException(t.getName(), e);
 
     public ZooKeeperThread(String threadName) {
         super(threadName);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooTrace.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooTrace.java
index c411a093483..464d818adc8 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooTrace.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooTrace.java
@@ -27,12 +27,16 @@
  * This class encapsulates and centralizes tracing for the ZooKeeper server.
  * Trace messages go to the log with TRACE level.
  * <p>
- * Log4j must be correctly configured to capture the TRACE messages.
+ * Logback must be correctly configured to capture the TRACE messages.
  */
 public class ZooTrace {
 
     public static final long CLIENT_REQUEST_TRACE_MASK = 1 << 1;
 
+    /**
+     * this field is obsolete
+     */
+    @Deprecated
     public static final long CLIENT_DATA_PACKET_TRACE_MASK = 1 << 2;
 
     public static final long CLIENT_PING_TRACE_MASK = 1 << 3;
@@ -47,6 +51,10 @@ public class ZooTrace {
 
     public static final long WARNING_TRACE_MASK = 1 << 8;
 
+    /**
+     * this field is obsolete
+     */
+    @Deprecated
     public static final long JMX_TRACE_MASK = 1 << 9;
 
     private static long traceMask = CLIENT_REQUEST_TRACE_MASK | SERVER_PACKET_TRACE_MASK | SESSION_TRACE_MASK | WARNING_TRACE_MASK;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/AuthRequest.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/AuthRequest.java
new file mode 100644
index 00000000000..5552a2420cc
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/AuthRequest.java
@@ -0,0 +1,66 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.admin;
+
+import org.apache.zookeeper.ZooDefs;
+
+/**
+ * Class representing auth data for performing ACL check on admin server commands.
+ *
+ * For example, SnapshotCommand requires {@link ZooDefs.Perms.ALL} permission on
+ * the root node.
+ *
+ */
+public class AuthRequest {
+    private final int permission;
+    private final String path;
+
+    /**
+     * @param permission
+     *                      the required permission for auth check
+     * @param path
+     *                      the ZNode path for auth check
+     */
+    public AuthRequest(final int permission, final String path) {
+        this.permission = permission;
+        this.path = path;
+    }
+
+    /**
+     * @return permission
+     */
+    public int getPermission() {
+        return permission;
+    }
+
+    /**
+     * @return ZNode path
+     */
+    public String getPath() {
+        return path;
+    }
+
+    @Override
+    public String toString() {
+        return "AuthRequest{"
+        + "permission=" + permission
+        + ", path='" + path + '\''
+        + '}';
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Command.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Command.java
index b422715bf2f..5bc332a2828 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Command.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Command.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server.admin;
 
+import java.io.InputStream;
 import java.util.Map;
 import java.util.Set;
 import org.apache.zookeeper.server.ZooKeeperServer;
@@ -44,12 +45,6 @@ public interface Command {
      */
     String getPrimaryName();
 
-    /**
-     * A string documenting this command (e.g., what it does, any arguments it
-     * takes).
-     */
-    String getDoc();
-
     /**
      * @return true if the command requires an active ZooKeeperServer or a
      *     synced peer in order to resolve
@@ -57,19 +52,39 @@ public interface Command {
     boolean isServerRequired();
 
     /**
-     * Run this command. Commands take a ZooKeeperServer and String-valued
-     * keyword arguments and return a map containing any information
+     * @return AuthRequest associated to the command. Null means auth check is not required.
+     */
+    AuthRequest getAuthRequest();
+
+    /**
+     * Run this command for HTTP GET request. Commands take a ZooKeeperServer, String-valued keyword
+     * arguments and return a CommandResponse object containing any information
      * constituting the response to the command. Commands are responsible for
      * parsing keyword arguments and performing any error handling if necessary.
      * Errors should be reported by setting the "error" entry of the returned
      * map with an appropriate message rather than throwing an exception.
      *
-     * @param zkServer
+     * @param zkServer ZooKeeper server
      * @param kwargs keyword -&gt; argument value mapping
-     * @return Map representing response to command containing at minimum:
+     * @return CommandResponse representing response to command containing at minimum:
      *    - "command" key containing the command's primary name
      *    - "error" key containing a String error message or null if no error
      */
-    CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs);
+    CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs);
 
+    /**
+     * Run this command for HTTP POST. Commands take a ZooKeeperServer and InputStream and
+     * return a CommandResponse object containing any information
+     * constituting the response to the command. Commands are responsible for
+     * parsing keyword arguments and performing any error handling if necessary.
+     * Errors should be reported by setting the "error" entry of the returned
+     * map with an appropriate message rather than throwing an exception.
+     *
+     * @param zkServer ZooKeeper server
+     * @param inputStream InputStream from request
+     * @return CommandResponse representing response to command containing at minimum:
+     *    - "command" key containing the command's primary name
+     *    - "error" key containing a String error message or null if no error
+     */
+     CommandResponse runPost(ZooKeeperServer zkServer, InputStream inputStream);
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandBase.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandBase.java
index 322de178f73..2a9ef99bb8a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandBase.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandBase.java
@@ -26,24 +26,27 @@ public abstract class CommandBase implements Command {
 
     private final String primaryName;
     private final Set<String> names;
-    private final String doc;
     private final boolean serverRequired;
+    private final AuthRequest authRequest;
 
     /**
      * @param names The possible names of this command, with the primary name first.
      */
     protected CommandBase(List<String> names) {
-        this(names, true, null);
+        this(names, true);
     }
     protected CommandBase(List<String> names, boolean serverRequired) {
         this(names, serverRequired, null);
     }
 
-    protected CommandBase(List<String> names, boolean serverRequired, String doc) {
+    protected CommandBase(List<String> names, boolean serverRequired, AuthRequest authRequest) {
+        if (authRequest != null && !serverRequired) {
+            throw new IllegalArgumentException("An active server is required for auth check");
+        }
         this.primaryName = names.get(0);
-        this.names = new HashSet<String>(names);
-        this.doc = doc;
+        this.names = new HashSet<>(names);
         this.serverRequired = serverRequired;
+        this.authRequest = authRequest;
     }
 
     @Override
@@ -56,16 +59,17 @@ public Set<String> getNames() {
         return names;
     }
 
-    @Override
-    public String getDoc() {
-        return doc;
-    }
 
     @Override
     public boolean isServerRequired() {
         return serverRequired;
     }
 
+    @Override
+    public AuthRequest getAuthRequest() {
+        return authRequest;
+    }
+
     /**
      * @return A response with the command set to the primary name and the
      *         error set to null (these are the two entries that all command
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandOutputter.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandOutputter.java
index a8fe8bdc049..b9a87830e1c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandOutputter.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandOutputter.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server.admin;
 
+import java.io.OutputStream;
 import java.io.PrintWriter;
 
 /**
@@ -31,6 +32,9 @@ public interface CommandOutputter {
     /** The MIME type of this output (e.g., "application/json") */
     String getContentType();
 
-    void output(CommandResponse response, PrintWriter pw);
+    /** Print out data as output */
+    default void output(CommandResponse response, PrintWriter pw) {}
 
+    /** Stream out data as output */
+    default void output(final CommandResponse response, final OutputStream os) {}
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandResponse.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandResponse.java
index d9e7239a113..d68d8ad399f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandResponse.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandResponse.java
@@ -17,8 +17,11 @@
 
 package org.apache.zookeeper.server.admin;
 
+import java.io.InputStream;
+import java.util.HashMap;
 import java.util.LinkedHashMap;
 import java.util.Map;
+import javax.servlet.http.HttpServletResponse;
 
 /**
  * A response from running a {@link Command}.
@@ -37,6 +40,9 @@ public class CommandResponse {
     private final String command;
     private final String error;
     private final Map<String, Object> data;
+    private final Map<String, String> headers;
+    private int statusCode;
+    private InputStream inputStream;
 
     /**
      * Creates a new response with no error string.
@@ -44,18 +50,35 @@ public class CommandResponse {
      * @param command command name
      */
     public CommandResponse(String command) {
-        this(command, null);
+        this(command, null, HttpServletResponse.SC_OK);
     }
     /**
      * Creates a new response.
      *
      * @param command command name
      * @param error error string (may be null)
+     * @param statusCode http status code
      */
-    public CommandResponse(String command, String error) {
+    public CommandResponse(String command, String error, int statusCode) {
+       this(command, error, statusCode, null);
+    }
+
+
+    /**
+     * Creates a new response.
+     *
+     * @param command command name
+     * @param error error string (may be null)
+     * @param statusCode http status code
+     * @param inputStream inputStream to send out data (may be null)
+     */
+    public CommandResponse(final String command, final String error, final int statusCode, final InputStream inputStream) {
         this.command = command;
         this.error = error;
-        data = new LinkedHashMap<String, Object>();
+        data = new LinkedHashMap<>();
+        headers = new HashMap<>();
+        this.statusCode = statusCode;
+        this.inputStream = inputStream;
     }
 
     /**
@@ -76,6 +99,38 @@ public String getError() {
         return error;
     }
 
+    /**
+     * Gets the http status code
+     *
+     * @return http status code
+     */
+    public int getStatusCode() {
+        return statusCode;
+    }
+
+    /**
+     * Sets the http status code
+     */
+    public void setStatusCode(int statusCode) {
+        this.statusCode = statusCode;
+    }
+
+    /**
+     * Gets the InputStream (may be null).
+     *
+     * @return InputStream
+     */
+    public InputStream getInputStream() {
+        return inputStream;
+    }
+
+    /**
+     * Sets the InputStream
+     */
+    public void setInputStream(final InputStream inputStream) {
+         this.inputStream = inputStream;
+    }
+
     /**
      * Adds a key/value pair to this response.
      *
@@ -96,6 +151,25 @@ public void putAll(Map<? extends String, ?> m) {
         data.putAll(m);
     }
 
+    /**
+     * Adds a header to this response.
+     *
+     * @param name name of the header
+     * @param value value of the header
+     */
+    public void addHeader(final String name, final String value) {
+        headers.put(name, value);
+    }
+
+    /**
+     * Returns all headers
+     *
+     * @return map representation of all headers
+     */
+    public Map<String, String> getHeaders() {
+        return headers;
+    }
+
     /**
      * Converts this response to a map. The returned map is mutable, and
      * changes to it do not reflect back into this response.
@@ -103,7 +177,7 @@ public void putAll(Map<? extends String, ?> m) {
      * @return map representation of response
      */
     public Map<String, Object> toMap() {
-        Map<String, Object> m = new LinkedHashMap<String, Object>(data);
+        Map<String, Object> m = new LinkedHashMap<>(data);
         m.put(KEY_COMMAND, command);
         m.put(KEY_ERROR, error);
         m.putAll(data);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java
index 7bb7c42410a..af69008986c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java
@@ -18,9 +18,17 @@
 
 package org.apache.zookeeper.server.admin;
 
+import static org.apache.zookeeper.server.persistence.FileSnap.SNAPSHOT_FILE_PREFIX;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
 import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.io.InputStream;
 import java.net.InetSocketAddress;
+import java.nio.charset.StandardCharsets;
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.HashMap;
@@ -31,16 +39,27 @@
 import java.util.Set;
 import java.util.SortedMap;
 import java.util.TreeMap;
+import java.util.concurrent.TimeUnit;
 import java.util.stream.Collectors;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
 import org.apache.zookeeper.Environment;
 import org.apache.zookeeper.Environment.Entry;
+import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.Version;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.data.ACL;
+import org.apache.zookeeper.data.Id;
+import org.apache.zookeeper.server.DataNode;
 import org.apache.zookeeper.server.DataTree;
 import org.apache.zookeeper.server.ServerCnxnFactory;
 import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.ZooTrace;
+import org.apache.zookeeper.server.auth.ProviderRegistry;
+import org.apache.zookeeper.server.auth.ServerAuthenticationProvider;
 import org.apache.zookeeper.server.persistence.SnapshotInfo;
+import org.apache.zookeeper.server.persistence.Util;
 import org.apache.zookeeper.server.quorum.Follower;
 import org.apache.zookeeper.server.quorum.FollowerZooKeeperServer;
 import org.apache.zookeeper.server.quorum.Leader;
@@ -51,7 +70,9 @@
 import org.apache.zookeeper.server.quorum.QuorumZooKeeperServer;
 import org.apache.zookeeper.server.quorum.ReadOnlyZooKeeperServer;
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
+import org.apache.zookeeper.server.util.RateLimiter;
 import org.apache.zookeeper.server.util.ZxidUtils;
+import org.eclipse.jetty.http.HttpStatus;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -65,10 +86,17 @@
 public class Commands {
 
     static final Logger LOG = LoggerFactory.getLogger(Commands.class);
+    // VisibleForTesting
+    static final String ADMIN_RATE_LIMITER_INTERVAL = "zookeeper.admin.rateLimiterIntervalInMS";
+    private static final long rateLimiterInterval = Integer.parseInt(System.getProperty(ADMIN_RATE_LIMITER_INTERVAL, "300000"));
+    // VisibleForTesting
+    static final String AUTH_INFO_SEPARATOR = " ";
+    // VisibleForTesting
+    static final String ROOT_PATH = "/";
 
     /** Maps command names to Command instances */
-    private static Map<String, Command> commands = new HashMap<String, Command>();
-    private static Set<String> primaryNames = new HashSet<String>();
+    private static Map<String, Command> commands = new HashMap<>();
+    private static Set<String> primaryNames = new HashSet<>();
 
     /**
      * Registers the given command. Registered commands can be run by passing
@@ -92,24 +120,146 @@ public static void registerCommand(Command command) {
      *
      * @param cmdName
      * @param zkServer
-     * @param kwargs String-valued keyword arguments to the command
+     * @param kwargs String-valued keyword arguments to the command from HTTP GET request
      *        (may be null if command requires no additional arguments)
+     * @param authInfo auth info for auth check
+     *        (null if command requires no auth check)
+     * @param request HTTP request
      * @return Map representing response to command containing at minimum:
      *    - "command" key containing the command's primary name
      *    - "error" key containing a String error message or null if no error
      */
-    public static CommandResponse runCommand(
-        String cmdName,
-        ZooKeeperServer zkServer,
-        Map<String, String> kwargs) {
+    public static CommandResponse runGetCommand(
+            String cmdName,
+            ZooKeeperServer zkServer,
+            Map<String, String> kwargs,
+            String authInfo,
+            HttpServletRequest request) {
+        return runCommand(cmdName, zkServer, kwargs, null, authInfo, request, true);
+    }
+
+    /**
+     * Run the registered command with name cmdName. Commands should not produce
+     * any exceptions; any (anticipated) errors should be reported in the
+     * "error" entry of the returned map. Likewise, if no command with the given
+     * name is registered, this will be noted in the "error" entry.
+     *
+     * @param cmdName
+     * @param zkServer
+     * @param inputStream InputStream from HTTP POST request
+     * @return Map representing response to command containing at minimum:
+     *    - "command" key containing the command's primary name
+     *    - "error" key containing a String error message or null if no error
+     */
+    public static CommandResponse runPostCommand(
+            String cmdName,
+            ZooKeeperServer zkServer,
+            InputStream inputStream,
+            String authInfo,
+            HttpServletRequest request) {
+        return runCommand(cmdName, zkServer, null, inputStream, authInfo, request, false);
+    }
+
+    private static CommandResponse runCommand(
+            String cmdName,
+            ZooKeeperServer zkServer,
+            Map<String, String> kwargs,
+            InputStream inputStream,
+            String authInfo,
+            HttpServletRequest request,
+            boolean isGet) {
         Command command = getCommand(cmdName);
         if (command == null) {
-            return new CommandResponse(cmdName, "Unknown command: " + cmdName);
+            // set the status code to 200 to keep the current behavior of existing commands
+            LOG.warn("Unknown command");
+            return new CommandResponse(cmdName, "Unknown command: " + cmdName, HttpServletResponse.SC_OK);
         }
         if (command.isServerRequired() && (zkServer == null || !zkServer.isRunning())) {
-            return new CommandResponse(cmdName, "This ZooKeeper instance is not currently serving requests");
+            // set the status code to 200 to keep the current behavior of existing commands
+            LOG.warn("This ZooKeeper instance is not currently serving requests for command");
+            return new CommandResponse(cmdName, "This ZooKeeper instance is not currently serving requests", HttpServletResponse.SC_OK);
+        }
+
+        final AuthRequest authRequest = command.getAuthRequest();
+        if (authRequest != null) {
+            if (authInfo == null) {
+                LOG.warn("Auth info is missing for command");
+                return new CommandResponse(cmdName, "Auth info is missing for the command", HttpServletResponse.SC_UNAUTHORIZED);
+            }
+            try {
+                final List<Id> ids = handleAuthentication(request, authInfo);
+                handleAuthorization(zkServer, ids, authRequest.getPermission(), authRequest.getPath());
+            } catch (final KeeperException.AuthFailedException e) {
+                return new CommandResponse(cmdName, "Not authenticated", HttpServletResponse.SC_UNAUTHORIZED);
+            } catch (final KeeperException.NoAuthException e) {
+                return new CommandResponse(cmdName, "Not authorized", HttpServletResponse.SC_FORBIDDEN);
+            } catch (final Exception e) {
+                LOG.warn("Error occurred during auth for command", e);
+                return new CommandResponse(cmdName, "Error occurred during auth", HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
+            }
+        }
+        return isGet ? command.runGet(zkServer, kwargs) : command.runPost(zkServer, inputStream);
+    }
+
+    private static List<Id> handleAuthentication(final HttpServletRequest request, final String authInfo) throws KeeperException.AuthFailedException {
+        final String[] authData = authInfo.split(AUTH_INFO_SEPARATOR);
+        // for IP and x509, auth info only contains the schema and Auth Id will be extracted from HTTP request
+        if (authData.length != 1 && authData.length != 2) {
+            LOG.warn("Invalid auth info length");
+            throw new KeeperException.AuthFailedException();
+        }
+
+        final String schema = authData[0];
+        final ServerAuthenticationProvider authProvider = ProviderRegistry.getServerProvider(schema);
+        if (authProvider != null) {
+            try {
+                final byte[] auth = authData.length == 2 ? authData[1].getBytes(StandardCharsets.UTF_8) : null;
+                final List<Id> ids = authProvider.handleAuthentication(request, auth);
+                if (ids.isEmpty()) {
+                    LOG.warn("Auth Id list is empty");
+                    throw new KeeperException.AuthFailedException();
+                }
+                return ids;
+            } catch (final RuntimeException e) {
+                LOG.warn("Caught runtime exception from AuthenticationProvider", e);
+                throw new KeeperException.AuthFailedException();
+            }
+        } else {
+            LOG.warn("Auth provider not found for schema");
+            throw new KeeperException.AuthFailedException();
+        }
+    }
+
+    /**
+     * Grant or deny authorization for a command by matching
+     * request-provided credentials with the ACLs present on a node.
+     *
+     * @param zkServer the ZooKeeper server object.
+     * @param ids the credentials extracted from the Authorization header.
+     * @param perm the set of permission bits required by the command.
+     * @param path the ZooKeeper node path whose ACLs should be used
+     * to satisfy the perm bits.
+     * @throws KeeperException.NoAuthException if one or more perm
+     * bits could not be satisfied.
+     */
+    private static void handleAuthorization(final ZooKeeperServer zkServer,
+                                            final List<Id> ids,
+                                            final int perm,
+                                            final String path)
+            throws KeeperException.NoNodeException, KeeperException.NoAuthException {
+        final DataNode dataNode = zkServer.getZKDatabase().getNode(path);
+        if (dataNode == null) {
+            throw new KeeperException.NoNodeException(path);
+        }
+        final List<ACL> acls = zkServer.getZKDatabase().aclForNode(dataNode);
+        // Check the individual bits of perm.
+        final int bitWidth = Integer.SIZE - Integer.numberOfLeadingZeros(perm);
+        for (int b = 0; b < bitWidth; b++) {
+            final int permBit = 1 << b;
+            if ((perm & permBit) != 0) {
+                zkServer.checkACL(null, acls, permBit, ids, path, null);
+            }
         }
-        return command.run(zkServer, kwargs);
     }
 
     /**
@@ -142,8 +292,11 @@ public static Command getCommand(String cmdName) {
         registerCommand(new LeaderCommand());
         registerCommand(new MonitorCommand());
         registerCommand(new ObserverCnxnStatResetCommand());
+        registerCommand(new RestoreCommand());
         registerCommand(new RuokCommand());
         registerCommand(new SetTraceMaskCommand());
+        registerCommand(new ShedConnectionsCommand());
+        registerCommand(new SnapshotCommand());
         registerCommand(new SrvrCommand());
         registerCommand(new StatCommand());
         registerCommand(new StatResetCommand());
@@ -159,14 +312,14 @@ public static Command getCommand(String cmdName) {
     /**
      * Reset all connection statistics.
      */
-    public static class CnxnStatResetCommand extends CommandBase {
+    public static class CnxnStatResetCommand extends GetCommand {
 
         public CnxnStatResetCommand() {
             super(Arrays.asList("connection_stat_reset", "crst"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             zkServer.getServerCnxnFactory().resetAllConnectionStats();
             return response;
@@ -179,14 +332,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
      * Server configuration parameters.
      * @see ZooKeeperServer#getConf()
      */
-    public static class ConfCommand extends CommandBase {
+    public static class ConfCommand extends GetCommand {
 
         public ConfCommand() {
             super(Arrays.asList("configuration", "conf", "config"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             response.putAll(zkServer.getConf().toMap());
             return response;
@@ -199,14 +352,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
      *   - "connections": list of connection info objects
      * @see org.apache.zookeeper.server.ServerCnxn#getConnectionInfo(boolean)
      */
-    public static class ConsCommand extends CommandBase {
+    public static class ConsCommand extends GetCommand {
 
         public ConsCommand() {
             super(Arrays.asList("connections", "cons"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             ServerCnxnFactory serverCnxnFactory = zkServer.getServerCnxnFactory();
             if (serverCnxnFactory != null) {
@@ -228,14 +381,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
     /**
      * Information on ZK datadir and snapdir size in bytes
      */
-    public static class DirsCommand extends CommandBase {
+    public static class DirsCommand extends GetCommand {
 
         public DirsCommand() {
             super(Arrays.asList("dirs"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             response.put("datadir_size", zkServer.getDataDirSize());
             response.put("logdir_size", zkServer.getLogDirSize());
@@ -253,14 +406,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
      * @see ZooKeeperServer#getSessionExpiryMap()
      * @see ZooKeeperServer#getEphemerals()
      */
-    public static class DumpCommand extends CommandBase {
+    public static class DumpCommand extends GetCommand {
 
         public DumpCommand() {
             super(Arrays.asList("dump"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             response.put("expiry_time_to_session_ids", zkServer.getSessionExpiryMap());
             response.put("session_id_to_ephemeral_paths", zkServer.getEphemerals());
@@ -272,14 +425,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
     /**
      * All defined environment variables.
      */
-    public static class EnvCommand extends CommandBase {
+    public static class EnvCommand extends GetCommand {
 
         public EnvCommand() {
             super(Arrays.asList("environment", "env", "envi"), false);
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             for (Entry e : Environment.list()) {
                 response.put(e.getKey(), e.getValue());
@@ -292,14 +445,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
     /**
      * Digest histories for every specific number of txns.
      */
-    public static class DigestCommand extends CommandBase {
+    public static class DigestCommand extends GetCommand {
 
         public DigestCommand() {
             super(Arrays.asList("hash"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             response.put("digests", zkServer.getZKDatabase().getDataTree().getDigestLog());
             return response;
@@ -311,14 +464,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
      * The current trace mask. Returned map contains:
      *   - "tracemask": Long
      */
-    public static class GetTraceMaskCommand extends CommandBase {
+    public static class GetTraceMaskCommand extends GetCommand {
 
         public GetTraceMaskCommand() {
             super(Arrays.asList("get_trace_mask", "gtmk"), false);
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             response.put("tracemask", ZooTrace.getTextTraceLevel());
             return response;
@@ -326,14 +479,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
 
     }
 
-    public static class InitialConfigurationCommand extends CommandBase {
+    public static class InitialConfigurationCommand extends GetCommand {
 
         public InitialConfigurationCommand() {
             super(Arrays.asList("initial_configuration", "icfg"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             response.put("initial_configuration", zkServer.getInitialConfig());
             return response;
@@ -345,14 +498,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
      * Is this server in read-only mode. Returned map contains:
      *   - "is_read_only": Boolean
      */
-    public static class IsroCommand extends CommandBase {
+    public static class IsroCommand extends GetCommand {
 
         public IsroCommand() {
             super(Arrays.asList("is_read_only", "isro"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             response.put("read_only", zkServer instanceof ReadOnlyZooKeeperServer);
             return response;
@@ -369,14 +522,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
      *   - "zxid": String
      *   - "timestamp": Long
      */
-    public static class LastSnapshotCommand extends CommandBase {
+    public static class LastSnapshotCommand extends GetCommand {
 
         public LastSnapshotCommand() {
             super(Arrays.asList("last_snapshot", "lsnp"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             SnapshotInfo info = zkServer.getTxnLogFactory().getLastSnapshotInfo();
             response.put("zxid", Long.toHexString(info == null ? -1L : info.zxid));
@@ -389,14 +542,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
     /**
      * Returns the leader status of this instance and the leader host string.
      */
-    public static class LeaderCommand extends CommandBase {
+    public static class LeaderCommand extends GetCommand {
 
         public LeaderCommand() {
             super(Arrays.asList("leader", "lead"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             if (zkServer instanceof QuorumZooKeeperServer) {
                 response.put("is_leader", zkServer instanceof LeaderZooKeeperServer);
@@ -432,18 +585,21 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
      *   - "open_file_descriptor_count": Long (unix only)
      *   - "max_file_descriptor_count": Long (unix only)
      *   - "fsync_threshold_exceed_count": Long
+     *   - "non_mtls_conn_count": Long
+     *   - "non_mtls_remote_conn_count": Long
+     *   - "non_mtls_local_conn_count": Long
      *   - "followers": Integer (leader only)
      *   - "synced_followers": Integer (leader only)
      *   - "pending_syncs": Integer (leader only)
      */
-    public static class MonitorCommand extends CommandBase {
+    public static class MonitorCommand extends GetCommand {
 
         public MonitorCommand() {
             super(Arrays.asList("monitor", "mntr"), false);
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             zkServer.dumpMonitorValues(response::put);
             ServerMetrics.getMetrics().getMetricsProvider().dump(response::put);
@@ -456,14 +612,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
     /**
      * Reset all observer connection statistics.
      */
-    public static class ObserverCnxnStatResetCommand extends CommandBase {
+    public static class ObserverCnxnStatResetCommand extends GetCommand {
 
         public ObserverCnxnStatResetCommand() {
             super(Arrays.asList("observer_connection_stat_reset", "orst"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             if (zkServer instanceof LeaderZooKeeperServer) {
                 Leader leader = ((LeaderZooKeeperServer) zkServer).getLeader();
@@ -477,17 +633,79 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
 
     }
 
+    /**
+     * Restore from snapshot on the current server.
+     *
+     * Returned map contains:
+     *  - "last_zxid": String
+     */
+    public static class RestoreCommand extends PostCommand {
+        static final String RESPONSE_DATA_LAST_ZXID = "last_zxid";
+        static final String ADMIN_RESTORE_ENABLED = "zookeeper.admin.restore.enabled";
+
+        private RateLimiter rateLimiter;
+
+        public RestoreCommand() {
+            super(Arrays.asList("restore", "rest"), true, new AuthRequest(ZooDefs.Perms.ALL, ROOT_PATH));
+            rateLimiter = new RateLimiter(1, rateLimiterInterval, TimeUnit.MILLISECONDS);
+        }
+
+        @Override
+        public CommandResponse runPost(final ZooKeeperServer zkServer, final InputStream inputStream) {
+            final CommandResponse response = initializeResponse();
+
+            // check feature flag
+            final boolean restoreEnabled = Boolean.parseBoolean(System.getProperty(ADMIN_RESTORE_ENABLED, "true"));
+            if (!restoreEnabled) {
+                response.setStatusCode(HttpServletResponse.SC_SERVICE_UNAVAILABLE);
+                LOG.warn("Restore command is disabled");
+                return response;
+            }
+
+            if (!zkServer.isSerializeLastProcessedZxidEnabled()) {
+                response.setStatusCode(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
+                LOG.warn("Restore command requires serializeLastProcessedZxidEnable flag is set to true");
+                return response;
+            }
+
+            if (inputStream == null){
+                response.setStatusCode(HttpServletResponse.SC_BAD_REQUEST);
+                LOG.warn("InputStream from restore request is null");
+                return response;
+            }
+
+            // check rate limiting
+            if (!rateLimiter.allow()) {
+                response.setStatusCode(HttpStatus.TOO_MANY_REQUESTS_429);
+                ServerMetrics.getMetrics().RESTORE_RATE_LIMITED_COUNT.add(1);
+                LOG.warn("Restore request was rate limited");
+                return response;
+            }
+
+            // restore from snapshot InputStream
+            try {
+                final long lastZxid = zkServer.restoreFromSnapshot(inputStream);
+                response.put(RESPONSE_DATA_LAST_ZXID, lastZxid);
+            } catch (final Exception e) {
+                response.setStatusCode(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
+                ServerMetrics.getMetrics().RESTORE_ERROR_COUNT.add(1);
+                LOG.warn("Exception occurred when restore snapshot via the restore command", e);
+            }
+            return response;
+        }
+    }
+
     /**
      * No-op command, check if the server is running
      */
-    public static class RuokCommand extends CommandBase {
+    public static class RuokCommand extends GetCommand {
 
         public RuokCommand() {
             super(Arrays.asList("ruok"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             return initializeResponse();
         }
 
@@ -499,14 +717,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
      *  Returned Map contains:
      *   - "tracemask": Long
      */
-    public static class SetTraceMaskCommand extends CommandBase {
+    public static class SetTraceMaskCommand extends GetCommand {
 
         public SetTraceMaskCommand() {
             super(Arrays.asList("set_trace_mask", "stmk"), false);
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             long traceMask;
             if (!kwargs.containsKey("traceMask")) {
@@ -527,6 +745,90 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
 
     }
 
+    /**
+     * Take a snapshot of current server and stream out the data.
+     *
+     *  Argument:
+     *   - "streaming": optional String to indicate whether streaming out data
+     *
+     *  Returned snapshot as stream if streaming is true and metadata of the snapshot
+     *   - "last_zxid": String
+     *   - "snapshot_size": String
+     */
+    public static class SnapshotCommand extends GetCommand {
+        static final String REQUEST_QUERY_PARAM_STREAMING = "streaming";
+
+        static final String RESPONSE_HEADER_LAST_ZXID = "last_zxid";
+        static final String RESPONSE_HEADER_SNAPSHOT_SIZE = "snapshot_size";
+
+        static final String ADMIN_SNAPSHOT_ENABLED = "zookeeper.admin.snapshot.enabled";
+
+        private final RateLimiter rateLimiter;
+
+        public SnapshotCommand() {
+            super(Arrays.asList("snapshot", "snap"), true, new AuthRequest(ZooDefs.Perms.ALL, ROOT_PATH));
+            rateLimiter = new RateLimiter(1, rateLimiterInterval, TimeUnit.MICROSECONDS);
+        }
+
+        @SuppressFBWarnings(value = "OBL_UNSATISFIED_OBLIGATION",
+                justification = "FileInputStream is passed to CommandResponse and closed in StreamOutputter")
+        @Override
+        public CommandResponse runGet(final ZooKeeperServer zkServer, final Map<String, String> kwargs) {
+            final CommandResponse response = initializeResponse();
+
+            // check feature flag
+            final boolean snapshotEnabled = Boolean.parseBoolean(System.getProperty(ADMIN_SNAPSHOT_ENABLED, "true"));
+            if (!snapshotEnabled) {
+                response.setStatusCode(HttpServletResponse.SC_SERVICE_UNAVAILABLE);
+                LOG.warn("Snapshot command is disabled");
+                return response;
+            }
+
+            if (!zkServer.isSerializeLastProcessedZxidEnabled()) {
+                response.setStatusCode(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
+                LOG.warn("Snapshot command requires serializeLastProcessedZxidEnable flag is set to true");
+                return response;
+            }
+
+            // check rate limiting
+            if (!rateLimiter.allow()) {
+                response.setStatusCode(HttpStatus.TOO_MANY_REQUESTS_429);
+                ServerMetrics.getMetrics().SNAPSHOT_RATE_LIMITED_COUNT.add(1);
+                LOG.warn("Snapshot request was rate limited");
+                return response;
+            }
+
+            // check the streaming query param
+            boolean streaming = true;
+            if (kwargs.containsKey(REQUEST_QUERY_PARAM_STREAMING)) {
+                streaming = Boolean.parseBoolean(kwargs.get(REQUEST_QUERY_PARAM_STREAMING));
+            }
+
+            // take snapshot and stream out data if needed
+            try {
+                final File snapshotFile = zkServer.takeSnapshot(false, false);
+                final long lastZxid = Util.getZxidFromName(snapshotFile.getName(), SNAPSHOT_FILE_PREFIX);
+                response.addHeader(RESPONSE_HEADER_LAST_ZXID, "0x" + ZxidUtils.zxidToString(lastZxid));
+
+                final long size = snapshotFile.length();
+                response.addHeader(RESPONSE_HEADER_SNAPSHOT_SIZE, String.valueOf(size));
+
+                if (size == 0) {
+                    response.setStatusCode(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
+                    ServerMetrics.getMetrics().SNAPSHOT_ERROR_COUNT.add(1);
+                    LOG.warn("Snapshot file {} is empty", snapshotFile);
+                } else if (streaming) {
+                    response.setInputStream(new FileInputStream(snapshotFile));
+                }
+            } catch (final Exception e) {
+                response.setStatusCode(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
+                ServerMetrics.getMetrics().SNAPSHOT_ERROR_COUNT.add(1);
+                LOG.warn("Exception occurred when taking the snapshot via the snapshot admin command", e);
+            }
+            return response;
+        }
+    }
+
     /**
      * Server information. Returned map contains:
      *   - "version": String
@@ -536,7 +838,7 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
      *   - "server_stats": ServerStats object
      *   - "node_count": Integer
      */
-    public static class SrvrCommand extends CommandBase {
+    public static class SrvrCommand extends GetCommand {
 
         public SrvrCommand() {
             super(Arrays.asList("server_stats", "srvr"));
@@ -548,7 +850,7 @@ protected SrvrCommand(List<String> names) {
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             LOG.info("running stat");
             response.put("version", Version.getFullVersion());
@@ -565,6 +867,77 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
 
     }
 
+    /**
+     * Attempts to shed approximately the specified percentage of connections.
+     *
+     * Request: JSON input stream containing the following required field:
+     * - "percentage": Integer [0-100] - percentage of connections to attempt shedding
+     *                                   value must be between 0 (no connections) and 100 (all connections).
+     *
+     * Response: JSON output stream containing:
+     * - "connections_shed": Integer - actual number of connections successfully closed
+     *                                 may vary due to randomness.
+     * - "percentage_requested": Integer - the percentage that was requested
+     */
+    public static class ShedConnectionsCommand extends PostCommand {
+        private static final String FIELD_PERCENTAGE = "percentage";
+
+        public ShedConnectionsCommand() {
+            super(Arrays.asList("shed_connections", "shed"), true, new AuthRequest(ZooDefs.Perms.ALL, ROOT_PATH));
+        }
+
+        @Override
+        public CommandResponse runPost(final ZooKeeperServer zkServer, final InputStream inputStream) {
+            final CommandResponse response = initializeResponse();
+
+            if (inputStream == null) {
+                response.setStatusCode(HttpServletResponse.SC_BAD_REQUEST);
+                response.put("error", "Request body is required");
+                return response;
+            }
+
+            try {
+                final ObjectMapper mapper = new ObjectMapper();
+                final JsonNode jsonNode = mapper.readTree(inputStream);
+
+                if (!jsonNode.has(FIELD_PERCENTAGE)) {
+                    response.setStatusCode(HttpServletResponse.SC_BAD_REQUEST);
+                    response.put("error", "Missing required field: " + FIELD_PERCENTAGE);
+                    return response;
+                }
+
+                final int percentage = jsonNode.get(FIELD_PERCENTAGE).asInt();
+                if (percentage < 0 || percentage > 100) {
+                    response.setStatusCode(HttpServletResponse.SC_BAD_REQUEST);
+                    response.put("error", "Percentage must be between 0 and 100");
+                    return response;
+                }
+
+                final ServerCnxnFactory factory = zkServer.getServerCnxnFactory();
+                final ServerCnxnFactory secureFactory = zkServer.getSecureServerCnxnFactory();
+
+                int connectionsShed = 0;
+                if (percentage > 0) {
+                    if (factory != null) {
+                        connectionsShed += factory.shedConnections(percentage);
+                    }
+                    if (secureFactory != null) {
+                        connectionsShed += secureFactory.shedConnections(percentage);
+                    }
+                }
+
+                response.put("connections_shed", connectionsShed);
+                response.put("percentage_requested", percentage);
+
+                LOG.info("Shed {} connections ({}%)", connectionsShed, percentage);
+            } catch (final IOException e) {
+                response.setStatusCode(HttpServletResponse.SC_BAD_REQUEST);
+                response.put("error", "Invalid JSON or failed to read request body: " + e.getMessage());
+            }
+            return response;
+        }
+    }
+
     /**
      * Same as SrvrCommand but has extra "connections" entry.
      */
@@ -575,8 +948,8 @@ public StatCommand() {
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
-            CommandResponse response = super.run(zkServer, kwargs);
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+            CommandResponse response = super.runGet(zkServer, kwargs);
 
             final Iterable<Map<String, Object>> connections;
             if (zkServer.getServerCnxnFactory() != null) {
@@ -601,14 +974,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
     /**
      * Resets server statistics.
      */
-    public static class StatResetCommand extends CommandBase {
+    public static class StatResetCommand extends GetCommand {
 
         public StatResetCommand() {
             super(Arrays.asList("stat_reset", "srst"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             zkServer.serverStats().reset();
             return response;
@@ -622,14 +995,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
      *   - "observers": list of observer learner handler info objects (leader/follower only)
      * @see org.apache.zookeeper.server.quorum.LearnerHandler#getLearnerHandlerInfo()
      */
-    public static class SyncedObserverConsCommand extends CommandBase {
+    public static class SyncedObserverConsCommand extends GetCommand {
 
         public SyncedObserverConsCommand() {
             super(Arrays.asList("observers", "obsr"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
 
             CommandResponse response = initializeResponse();
 
@@ -659,14 +1032,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
     /**
      * All defined system properties.
      */
-    public static class SystemPropertiesCommand extends CommandBase {
+    public static class SystemPropertiesCommand extends GetCommand {
 
         public SystemPropertiesCommand() {
             super(Arrays.asList("system_properties", "sysp"), false);
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             Properties systemProperties = System.getProperties();
             SortedMap<String, String> sortedSystemProperties = new TreeMap<>();
@@ -681,14 +1054,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
      * Returns the current ensemble configuration information.
      * It provides list of current voting members in the ensemble.
      */
-    public static class VotingViewCommand extends CommandBase {
+    public static class VotingViewCommand extends GetCommand {
 
         public VotingViewCommand() {
             super(Arrays.asList("voting_view"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             if (zkServer instanceof QuorumZooKeeperServer) {
                 QuorumPeer peer = ((QuorumZooKeeperServer) zkServer).self;
@@ -749,14 +1122,14 @@ private static String getAddressString(InetSocketAddress address) {
      * @see DataTree#getWatches()
      * @see DataTree#getWatches()
      */
-    public static class WatchCommand extends CommandBase {
+    public static class WatchCommand extends GetCommand {
 
         public WatchCommand() {
             super(Arrays.asList("watches", "wchc"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             DataTree dt = zkServer.getZKDatabase().getDataTree();
             CommandResponse response = initializeResponse();
             response.put("session_id_to_watched_paths", dt.getWatches().toMap());
@@ -770,14 +1143,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
      *   - "path_to_session_ids": Map&lt;String, Set&lt;Long&gt;&gt; path -&gt; session IDs of sessions watching path
      * @see DataTree#getWatchesByPath()
      */
-    public static class WatchesByPathCommand extends CommandBase {
+    public static class WatchesByPathCommand extends GetCommand {
 
         public WatchesByPathCommand() {
             super(Arrays.asList("watches_by_path", "wchp"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             DataTree dt = zkServer.getZKDatabase().getDataTree();
             CommandResponse response = initializeResponse();
             response.put("path_to_session_ids", dt.getWatchesByPath().toMap());
@@ -790,14 +1163,14 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
      * Summarized watch information.
      * @see DataTree#getWatchesSummary()
      */
-    public static class WatchSummaryCommand extends CommandBase {
+    public static class WatchSummaryCommand extends GetCommand {
 
         public WatchSummaryCommand() {
             super(Arrays.asList("watch_summary", "wchs"));
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             DataTree dt = zkServer.getZKDatabase().getDataTree();
             CommandResponse response = initializeResponse();
             response.putAll(dt.getWatchesSummary().toMap());
@@ -810,21 +1183,21 @@ public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs)
      * Returns the current phase of Zab protocol that peer is running.
      * It can be in one of these phases: ELECTION, DISCOVERY, SYNCHRONIZATION, BROADCAST
      */
-    public static class ZabStateCommand extends CommandBase {
+    public static class ZabStateCommand extends GetCommand {
 
         public ZabStateCommand() {
             super(Arrays.asList("zabstate"), false);
         }
 
         @Override
-        public CommandResponse run(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
             CommandResponse response = initializeResponse();
             if (zkServer instanceof QuorumZooKeeperServer) {
                 QuorumPeer peer = ((QuorumZooKeeperServer) zkServer).self;
                 QuorumPeer.ZabState zabState = peer.getZabState();
                 QuorumVerifier qv = peer.getQuorumVerifier();
 
-                QuorumPeer.QuorumServer voter = qv.getVotingMembers().get(peer.getId());
+                QuorumPeer.QuorumServer voter = qv.getVotingMembers().get(peer.getMyId());
                 boolean voting = (
                         voter != null
                                 && voter.addr.equals(peer.getQuorumAddress())
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogEntry.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/GetCommand.java
similarity index 53%
rename from zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogEntry.java
rename to zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/GetCommand.java
index 27973ba91a3..ea7e5d90734 100644
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogEntry.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/GetCommand.java
@@ -1,4 +1,4 @@
-/**
+/*
  * Licensed to the Apache Software Foundation (ASF) under one
  * or more contributor license agreements.  See the NOTICE file
  * distributed with this work for additional information
@@ -15,33 +15,33 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.apache.zookeeper.graph;
 
-import java.io.Serializable;
-import java.util.HashMap;
-import java.util.Map;
+package org.apache.zookeeper.server.admin;
+
+import java.io.InputStream;
+import java.util.List;
+import org.apache.zookeeper.server.ZooKeeperServer;
+
+/**
+ * Command that represents HTTP GET request
+ */
+
+public abstract class GetCommand extends CommandBase {
 
-public abstract class LogEntry implements Serializable {
-    private Map attributes;
+    protected GetCommand(List<String> names) {
+        super(names);
+    }
 
-    public enum Type { UNKNOWN, LOG4J, TXN };
-        
-    public LogEntry(long timestamp) {
-	attributes = new HashMap();
-	setAttribute("timestamp", new Long(timestamp));
+    protected GetCommand(List<String> names, boolean serverRequired) {
+        super(names, serverRequired);
     }
-    
-    public long getTimestamp() {
-	return (Long)getAttribute("timestamp");
-    }    
-    
-    public abstract Type getType();
-    
-    public void setAttribute(String key, Object v) {
-	attributes.put(key, v);
+
+    protected GetCommand(List<String> names, boolean serverRequired, AuthRequest authRequest) {
+        super(names, serverRequired, authRequest);
     }
 
-    public Object getAttribute(String key) {
-	return attributes.get(key);
+    @Override
+    public CommandResponse runPost(ZooKeeperServer zkServer, InputStream inputStream) {
+        return null;
     }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
index 27242436cff..3ec6f25b92e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
@@ -21,26 +21,32 @@
 import java.io.IOException;
 import java.security.GeneralSecurityException;
 import java.security.KeyStore;
-import java.util.ArrayList;
-import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.stream.Collectors;
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import org.apache.zookeeper.common.QuorumX509Util;
+import org.apache.zookeeper.common.SecretUtils;
 import org.apache.zookeeper.common.X509Util;
 import org.apache.zookeeper.server.ZooKeeperServer;
+import org.apache.zookeeper.server.auth.IPAuthenticationProvider;
+import org.eclipse.jetty.http.HttpHeader;
 import org.eclipse.jetty.http.HttpVersion;
+import org.eclipse.jetty.security.ConstraintMapping;
+import org.eclipse.jetty.security.ConstraintSecurityHandler;
 import org.eclipse.jetty.server.HttpConfiguration;
 import org.eclipse.jetty.server.HttpConnectionFactory;
 import org.eclipse.jetty.server.SecureRequestCustomizer;
 import org.eclipse.jetty.server.Server;
 import org.eclipse.jetty.server.ServerConnector;
+import org.eclipse.jetty.server.SslConnectionFactory;
 import org.eclipse.jetty.servlet.ServletContextHandler;
 import org.eclipse.jetty.servlet.ServletHolder;
+import org.eclipse.jetty.util.security.Constraint;
 import org.eclipse.jetty.util.ssl.SslContextFactory;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -83,7 +89,9 @@ public JettyAdminServer() throws AdminServerException, IOException, GeneralSecur
             Integer.getInteger("zookeeper.admin.idleTimeout", DEFAULT_IDLE_TIMEOUT),
             System.getProperty("zookeeper.admin.commandURL", DEFAULT_COMMAND_URL),
             Integer.getInteger("zookeeper.admin.httpVersion", DEFAULT_HTTP_VERSION),
-            Boolean.getBoolean("zookeeper.admin.portUnification"));
+            Boolean.getBoolean("zookeeper.admin.portUnification"),
+            Boolean.getBoolean("zookeeper.admin.forceHttps"),
+            Boolean.getBoolean("zookeeper.admin.needClientAuth"));
     }
 
     public JettyAdminServer(
@@ -92,7 +100,9 @@ public JettyAdminServer(
         int timeout,
         String commandUrl,
         int httpVersion,
-        boolean portUnification) throws IOException, GeneralSecurityException {
+        boolean portUnification,
+        boolean forceHttps,
+        boolean needClientAuth) throws IOException, GeneralSecurityException {
 
         this.port = port;
         this.idleTimeout = timeout;
@@ -102,7 +112,7 @@ public JettyAdminServer(
         server = new Server();
         ServerConnector connector = null;
 
-        if (!portUnification) {
+        if (!portUnification && !forceHttps) {
             connector = new ServerConnector(server);
         } else {
             SecureRequestCustomizer customizer = new SecureRequestCustomizer();
@@ -116,10 +126,15 @@ public JettyAdminServer(
             try (QuorumX509Util x509Util = new QuorumX509Util()) {
                 String privateKeyType = System.getProperty(x509Util.getSslKeystoreTypeProperty(), "");
                 String privateKeyPath = System.getProperty(x509Util.getSslKeystoreLocationProperty(), "");
-                String privateKeyPassword = System.getProperty(x509Util.getSslKeystorePasswdProperty(), "");
+                String privateKeyPassword = getPasswordFromSystemPropertyOrFile(
+                        x509Util.getSslKeystorePasswdProperty(),
+                        x509Util.getSslKeystorePasswdPathProperty());
+
                 String certAuthType = System.getProperty(x509Util.getSslTruststoreTypeProperty(), "");
                 String certAuthPath = System.getProperty(x509Util.getSslTruststoreLocationProperty(), "");
-                String certAuthPassword = System.getProperty(x509Util.getSslTruststorePasswdProperty(), "");
+                String certAuthPassword = getPasswordFromSystemPropertyOrFile(
+                        x509Util.getSslTruststorePasswdProperty(),
+                        x509Util.getSslTruststorePasswdPathProperty());
                 KeyStore keyStore = null, trustStore = null;
 
                 try {
@@ -132,16 +147,37 @@ public JettyAdminServer(
                     throw e;
                 }
 
-                SslContextFactory sslContextFactory = new SslContextFactory.Server();
+                SslContextFactory.Server sslContextFactory = new SslContextFactory.Server();
                 sslContextFactory.setKeyStore(keyStore);
                 sslContextFactory.setKeyStorePassword(privateKeyPassword);
                 sslContextFactory.setTrustStore(trustStore);
                 sslContextFactory.setTrustStorePassword(certAuthPassword);
+                sslContextFactory.setNeedClientAuth(needClientAuth);
+
+                String enabledProtocols = System.getProperty(x509Util.getSslEnabledProtocolsProperty());
+                if (enabledProtocols != null) {
+                    LOG.debug("Setting enabled protocols: '{}'", enabledProtocols);
+                    String[] enabledProtocolsArray = enabledProtocols.split(",");
+                    sslContextFactory.setIncludeProtocols(enabledProtocolsArray);
+                }
+
+                String sslCipherSuites = System.getProperty(x509Util.getSslCipherSuitesProperty());
+                if (sslCipherSuites != null) {
+                    LOG.debug("Setting enabled cipherSuites: '{}'", sslCipherSuites);
+                    String[] cipherSuitesArray = sslCipherSuites.split(",");
+                    sslContextFactory.setIncludeCipherSuites(cipherSuitesArray);
+                }
 
-                connector = new ServerConnector(
-                    server,
-                    new UnifiedConnectionFactory(sslContextFactory, HttpVersion.fromVersion(httpVersion).asString()),
-                    new HttpConnectionFactory(config));
+                if (forceHttps) {
+                    connector = new ServerConnector(server,
+                            new SslConnectionFactory(sslContextFactory, HttpVersion.fromVersion(httpVersion).asString()),
+                            new HttpConnectionFactory(config));
+                } else {
+                    connector = new ServerConnector(
+                            server,
+                            new UnifiedConnectionFactory(sslContextFactory, HttpVersion.fromVersion(httpVersion).asString()),
+                            new HttpConnectionFactory(config));
+                }
             }
         }
 
@@ -153,6 +189,7 @@ public JettyAdminServer(
 
         ServletContextHandler context = new ServletContextHandler(ServletContextHandler.SESSIONS);
         context.setContextPath("/*");
+        constrainTraceMethod(context);
         server.setHandler(context);
 
         context.addServlet(new ServletHolder(new CommandServlet()), commandUrl + "/*");
@@ -217,6 +254,7 @@ private class CommandServlet extends HttpServlet {
 
         private static final long serialVersionUID = 1L;
 
+        @Override
         protected void doGet(
             HttpServletRequest request,
             HttpServletResponse response) throws ServletException, IOException {
@@ -235,35 +273,130 @@ protected void doGet(
 
             // Extract keyword arguments to command from request parameters
             @SuppressWarnings("unchecked") Map<String, String[]> parameterMap = request.getParameterMap();
-            Map<String, String> kwargs = new HashMap<String, String>();
+            Map<String, String> kwargs = new HashMap<>();
             for (Map.Entry<String, String[]> entry : parameterMap.entrySet()) {
                 kwargs.put(entry.getKey(), entry.getValue()[0]);
             }
+            final String authInfo = request.getHeader(HttpHeader.AUTHORIZATION.asString());
 
             // Run the command
-            CommandResponse cmdResponse = Commands.runCommand(cmd, zkServer, kwargs);
+            final CommandResponse cmdResponse = Commands.runGetCommand(cmd, zkServer, kwargs, authInfo, request);
+            response.setStatus(cmdResponse.getStatusCode());
+
+            final Map<String, String> headers = cmdResponse.getHeaders();
+            for (final Map.Entry<String, String> header : headers.entrySet()) {
+                response.addHeader(header.getKey(), header.getValue());
+            }
+            final String clientIP = IPAuthenticationProvider.getClientIPAddress(request);
+            if (cmdResponse.getInputStream() == null) {
+                // Format and print the output of the command
+                CommandOutputter outputter = new JsonOutputter(clientIP);
+                response.setContentType(outputter.getContentType());
+                outputter.output(cmdResponse, response.getWriter());
+            } else {
+                // Stream out the output of the command
+                CommandOutputter outputter = new StreamOutputter(clientIP);
+                response.setContentType(outputter.getContentType());
+                outputter.output(cmdResponse, response.getOutputStream());
+            }
+        }
+
+        /**
+         * Serves HTTP POST requests. It reads request payload as raw data.
+         * It's up to each command to process the payload accordingly.
+         * For example, RestoreCommand uses the payload InputStream directly
+         * to read snapshot data.
+         */
+        @Override
+        protected void doPost(final HttpServletRequest request,
+                              final HttpServletResponse response) throws ServletException, IOException {
+            final String cmdName = extractCommandNameFromURL(request, response);
+            if (cmdName != null) {
+                final String authInfo = request.getHeader(HttpHeader.AUTHORIZATION.asString());
+                final CommandResponse cmdResponse = Commands.runPostCommand(cmdName, zkServer, request.getInputStream(), authInfo, request);
+                final String clientIP = IPAuthenticationProvider.getClientIPAddress(request);
+                sendJSONResponse(response, cmdResponse, clientIP);
+            }
+        }
+
+        /**
+         * Extracts the command name from URL if it exists otherwise null
+         */
+        private String extractCommandNameFromURL(final HttpServletRequest request,
+                                                 final HttpServletResponse response) throws IOException {
+            String cmd = request.getPathInfo();
+            if (cmd == null || cmd.equals("/")) {
+                printCommandLinks(response);
+                return null;
+            }
+            // Strip leading "/"
+            return cmd.substring(1);
+        }
+
+        /**
+         * Prints the list of URLs to each registered command as response.
+         */
+        private void printCommandLinks(final HttpServletResponse response) throws IOException {
+            for (final String link : commandLinks()) {
+                response.getWriter().println(link);
+                response.getWriter().println("<br/>");
+            }
+        }
+
+        /**
+         * Send JSON string as the response.
+         */
+        private void sendJSONResponse(final HttpServletResponse response,
+                                      final CommandResponse cmdResponse,
+                                      final String clientIP) throws IOException {
+            final CommandOutputter outputter = new JsonOutputter(clientIP);
 
-            // Format and print the output of the command
-            CommandOutputter outputter = new JsonOutputter();
-            response.setStatus(HttpServletResponse.SC_OK);
+            response.setStatus(cmdResponse.getStatusCode());
             response.setContentType(outputter.getContentType());
             outputter.output(cmdResponse, response.getWriter());
         }
-
     }
 
     /**
      * Returns a list of URLs to each registered Command.
      */
     private List<String> commandLinks() {
-        List<String> links = new ArrayList<String>();
-        List<String> commands = new ArrayList<String>(Commands.getPrimaryNames());
-        Collections.sort(commands);
-        for (String command : commands) {
-            String url = commandUrl + "/" + command;
-            links.add(String.format("<a href=\"%s\">%s</a>", url, command));
-        }
-        return links;
+        return Commands.getPrimaryNames().stream().sorted().map(command -> String.format("<a href=\"%s\">%s</a>", commandUrl + "/" + command , command)).collect(Collectors.toList());
+    }
+
+    /**
+     * Add constraint to a given context to disallow TRACE method
+     * @param ctxHandler the context to modify
+     */
+    private void constrainTraceMethod(ServletContextHandler ctxHandler) {
+        Constraint c = new Constraint();
+        c.setAuthenticate(true);
+
+        ConstraintMapping cmt = new ConstraintMapping();
+        cmt.setConstraint(c);
+        cmt.setMethod("TRACE");
+        cmt.setPathSpec("/*");
+
+        ConstraintSecurityHandler securityHandler = new ConstraintSecurityHandler();
+        securityHandler.setConstraintMappings(new ConstraintMapping[] {cmt});
+
+        ctxHandler.setSecurityHandler(securityHandler);
     }
 
+    /**
+     * Returns the password specified by the given property or stored in the file specified by the
+     * given path property. If both are specified, the password stored in the file will be returned.
+     * @param propertyName the name of the property
+     * @param pathPropertyName the name of the path property
+     * @return password value
+     */
+    private String getPasswordFromSystemPropertyOrFile(final String propertyName,
+                                                       final String pathPropertyName) {
+        String value = System.getProperty(propertyName, "");
+        final String pathValue = System.getProperty(pathPropertyName, "");
+        if (!pathValue.isEmpty()) {
+            value = String.valueOf(SecretUtils.readSecret(pathValue));
+        }
+        return value;
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JsonOutputter.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JsonOutputter.java
index 0679cfae818..44c88de9d76 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JsonOutputter.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JsonOutputter.java
@@ -21,7 +21,7 @@
 import com.fasterxml.jackson.core.JsonGenerationException;
 import com.fasterxml.jackson.databind.JsonMappingException;
 import com.fasterxml.jackson.databind.ObjectMapper;
-import com.fasterxml.jackson.databind.PropertyNamingStrategy;
+import com.fasterxml.jackson.databind.PropertyNamingStrategies;
 import com.fasterxml.jackson.databind.SerializationFeature;
 import java.io.IOException;
 import java.io.PrintWriter;
@@ -35,12 +35,14 @@ public class JsonOutputter implements CommandOutputter {
     public static final String ERROR_RESPONSE = "{\"error\": \"Exception writing command response to JSON\"}";
 
     private ObjectMapper mapper;
+    private final String clientIP;
 
-    public JsonOutputter() {
+    public JsonOutputter(final String clientIP) {
         mapper = new ObjectMapper();
         mapper.configure(SerializationFeature.WRITE_ENUMS_USING_TO_STRING, true);
         mapper.configure(SerializationFeature.INDENT_OUTPUT, true);
-        mapper.setPropertyNamingStrategy(PropertyNamingStrategy.SNAKE_CASE);
+        mapper.setPropertyNamingStrategy(PropertyNamingStrategies.SNAKE_CASE);
+        this.clientIP = clientIP;
     }
 
     @Override
@@ -59,7 +61,7 @@ public void output(CommandResponse response, PrintWriter pw) {
             LOG.warn("Exception writing command response to JSON:", e);
             pw.write(ERROR_RESPONSE);
         } catch (IOException e) {
-            LOG.warn("Exception writing command response to JSON:", e);
+            LOG.warn("Exception writing command response as JSON to {}", clientIP, e);
             pw.write(ERROR_RESPONSE);
         }
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/PostCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/PostCommand.java
new file mode 100644
index 00000000000..3f5d50a88e2
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/PostCommand.java
@@ -0,0 +1,37 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Command that represents HTTP POST request
+ */
+package org.apache.zookeeper.server.admin;
+
+import java.util.List;
+import java.util.Map;
+import org.apache.zookeeper.server.ZooKeeperServer;
+
+public abstract class PostCommand extends CommandBase {
+    protected PostCommand(List<String> names, boolean serverRequired, AuthRequest authRequest) {
+        super(names, serverRequired, authRequest);
+    }
+
+    @Override
+    public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+        return null;
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/StreamOutputter.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/StreamOutputter.java
new file mode 100644
index 00000000000..b0caa1923fb
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/StreamOutputter.java
@@ -0,0 +1,52 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.admin;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import org.apache.zookeeper.common.IOUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * A class for streaming data out.
+ */
+public class StreamOutputter implements CommandOutputter{
+    private static final Logger LOG = LoggerFactory.getLogger(StreamOutputter.class);
+    private final String clientIP;
+
+    public StreamOutputter(final String clientIP) {
+        this.clientIP = clientIP;
+    }
+
+    @Override
+    public String getContentType() {
+        return "application/octet-stream";
+    }
+
+    @Override
+    public void output(final CommandResponse response, final OutputStream os) {
+        try (final InputStream is = response.getInputStream()){
+            IOUtils.copyBytes(is, os, 1024, true);
+        } catch (final IOException e) {
+            LOG.warn("Exception streaming out data to {}", clientIP, e);
+        }
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/UnifiedConnectionFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/UnifiedConnectionFactory.java
index 71622dfc10d..2176c103310 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/UnifiedConnectionFactory.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/UnifiedConnectionFactory.java
@@ -20,6 +20,7 @@
 
 import javax.net.ssl.SSLEngine;
 import javax.net.ssl.SSLSession;
+import org.apache.zookeeper.server.ServerMetrics;
 import org.eclipse.jetty.io.Connection;
 import org.eclipse.jetty.io.EndPoint;
 import org.eclipse.jetty.io.ssl.SslConnection;
@@ -94,6 +95,7 @@ public Connection newConnection(Connector connector, EndPoint realEndPoint) {
         } else {
             sslConnection = null;
             plainEndpoint = aheadEndpoint;
+            ServerMetrics.getMetrics().INSECURE_ADMIN.add(1);
         }
 
         ConnectionFactory next = connector.getConnectionFactory(nextProtocol);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/AuthenticationProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/AuthenticationProvider.java
index 179eac8dfbf..1de8a741184 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/AuthenticationProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/AuthenticationProvider.java
@@ -18,7 +18,11 @@
 
 package org.apache.zookeeper.server.auth;
 
+import java.util.ArrayList;
+import java.util.List;
+import javax.servlet.http.HttpServletRequest;
 import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.server.ServerCnxn;
 
 /**
@@ -49,6 +53,21 @@ public interface AuthenticationProvider {
      */
     KeeperException.Code handleAuthentication(ServerCnxn cnxn, byte[] authData);
 
+    /**
+     * This method is called when admin server command passes authentication data for this
+     * scheme.
+     *
+     * @param request
+     *                the request that contains the authentication information.
+     * @param authData
+     *                the authentication data received.
+     * @return Ids
+     *                the list of Id. Empty list means not authenticated
+     */
+    default List<Id> handleAuthentication(HttpServletRequest request, byte[] authData) {
+        return new ArrayList<>();
+    }
+
     /**
      * This method is called to see if the given id matches the given id
      * expression in the ACL. This allows schemes to use application specific
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/DigestAuthenticationProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/DigestAuthenticationProvider.java
index 2330000a6f3..1a13d5a1a8a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/DigestAuthenticationProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/DigestAuthenticationProvider.java
@@ -18,8 +18,13 @@
 
 package org.apache.zookeeper.server.auth;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import javax.servlet.http.HttpServletRequest;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.server.ServerCnxn;
@@ -30,6 +35,24 @@ public class DigestAuthenticationProvider implements AuthenticationProvider {
 
     private static final Logger LOG = LoggerFactory.getLogger(DigestAuthenticationProvider.class);
 
+    private static final String DEFAULT_DIGEST_ALGORITHM = "SHA1";
+
+    public static final String DIGEST_ALGORITHM_KEY = "zookeeper.DigestAuthenticationProvider.digestAlg";
+
+    private static final String DIGEST_ALGORITHM = System.getProperty(DIGEST_ALGORITHM_KEY, DEFAULT_DIGEST_ALGORITHM);
+
+    static {
+        try {
+            //sanity check, pre-check the availability of the algorithm to avoid some unexpected exceptions in the runtime
+            generateDigest(DIGEST_ALGORITHM);
+        } catch (NoSuchAlgorithmException e) {
+            throw new RuntimeException("don't support this ACL digest algorithm: " + DIGEST_ALGORITHM + " in the current environment");
+        }
+        LOG.info("ACL digest algorithm is: {}", DIGEST_ALGORITHM);
+    }
+
+    private static final String DIGEST_AUTH_ENABLED = "zookeeper.DigestAuthenticationProvider.enabled";
+
     /** specify a command line property with key of
      * "zookeeper.DigestAuthenticationProvider.superDigest"
      * and value of "super:&lt;base64encoded(SHA1(password))&gt;" to enable
@@ -37,6 +60,12 @@ public class DigestAuthenticationProvider implements AuthenticationProvider {
      */
     private static final String superDigest = System.getProperty("zookeeper.DigestAuthenticationProvider.superDigest");
 
+    public static boolean isEnabled() {
+        boolean enabled = Boolean.parseBoolean(System.getProperty(DIGEST_AUTH_ENABLED, "true"));
+        LOG.info("{} = {}", DIGEST_AUTH_ENABLED, enabled);
+        return enabled;
+    }
+
     public String getScheme() {
         return "digest";
     }
@@ -88,23 +117,29 @@ private static char encode(int i) {
 
     public static String generateDigest(String idPassword) throws NoSuchAlgorithmException {
         String[] parts = idPassword.split(":", 2);
-        byte[] digest = MessageDigest.getInstance("SHA1").digest(idPassword.getBytes());
+        byte[] digest = digest(idPassword);
         return parts[0] + ":" + base64Encode(digest);
     }
 
+    // @VisibleForTesting
+    public static byte[] digest(String idPassword) throws NoSuchAlgorithmException {
+        return MessageDigest.getInstance(DIGEST_ALGORITHM).digest(idPassword.getBytes(UTF_8));
+    }
+
     public KeeperException.Code handleAuthentication(ServerCnxn cnxn, byte[] authData) {
-        String id = new String(authData);
-        try {
-            String digest = generateDigest(id);
-            if (digest.equals(superDigest)) {
-                cnxn.addAuthInfo(new Id("super", ""));
-            }
-            cnxn.addAuthInfo(new Id(getScheme(), digest));
-            return KeeperException.Code.OK;
-        } catch (NoSuchAlgorithmException e) {
-            LOG.error("Missing algorithm", e);
+        final List<Id> ids = handleAuthentication(authData);
+        if (ids.isEmpty()) {
+            return KeeperException.Code.AUTHFAILED;
         }
-        return KeeperException.Code.AUTHFAILED;
+        for (Id id : ids) {
+            cnxn.addAuthInfo(id);
+        }
+        return KeeperException.Code.OK;
+    }
+
+    @Override
+    public List<Id> handleAuthentication(HttpServletRequest request, byte[] authData) {
+        return handleAuthentication(authData);
     }
 
     public boolean isAuthenticated() {
@@ -140,4 +175,18 @@ public static void main(String[] args) throws NoSuchAlgorithmException {
         }
     }
 
+    private List<Id> handleAuthentication(final byte[] authData) {
+        final List<Id> ids = new ArrayList<>();
+        final String id = new String(authData);
+        try {
+            final String digest = generateDigest(id);
+            if (digest.equals(superDigest)) {
+                ids.add(new Id("super", ""));
+            }
+            ids.add(new Id(getScheme(), digest));
+        } catch (final NoSuchAlgorithmException e) {
+            LOG.error("Missing algorithm", e);
+        }
+        return Collections.unmodifiableList(ids);
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/EnsembleAuthenticationProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/EnsembleAuthenticationProvider.java
index 5fb4de2c975..1e24c928353 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/EnsembleAuthenticationProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/EnsembleAuthenticationProvider.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server.auth;
 
+import java.nio.charset.StandardCharsets;
 import java.util.HashSet;
 import java.util.Set;
 import org.apache.zookeeper.KeeperException;
@@ -51,7 +52,7 @@ public EnsembleAuthenticationProvider() {
     }
 
     public void setEnsembleNames(String namesCSV) {
-        ensembleNames = new HashSet<String>();
+        ensembleNames = new HashSet<>();
         for (String name : namesCSV.split(",")) {
             ensembleNames.add(name.trim());
         }
@@ -76,7 +77,7 @@ public KeeperException.Code handleAuthentication(ServerCnxn cnxn, byte[] authDat
             return KeeperException.Code.OK;
         }
 
-        String receivedEnsembleName = new String(authData);
+        String receivedEnsembleName = new String(authData, StandardCharsets.UTF_8);
 
         if (ensembleNames == null) {
             ServerMetrics.getMetrics().ENSEMBLE_AUTH_SKIP.add(1);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/IPAuthenticationProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/IPAuthenticationProvider.java
index b93e55a32e4..0b4ef9a703e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/IPAuthenticationProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/IPAuthenticationProvider.java
@@ -18,11 +18,30 @@
 
 package org.apache.zookeeper.server.auth;
 
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import java.util.StringTokenizer;
+import java.util.regex.Pattern;
+import javax.servlet.http.HttpServletRequest;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.server.ServerCnxn;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 public class IPAuthenticationProvider implements AuthenticationProvider {
+    private static final Logger LOG = LoggerFactory.getLogger(IPAuthenticationProvider.class);
+    public static final String X_FORWARDED_FOR_HEADER_NAME = "X-Forwarded-For";
+
+    public static final String USE_X_FORWARDED_FOR_KEY = "zookeeper.IPAuthenticationProvider.usexforwardedfor";
+    private static final int IPV6_BYTE_LENGTH = 16; // IPv6 address is 128 bits = 16 bytes
+    private static final int IPV6_SEGMENT_COUNT = 8; // IPv6 address has 8 segments
+    private static final int IPV6_SEGMENT_BYTE_LENGTH = 2; // Each segment has up to two bytes
+    private static final int IPV6_SEGMENT_HEX_LENGTH = 4; // Each segment has up to 4 hex digits
+
+    private static final Pattern IPV6_PATTERN = Pattern.compile(":");
+    private static final Pattern IPV4_PATTERN = Pattern.compile("\\.");
 
     public String getScheme() {
         return "ip";
@@ -34,12 +53,27 @@ public KeeperException.Code handleAuthentication(ServerCnxn cnxn, byte[] authDat
         return KeeperException.Code.OK;
     }
 
+    @Override
+    public List<Id> handleAuthentication(HttpServletRequest request, byte[] authData) {
+        final List<Id> ids = new ArrayList<>();
+
+        final String ip = getClientIPAddress(request);
+        ids.add(new Id(getScheme(), ip));
+
+        return Collections.unmodifiableList(ids);
+    }
+
     // This is a bit weird but we need to return the address and the number of
     // bytes (to distinguish between IPv4 and IPv6
     private byte[] addr2Bytes(String addr) {
-        byte[] b = v4addr2Bytes(addr);
-        // TODO Write the v6addr2Bytes
-        return b;
+        if (IPV6_PATTERN.matcher(addr).find()) {
+            return v6addr2Bytes(addr);
+        } else if (IPV4_PATTERN.matcher(addr).find()) {
+            return v4addr2Bytes(addr);
+        } else {
+            LOG.warn("Input string does not resemble an IPv4 or IPv6 address: {}", addr);
+            return null;
+        }
     }
 
     private byte[] v4addr2Bytes(String addr) {
@@ -63,6 +97,83 @@ private byte[] v4addr2Bytes(String addr) {
         return b;
     }
 
+    /**
+     * Validates an IPv6 address string and converts it into a byte array.
+     *
+     * @param ipv6Addr The IPv6 address string to validate.
+     * @return A byte array representing the IPv6 address if valid, or null if the address
+     * is invalid or cannot be parsed.
+     */
+    static byte[] v6addr2Bytes(String ipv6Addr) {
+        try {
+            return parseV6addr(ipv6Addr);
+        } catch (IllegalArgumentException e) {
+            LOG.warn("Fail to parse {} as IPv6 address: {}", ipv6Addr, e.getMessage());
+            return null;
+        }
+    }
+
+    static byte[] parseV6addr(String ipv6Addr) {
+        // Split the address by "::" to handle zero compression, -1 to keep trailing empty strings
+        String[] parts = ipv6Addr.split("::", -1);
+
+        String[] segments1 = new String[0];
+        String[] segments2 = new String[0];
+
+        // Case 1: No "::" (full address)
+        if (parts.length == 1) {
+            segments1 = parts[0].split(":", -1);
+            if (segments1.length != IPV6_SEGMENT_COUNT) {
+                String reason = "wrong number of segments";
+                throw new IllegalArgumentException(reason);
+            }
+        } else if (parts.length == 2) {
+            // Case 2: "::" is present
+            // Handle cases like "::1" or "1::"
+            if (!parts[0].isEmpty()) {
+                segments1 = parts[0].split(":", -1);
+            }
+            if (!parts[1].isEmpty()) {
+                segments2 = parts[1].split(":", -1);
+            }
+
+            // Check if the total number of explicit segments exceeds 8
+            if (segments1.length + segments2.length >= IPV6_SEGMENT_COUNT) {
+                String reason = "too many segments";
+                throw new IllegalArgumentException(reason);
+            }
+        } else {
+            // Case 3: Invalid number of parts after splitting by "::" (should be 1 or 2)
+            String reason = "too many '::'";
+            throw new IllegalArgumentException(reason);
+        }
+
+        byte[] result = new byte[IPV6_BYTE_LENGTH];
+        // Process segments before "::"
+        parseV6Segment(result, 0, segments1);
+        // Process segments after "::"
+        parseV6Segment(result, IPV6_BYTE_LENGTH - segments2.length * IPV6_SEGMENT_BYTE_LENGTH, segments2);
+
+        return result;
+    }
+
+    private static void parseV6Segment(byte[] addr, int i, String[] segments) {
+        for (String segment : segments) {
+            if (segment.isEmpty()) {
+                throw new IllegalArgumentException("empty segment");
+            } else if (segment.length() > IPV6_SEGMENT_HEX_LENGTH) {
+                throw new IllegalArgumentException("segment too long");
+            }
+            try {
+                int value = Integer.parseInt(segment, 16);
+                addr[i++] = (byte) ((value >> 8) & 0xFF);
+                addr[i++] = (byte) (value & 0xFF);
+            } catch (NumberFormatException e) {
+                throw new IllegalArgumentException("invalid hexadecimal characters in segment: " + segment);
+            }
+        }
+    }
+
     private void mask(byte[] b, int bits) {
         int start = bits / 8;
         int startMask = (1 << (8 - (bits % 8))) - 1;
@@ -75,6 +186,7 @@ private void mask(byte[] b, int bits) {
     }
 
     public boolean matches(String id, String aclExpr) {
+        LOG.trace("id: '{}' aclExpr:  {}", id, aclExpr);
         String[] parts = aclExpr.split("/", 2);
         byte[] aclAddr = addr2Bytes(parts[0]);
         if (aclAddr == null) {
@@ -97,6 +209,10 @@ public boolean matches(String id, String aclExpr) {
             return false;
         }
         mask(remoteAddr, bits);
+        // Check if id and acl expression are of different formats (ipv6 or iv4) return false
+        if (remoteAddr.length != aclAddr.length) {
+            return false;
+        }
         for (int i = 0; i < remoteAddr.length; i++) {
             if (remoteAddr[i] != aclAddr[i]) {
                 return false;
@@ -128,4 +244,22 @@ public boolean isValid(String id) {
         return true;
     }
 
+    /**
+     * Returns the HTTP(s) client IP address
+     * @param request HttpServletRequest
+     * @return IP address
+     */
+    public static String getClientIPAddress(final HttpServletRequest request) {
+        if (!Boolean.getBoolean(USE_X_FORWARDED_FOR_KEY)) {
+            return request.getRemoteAddr();
+        }
+
+        // to handle the case that a HTTP(s) client connects via a proxy or load balancer
+        final String xForwardedForHeader = request.getHeader(X_FORWARDED_FOR_HEADER_NAME);
+        if (xForwardedForHeader == null) {
+            return request.getRemoteAddr();
+        }
+        // the format of the field is: X-Forwarded-For: client, proxy1, proxy2 ...
+        return new StringTokenizer(xForwardedForHeader, ",").nextToken().trim();
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/KerberosName.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/KerberosName.java
index 02ec5932182..a240c45b656 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/KerberosName.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/KerberosName.java
@@ -322,7 +322,7 @@ String apply(String[] params) throws IOException {
     }
 
     static List<Rule> parseRules(String rules) {
-        List<Rule> result = new ArrayList<Rule>();
+        List<Rule> result = new ArrayList<>();
         String remaining = rules.trim();
         while (remaining.length() > 0) {
             Matcher matcher = ruleParser.matcher(remaining);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/KeyAuthenticationProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/KeyAuthenticationProvider.java
index 03c15a1a559..cf252b9b08a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/KeyAuthenticationProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/KeyAuthenticationProvider.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.server.auth;
 
-import java.nio.charset.StandardCharsets;
+import static java.nio.charset.StandardCharsets.UTF_8;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.KeeperException.NoNodeException;
 import org.apache.zookeeper.data.Id;
@@ -37,7 +37,7 @@
  * See the "Pluggable ZooKeeper authentication" section of the
  * "Zookeeper Programmer's Guide" for general details of implementing an
  * authentication plugin. e.g.
- * http://zookeeper.apache.org/doc/trunk/zookeeperProgrammers.html#sc_ZooKeeperPluggableAuthentication
+ * http://zookeeper.apache.org/doc/current/zookeeperProgrammers.html#sc_ZooKeeperPluggableAuthentication
  *
  * This class looks for a numeric "key" under the /key node.
  * Authorization is granted if the user passes in as authorization a number
@@ -75,8 +75,8 @@ private byte[] getKey(ZooKeeperServer zks) {
     private boolean validate(byte[] key, byte[] auth) {
         // perform arbitrary function (auth is a multiple of key)
         try {
-            String keyStr = new String(key, StandardCharsets.UTF_8);
-            String authStr = new String(auth, StandardCharsets.UTF_8);
+            String keyStr = new String(key, UTF_8);
+            String authStr = new String(auth, UTF_8);
             int keyVal = Integer.parseInt(keyStr);
             int authVal = Integer.parseInt(authStr);
             if (keyVal != 0 && ((authVal % keyVal) != 0)) {
@@ -92,22 +92,11 @@ private boolean validate(byte[] key, byte[] auth) {
     @Override
     public KeeperException.Code handleAuthentication(ServerObjs serverObjs, byte[] authData) {
         byte[] key = getKey(serverObjs.getZks());
-        String authStr = "";
+        String authStr = new String(authData, UTF_8);
         String keyStr = "";
-        try {
-            authStr = new String(authData, StandardCharsets.UTF_8);
-        } catch (Exception e) {
-            LOG.error("UTF-8", e);
-        }
         if (key != null) {
             if (!validate(key, authData)) {
-                try {
-                    keyStr = new String(key, StandardCharsets.UTF_8);
-                } catch (Exception e) {
-                    LOG.error("UTF-8", e);
-                    // empty key
-                    keyStr = authStr;
-                }
+                keyStr = new String(key, UTF_8);
                 LOG.debug("KeyAuthenticationProvider handleAuthentication ({}, {}) -> FAIL.\n", keyStr, authStr);
                 return KeeperException.Code.AUTHFAILED;
             }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/ProviderRegistry.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/ProviderRegistry.java
index 29997a2c919..bab8059e0b6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/ProviderRegistry.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/ProviderRegistry.java
@@ -29,8 +29,10 @@ public class ProviderRegistry {
 
     private static final Logger LOG = LoggerFactory.getLogger(ProviderRegistry.class);
 
+    public static final String AUTHPROVIDER_PROPERTY_PREFIX = "zookeeper.authProvider.";
+
     private static boolean initialized = false;
-    private static Map<String, AuthenticationProvider> authenticationProviders = new HashMap<>();
+    private static final Map<String, AuthenticationProvider> authenticationProviders = new HashMap<>();
 
     //VisibleForTesting
     public static void reset() {
@@ -43,27 +45,37 @@ public static void reset() {
     public static void initialize() {
         synchronized (ProviderRegistry.class) {
             IPAuthenticationProvider ipp = new IPAuthenticationProvider();
-            DigestAuthenticationProvider digp = new DigestAuthenticationProvider();
             authenticationProviders.put(ipp.getScheme(), ipp);
-            authenticationProviders.put(digp.getScheme(), digp);
+
+            if (DigestAuthenticationProvider.isEnabled()) {
+                DigestAuthenticationProvider digp = new DigestAuthenticationProvider();
+                authenticationProviders.put(digp.getScheme(), digp);
+            }
+
             Enumeration<Object> en = System.getProperties().keys();
             while (en.hasMoreElements()) {
                 String k = (String) en.nextElement();
-                if (k.startsWith("zookeeper.authProvider.")) {
-                    String className = System.getProperty(k);
-                    try {
-                        Class<?> c = ZooKeeperServer.class.getClassLoader().loadClass(className);
-                        AuthenticationProvider ap = (AuthenticationProvider) c.getDeclaredConstructor().newInstance();
-                        authenticationProviders.put(ap.getScheme(), ap);
-                    } catch (Exception e) {
-                        LOG.warn("Problems loading {}", className, e);
-                    }
-                }
+                addOrUpdateProvider(k);
             }
             initialized = true;
         }
     }
 
+    public static void addOrUpdateProvider(String authKey) {
+        synchronized (ProviderRegistry.class) {
+            if (authKey.startsWith(AUTHPROVIDER_PROPERTY_PREFIX)) {
+                String className = System.getProperty(authKey);
+                try {
+                    Class<?> c = ZooKeeperServer.class.getClassLoader().loadClass(className);
+                    AuthenticationProvider ap = (AuthenticationProvider) c.getDeclaredConstructor().newInstance();
+                    authenticationProviders.put(ap.getScheme(), ap);
+                } catch (Exception e) {
+                    LOG.warn("Problems loading {}", className, e);
+                }
+            }
+        }
+    }
+
     public static ServerAuthenticationProvider getServerProvider(String scheme) {
         return WrappedAuthenticationProvider.wrap(getProvider(scheme));
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/SaslServerCallbackHandler.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/SaslServerCallbackHandler.java
index b6415fd80f9..79c57e462e7 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/SaslServerCallbackHandler.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/SaslServerCallbackHandler.java
@@ -19,57 +19,29 @@
 package org.apache.zookeeper.server.auth;
 
 import java.io.IOException;
-import java.util.HashMap;
 import java.util.Map;
 import javax.security.auth.callback.Callback;
 import javax.security.auth.callback.CallbackHandler;
 import javax.security.auth.callback.NameCallback;
 import javax.security.auth.callback.PasswordCallback;
 import javax.security.auth.callback.UnsupportedCallbackException;
-import javax.security.auth.login.AppConfigurationEntry;
-import javax.security.auth.login.Configuration;
 import javax.security.sasl.AuthorizeCallback;
 import javax.security.sasl.RealmCallback;
-import org.apache.zookeeper.server.ZooKeeperSaslServer;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 public class SaslServerCallbackHandler implements CallbackHandler {
 
-    private static final String USER_PREFIX = "user_";
     private static final Logger LOG = LoggerFactory.getLogger(SaslServerCallbackHandler.class);
     private static final String SYSPROP_SUPER_PASSWORD = "zookeeper.SASLAuthenticationProvider.superPassword";
     private static final String SYSPROP_REMOVE_HOST = "zookeeper.kerberos.removeHostFromPrincipal";
     private static final String SYSPROP_REMOVE_REALM = "zookeeper.kerberos.removeRealmFromPrincipal";
 
     private String userName;
-    private final Map<String, String> credentials = new HashMap<String, String>();
+    private final Map<String, String> credentials;
 
-    public SaslServerCallbackHandler(Configuration configuration) throws IOException {
-        String serverSection = System.getProperty(
-            ZooKeeperSaslServer.LOGIN_CONTEXT_NAME_KEY,
-            ZooKeeperSaslServer.DEFAULT_LOGIN_CONTEXT_NAME);
-
-        AppConfigurationEntry[] configurationEntries = configuration.getAppConfigurationEntry(serverSection);
-
-        if (configurationEntries == null) {
-            String errorMessage = "Could not find a '" + serverSection + "' entry in this configuration: Server cannot start.";
-            LOG.error(errorMessage);
-            throw new IOException(errorMessage);
-        }
-        credentials.clear();
-        for (AppConfigurationEntry entry : configurationEntries) {
-            Map<String, ?> options = entry.getOptions();
-            // Populate DIGEST-MD5 user -> password map with JAAS configuration entries from the "Server" section.
-            // Usernames are distinguished from other options by prefixing the username with a "user_" prefix.
-            for (Map.Entry<String, ?> pair : options.entrySet()) {
-                String key = pair.getKey();
-                if (key.startsWith(USER_PREFIX)) {
-                    String userName = key.substring(USER_PREFIX.length());
-                    credentials.put(userName, (String) pair.getValue());
-                }
-            }
-        }
+    public SaslServerCallbackHandler(Map<String, String> credentials) {
+        this.credentials = credentials;
     }
 
     public void handle(Callback[] callbacks) throws UnsupportedCallbackException {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/WrappedAuthenticationProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/WrappedAuthenticationProvider.java
index 65dc4376bb0..6347ede5a22 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/WrappedAuthenticationProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/WrappedAuthenticationProvider.java
@@ -18,7 +18,10 @@
 
 package org.apache.zookeeper.server.auth;
 
+import java.util.List;
+import javax.servlet.http.HttpServletRequest;
 import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.server.ServerCnxn;
 
 /**
@@ -52,6 +55,17 @@ public KeeperException.Code handleAuthentication(ServerObjs serverObjs, byte[] a
         return implementation.handleAuthentication(serverObjs.getCnxn(), authData);
     }
 
+    /**
+     * {@inheritDoc}
+     *
+     * forwards to older method {@link #handleAuthentication(HttpServletRequest, byte[])}
+     * @return
+     */
+    @Override
+    public List<Id> handleAuthentication(HttpServletRequest request, byte[] authData) {
+        return implementation.handleAuthentication(request, authData);
+    }
+
     /**
      * {@inheritDoc}
      *
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java
index 1f42b2427ca..3bc4304689d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java
@@ -18,11 +18,18 @@
 
 package org.apache.zookeeper.server.auth;
 
+import java.security.cert.Certificate;
 import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.List;
 import javax.net.ssl.X509KeyManager;
 import javax.net.ssl.X509TrustManager;
 import javax.security.auth.x500.X500Principal;
+import javax.servlet.http.HttpServletRequest;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.common.ClientX509Util;
 import org.apache.zookeeper.common.X509Exception;
@@ -45,11 +52,15 @@
  * <br>To specify store passwords, set the following system properties:
  * <br><code>zookeeper.ssl.keyStore.password</code>
  * <br><code>zookeeper.ssl.trustStore.password</code>
+ * <br>Alternatively, the passwords can be specified by the following password file path properties:
+ * <br><code>zookeeper.ssl.keyStore.passwordPath</code>
+ * <br><code>zookeeper.ssl.trustStore.passwordPath</code>
  * <br>Alternatively, this can be plugged with any X509TrustManager and
  * X509KeyManager implementation.
  */
 public class X509AuthenticationProvider implements AuthenticationProvider {
 
+    public static final String X509_CERTIFICATE_ATTRIBUTE_NAME = "javax.servlet.request.X509Certificate";
     static final String ZOOKEEPER_X509AUTHENTICATIONPROVIDER_SUPERUSER = "zookeeper.X509AuthenticationProvider.superUser";
     private static final Logger LOG = LoggerFactory.getLogger(X509AuthenticationProvider.class);
     private final X509TrustManager trustManager;
@@ -61,51 +72,28 @@ public class X509AuthenticationProvider implements AuthenticationProvider {
      * <br><code>zookeeper.ssl.keyStore.location</code>
      * <br><code>zookeeper.ssl.trustStore.location</code>
      * <br><code>zookeeper.ssl.keyStore.password</code>
+     * <br><code>zookeeper.ssl.keyStore.passwordPath</code>
      * <br><code>zookeeper.ssl.trustStore.password</code>
+     * <br><code>zookeeper.ssl.trustStore.passwordPath</code>
      */
     public X509AuthenticationProvider() throws X509Exception {
         ZKConfig config = new ZKConfig();
         try (X509Util x509Util = new ClientX509Util()) {
-            String keyStoreLocation = config.getProperty(x509Util.getSslKeystoreLocationProperty(), "");
-            String keyStorePassword = config.getProperty(x509Util.getSslKeystorePasswdProperty(), "");
-            String keyStoreTypeProp = config.getProperty(x509Util.getSslKeystoreTypeProperty());
-
-            boolean crlEnabled = Boolean.parseBoolean(config.getProperty(x509Util.getSslCrlEnabledProperty()));
-            boolean ocspEnabled = Boolean.parseBoolean(config.getProperty(x509Util.getSslOcspEnabledProperty()));
-            boolean hostnameVerificationEnabled = Boolean.parseBoolean(config.getProperty(x509Util.getSslHostnameVerificationEnabledProperty()));
-
             X509KeyManager km = null;
             X509TrustManager tm = null;
-            if (keyStoreLocation.isEmpty()) {
-                LOG.warn("keystore not specified for client connection");
-            } else {
-                try {
-                    km = X509Util.createKeyManager(keyStoreLocation, keyStorePassword, keyStoreTypeProp);
-                } catch (KeyManagerException e) {
-                    LOG.error("Failed to create key manager", e);
-                }
+
+            try {
+                km = x509Util.buildKeyManager(config);
+            } catch (KeyManagerException e) {
+                LOG.error("Failed to create key manager", e);
             }
 
-            String trustStoreLocation = config.getProperty(x509Util.getSslTruststoreLocationProperty(), "");
-            String trustStorePassword = config.getProperty(x509Util.getSslTruststorePasswdProperty(), "");
-            String trustStoreTypeProp = config.getProperty(x509Util.getSslTruststoreTypeProperty());
-
-            if (trustStoreLocation.isEmpty()) {
-                LOG.warn("Truststore not specified for client connection");
-            } else {
-                try {
-                    tm = X509Util.createTrustManager(
-                        trustStoreLocation,
-                        trustStorePassword,
-                        trustStoreTypeProp,
-                        crlEnabled,
-                        ocspEnabled,
-                        hostnameVerificationEnabled,
-                        false);
-                } catch (TrustManagerException e) {
-                    LOG.error("Failed to create trust manager", e);
-                }
+            try {
+                tm = x509Util.buildTrustManager(config);
+            } catch (TrustManagerException e) {
+                LOG.error("Failed to create trust manager", e);
             }
+
             this.keyManager = km;
             this.trustManager = tm;
         }
@@ -132,41 +120,28 @@ public String getScheme() {
 
     @Override
     public KeeperException.Code handleAuthentication(ServerCnxn cnxn, byte[] authData) {
-        X509Certificate[] certChain = (X509Certificate[]) cnxn.getClientCertificateChain();
+        List<Certificate> certs = Arrays.asList(cnxn.getClientCertificateChain());
+        X509Certificate[] certChain = certs.toArray(new X509Certificate[certs.size()]);
 
-        if (certChain == null || certChain.length == 0) {
+        final Collection<Id> ids = handleAuthentication(certChain);
+        if (ids.isEmpty()) {
+            LOG.error("Failed to authenticate session 0x{}", Long.toHexString(cnxn.getSessionId()));
             return KeeperException.Code.AUTHFAILED;
         }
 
-        if (trustManager == null) {
-            LOG.error("No trust manager available to authenticate session 0x{}", Long.toHexString(cnxn.getSessionId()));
-            return KeeperException.Code.AUTHFAILED;
+        for (Id id : ids) {
+            cnxn.addAuthInfo(id);
         }
-
-        X509Certificate clientCert = certChain[0];
-
-        try {
-            // Authenticate client certificate
-            trustManager.checkClientTrusted(certChain, clientCert.getPublicKey().getAlgorithm());
-        } catch (CertificateException ce) {
-            LOG.error("Failed to trust certificate for session 0x{}", Long.toHexString(cnxn.getSessionId()), ce);
-            return KeeperException.Code.AUTHFAILED;
-        }
-
-        String clientId = getClientId(clientCert);
-
-        if (clientId.equals(System.getProperty(ZOOKEEPER_X509AUTHENTICATIONPROVIDER_SUPERUSER))) {
-            cnxn.addAuthInfo(new Id("super", clientId));
-            LOG.info("Authenticated Id '{}' as super user", clientId);
-        }
-
-        Id authInfo = new Id(getScheme(), clientId);
-        cnxn.addAuthInfo(authInfo);
-
-        LOG.info("Authenticated Id '{}' for Scheme '{}'", authInfo.getId(), authInfo.getScheme());
         return KeeperException.Code.OK;
     }
 
+    @Override
+    public List<Id> handleAuthentication(HttpServletRequest request, byte[] authData) {
+        final X509Certificate[] certChain =
+                (X509Certificate[]) request.getAttribute(X509_CERTIFICATE_ATTRIBUTE_NAME);
+        return handleAuthentication(certChain);
+    }
+
     /**
      * Determine the string to be used as the remote host session Id for
      * authorization purposes. Associate this client identifier with a
@@ -233,4 +208,36 @@ public X509KeyManager getKeyManager() throws KeyManagerException {
         return keyManager;
     }
 
+    private List<Id> handleAuthentication(final X509Certificate[] certChain) {
+        final List<Id> ids = new ArrayList<>();
+        if (certChain == null || certChain.length == 0) {
+            LOG.warn("No certificate chain available to authenticate");
+            return ids;
+        }
+
+        if (trustManager == null) {
+            LOG.error("No trust manager available to authenticate");
+            return ids;
+        }
+
+        final X509Certificate clientCert = certChain[0];
+        try {
+            // Authenticate client certificate
+            trustManager.checkClientTrusted(certChain, clientCert.getPublicKey().getAlgorithm());
+        } catch (CertificateException ce) {
+            LOG.error("Failed to trust certificate", ce);
+            return ids;
+        }
+
+        final String clientId = getClientId(clientCert);
+        if (clientId.equals(System.getProperty(ZOOKEEPER_X509AUTHENTICATIONPROVIDER_SUPERUSER))) {
+            ids.add(new Id("super", clientId));
+            LOG.info("Authenticated Id '{}' as super user", clientId);
+        }
+
+        final Id id = new Id(getScheme(), clientId);
+        ids.add(id);
+        LOG.info("Authenticated Id '{}' for scheme '{}'", id.getId(), id.getScheme());
+        return Collections.unmodifiableList(ids);
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/command/FourLetterCommands.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/command/FourLetterCommands.java
index 40b1698e32f..3c615f4faf7 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/command/FourLetterCommands.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/command/FourLetterCommands.java
@@ -151,9 +151,9 @@ public class FourLetterCommands {
 
     private static final Logger LOG = LoggerFactory.getLogger(FourLetterCommands.class);
 
-    private static final Map<Integer, String> cmd2String = new HashMap<Integer, String>();
+    private static final Map<Integer, String> cmd2String = new HashMap<>();
 
-    private static final Set<String> whiteListedCommands = new HashSet<String>();
+    private static final Set<String> whiteListedCommands = new HashSet<>();
 
     private static boolean whiteListInitialized = false;
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/CommandClient.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/CommandClient.java
new file mode 100644
index 00000000000..632ece8e987
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/CommandClient.java
@@ -0,0 +1,131 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.controller;
+
+import java.io.IOException;
+import java.net.InetSocketAddress;
+import java.nio.charset.StandardCharsets;
+import java.util.concurrent.TimeUnit;
+import org.eclipse.jetty.client.HttpClient;
+import org.eclipse.jetty.client.api.ContentResponse;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * A convenient helper to send controller command to ControllerService.
+ */
+public class CommandClient {
+    private final int requestTimeoutInMs;
+    private static final int DEFAULT_TIMEOUT = 10000;
+    private static final Logger LOG = LoggerFactory.getLogger(CommandClient.class);
+    private final int hostPort;
+    private final String hostName;
+    private HttpClient client;
+    private boolean started = false;
+
+    /**
+     * Instantiate a client configured to send requests to localhost.
+     * @param localHostPort Port that the localhost CommandListener is listening on.
+     * @param requestTimeoutInMs Timeout in ms for synchronous requests to timeout.
+     */
+    public CommandClient(int localHostPort, int requestTimeoutInMs) {
+        this.client = new HttpClient();
+        this.requestTimeoutInMs = requestTimeoutInMs;
+        this.hostName = "localhost";
+        this.hostPort = localHostPort;
+    }
+
+    /**
+     * Instantiate a client configured to send requests to the specified host address.
+     * @param  hostAddress The host address of the listening server.
+     * @param  requestTimeoutInMs Timeout in ms for synchronous requests to timeout.
+     */
+    public CommandClient(InetSocketAddress hostAddress, int requestTimeoutInMs) {
+        this.client = new HttpClient();
+        this.requestTimeoutInMs = requestTimeoutInMs;
+        this.hostName = hostAddress.getHostName();
+        this.hostPort = hostAddress.getPort();
+    }
+
+    public CommandClient(int localhostPort) {
+        this(localhostPort, DEFAULT_TIMEOUT);
+    }
+
+    public synchronized void close() {
+        try {
+            if (client != null) {
+                client.stop();
+                client = null;
+            }
+        } catch (Exception ex) {
+            LOG.warn("Exception during shutdown", ex);
+        }
+    }
+
+    /**
+     * Send a command with no parameters to the server and wait for a response.
+     * Returns true if we received a good (200) response and false otherwise.
+     */
+    public boolean trySendCommand(ControlCommand.Action action) {
+        return trySendCommand(action, null);
+    }
+
+    /**
+     * Send a command with an optional command parameter to the server and wait for a response.
+     * @param action The command Action to send.
+     * @param commandParameter The command parameter, in the form of command/action/parameter.
+     * @return true if we received a good (200) response and false otherwise.
+     */
+    public boolean trySendCommand(ControlCommand.Action action, String commandParameter)  {
+        try {
+            if (!started) {
+                client.start();
+                started = true;
+            }
+            ContentResponse response = sendCommand(action, commandParameter);
+            LOG.info("Received {} response from the server", response);
+            return (response.getStatus() == 200);
+        } catch (InterruptedException | IOException ex) {
+            LOG.warn("Failed to get response from server", ex);
+        } catch (Exception ex) {
+            LOG.error("Unknown exception when sending command", ex);
+        }
+
+        return false;
+    }
+
+    /**
+     * Send a command and optional command parameter to the server and block until receiving
+     * a response.
+     *
+     * @param action The command Action to send.
+     * @param commandParameter The command parameter, in the form of command/action/parameter.
+     * @return The full response body from the CommandListener server.
+     */
+    public ContentResponse sendCommand(ControlCommand.Action action,
+                                       String commandParameter) throws Exception {
+        String command = String.format("%s%s:%s/%s", "http://",
+            this.hostName, this.hostPort, ControlCommand.createCommandUri(action, commandParameter));
+        ContentResponse response = this.client.newRequest(command).timeout(this.requestTimeoutInMs,
+            TimeUnit.MILLISECONDS).send();
+        LOG.info("Sent command {}", command);
+        LOG.info("Response body {}", new String(response.getContent(), StandardCharsets.UTF_8));
+        return response;
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/CommandListener.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/CommandListener.java
new file mode 100644
index 00000000000..3f5bb62ffe8
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/CommandListener.java
@@ -0,0 +1,96 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.controller;
+
+import java.io.IOException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import org.apache.zookeeper.server.ExitCode;
+import org.apache.zookeeper.util.ServiceUtils;
+import org.eclipse.jetty.server.Request;
+import org.eclipse.jetty.server.Server;
+import org.eclipse.jetty.server.handler.AbstractHandler;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * An HTTP server listening to incoming controller commands sent from CommandClient (or any of your favorite REST client
+ * ) and dispatching the command to the ZooKeeperServerController for execution.
+ */
+public class CommandListener {
+    private static final Logger LOG = LoggerFactory.getLogger(CommandListener.class);
+
+    private ZooKeeperServerController controller;
+    private Server server;
+
+    public CommandListener(ZooKeeperServerController controller, ControllerServerConfig config) {
+        try {
+            this.controller = controller;
+
+            String host = config.getControllerAddress().getHostName();
+            int port = config.getControllerAddress().getPort();
+
+            server = new Server(port);
+            LOG.info("CommandListener server host: {} with port: {}", host, port);
+            server.setHandler(new CommandHandler());
+            server.start();
+        } catch (Exception ex) {
+            LOG.error("Failed to instantiate CommandListener.", ex);
+            ServiceUtils.requestSystemExit(ExitCode.UNEXPECTED_ERROR.getValue());
+        }
+    }
+
+    public void close() {
+        try {
+            if (server != null) {
+                server.stop();
+                server = null;
+            }
+        } catch (Exception ex) {
+            LOG.warn("Exception during shutdown CommandListener server", ex);
+        }
+    }
+
+    private class CommandHandler extends AbstractHandler {
+        @Override
+        public void handle(String target, Request baseRequest, HttpServletRequest request, HttpServletResponse response)
+                throws IOException {
+            // Extract command string from request path. Remove leading '/'.
+            String commandStr = request.getPathInfo().substring(1);
+            int responseCode;
+            response.setContentType("text/html;charset=utf-8");
+
+            try {
+                ControlCommand command = ControlCommand.parseUri(commandStr);
+                controller.processCommand(command);
+                baseRequest.setHandled(true);
+                responseCode = HttpServletResponse.SC_OK;
+            } catch (IllegalArgumentException ex) {
+                LOG.error("Bad argument or command", ex);
+                responseCode = HttpServletResponse.SC_BAD_REQUEST;
+            } catch (Exception ex) {
+                LOG.error("Failed processing the request", ex);
+                throw ex;
+            }
+            response.setStatus(responseCode);
+            response.getWriter().println(commandStr);
+            LOG.info("CommandListener processed command {} with response code {}", commandStr, responseCode);
+        }
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControlCommand.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControlCommand.java
new file mode 100644
index 00000000000..8454daa37bc
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControlCommand.java
@@ -0,0 +1,122 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.controller;
+
+/**
+ * Set of commands that this controller can execute. Commands are comprised
+ * of an action and an optional parameter specific to that action.
+ */
+public class ControlCommand {
+    /**
+     * Actions available to the controller
+      */
+    public enum Action {
+        // Simple "are you there" ping to confirm the controller is up and running.
+        PING,
+        // Shutdown everything, including CommandListener, ControllerService, Controller and the ZooKeeperServer.
+        SHUTDOWN,
+        // Close a connection triggering a client disconnect (and then reconnect attempt).
+        // No parameter indicates close all connections. Optional parameter indicates a specific session id (as long).
+        CLOSECONNECTION,
+        // More actions go here in the future (force drop sessions, etc).
+        EXPIRESESSION,
+        // Reject all future connections. No parameter required.
+        REJECTCONNECTIONS,
+        // Add latency to server replies.
+        // Optional parameter indicates time in milliseconds to delay
+        // (default = 1 second).
+        ADDDELAY,
+        // Fail requests.
+        // Optional parameter indicates how many requests to fail.
+        // (default = all requests until RESET).
+        FAILREQUESTS,
+        // Process requests but do not send a response.
+        // Optional parameter indicates how many requests to fail.
+        // (default = all requests until RESET).
+        NORESPONSE,
+        // No parameter indicates fail all requests.
+        // Optional parameter indicates undo all the chaotic action commands
+        // (reject connections, add delay, fail requests, eat requests and so on...).
+        RESET,
+        // Force the quorum to elect a new leader.
+        ELECTNEWLEADER,
+        // More actions go here in the future...
+    }
+
+    public static final String ENDPOINT = "command";
+    public static final String ENDPOINT_PREFIX = ENDPOINT + "/";
+
+    private Action action;
+    public Action getAction() {
+        return action;
+    }
+
+    private String parameter;
+    protected String getParameter() {
+        return parameter;
+    }
+
+    public ControlCommand(Action action) {
+        this(action, null);
+    }
+
+    public ControlCommand(Action action, String param) {
+        this.action = action;
+        this.parameter = param;
+    }
+
+    /**
+     * Create a REST command uri.
+     * @param action The 'verb' of the command.
+     * @param parameter The optional parameter.
+     * @return A string to send to the server as the end of the Uri.
+     */
+    public static String createCommandUri(Action action, String parameter) {
+        return ENDPOINT_PREFIX + action.toString() + (parameter != null && !parameter.isEmpty() ? "/" + parameter : "");
+    }
+
+    /**
+     * Parse a Uri into the required Command action and parameter.
+     * @param commandUri the properly formatted Uri.
+     */
+    public static ControlCommand parseUri(String commandUri) {
+        if (commandUri == null) {
+            throw new IllegalArgumentException("commandUri can't be null.");
+        }
+
+        if (!commandUri.startsWith(ENDPOINT_PREFIX)) {
+            throw new IllegalArgumentException("Missing required prefix: " + ENDPOINT_PREFIX);
+        }
+
+        String uri = commandUri.substring(ENDPOINT_PREFIX.length());
+        String name;
+        String param;
+
+        int separatorIndex = uri.indexOf('/');
+        if (separatorIndex < 0) {
+            name = uri;
+            param = null;
+        } else {
+            name = uri.substring(0, separatorIndex);
+            param = uri.substring(separatorIndex + 1);
+        }
+
+        return new ControlCommand(Action.valueOf(name.toUpperCase()), param);
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllableConnection.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllableConnection.java
new file mode 100644
index 00000000000..2238f35bf11
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllableConnection.java
@@ -0,0 +1,81 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.controller;
+
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+import java.io.IOException;
+import java.nio.ByteBuffer;
+import java.nio.channels.SelectionKey;
+import java.nio.channels.SocketChannel;
+import org.apache.jute.BinaryInputArchive;
+import org.apache.jute.Record;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.proto.ReplyHeader;
+import org.apache.zookeeper.proto.RequestHeader;
+import org.apache.zookeeper.server.ByteBufferInputStream;
+import org.apache.zookeeper.server.NIOServerCnxn;
+import org.apache.zookeeper.server.NIOServerCnxnFactory;
+import org.apache.zookeeper.server.ZooKeeperServer;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Extension of NIOServerCnxn which can inject changes per controller commands.
+ * Similar extensions can implement on top of NettyServerCnxn as well.
+ */
+@SuppressFBWarnings(value = "BC_UNCONFIRMED_CAST", justification = "factory is ControllableConnectionFactory type.")
+public class ControllableConnection extends NIOServerCnxn {
+    private static final Logger LOG = LoggerFactory.getLogger(ControllableConnection.class);
+    private final ControllableConnectionFactory controller;
+
+    public ControllableConnection(ZooKeeperServer zk, SocketChannel sock, SelectionKey sk, NIOServerCnxnFactory factory,
+                                  NIOServerCnxnFactory.SelectorThread selectorThread) throws IOException {
+        super(zk, sock, sk, factory, selectorThread);
+        controller = (ControllableConnectionFactory) factory;
+    }
+
+    @Override
+    public int sendResponse(ReplyHeader header, Record record, String tag) {
+        if (controller.shouldSendResponse()) {
+            try {
+                return super.sendResponse(header, record, tag);
+            } catch (IOException ex) {
+                LOG.warn("IO Exception occurred", ex);
+            }
+        } else {
+            LOG.warn("Controller is configured to NOT sending response back to client.");
+        }
+        return -1;
+    }
+
+    @Override
+    protected void readRequest() throws IOException {
+        if (controller.shouldFailNextRequest()) {
+            ByteBuffer buffer = incomingBuffer.slice();
+            BinaryInputArchive bia = BinaryInputArchive.getArchive(new ByteBufferInputStream(buffer));
+            RequestHeader h = new RequestHeader();
+            h.deserialize(bia, "header");
+            super.sendResponse(new ReplyHeader(h.getXid(), 0, KeeperException.Code.APIERROR.intValue()),
+                    null, null);
+        } else {
+            controller.delayRequestIfNeeded();
+            super.readRequest();
+        }
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllableConnectionFactory.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllableConnectionFactory.java
new file mode 100644
index 00000000000..15d9d610768
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllableConnectionFactory.java
@@ -0,0 +1,125 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.controller;
+
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+import java.io.IOException;
+import java.nio.channels.SelectionKey;
+import java.nio.channels.SocketChannel;
+import org.apache.zookeeper.server.NIOServerCnxn;
+import org.apache.zookeeper.server.NIOServerCnxnFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Extension of NIOServerCnxnFactory which can inject changes per controller commands.
+ * Similar extensions can implement on top of NettyServerCnxnFactory as well.
+ */
+@SuppressFBWarnings(value = "SWL_SLEEP_WITH_LOCK_HELD", justification = "no dead lock")
+public class ControllableConnectionFactory extends NIOServerCnxnFactory {
+    private static final Logger LOG = LoggerFactory.getLogger(ControllableConnectionFactory.class);
+    private long responseDelayInMs = 0;
+    private long remainingRequestsToFail = 0;
+    private long remainingResponsesToHold = 0;
+
+    public ControllableConnectionFactory() {
+    }
+
+    @Override
+    protected NIOServerCnxn createConnection(SocketChannel sock, SelectionKey sk, SelectorThread selectorThread)
+            throws IOException {
+        return new ControllableConnection(zkServer, sock, sk, this, selectorThread);
+    }
+
+    /**
+     * Called by the connection to delay processing requests from the client.
+    */
+    public synchronized void delayRequestIfNeeded() {
+        try {
+            if (responseDelayInMs > 0) {
+                Thread.sleep(responseDelayInMs);
+            }
+        } catch (InterruptedException ex) {
+            LOG.warn("Interrupted while delaying requests", ex);
+        }
+    }
+
+    /**
+     * Check if we should fail the next incoming request.
+     * If so, decrement the remaining requests to fail.
+    */
+    public synchronized boolean shouldFailNextRequest() {
+        if (remainingRequestsToFail == 0) {
+            return false;
+        }
+
+        // Value < 0 indicates fail all requests.
+        if (remainingRequestsToFail > 0) {
+            remainingRequestsToFail--;
+        }
+
+        return true;
+    }
+
+    /**
+     * Check if we should send a response to the latest processed request (true),
+     * or eat the response to mess with the client (false).
+     * If so, decrement the remaining requests to eat.
+    */
+    public synchronized boolean shouldSendResponse() {
+        if (remainingResponsesToHold == 0) {
+            return true;
+        }
+
+        // Value < 0 indicates hold all the responses.
+        if (remainingResponsesToHold > 0) {
+            remainingResponsesToHold--;
+        }
+        return false;
+    }
+
+    public synchronized void delayResponses(long delayInMs) {
+        if (delayInMs < 0) {
+            throw new IllegalArgumentException("delay must be non-negative");
+        }
+        responseDelayInMs = delayInMs;
+    }
+
+    public synchronized void resetBadBehavior() {
+        responseDelayInMs = 0;
+        remainingRequestsToFail = 0;
+        remainingResponsesToHold = 0;
+    }
+
+    public synchronized void failAllFutureRequests() {
+        this.remainingRequestsToFail = -1;
+    }
+
+    public synchronized void failFutureRequests(long requestsToFail) {
+        this.remainingRequestsToFail = requestsToFail;
+    }
+
+    public synchronized void holdAllFutureResponses() {
+        this.remainingResponsesToHold = -1;
+    }
+
+    public synchronized void holdFutureResponses(long requestsToHold) {
+        this.remainingResponsesToHold = requestsToHold;
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllerServerConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllerServerConfig.java
new file mode 100644
index 00000000000..ff99631231a
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllerServerConfig.java
@@ -0,0 +1,157 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.controller;
+
+import java.io.File;
+import java.io.IOException;
+import java.net.InetAddress;
+import java.net.InetSocketAddress;
+import java.net.ServerSocket;
+import java.util.HashMap;
+import java.util.Map;
+import org.apache.zookeeper.common.ConfigException;
+import org.apache.zookeeper.server.ServerConfig;
+import org.apache.zookeeper.server.quorum.QuorumPeer;
+import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
+import org.apache.zookeeper.server.quorum.flexible.QuorumMaj;
+
+/**
+ * Config for the ControllerService. Responsible for providing the minimum set of configurations
+ * that's required to spin up a single member ensemble.
+ */
+public class ControllerServerConfig extends QuorumPeerConfig {
+    public static final String CONTROLLER_PORT_KEY = "zookeeper.controllerPort";
+    public static final String CLIENT_PORT_KEY = "zookeeper.clientPortAddress";
+    private InetSocketAddress controllerAddress;
+    public InetSocketAddress getControllerAddress() {
+        return controllerAddress;
+    }
+
+    /**
+     * Instantiate a new config via a zk config file.
+     * @param configFile path to the configuration file
+     * @throws ConfigException
+     */
+    public ControllerServerConfig(String configFile) throws ConfigException {
+        parse(configFile);
+    }
+
+    /**
+     * Instantiate a config object with required parameters.
+     * @param hostAddress The address to bind to (likely loopback or localhost)
+     * @param controllerPort Port the controller will listen for incoming control command sent from CommandClient.
+     * @param zkServerPort Port the ZooKeeper server will listen on.
+     * @param dataDirPath Path to the data directory that ZooKeeperServer uses.
+     */
+    public ControllerServerConfig(InetAddress hostAddress, int controllerPort, int zkServerPort, String dataDirPath) {
+        controllerAddress = new InetSocketAddress(hostAddress, controllerPort);
+        clientPortAddress = new InetSocketAddress(hostAddress, zkServerPort);
+        dataDir = new File(dataDirPath);
+        dataLogDir = dataDir;
+        serverId = 0;
+    }
+
+    /**
+     * Instantiate a config object with required parameters.
+     * @param controllerPort Port the controller will listen for incoming control command sent from CommandClient.
+     * @param zkServerPort Port the ZooKeeper server will listen on.
+     * @param dataDirPath Path to the data directory that ZooKeeperServer uses.
+     */
+    public ControllerServerConfig(int controllerPort, int zkServerPort, String dataDirPath) {
+        this(InetAddress.getLoopbackAddress(), controllerPort, zkServerPort, dataDirPath);
+    }
+
+    public ServerConfig getZooKeeperServerConfig() {
+        ServerConfig serverConfig = new ServerConfig();
+        serverConfig.readFrom(this);
+        return serverConfig;
+    }
+
+    @Override
+    public void parse(String configFile) throws ConfigException {
+        super.parse(configFile);
+        for (String key : System.getProperties().stringPropertyNames()) {
+            if (CONTROLLER_PORT_KEY.equalsIgnoreCase(key)) {
+                setControllerAddress(System.getProperty(key));
+            }
+            if (CLIENT_PORT_KEY.equals(key)) {
+                setClientAddress(System.getProperty(key));
+            }
+        }
+
+        if (controllerAddress == null) {
+            throw new ConfigException("Missing required parameter " + CONTROLLER_PORT_KEY);
+        }
+
+        if (clientPortAddress == null) {
+            throw new ConfigException("Missing required parameter " + CLIENT_PORT_KEY);
+        }
+    }
+
+    private void setControllerAddress(String port) {
+        try {
+            controllerAddress = new InetSocketAddress(InetAddress.getLoopbackAddress(), Integer.parseInt(port));
+        } catch (NumberFormatException ex) {
+            throw new IllegalArgumentException("Invalid port", ex);
+        }
+    }
+
+    private void setClientAddress(String port) {
+        try {
+            clientPortAddress = new InetSocketAddress(InetAddress.getLoopbackAddress(), Integer.parseInt(port));
+        } catch (NumberFormatException ex) {
+            throw new IllegalArgumentException("Invalid port", ex);
+        }
+    }
+
+    /**
+     * Ensure config is acceptable by filling in default values for any missing quorum configuration
+     * (specifically in the case of a single machine ensemble)
+     *
+     * @throws IOException
+     */
+    public void ensureComplete() throws IOException {
+        if (this.quorumVerifier != null && this.quorumVerifier.getAllMembers().size() > 0) {
+            return;
+        }
+
+        // QuorumPeer requires a QuorumVerifier.
+        // We will use majority strategy with only this host in the quorum.
+        // We need to provide 2 more ports: one for elections and one for quorum communications.
+        // We will also mark this host as the leader.
+        ServerSocket randomSocket1 = new ServerSocket(0);
+        int quorumPort = randomSocket1.getLocalPort();
+
+        ServerSocket randomSocket2 = new ServerSocket(0);
+        int electionPort = randomSocket2.getLocalPort();
+
+        randomSocket1.close();
+        randomSocket2.close();
+
+        QuorumPeer.QuorumServer selfAsPeer = new QuorumPeer.QuorumServer(
+                0,
+                new InetSocketAddress(quorumPort),
+                new InetSocketAddress(electionPort),
+                this.clientPortAddress
+        );
+        Map<Long, QuorumPeer.QuorumServer> peers = new HashMap<>();
+        peers.put(selfAsPeer.id, selfAsPeer);
+        this.quorumVerifier = new QuorumMaj(peers);
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllerService.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllerService.java
new file mode 100644
index 00000000000..a762bc1bae3
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ControllerService.java
@@ -0,0 +1,168 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.controller;
+
+import java.io.IOException;
+import org.apache.zookeeper.common.ConfigException;
+import org.apache.zookeeper.server.ExitCode;
+import org.apache.zookeeper.server.ServerCnxnFactory;
+import org.apache.zookeeper.server.quorum.QuorumPeer;
+import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
+import org.apache.zookeeper.util.ServiceUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Main class which starts a ZooKeeperServer, a ZooKeeperServerController and the ControllerService.
+ * Tests should either invoke this class as the main target of a new JVM process OR explicitly
+ * start and stop a singleton of this class in their test process.
+ */
+public class ControllerService {
+    private static final Logger LOG = LoggerFactory.getLogger(ControllerService.class);
+
+    private ZooKeeperServerController controller;
+    private CommandListener listener;
+
+    protected QuorumPeerConfig config;
+    private ServerCnxnFactory serverCnxnFactory = null;
+    protected QuorumPeer quorumPeer = null;
+
+    /**
+     * Starts the ControllerService as a stand alone app. Useful for out of process testing
+     * - such as during integration testing.
+     */
+    public static void main(String[] args) {
+        ControllerServerConfig config;
+        try {
+            if (args.length != 1) {
+                throw new IllegalArgumentException("Require config file as cmd line argument");
+            } else {
+                config = new ControllerServerConfig(args[0]);
+            }
+            new ControllerService().start(config);
+        } catch (Exception ex) {
+            System.err.println(ex.getMessage());
+            System.err.println("Usage: TestControllerMain controller-port configfile");
+            ServiceUtils.requestSystemExit(ExitCode.UNEXPECTED_ERROR.getValue());
+        }
+    }
+
+    /**
+     * Starts a new thread to run the controller (useful when this service is hosted in process
+     * - such as during unit testing).
+     */
+    public Thread start(ControllerServerConfig controllerConfig) {
+        this.config = controllerConfig;
+        final ControllerService svc = this;
+
+        Thread runner = new Thread(() -> {
+            try {
+                svc.run();
+            } catch (Exception e) {
+            }
+        });
+        runner.setDaemon(true);
+        runner.start();
+        return runner;
+    }
+
+    public synchronized void shutdown() {
+        if (listener != null) {
+            listener.close();
+            listener = null;
+        }
+
+        if (controller != null) {
+            controller.shutdown();
+            controller = null;
+        }
+    }
+
+    /**
+     * Initializes an instance of the ZooKeeperServer, the ZooKeeperServerController, and a new
+     * Http listener (CommandListener) for the controller.
+     */
+    protected void initService() throws IOException {
+        ControllerServerConfig controllerConfig = (ControllerServerConfig) config;
+        controllerConfig.ensureComplete();
+        this.controller = new ZooKeeperServerController(controllerConfig);
+        this.listener = new CommandListener(controller, controllerConfig);
+        this.serverCnxnFactory = controller.getCnxnFactory();
+    }
+
+    protected void runServices() {
+        this.controller.run();
+    }
+
+    protected void cleanup() {
+        if (listener != null) {
+            listener.close();
+            listener = null;
+        }
+    }
+
+    /**
+     * Runs the main loop for this application but does not exit the process.
+     */
+    public void initializeAndRun(String[] args) throws ConfigException {
+        initConfig(args);
+        run();
+    }
+
+    /**
+     * Derived classes may override to do custom initialization of command line args.
+     */
+    protected void initConfig(String[] args) throws ConfigException {
+        if (args.length == 1) {
+            config.parse(args[0]);
+        }
+    }
+
+    /**
+     * Run the app given a QuorumPeerConfig.
+     *
+     * @param config The quorum peer config.
+     */
+    public void runFromConfig(QuorumPeerConfig config) {
+        LOG.info("Starting quorum peer from peer config");
+        this.config = config;
+        run();
+    }
+
+    protected void run() {
+        try {
+            initService();
+        } catch (Exception ex) {
+            LOG.error("Failed to start ControllerService.", ex);
+            ServiceUtils.requestSystemExit(ExitCode.UNEXPECTED_ERROR.getValue());
+
+        }
+        runServices();
+        cleanup();
+    }
+
+    /**
+     * Is the service up with all necessary initialization and port opening complete?
+     *
+     * @return true if the controller service is ready to use; false otherwise.
+     */
+    public boolean isReady() {
+        return controller != null && controller.isReady();
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ZooKeeperServerController.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ZooKeeperServerController.java
new file mode 100644
index 00000000000..3f85ef8134a
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/controller/ZooKeeperServerController.java
@@ -0,0 +1,186 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.controller;
+
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+import java.io.IOException;
+import org.apache.zookeeper.server.ExitCode;
+import org.apache.zookeeper.server.ServerCnxn;
+import org.apache.zookeeper.server.ServerCnxnFactory;
+import org.apache.zookeeper.server.ZooKeeperServer;
+import org.apache.zookeeper.server.quorum.QuorumPeer;
+import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
+import org.apache.zookeeper.util.ServiceUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Class which accepts commands to modify ZooKeeperServer state or Connection state at runtime for the purpose of
+ * single machine integration testing. Not meant to be used in production. It is recommended to use this in conjunction
+ * with the CommandListener HttpServer and CommandClient.
+ *
+ */
+@SuppressFBWarnings(value = "IS2_INCONSISTENT_SYNC", justification = "quorum peer is internally synchronized.")
+public class ZooKeeperServerController {
+
+    private static final Logger LOG = LoggerFactory.getLogger(ZooKeeperServerController.class);
+    private static final long DEFAULT_DELAY_MS = 1000;
+
+    private QuorumPeer quorumPeer;
+    private ControllableConnectionFactory cnxnFactory;
+
+    public ZooKeeperServerController(QuorumPeerConfig config) throws IOException {
+        if (config == null) {
+            throw new IllegalArgumentException("ZooKeeperServerController requires a valid config!");
+        }
+
+        cnxnFactory = new ControllableConnectionFactory();
+        cnxnFactory.configure(config.getClientPortAddress(), config.getMaxClientCnxns(), config.getClientPortListenBacklog());
+        quorumPeer = QuorumPeer.createFromConfig(config);
+        quorumPeer.setCnxnFactory(cnxnFactory);
+    }
+
+    public void run() {
+        try {
+            quorumPeer.start();
+            quorumPeer.join();
+        } catch (Exception ex) {
+            LOG.error("Fatal error starting quorum peer", ex);
+            ServiceUtils.requestSystemExit(ExitCode.UNEXPECTED_ERROR.getValue());
+        }
+    }
+
+    protected ServerCnxnFactory getCnxnFactory() {
+        return cnxnFactory;
+    }
+
+    public synchronized void shutdown() {
+        if (this.cnxnFactory != null) {
+            this.cnxnFactory.shutdown();
+            this.cnxnFactory = null;
+        }
+
+        if (this.quorumPeer != null && this.quorumPeer.isRunning()) {
+            this.quorumPeer.shutdown();
+            this.quorumPeer = null;
+        }
+    }
+
+    public synchronized boolean isReady() {
+        return this.cnxnFactory != null
+                && this.quorumPeer != null
+                && this.quorumPeer.isRunning()
+                && this.quorumPeer.getActiveServer() != null;
+    }
+
+    /**
+     * Process the command. An exception indicates errors. No exception indicates success.
+     */
+    public void processCommand(ControlCommand command) {
+        if (command == null) {
+            throw new IllegalArgumentException("Invalid command parameter!");
+        }
+
+        LOG.info("processing command {}{}", command.getAction(),
+                command.getParameter() == null ? "" : "[" + command.getParameter() + "]");
+
+        // Don't process command if we are shutting down or still initializing.
+        if (!isReady()) {
+            throw new IllegalStateException("Service is not ready. It has already been shutdown or is still initializing.");
+        }
+
+        switch (command.getAction()) {
+            case PING:
+                // NO-OP
+                break;
+            case SHUTDOWN:
+                shutdown();
+                break;
+            case CLOSECONNECTION:
+                if (command.getParameter() == null) {
+                    cnxnFactory.closeAll(ServerCnxn.DisconnectReason.CLOSE_ALL_CONNECTIONS_FORCED);
+                } else {
+                    // A single parameter should be a session id as long.
+                    // Parse failure exceptions will be sent to the caller.
+                    cnxnFactory.closeSession(Long.decode(command.getParameter()),
+                            ServerCnxn.DisconnectReason.CONNECTION_CLOSE_FORCED);
+                }
+                break;
+            case EXPIRESESSION:
+                if (command.getParameter() == null) {
+                    expireAllSessions();
+                } else {
+                    // A single parameter should be a session id as long.
+                    // Parse failure exceptions will be sent to the caller
+                    expireSession(Long.decode(command.getParameter()));
+                }
+                break;
+            case REJECTCONNECTIONS:
+                // TODO: (hanm) implement once dependent feature is ready.
+                //cnxnFactory.rejectNewConnections();
+                break;
+            case ADDDELAY:
+                cnxnFactory.delayResponses(command.getParameter() == null
+                        ? DEFAULT_DELAY_MS : Long.decode(command.getParameter()));
+                break;
+            case NORESPONSE:
+                if (command.getParameter() == null) {
+                    cnxnFactory.holdAllFutureResponses();
+                } else {
+                    cnxnFactory.holdFutureResponses(Long.decode(command.getParameter()));
+                }
+                break;
+            case FAILREQUESTS:
+                if (command.getParameter() == null) {
+                    cnxnFactory.failAllFutureRequests();
+                } else {
+                    cnxnFactory.failFutureRequests(Long.decode(command.getParameter()));
+                }
+                break;
+            case RESET:
+                cnxnFactory.resetBadBehavior();
+                break;
+            case ELECTNEWLEADER:
+                quorumPeer.startLeaderElection();
+                break;
+            default:
+                throw new IllegalArgumentException("Unknown command: " + command);
+        }
+    }
+
+    private ZooKeeperServer getServer() {
+        return quorumPeer.getActiveServer();
+    }
+
+    private void expireSession(long sessionId) {
+        getServer().expire(sessionId);
+    }
+
+    private void expireAllSessions() {
+        for (Long sessionId : getServer().getSessionTracker().localSessions()) {
+            expireSession(sessionId);
+        }
+
+        for (Long sessionId : getServer().getSessionTracker().globalSessions()) {
+            expireSession(sessionId);
+        }
+    }
+
+}
+
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/Arg.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ExitHandler.java
similarity index 65%
rename from zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/Arg.java
rename to zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ExitHandler.java
index 4fda3cf7d66..56b26488ed0 100644
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/Arg.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ExitHandler.java
@@ -1,3 +1,5 @@
+package org.apache.zookeeper.server.embedded;
+
 /**
  * Licensed to the Apache Software Foundation (ASF) under one
  * or more contributor license agreements.  See the NOTICE file
@@ -15,22 +17,19 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.apache.zookeeper.graph.filterops;
-
-import org.apache.zookeeper.graph.FilterOp.*;
-
-public class Arg<T> {
-    private ArgType type;
-    protected T value;
-    
-    protected Arg(ArgType type) {
-	this.type = type;
-    }
-    
-    public ArgType getType() { return type; }
-    public T getValue() { return value; }
 
-    public String toString() {
-	return "[" + type + ":" + value + "]";
-    }
+/**
+ * Behaviour of the server in case of internal error.
+ * When you are running tests you will use {@link #LOG_ONLY},
+ * but please take care of using {@link #EXIT} when running in production.
+ */
+public enum ExitHandler {
+    /**
+     * Exit the Java process.
+     */
+    EXIT,
+    /**
+     * Only log the error. This option is meant to be used only in tests.
+     */
+    LOG_ONLY;
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbedded.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbedded.java
new file mode 100644
index 00000000000..f73a1ee3d99
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbedded.java
@@ -0,0 +1,144 @@
+package org.apache.zookeeper.server.embedded;
+
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import java.nio.file.Path;
+import java.util.Objects;
+import java.util.Properties;
+import org.apache.yetus.audience.InterfaceAudience;
+import org.apache.yetus.audience.InterfaceStability;
+
+/**
+ * This API allows you to start a ZooKeeper server node from Java code <p>
+ * The server will run inside the same process.<p>
+ * Typical usecases are:
+ * <ul>
+ * <li>Running automated tests</li>
+ * <li>Launch ZooKeeper server with a Java based service management system</li>
+ * </ul>
+ * <p>
+ * Please take into consideration that in production usually it is better to not run the client
+ * together with the server in order to avoid race conditions, especially around how ephemeral nodes work.
+ */
+@InterfaceAudience.Public
+@InterfaceStability.Evolving
+public interface ZooKeeperServerEmbedded extends AutoCloseable {
+    /**
+     * Builder for ZooKeeperServerEmbedded.
+     */
+    class ZookKeeperServerEmbeddedBuilder {
+
+        private Path baseDir;
+        private Properties configuration;
+        private ExitHandler exitHandler = ExitHandler.EXIT;
+
+        /**
+         * Base directory of the server.
+         * The system will create a temporary configuration file inside this directory.
+         * Please remember that dynamic configuration files will be saved into this directory by default.
+         * <p>
+         * If you do not set a 'dataDir' configuration entry the system will use a subdirectory of baseDir.
+         * @param baseDir
+         * @return the builder
+         */
+        public ZookKeeperServerEmbeddedBuilder baseDir(Path baseDir) {
+            this.baseDir = Objects.requireNonNull(baseDir);
+            return this;
+        }
+
+        /**
+         * Set the contents of the main configuration as it would be in zk_server.conf file.
+         * @param configuration the configuration
+         * @return the builder
+         */
+        public ZookKeeperServerEmbeddedBuilder configuration(Properties configuration) {
+            this.configuration = Objects.requireNonNull(configuration);
+            return this;
+        }
+
+        /**
+         * Set the behaviour in case of hard system errors, see {@link ExitHandler}.
+         * @param exitHandler the handler
+         * @return the builder
+         */
+        public ZookKeeperServerEmbeddedBuilder exitHandler(ExitHandler exitHandler) {
+            this.exitHandler = Objects.requireNonNull(exitHandler);
+            return this;
+        }
+
+        /**
+         * Validate the configuration and create the server, without starting it.
+         * @return the new server
+         * @throws Exception
+         * @see #start()
+         */
+        public ZooKeeperServerEmbedded build() throws Exception {
+            if (baseDir == null) {
+                throw new IllegalStateException("baseDir is null");
+            }
+            if (configuration == null) {
+                throw new IllegalStateException("configuration is null");
+            }
+            return new ZooKeeperServerEmbeddedImpl(configuration, baseDir, exitHandler);
+        }
+    }
+
+    static ZookKeeperServerEmbeddedBuilder builder() {
+        return new ZookKeeperServerEmbeddedBuilder();
+    }
+
+    /**
+     * Start the server.
+     * @throws Exception
+     */
+    void start() throws Exception;
+
+    /**
+     * Start the server
+     * @param startupTimeout time to wait in millis for the server to start
+     * @throws Exception
+     */
+    void start(long startupTimeout) throws Exception;
+
+    /**
+     * Get client port for no secure connection.
+     */
+    int getClientPort();
+
+    /**
+     * Get client port for secure connection.
+     */
+    int getSecureClientPort();
+
+    /**
+     * Get a connection string useful for the client.
+     * @return the connection string
+     * @throws Exception in case the connection string is not available
+     */
+    String getConnectionString() throws Exception;
+
+    String getSecureConnectionString() throws Exception;
+
+    /**
+     * Shutdown gracefully the server and wait for resources to be released.
+     */
+    @Override
+    void close();
+
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java
new file mode 100644
index 00000000000..14e7cbbb7e9
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java
@@ -0,0 +1,234 @@
+package org.apache.zookeeper.server.embedded;
+
+import java.io.OutputStream;
+import java.net.InetSocketAddress;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Map;
+import java.util.Properties;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;
+import javax.security.sasl.SaslException;
+import org.apache.zookeeper.server.DatadirCleanupManager;
+import org.apache.zookeeper.server.ExitCode;
+import org.apache.zookeeper.server.ServerConfig;
+import org.apache.zookeeper.server.ZooKeeperServerMain;
+import org.apache.zookeeper.server.quorum.QuorumPeer;
+import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
+import org.apache.zookeeper.server.quorum.QuorumPeerMain;
+import org.apache.zookeeper.util.ServiceUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright
+ * ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the
+ * License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+ * implied. See the License for the specific language governing permissions and limitations under the License.
+ */
+/**
+ * Implementation of ZooKeeperServerEmbedded.
+ */
+class ZooKeeperServerEmbeddedImpl implements ZooKeeperServerEmbedded {
+
+    private static final Logger LOG = LoggerFactory.getLogger(ZooKeeperServerEmbeddedImpl.class);
+
+    private final QuorumPeerConfig config;
+    private QuorumPeerMain maincluster;
+    private ZooKeeperServerMain mainsingle;
+    private Thread thread;
+    private DatadirCleanupManager purgeMgr;
+    private final ExitHandler exitHandler;
+    private volatile boolean stopping;
+
+    private int boundClientPort;
+    private int boundSecureClientPort;
+
+    ZooKeeperServerEmbeddedImpl(Properties p, Path baseDir, ExitHandler exitHandler) throws Exception {
+        if (!p.containsKey("dataDir")) {
+            p.put("dataDir", baseDir.resolve("data").toAbsolutePath().toString());
+        }
+        Path configFile = Files.createTempFile(baseDir, "zookeeper.configuration", ".properties");
+        try (OutputStream oo = Files.newOutputStream(configFile)) {
+            p.store(oo, "Automatically generated at every-boot");
+        }
+        this.exitHandler = exitHandler;
+        LOG.info("Current configuration is at {}", configFile.toAbsolutePath());
+        config = new QuorumPeerConfig();
+        config.parse(configFile.toAbsolutePath().toString());
+        LOG.info("ServerID:" + config.getServerId());
+        LOG.info("DataDir:" + config.getDataDir());
+        LOG.info("Servers:" + config.getServers());
+        LOG.info("ElectionPort:" + config.getElectionPort());
+        LOG.info("SyncLimit:" + config.getSyncLimit());
+        LOG.info("PeerType:" + config.getPeerType());
+        LOG.info("Distributed:" + config.isDistributed());
+        LOG.info("SyncEnabled:" + config.getSyncEnabled());
+        LOG.info("MetricsProviderClassName:" + config.getMetricsProviderClassName());
+
+        for (Map.Entry<Long, QuorumPeer.QuorumServer> server : config.getServers().entrySet()) {
+            LOG.info("Server: " + server.getKey() + " -> addr " + server.getValue().addr + " elect "
+                    + server.getValue().electionAddr + " id=" + server.getValue().id + " type "
+                    + server.getValue().type);
+        }
+    }
+
+    @Override
+    public void start() throws Exception {
+        start(Integer.MAX_VALUE);
+    }
+
+    @Override
+    public void start(long startupTimeout) throws Exception {
+        switch (exitHandler) {
+            case EXIT:
+                ServiceUtils.setSystemExitProcedure(ServiceUtils.SYSTEM_EXIT);
+                break;
+            case LOG_ONLY:
+                ServiceUtils.setSystemExitProcedure(ServiceUtils.LOG_ONLY);
+                break;
+            default:
+                ServiceUtils.setSystemExitProcedure(ServiceUtils.SYSTEM_EXIT);
+                break;
+        }
+        final CompletableFuture<String> started = new CompletableFuture<>();
+
+        if (config.getServers().size() > 1 || config.isDistributed()) {
+            LOG.info("Running ZK Server in single Quorum MODE");
+
+            maincluster = new QuorumPeerMain() {
+                protected QuorumPeer getQuorumPeer() throws SaslException {
+                    return new QuorumPeer() {
+                        @Override
+                        public void start() {
+                            super.start();
+                            boundClientPort = super.getClientPort();
+                            boundSecureClientPort = super.getSecureClientPort();
+                            LOG.info("ZK Server {} started", this);
+                            started.complete(null);
+                        }
+                    };
+                }
+            };
+
+            // Start and schedule the purge task
+            purgeMgr = new DatadirCleanupManager(config
+                    .getDataDir(), config.getDataLogDir(), config
+                    .getSnapRetainCount(), config.getPurgeIntervalInMs());
+            purgeMgr.start();
+
+            thread = new Thread("zkservermainrunner") {
+                @Override
+                public void run() {
+                    try {
+                        maincluster.runFromConfig(config);
+                        maincluster.close();
+                        LOG.info("ZK server died. Requesting stop on JVM");
+                        if (!stopping) {
+                            ServiceUtils.requestSystemExit(ExitCode.EXECUTION_FINISHED.getValue());
+                        }
+                    } catch (Throwable t) {
+                        LOG.error("error during server lifecycle", t);
+                        maincluster.close();
+                        if (!stopping) {
+                            ServiceUtils.requestSystemExit(ExitCode.INVALID_INVOCATION.getValue());
+                        }
+                    }
+                }
+            };
+            thread.start();
+        } else {
+            LOG.info("Running ZK Server in single STANDALONE MODE");
+            mainsingle = new ZooKeeperServerMain() {
+                @Override
+                public void serverStarted() {
+                    LOG.info("ZK Server started");
+                    boundClientPort = super.getClientPort();
+                    boundSecureClientPort = super.getSecureClientPort();
+                    started.complete(null);
+                }
+            };
+            purgeMgr = new DatadirCleanupManager(config
+                    .getDataDir(), config.getDataLogDir(), config
+                    .getSnapRetainCount(), config.getPurgeIntervalInMs());
+            purgeMgr.start();
+            thread = new Thread("zkservermainrunner") {
+                @Override
+                public void run() {
+                    try {
+                        ServerConfig cc = new ServerConfig();
+                        cc.readFrom(config);
+                        LOG.info("ZK server starting");
+                        mainsingle.runFromConfig(cc);
+                        LOG.info("ZK server died. Requesting stop on JVM");
+                        if (!stopping) {
+                            ServiceUtils.requestSystemExit(ExitCode.EXECUTION_FINISHED.getValue());
+                        }
+                    } catch (Throwable t) {
+                        LOG.error("error during server lifecycle", t);
+                        mainsingle.close();
+                        if (!stopping) {
+                            ServiceUtils.requestSystemExit(ExitCode.INVALID_INVOCATION.getValue());
+                        }
+                    }
+                }
+            };
+            thread.start();
+        }
+
+        try {
+            started.get(startupTimeout, TimeUnit.MILLISECONDS);
+        } catch (TimeoutException err) {
+            LOG.info("Startup timed out, trying to close");
+            close();
+            throw err;
+        }
+    }
+
+    @Override
+    public int getClientPort() {
+        return boundClientPort;
+    }
+
+    @Override
+    public int getSecureClientPort() {
+        return boundSecureClientPort;
+    }
+
+    @Override
+    public String getConnectionString() {
+        return prettifyConnectionString(config.getClientPortAddress(), boundClientPort);
+    }
+
+    @Override
+    public String getSecureConnectionString() {
+        return prettifyConnectionString(config.getSecureClientPortAddress(), boundSecureClientPort);
+    }
+
+    private String prettifyConnectionString(InetSocketAddress confAddress, int boundPort) {
+        if (confAddress != null) {
+            return confAddress.getHostString()
+                .replace("0.0.0.0", "localhost")
+                .replace("0:0:0:0:0:0:0:0", "localhost")
+                + ":" + boundPort;
+        }
+        throw new IllegalStateException("No client address is configured");
+    }
+
+    @Override
+    public void close() {
+        LOG.info("Stopping ZK Server");
+        stopping = true;
+        if (mainsingle != null) {
+            mainsingle.close();
+        }
+        if (maincluster != null) {
+            maincluster.close();
+        }
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/metric/AvgMinMaxCounter.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/metric/AvgMinMaxCounter.java
index 0f06e4a66cd..e6b6d0f5b97 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/metric/AvgMinMaxCounter.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/metric/AvgMinMaxCounter.java
@@ -109,7 +109,7 @@ public void add(long value) {
     }
 
     public Map<String, Object> values() {
-        Map<String, Object> m = new LinkedHashMap<String, Object>();
+        Map<String, Object> m = new LinkedHashMap<>();
         m.put("avg_" + name, this.getAvg());
         m.put("min_" + name, this.getMin());
         m.put("max_" + name, this.getMax());
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/metric/AvgMinMaxPercentileCounter.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/metric/AvgMinMaxPercentileCounter.java
index 3162043a7a5..ed274085a08 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/metric/AvgMinMaxPercentileCounter.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/metric/AvgMinMaxPercentileCounter.java
@@ -84,7 +84,7 @@ private static long nextLong(long n) {
         @Override
         public Snapshot getSnapshot() {
             final int s = size();
-            final List<Long> copy = new ArrayList<Long>(s);
+            final List<Long> copy = new ArrayList<>(s);
             for (int i = 0; i < s; i++) {
                 copy.add(values.get(i));
             }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/metric/SimpleCounter.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/metric/SimpleCounter.java
index 71218335c64..5af8995a428 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/metric/SimpleCounter.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/metric/SimpleCounter.java
@@ -48,7 +48,7 @@ public long get() {
 
     @Override
     public Map<String, Object> values() {
-        Map<String, Object> m = new LinkedHashMap<String, Object>();
+        Map<String, Object> m = new LinkedHashMap<>();
         m.put(name, this.get());
         return m;
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/metric/SimpleCounterSet.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/metric/SimpleCounterSet.java
new file mode 100644
index 00000000000..63166de3f20
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/metric/SimpleCounterSet.java
@@ -0,0 +1,55 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.metric;
+
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+import org.apache.zookeeper.metrics.CounterSet;
+
+/**
+ * Represent a set of counters identified by different keys.
+ * The counter is thread-safe
+ */
+public class SimpleCounterSet extends Metric implements CounterSet {
+    private final String name;
+    private final ConcurrentHashMap<String, SimpleCounter> counters = new ConcurrentHashMap<>();
+
+    public SimpleCounterSet(final String name) {
+        this.name = name;
+    }
+
+    @Override
+    public void add(final String key, final long delta) {
+        final SimpleCounter counter = counters.computeIfAbsent(key, (k) -> new SimpleCounter(k + "_" + name));
+        counter.add(delta);
+    }
+
+    @Override
+    public void reset() {
+        counters.values().forEach(SimpleCounter::reset);
+    }
+
+    @Override
+    public Map<String, Object> values() {
+        final Map<String, Object> m = new LinkedHashMap<>();
+        counters.values().forEach(counter -> m.putAll(counter.values()));
+        return m;
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FilePadding.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FilePadding.java
index b25855959e6..87e669f26c4 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FilePadding.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FilePadding.java
@@ -73,7 +73,11 @@ public void setCurrentSize(long currentSize) {
      * @throws IOException
      */
     long padFile(FileChannel fileChannel) throws IOException {
-        long newFileSize = calculateFileSizeWithPadding(fileChannel.position(), currentSize, preAllocSize);
+        return this.padFile(fileChannel, fileChannel.position());
+    }
+
+    long padFile(FileChannel fileChannel, long position) throws IOException {
+        long newFileSize = calculateFileSizeWithPadding(position, currentSize, preAllocSize);
         if (currentSize != newFileSize) {
             fileChannel.write((ByteBuffer) fill.position(0), newFileSize - fill.remaining());
             currentSize = newFileSize;
@@ -81,6 +85,7 @@ long padFile(FileChannel fileChannel) throws IOException {
         return currentSize;
     }
 
+
     /**
      * Calculates a new file size with padding. We only return a new size if
      * the current file position is sufficiently close (less than 4K) to end of
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileSnap.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileSnap.java
index 4c092323857..cb7efc403e0 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileSnap.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileSnap.java
@@ -26,6 +26,7 @@
 import java.util.Map;
 import java.util.zip.CheckedInputStream;
 import java.util.zip.CheckedOutputStream;
+import javax.annotation.Nonnull;
 import org.apache.jute.BinaryInputArchive;
 import org.apache.jute.BinaryOutputArchive;
 import org.apache.jute.InputArchive;
@@ -53,7 +54,7 @@ public class FileSnap implements SnapShot {
 
     public static final String SNAPSHOT_FILE_PREFIX = "snapshot";
 
-    public FileSnap(File snapDir) {
+    public FileSnap(@Nonnull File snapDir) {
         this.snapDir = snapDir;
     }
 
@@ -99,6 +100,11 @@ public long deserialize(DataTree dt, Map<Long, Integer> sessions) throws IOExcep
                     SnapStream.checkSealIntegrity(snapIS, ia);
                 }
 
+                // deserialize lastProcessedZxid and check inconsistency
+                if (dt.deserializeLastProcessedZxid(ia)) {
+                    SnapStream.checkSealIntegrity(snapIS, ia);
+                }
+
                 foundValid = true;
                 break;
             } catch (IOException e) {
@@ -126,7 +132,7 @@ public long deserialize(DataTree dt, Map<Long, Integer> sessions) throws IOExcep
      * @param ia the input archive to restore from
      * @throws IOException
      */
-    public void deserialize(DataTree dt, Map<Long, Integer> sessions, InputArchive ia) throws IOException {
+    public static void deserialize(DataTree dt, Map<Long, Integer> sessions, InputArchive ia) throws IOException {
         FileHeader header = new FileHeader();
         header.deserialize(ia, "fileheader");
         if (header.getMagic() != SNAP_MAGIC) {
@@ -139,7 +145,7 @@ public void deserialize(DataTree dt, Map<Long, Integer> sessions, InputArchive i
      * find the most recent snapshot in the database.
      * @return the file containing the most recent snapshot
      */
-    public File findMostRecentSnapshot() throws IOException {
+    public File findMostRecentSnapshot() {
         List<File> files = findNValidSnapshots(1);
         if (files.size() == 0) {
             return null;
@@ -157,12 +163,11 @@ public File findMostRecentSnapshot() throws IOException {
      * @param n the number of most recent snapshots
      * @return the last n snapshots (the number might be
      * less than n in case enough snapshots are not available).
-     * @throws IOException
      */
-    protected List<File> findNValidSnapshots(int n) throws IOException {
+    protected List<File> findNValidSnapshots(int n) {
         List<File> files = Util.sortDataDir(snapDir.listFiles(), SNAPSHOT_FILE_PREFIX, false);
         int count = 0;
-        List<File> list = new ArrayList<File>();
+        List<File> list = new ArrayList<>();
         for (File f : files) {
             // we should catch the exceptions
             // from the valid snapshot and continue
@@ -192,7 +197,7 @@ protected List<File> findNValidSnapshots(int n) throws IOException {
     public List<File> findNRecentSnapshots(int n) throws IOException {
         List<File> files = Util.sortDataDir(snapDir.listFiles(), SNAPSHOT_FILE_PREFIX, false);
         int count = 0;
-        List<File> list = new ArrayList<File>();
+        List<File> list = new ArrayList<>();
         for (File f : files) {
             if (count == n) {
                 break;
@@ -256,6 +261,11 @@ public synchronized void serialize(
                     SnapStream.sealStream(snapOS, oa);
                 }
 
+                // serialize the last processed zxid and add another CRC check
+                if (dt.serializeLastProcessedZxid(oa)) {
+                    SnapStream.sealStream(snapOS, oa);
+                }
+
                 lastSnapshotInfo = new SnapshotInfo(
                     Util.getZxidFromName(snapShot.getName(), SNAPSHOT_FILE_PREFIX),
                     snapShot.lastModified() / 1000);
@@ -265,22 +275,6 @@ public synchronized void serialize(
         }
     }
 
-    private void writeChecksum(CheckedOutputStream crcOut, OutputArchive oa) throws IOException {
-        long val = crcOut.getChecksum().getValue();
-        oa.writeLong(val, "val");
-        oa.writeString("/", "path");
-    }
-
-    private void checkChecksum(CheckedInputStream crcIn, InputArchive ia) throws IOException {
-        long checkSum = crcIn.getChecksum().getValue();
-        long val = ia.readLong("val");
-        // read and ignore "/" written by writeChecksum
-        ia.readString("path");
-        if (val != checkSum) {
-            throw new IOException("CRC corruption");
-        }
-    }
-
     /**
      * synchronized close just so that if serialize is in place
      * the close operation will block and will wait till serialize
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnLog.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnLog.java
index 62969bac8a6..e14e510c2be 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnLog.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnLog.java
@@ -43,6 +43,7 @@
 import org.apache.jute.InputArchive;
 import org.apache.jute.OutputArchive;
 import org.apache.jute.Record;
+import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.server.ServerStats;
 import org.apache.zookeeper.server.TxnLogEntry;
@@ -167,6 +168,12 @@ public class FileTxnLog implements TxnLog, Closeable {
      */
     private long prevLogsRunningTotal;
 
+    long filePosition = 0;
+
+    private long unFlushedSize = 0;
+
+    private long fileSize = 0;
+
     /**
      * constructor for FileTxnLog. Take the directory
      * where the txnlogs are stored
@@ -207,7 +214,7 @@ public static void setTxnLogSizeLimit(long size) {
      */
     public synchronized long getCurrentLogSize() {
         if (logFileWrite != null) {
-            return logFileWrite.length();
+            return fileSize;
         }
         return 0;
     }
@@ -220,6 +227,13 @@ public synchronized long getTotalLogSize() {
         return prevLogsRunningTotal + getCurrentLogSize();
     }
 
+    /**
+     * Get log size limit
+     */
+    public static long getTxnLogSizeLimit() {
+        return txnLogSizeLimit;
+    }
+
     /**
      * creates a checksum algorithm to be used
      * @return the checksum used for this txnlog
@@ -238,7 +252,9 @@ public synchronized void rollLog() throws IOException {
             prevLogsRunningTotal += getCurrentLogSize();
             this.logStream = null;
             oa = null;
-
+            fileSize = 0;
+            filePosition = 0;
+            unFlushedSize = 0;
             // Roll over the current log file into the running total
         }
     }
@@ -256,18 +272,9 @@ public synchronized void close() throws IOException {
         }
     }
 
-    /**
-     * append an entry to the transaction log
-     * @param hdr the header of the transaction
-     * @param txn the transaction part of the entry
-     * returns true iff something appended, otw false
-     */
-    public synchronized boolean append(TxnHeader hdr, Record txn) throws IOException {
-              return append(hdr, txn, null);
-    }
-
     @Override
-    public synchronized boolean append(TxnHeader hdr, Record txn, TxnDigest digest) throws IOException {
+    public synchronized boolean append(Request request) throws IOException {
+        TxnHeader hdr = request.getHdr();
         if (hdr == null) {
             return false;
         }
@@ -276,7 +283,7 @@ public synchronized boolean append(TxnHeader hdr, Record txn, TxnDigest digest)
                 "Current zxid {} is <= {} for {}",
                 hdr.getZxid(),
                 lastZxidSeen,
-                hdr.getType());
+                Request.op2String(hdr.getType()));
         } else {
             lastZxidSeen = hdr.getZxid();
         }
@@ -288,22 +295,34 @@ public synchronized boolean append(TxnHeader hdr, Record txn, TxnDigest digest)
             logStream = new BufferedOutputStream(fos);
             oa = BinaryOutputArchive.getArchive(logStream);
             FileHeader fhdr = new FileHeader(TXNLOG_MAGIC, VERSION, dbId);
+            long dataSize = oa.getDataSize();
             fhdr.serialize(oa, "fileheader");
             // Make sure that the magic number is written before padding.
             logStream.flush();
-            filePadding.setCurrentSize(fos.getChannel().position());
+            // Before writing data, first obtain the size of the OutputArchive.
+            // After writing the data, obtain the size of the OutputArchive again,
+            // so we can obtain the size of the data written this time.
+            // In this case, the data already flush into the channel, so add the size to filePosition.
+            filePosition += oa.getDataSize() - dataSize;
+            filePadding.setCurrentSize(filePosition);
             streamsToFlush.add(fos);
         }
-        filePadding.padFile(fos.getChannel());
-        byte[] buf = Util.marshallTxnEntry(hdr, txn, digest);
+        fileSize = filePadding.padFile(fos.getChannel(), filePosition);
+        byte[] buf = request.getSerializeData();
         if (buf == null || buf.length == 0) {
             throw new IOException("Faulty serialization for header " + "and txn");
         }
+        long dataSize = oa.getDataSize();
         Checksum crc = makeChecksumAlgorithm();
         crc.update(buf, 0, buf.length);
         oa.writeLong(crc.getValue(), "txnEntryCRC");
         Util.writeTxnBytes(oa, buf);
-
+        // Before writing data, first obtain the size of the OutputArchive.
+        // After writing the data, obtain the size of the OutputArchive again,
+        // so we can obtain the size of the data written this time.
+        // In this case, the data just write to the cache, not flushed, so add the size to unFlushedSize.
+        // After flushed, the unFlushedSize will add to the filePosition.
+        unFlushedSize += oa.getDataSize() - dataSize;
         return true;
     }
 
@@ -313,7 +332,7 @@ public synchronized boolean append(TxnHeader hdr, Record txn, TxnDigest digest)
      * ascending order.
      * @param logDirList array of files
      * @param snapshotZxid return files at, or before this zxid
-     * @return
+     * @return log files that starts at, or just before, the snapshot and subsequent ones
      */
     public static File[] getLogFiles(File[] logDirList, long snapshotZxid) {
         List<File> files = Util.sortDataDir(logDirList, LOG_FILE_PREFIX, true);
@@ -331,7 +350,7 @@ public static File[] getLogFiles(File[] logDirList, long snapshotZxid) {
                 logZxid = fzxid;
             }
         }
-        List<File> v = new ArrayList<File>(5);
+        List<File> v = new ArrayList<>(5);
         for (File f : files) {
             long fzxid = Util.getZxidFromName(f.getName(), LOG_FILE_PREFIX);
             if (fzxid < logZxid) {
@@ -354,10 +373,7 @@ public long getLastLoggedZxid() {
         // if a log file is more recent we must scan it to find
         // the highest zxid
         long zxid = maxLog;
-        TxnIterator itr = null;
-        try {
-            FileTxnLog txn = new FileTxnLog(logDir);
-            itr = txn.read(maxLog);
+        try (FileTxnLog txn = new FileTxnLog(logDir); TxnIterator itr = txn.read(maxLog)) {
             while (true) {
                 if (!itr.next()) {
                     break;
@@ -367,22 +383,10 @@ public long getLastLoggedZxid() {
             }
         } catch (IOException e) {
             LOG.warn("Unexpected exception", e);
-        } finally {
-            close(itr);
         }
         return zxid;
     }
 
-    private void close(TxnIterator itr) {
-        if (itr != null) {
-            try {
-                itr.close();
-            } catch (IOException ioe) {
-                LOG.warn("Error closing file iterator", ioe);
-            }
-        }
-    }
-
     /**
      * commit the logs. make sure that everything hits the
      * disk
@@ -390,6 +394,13 @@ private void close(TxnIterator itr) {
     public synchronized void commit() throws IOException {
         if (logStream != null) {
             logStream.flush();
+            filePosition += unFlushedSize;
+            // If we have written more than we have previously preallocated,
+            // we should override the fileSize by filePosition.
+            if (filePosition > fileSize) {
+                fileSize = filePosition;
+            }
+            unFlushedSize = 0;
         }
         for (FileOutputStream log : streamsToFlush) {
             log.flush();
@@ -468,9 +479,7 @@ public TxnIterator read(long zxid, boolean fastForward) throws IOException {
      * @return true if successful false if not
      */
     public boolean truncate(long zxid) throws IOException {
-        FileTxnIterator itr = null;
-        try {
-            itr = new FileTxnIterator(this.logDir, zxid);
+        try (FileTxnIterator itr = new FileTxnIterator(this.logDir, zxid)) {
             PositionInputStream input = itr.inputStream;
             if (input == null) {
                 throw new IOException("No log files found to truncate! This could "
@@ -487,8 +496,6 @@ public boolean truncate(long zxid) throws IOException {
                     LOG.warn("Unable to truncate {}", itr.logFile);
                 }
             }
-        } finally {
-            close(itr);
         }
         return true;
     }
@@ -701,14 +708,29 @@ public long getStorageSize() {
 
         /**
          * go to the next logfile
+         *
          * @return true if there is one and false if there is no
          * new file to be read
-         * @throws IOException
          */
         private boolean goToNextLog() throws IOException {
-            if (storedFiles.size() > 0) {
+            if (!storedFiles.isEmpty()) {
                 this.logFile = storedFiles.remove(storedFiles.size() - 1);
-                ia = createInputArchive(this.logFile);
+                try {
+                    ia = createInputArchive(this.logFile);
+                } catch (EOFException ex) {
+                    // If this file is the last log file in the database and is empty,
+                    // it means that the last time the file was created
+                    // before the header was written.
+                    if (storedFiles.isEmpty() && this.logFile.length() == 0) {
+                        boolean deleted = this.logFile.delete();
+                        if (!deleted) {
+                            throw new IOException("Failed to delete empty tail log file: " + this.logFile.getName());
+                        }
+                        LOG.warn("Delete empty tail log file to recover from corruption file: {}", this.logFile.getName());
+                        return false;
+                    }
+                    throw ex;
+                }
                 return true;
             }
             return false;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java
index eddeae8d93e..2816826046e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java
@@ -51,10 +51,10 @@
  */
 public class FileTxnSnapLog {
 
-    //the directory containing the
+    //the directory containing
     //the transaction logs
     final File dataDir;
-    //the directory containing the
+    //the directory containing
     //the snapshot directory
     final File snapDir;
     TxnLog txnLog;
@@ -204,11 +204,11 @@ public boolean accept(File dir, String name) {
     }
 
     /**
-     * get the datadir used by this filetxn
+     * get the data log dir used by this filetxn
      * snap log
-     * @return the data dir
+     * @return the data log dir
      */
-    public File getDataDir() {
+    public File getDataLogDir() {
         return this.dataDir;
     }
 
@@ -229,6 +229,15 @@ public SnapshotInfo getLastSnapshotInfo() {
         return this.snapLog.getLastSnapshotInfo();
     }
 
+    /**
+     * whether to force the write of an initial snapshot after a leader election,
+     * to address ZOOKEEPER-3781 after upgrading from Zookeeper 3.4.x.
+     * @return true if an initial snapshot should be written even if not otherwise required, false otherwise.
+     */
+    public boolean shouldForceWriteInitialSnapshotAfterLeaderElection() {
+        return trustEmptySnapshot && getLastSnapshotInfo() == null;
+    }
+
     /**
      * this function restores the server
      * database after reading from the
@@ -304,7 +313,7 @@ public long restore(DataTree dt, Map<Long, Integer> sessions, PlayBackListener l
     }
 
     /**
-     * This function will fast forward the server database to have the latest
+     * This function will fast-forward the server database to have the latest
      * transactions in it.  This is the same as restore, but only reads from
      * the transaction logs and not restores from a snapshot.
      * @param dt the datatree to write transactions to.
@@ -459,9 +468,10 @@ public long getLastLoggedZxid() {
      * @param sessionsWithTimeouts the session timeouts to be
      * serialized onto disk
      * @param syncSnap sync the snapshot immediately after write
+     * @return the snapshot file
      * @throws IOException
      */
-    public void save(
+    public File save(
         DataTree dataTree,
         ConcurrentHashMap<Long, Integer> sessionsWithTimeouts,
         boolean syncSnap) throws IOException {
@@ -470,6 +480,7 @@ public void save(
         LOG.info("Snapshotting: 0x{} to {}", Long.toHexString(lastZxid), snapshotFile);
         try {
             snapLog.serialize(dataTree, sessionsWithTimeouts, snapshotFile, syncSnap);
+            return snapshotFile;
         } catch (IOException e) {
             if (snapshotFile.length() == 0) {
                 /* This may be caused by a full disk. In such a case, the server
@@ -552,9 +563,8 @@ public List<File> findNRecentSnapshots(int n) throws IOException {
      * @param n the number of recent valid snapshots
      * @return the list of n recent valid snapshots, with
      * the most recent in front
-     * @throws IOException
      */
-    public List<File> findNValidSnapshots(int n) throws IOException {
+    public List<File> findNValidSnapshots(int n) {
         FileSnap snaplog = new FileSnap(snapDir);
         return snaplog.findNValidSnapshots(n);
     }
@@ -566,7 +576,7 @@ public List<File> findNValidSnapshots(int n) throws IOException {
      * file may contain transactions beyond given zxid.
      * @param zxid the zxid that contains logs greater than
      * zxid
-     * @return
+     * @return the snapshot logs which may contain transactions newer than the given zxid
      */
     public File[] getSnapshotLogs(long zxid) {
         return FileTxnLog.getLogFiles(dataDir.listFiles(), zxid);
@@ -579,7 +589,7 @@ public File[] getSnapshotLogs(long zxid) {
      * @throws IOException
      */
     public boolean append(Request si) throws IOException {
-        return txnLog.append(si.getHdr(), si.getTxn(), si.getTxnDigest());
+        return txnLog.append(si);
     }
 
     /**
@@ -611,14 +621,16 @@ public void rollLog() throws IOException {
      * @throws IOException
      */
     public void close() throws IOException {
-        if (txnLog != null) {
-            txnLog.close();
-            txnLog = null;
+        TxnLog txnLogToClose = txnLog;
+        if (txnLogToClose != null) {
+            txnLogToClose.close();
         }
-        if (snapLog != null) {
-            snapLog.close();
-            snapLog = null;
+        txnLog = null;
+        SnapShot snapSlogToClose = snapLog;
+        if (snapSlogToClose != null) {
+            snapSlogToClose.close();
         }
+        snapLog = null;
     }
 
     @SuppressWarnings("serial")
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/SnapStream.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/SnapStream.java
index b812aa1f9ef..2f8fe7b4023 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/SnapStream.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/SnapStream.java
@@ -102,18 +102,23 @@ public static StreamMode fromString(String name) {
     public static CheckedInputStream getInputStream(File file) throws IOException {
         FileInputStream fis = new FileInputStream(file);
         InputStream is;
-        switch (getStreamMode(file.getName())) {
-        case GZIP:
-            is = new GZIPInputStream(fis);
-            break;
-        case SNAPPY:
-            is = new SnappyInputStream(fis);
-            break;
-        case CHECKED:
-        default:
-            is = new BufferedInputStream(fis);
+        try {
+            switch (getStreamMode(file.getName())) {
+                case GZIP:
+                    is = new GZIPInputStream(fis);
+                    break;
+                case SNAPPY:
+                    is = new SnappyInputStream(fis);
+                    break;
+                case CHECKED:
+                default:
+                    is = new BufferedInputStream(fis);
+            }
+            return new CheckedInputStream(is, new Adler32());
+        } catch (IOException e) {
+            fis.close();
+            throw e;
         }
-        return new CheckedInputStream(is, new Adler32());
     }
 
     /**
@@ -129,9 +134,16 @@ public static CheckedOutputStream getOutputStream(File file, boolean fsync) thro
         OutputStream os;
         switch (streamMode) {
         case GZIP:
-            os = new GZIPOutputStream(fos);
+            try {
+                os = new GZIPOutputStream(fos);
+            } catch (IOException e) {
+                fos.close();
+                throw e;
+            }
             break;
         case SNAPPY:
+            // Unlike SnappyInputStream, the SnappyOutputStream
+            // constructor cannot throw an IOException.
             os = new SnappyOutputStream(fos);
             break;
         case CHECKED:
@@ -158,7 +170,7 @@ public static void sealStream(CheckedOutputStream os, OutputArchive oa) throws I
      * the checkSum of the content.
      *
      */
-    static void checkSealIntegrity(CheckedInputStream is, InputArchive ia) throws IOException {
+    public static void checkSealIntegrity(CheckedInputStream is, InputArchive ia) throws IOException {
         long checkSum = is.getChecksum().getValue();
         long val = ia.readLong("val");
         ia.readString("path");  // Read and ignore "/" written by SealStream.
@@ -170,7 +182,7 @@ static void checkSealIntegrity(CheckedInputStream is, InputArchive ia) throws IO
     /**
      * Verifies that the file is a valid snapshot. Snapshot may be invalid if
      * it's incomplete as in a situation when the server dies while in the
-     * process of storing a snapshot. Any files that are improperly formated
+     * process of storing a snapshot. Any files that are improperly formatted
      * or corrupted are invalid. Any file that is not a snapshot is also an
      * invalid snapshot.
      *
@@ -210,7 +222,7 @@ public static StreamMode getStreamMode() {
      * Detect the stream mode from file name extension
      *
      * @param fileName
-     * @return
+     * @return the stream mode detected
      */
     public static StreamMode getStreamMode(String fileName) {
         String[] splitSnapName = fileName.split("\\.");
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/TxnLog.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/TxnLog.java
index b5572087fb0..e29bec2a1c4 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/TxnLog.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/TxnLog.java
@@ -21,6 +21,7 @@
 import java.io.Closeable;
 import java.io.IOException;
 import org.apache.jute.Record;
+import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.ServerStats;
 import org.apache.zookeeper.txn.TxnDigest;
 import org.apache.zookeeper.txn.TxnHeader;
@@ -43,24 +44,14 @@ public interface TxnLog extends Closeable {
      * @throws IOException
      */
     void rollLog() throws IOException;
-    /**
-     * Append a request to the transaction log
-     * @param hdr the transaction header
-     * @param r the transaction itself
-     * @return true iff something appended, otw false
-     * @throws IOException
-     */
-    boolean append(TxnHeader hdr, Record r) throws IOException;
 
     /**
-     * Append a request to the transaction log with a digset
-     * @param hdr the transaction header
-     * @param r the transaction itself
-     * @param digest transaction digest
+     * Append a request to the transaction log with a digest
+     * @param request the request to be appended
      * returns true iff something appended, otw false
      * @throws IOException
      */
-    boolean append(TxnHeader hdr, Record r, TxnDigest digest) throws IOException;
+    boolean append(Request request) throws IOException;
 
     /**
      * Start reading the transaction logs
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/TxnLogToolkit.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/TxnLogToolkit.java
index 389caea6470..8cd08212254 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/TxnLogToolkit.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/TxnLogToolkit.java
@@ -30,6 +30,7 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
+import java.nio.ByteBuffer;
 import java.nio.charset.StandardCharsets;
 import java.text.DateFormat;
 import java.util.Date;
@@ -39,22 +40,27 @@
 import java.util.zip.Checksum;
 import org.apache.commons.cli.CommandLine;
 import org.apache.commons.cli.CommandLineParser;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.HelpFormatter;
 import org.apache.commons.cli.Option;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.PosixParser;
 import org.apache.jute.BinaryInputArchive;
 import org.apache.jute.BinaryOutputArchive;
 import org.apache.jute.Record;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.server.ByteBufferInputStream;
 import org.apache.zookeeper.server.ExitCode;
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.TxnLogEntry;
 import org.apache.zookeeper.server.util.LogChopper;
 import org.apache.zookeeper.server.util.SerializeUtils;
+import org.apache.zookeeper.txn.CheckVersionTxn;
 import org.apache.zookeeper.txn.CreateContainerTxn;
 import org.apache.zookeeper.txn.CreateTTLTxn;
 import org.apache.zookeeper.txn.CreateTxn;
+import org.apache.zookeeper.txn.DeleteTxn;
+import org.apache.zookeeper.txn.ErrorTxn;
 import org.apache.zookeeper.txn.MultiTxn;
 import org.apache.zookeeper.txn.SetDataTxn;
 import org.apache.zookeeper.txn.Txn;
@@ -307,11 +313,13 @@ private void printTxn(byte[] bytes, String prefix) throws IOException {
     }
 
     /**
-     * get the formatted string from the txn.
+     * Get the formatted string from the txn.
+     *
      * @param txn transaction log data
      * @return the formatted string
      */
-    private static String getFormattedTxnStr(Record txn) throws IOException {
+    // @VisibleForTesting
+    static String getFormattedTxnStr(Record txn) throws IOException {
         StringBuilder txnData = new StringBuilder();
         if (txn == null) {
             return txnData.toString();
@@ -334,25 +342,70 @@ private static String getFormattedTxnStr(Record txn) throws IOException {
             txnData.append(createTTLTxn.getPath() + "," + checkNullToEmpty(createTTLTxn.getData()))
                    .append("," + createTTLTxn.getAcl() + "," + createTTLTxn.getParentCVersion())
                    .append("," + createTTLTxn.getTtl());
+        } else if (txn instanceof DeleteTxn) {
+            DeleteTxn deleteTxn = ((DeleteTxn) txn);
+            txnData.append(deleteTxn.getPath());
+        } else if (txn instanceof CheckVersionTxn) {
+            CheckVersionTxn checkVersionTxn = ((CheckVersionTxn) txn);
+            txnData.append(checkVersionTxn.getPath()).append(",").append(checkVersionTxn.getVersion());
         } else if (txn instanceof MultiTxn) {
             MultiTxn multiTxn = ((MultiTxn) txn);
             List<Txn> txnList = multiTxn.getTxns();
             for (int i = 0; i < txnList.size(); i++) {
                 Txn t = txnList.get(i);
                 if (i == 0) {
-                    txnData.append(Request.op2String(t.getType()) + ":" + checkNullToEmpty(t.getData()));
+                    txnData.append(Request.op2String(t.getType())).append(":");
                 } else {
-                    txnData.append(";" + Request.op2String(t.getType()) + ":" + checkNullToEmpty(t.getData()));
+                    txnData.append(";").append(Request.op2String(t.getType())).append(":");
+                }
+                if (t.getType() == ZooDefs.OpCode.error) {
+                    txnData.append(ByteBuffer.wrap(t.getData()).getInt());
+                } else {
+                    txnData.append(getFormattedTxnStr(deserializeSubTxn(t)));
                 }
             }
         } else {
-            txnData.append(txn.toString());
+            txnData.append(txn);
         }
 
         return txnData.toString();
     }
 
-    private static String checkNullToEmpty(byte[] data) throws IOException {
+    private static Record deserializeSubTxn(Txn txn) throws IOException {
+        Record record;
+        switch (txn.getType()) {
+            case ZooDefs.OpCode.create:
+            case ZooDefs.OpCode.create2:
+                record = new CreateTxn();
+                break;
+            case ZooDefs.OpCode.createTTL:
+                record = new CreateTTLTxn();
+                break;
+            case ZooDefs.OpCode.createContainer:
+                record = new CreateContainerTxn();
+                break;
+            case ZooDefs.OpCode.delete:
+            case ZooDefs.OpCode.deleteContainer:
+                record = new DeleteTxn();
+                break;
+            case ZooDefs.OpCode.setData:
+                record = new SetDataTxn();
+                break;
+            case ZooDefs.OpCode.error:
+                record = new ErrorTxn();
+                break;
+            case ZooDefs.OpCode.check:
+                record = new CheckVersionTxn();
+                break;
+            default:
+                throw new IOException("Unsupported Txn with type=" + txn.getType());
+        }
+        ByteBuffer bb = ByteBuffer.wrap(txn.getData());
+        ByteBufferInputStream.byteBuffer2Record(bb, record);
+        return record;
+    }
+
+    private static String checkNullToEmpty(byte[] data) {
         if (data == null || data.length == 0) {
             return "";
         }
@@ -383,7 +436,7 @@ private void closeRecoveryFile() throws IOException {
     }
 
     private static TxnLogToolkit parseCommandLine(String[] args) throws TxnLogToolkitException, FileNotFoundException {
-        CommandLineParser parser = new PosixParser();
+        CommandLineParser parser = new DefaultParser();
         Options options = new Options();
 
         Option helpOpt = new Option("h", "help", false, "Print help message");
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/Util.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/Util.java
index a4d834453d8..31c5ab5b6ef 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/Util.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/persistence/Util.java
@@ -172,23 +172,19 @@ public static byte[] readTxnBytes(InputArchive ia) throws IOException {
         return null;
     }
 
+
     /**
      * Serializes transaction header and transaction data into a byte buffer.
      *
      * @param hdr transaction header
      * @param txn transaction data
+     * @param digest transaction digest
+     *
      * @return serialized transaction record
-     * @throws IOException
      */
-    public static byte[] marshallTxnEntry(TxnHeader hdr, Record txn) throws IOException {
-        return marshallTxnEntry(hdr, txn, null);
-    }
-
-    public static byte[] marshallTxnEntry(TxnHeader hdr, Record txn, TxnDigest digest)
-            throws IOException {
+    public static byte[] marshallTxnEntry(TxnHeader hdr, Record txn, TxnDigest digest) throws IOException {
         ByteArrayOutputStream baos = new ByteArrayOutputStream();
         OutputArchive boa = BinaryOutputArchive.getArchive(baos);
-
         hdr.serialize(boa, "hdr");
         if (txn != null) {
             txn.serialize(boa, "txn");
@@ -248,7 +244,7 @@ public int compare(File o1, File o2) {
      */
     public static List<File> sortDataDir(File[] files, String prefix, boolean ascending) {
         if (files == null) {
-            return new ArrayList<File>(0);
+            return new ArrayList<>(0);
         }
         List<File> filelist = Arrays.asList(files);
         Collections.sort(filelist, new DataDirFileComparator(prefix, ascending));
@@ -259,7 +255,6 @@ public static List<File> sortDataDir(File[] files, String prefix, boolean ascend
      * Returns true if fileName is a log file name.
      *
      * @param fileName
-     * @return
      */
     public static boolean isLogFileName(String fileName) {
         return fileName.startsWith(FileTxnLog.LOG_FILE_PREFIX + ".");
@@ -269,7 +264,6 @@ public static boolean isLogFileName(String fileName) {
      * Returns true if fileName is a snapshot file name.
      *
      * @param fileName
-     * @return
      */
     public static boolean isSnapshotFileName(String fileName) {
         return fileName.startsWith(FileSnap.SNAPSHOT_FILE_PREFIX + ".");
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/AckRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/AckRequestProcessor.java
index 32eb8a8186b..f277dcdf3ff 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/AckRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/AckRequestProcessor.java
@@ -44,7 +44,7 @@ public void processRequest(Request request) {
         QuorumPeer self = leader.self;
         if (self != null) {
             request.logLatency(ServerMetrics.getMetrics().PROPOSAL_ACK_CREATION_LATENCY);
-            leader.processAck(self.getId(), request.zxid, null);
+            leader.processAck(self.getMyId(), request.zxid, null);
         } else {
             LOG.error("Null QuorumPeer");
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/CommitProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/CommitProcessor.java
index 01f9f0d2738..3be43c37e30 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/CommitProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/CommitProcessor.java
@@ -29,12 +29,14 @@
 import java.util.concurrent.atomic.AtomicInteger;
 import org.apache.zookeeper.ZooDefs.OpCode;
 import org.apache.zookeeper.common.Time;
+import org.apache.zookeeper.server.ExitCode;
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.RequestProcessor;
 import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.server.WorkerService;
 import org.apache.zookeeper.server.ZooKeeperCriticalThread;
 import org.apache.zookeeper.server.ZooKeeperServerListener;
+import org.apache.zookeeper.util.ServiceUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -88,7 +90,7 @@ public class CommitProcessor extends ZooKeeperCriticalThread implements RequestP
     /**
      * Incoming requests.
      */
-    protected LinkedBlockingQueue<Request> queuedRequests = new LinkedBlockingQueue<Request>();
+    protected LinkedBlockingQueue<Request> queuedRequests = new LinkedBlockingQueue<>();
 
     /**
      * Incoming requests that are waiting on a commit,
@@ -109,7 +111,7 @@ public class CommitProcessor extends ZooKeeperCriticalThread implements RequestP
     /**
      * Requests that have been committed.
      */
-    protected final LinkedBlockingQueue<Request> committedRequests = new LinkedBlockingQueue<Request>();
+    protected final LinkedBlockingQueue<Request> committedRequests = new LinkedBlockingQueue<>();
 
     /**
      * Requests that we are holding until commit comes in. Keys represent
@@ -165,6 +167,9 @@ private boolean isProcessingRequest() {
     }
 
     protected boolean needCommit(Request request) {
+        if (request.isThrottled()) {
+          return false;
+        }
         switch (request.type) {
         case OpCode.create:
         case OpCode.create2:
@@ -208,12 +213,11 @@ public void run() {
                  * request from a client on another server (i.e., the order of
                  * the following two lines is important!).
                  */
-                commitIsWaiting = !committedRequests.isEmpty();
-                requestsToProcess = queuedRequests.size();
-                // Avoid sync if we have something to do
-                if (requestsToProcess == 0 && !commitIsWaiting) {
-                    // Waiting for requests to process
-                    synchronized (this) {
+                synchronized (this) {
+                    commitIsWaiting = !committedRequests.isEmpty();
+                    requestsToProcess = queuedRequests.size();
+                    if (requestsToProcess == 0 && !commitIsWaiting) {
+                        // Waiting for requests to process
                         while (!stopped && requestsToProcess == 0 && !commitIsWaiting) {
                             wait();
                             commitIsWaiting = !committedRequests.isEmpty();
@@ -306,6 +310,11 @@ public void run() {
                         // Process committed head
                         request = committedRequests.peek();
 
+                        if (request.isThrottled()) {
+                            LOG.error("Throttled request in committed pool: {}. Exiting.", request);
+                            ServiceUtils.requestSystemExit(ExitCode.UNEXPECTED_ERROR.getValue());
+                        }
+
                         /*
                          * Check if this is a local write request is pending,
                          * if so, update it with the committed info. If the commit matches
@@ -349,6 +358,10 @@ public void run() {
                                 topPending.zxid = request.zxid;
                                 topPending.commitRecvTime = request.commitRecvTime;
                                 request = topPending;
+                                if (request.isThrottled()) {
+                                    LOG.error("Throttled request in committed & pending pool: {}. Exiting.", request);
+                                    ServiceUtils.requestSystemExit(ExitCode.UNEXPECTED_ERROR.getValue());
+                                }
                                 // Only decrement if we take a request off the queue.
                                 numWriteQueuedRequests.decrementAndGet();
                                 queuedWriteRequests.poll();
@@ -452,7 +465,8 @@ public void start() {
      */
     private void sendToNextProcessor(Request request) {
         numRequestsProcessing.incrementAndGet();
-        workerPool.schedule(new CommitWorkRequest(request), request.sessionId);
+        CommitWorkRequest workRequest = new CommitWorkRequest(request);
+        workerPool.schedule(workRequest, request.sessionId);
     }
 
     private void processWrite(Request request) throws RequestProcessorException {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
index 3ab10073f4d..61c0eb60104 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FastLeaderElection.java
@@ -18,20 +18,23 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.io.IOException;
+import java.nio.BufferUnderflowException;
 import java.nio.ByteBuffer;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.concurrent.LinkedBlockingQueue;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicLong;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.jmx.MBeanRegistry;
 import org.apache.zookeeper.server.ZooKeeperThread;
 import org.apache.zookeeper.server.quorum.QuorumCnxManager.Message;
 import org.apache.zookeeper.server.quorum.QuorumPeer.LearnerType;
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
+import org.apache.zookeeper.server.quorum.flexible.QuorumOracleMaj;
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
 import org.apache.zookeeper.server.util.ZxidUtils;
 import org.slf4j.Logger;
@@ -84,9 +87,9 @@ public class FastLeaderElection implements Election {
 
     static {
         minNotificationInterval = Integer.getInteger(MIN_NOTIFICATION_INTERVAL, minNotificationInterval);
-        LOG.info("{}={}", MIN_NOTIFICATION_INTERVAL, minNotificationInterval);
+        LOG.info("{} = {} ms", MIN_NOTIFICATION_INTERVAL, minNotificationInterval);
         maxNotificationInterval = Integer.getInteger(MAX_NOTIFICATION_INTERVAL, maxNotificationInterval);
-        LOG.info("{}={}", MAX_NOTIFICATION_INTERVAL, maxNotificationInterval);
+        LOG.info("{} = {} ms", MAX_NOTIFICATION_INTERVAL, maxNotificationInterval);
     }
 
     /**
@@ -220,8 +223,8 @@ class WorkerReceiver extends ZooKeeperThread {
             volatile boolean stop;
             QuorumCnxManager manager;
 
-            WorkerReceiver(QuorumCnxManager manager) {
-                super("WorkerReceiver");
+            WorkerReceiver(QuorumCnxManager manager, String threadName) {
+                super(threadName);
                 this.stop = false;
                 this.manager = manager;
             }
@@ -237,19 +240,21 @@ public void run() {
                             continue;
                         }
 
+                        final int capacity = response.buffer.capacity();
+
                         // The current protocol and two previous generations all send at least 28 bytes
-                        if (response.buffer.capacity() < 28) {
-                            LOG.error("Got a short response: {}", response.buffer.capacity());
+                        if (capacity < 28) {
+                            LOG.error("Got a short response from server {}: {}", response.sid, capacity);
                             continue;
                         }
 
                         // this is the backwardCompatibility mode in place before ZK-107
                         // It is for a version of the protocol in which we didn't send peer epoch
                         // With peer epoch and version the message became 40 bytes
-                        boolean backCompatibility28 = (response.buffer.capacity() == 28);
+                        boolean backCompatibility28 = (capacity == 28);
 
                         // this is the backwardCompatibility mode for no version information
-                        boolean backCompatibility40 = (response.buffer.capacity() == 40);
+                        boolean backCompatibility40 = (capacity == 40);
 
                         response.buffer.clear();
 
@@ -263,64 +268,74 @@ public void run() {
                         long rpeerepoch;
 
                         int version = 0x0;
-                        if (!backCompatibility28) {
-                            rpeerepoch = response.buffer.getLong();
-                            if (!backCompatibility40) {
-                                /*
-                                 * Version added in 3.4.6
-                                 */
+                        QuorumVerifier rqv = null;
 
-                                version = response.buffer.getInt();
+                        try {
+                            if (!backCompatibility28) {
+                                rpeerepoch = response.buffer.getLong();
+                                if (!backCompatibility40) {
+                                    /*
+                                     * Version added in 3.4.6
+                                     */
+
+                                    version = response.buffer.getInt();
+                                } else {
+                                    LOG.info("Backward compatibility mode (36 bits), server id: {}", response.sid);
+                                }
                             } else {
-                                LOG.info("Backward compatibility mode (36 bits), server id: {}", response.sid);
+                                LOG.info("Backward compatibility mode (28 bits), server id: {}", response.sid);
+                                rpeerepoch = ZxidUtils.getEpochFromZxid(rzxid);
                             }
-                        } else {
-                            LOG.info("Backward compatibility mode (28 bits), server id: {}", response.sid);
-                            rpeerepoch = ZxidUtils.getEpochFromZxid(rzxid);
-                        }
 
-                        QuorumVerifier rqv = null;
+                            // check if we have a version that includes config. If so extract config info from message.
+                            if (version > 0x1) {
+                                int configLength = response.buffer.getInt();
 
-                        // check if we have a version that includes config. If so extract config info from message.
-                        if (version > 0x1) {
-                            int configLength = response.buffer.getInt();
-                            byte[] b = new byte[configLength];
-
-                            response.buffer.get(b);
-
-                            synchronized (self) {
-                                try {
-                                    rqv = self.configFromString(new String(b));
-                                    QuorumVerifier curQV = self.getQuorumVerifier();
-                                    if (rqv.getVersion() > curQV.getVersion()) {
-                                        LOG.info("{} Received version: {} my version: {}",
-                                                 self.getId(),
-                                                 Long.toHexString(rqv.getVersion()),
-                                                 Long.toHexString(self.getQuorumVerifier().getVersion()));
-                                        if (self.getPeerState() == ServerState.LOOKING) {
-                                            LOG.debug("Invoking processReconfig(), state: {}", self.getServerState());
-                                            self.processReconfig(rqv, null, null, false);
-                                            if (!rqv.equals(curQV)) {
-                                                LOG.info("restarting leader election");
-                                                self.shuttingDownLE = true;
-                                                self.getElectionAlg().shutdown();
-
-                                                break;
+                                // we want to avoid errors caused by the allocation of a byte array with negative length
+                                // (causing NegativeArraySizeException) or huge length (causing e.g. OutOfMemoryError)
+                                if (configLength < 0 || configLength > capacity) {
+                                    throw new IOException(String.format("Invalid configLength in notification message! sid=%d, capacity=%d, version=%d, configLength=%d",
+                                                                        response.sid, capacity, version, configLength));
+                                }
+
+                                byte[] b = new byte[configLength];
+                                response.buffer.get(b);
+
+                                synchronized (self) {
+                                    try {
+                                        rqv = self.configFromString(new String(b, UTF_8));
+                                        QuorumVerifier curQV = self.getQuorumVerifier();
+                                        if (rqv.getVersion() > curQV.getVersion()) {
+                                            LOG.info("{} Received version: {} my version: {}",
+                                                     self.getMyId(),
+                                                     Long.toHexString(rqv.getVersion()),
+                                                     Long.toHexString(self.getQuorumVerifier().getVersion()));
+                                            if (self.getPeerState() == ServerState.LOOKING) {
+                                                LOG.debug("Invoking processReconfig(), state: {}", self.getServerState());
+                                                self.processReconfig(rqv, null, null, false);
+                                                if (!rqv.equals(curQV)) {
+                                                    LOG.info("restarting leader election");
+                                                    self.shuttingDownLE = true;
+                                                    self.getElectionAlg().shutdown();
+
+                                                    break;
+                                                }
+                                            } else {
+                                                LOG.debug("Skip processReconfig(), state: {}", self.getServerState());
                                             }
-                                        } else {
-                                            LOG.debug("Skip processReconfig(), state: {}", self.getServerState());
                                         }
+                                    } catch (IOException | ConfigException e) {
+                                        LOG.error("Something went wrong while processing config received from {}", response.sid);
                                     }
-                                } catch (IOException e) {
-                                    LOG.error("Something went wrong while processing config received from {}", response.sid);
-                                } catch (ConfigException e) {
-                                    LOG.error("Something went wrong while processing config received from {}", response.sid);
                                 }
+                            } else {
+                                LOG.info("Backward compatibility mode (before reconfig), server id: {}", response.sid);
                             }
-                        } else {
-                            LOG.info("Backward compatibility mode (before reconfig), server id: {}", response.sid);
+                        } catch (BufferUnderflowException | IOException e) {
+                            LOG.warn("Skipping the processing of a partial / malformed response message sent by sid={} (message length: {})",
+                                     response.sid, capacity, e);
+                            continue;
                         }
-
                         /*
                          * If it is from a non-voting server (such as an observer or
                          * a non-voting follower), respond right away.
@@ -336,12 +351,12 @@ public void run() {
                                 self.getPeerState(),
                                 response.sid,
                                 current.getPeerEpoch(),
-                                qv.toString().getBytes());
+                                qv.toString().getBytes(UTF_8));
 
                             sendqueue.offer(notmsg);
                         } else {
                             // Receive new message
-                            LOG.debug("Receive new notification message. My id = {}", self.getId());
+                            LOG.debug("Receive new notification message. My id = {}", self.getMyId());
 
                             // State of peer that sent this message
                             QuorumPeer.ServerState ackstate = QuorumPeer.ServerState.LOOKING;
@@ -410,7 +425,7 @@ public void run() {
                                         self.getPeerState(),
                                         response.sid,
                                         v.getPeerEpoch(),
-                                        qv.toString().getBytes());
+                                        qv.toString().getBytes(UTF_8));
                                     sendqueue.offer(notmsg);
                                 }
                             } else {
@@ -431,7 +446,7 @@ public void run() {
 
                                     LOG.debug(
                                         "Sending new notification. My id ={} recipient={} zxid=0x{} leader={} config version = {}",
-                                        self.getId(),
+                                        self.getMyId(),
                                         response.sid,
                                         Long.toHexString(current.getZxid()),
                                         current.getId(),
@@ -446,7 +461,7 @@ public void run() {
                                         self.getPeerState(),
                                         response.sid,
                                         current.getPeerEpoch(),
-                                        qv.toString().getBytes());
+                                        qv.toString().getBytes(UTF_8));
                                     sendqueue.offer(notmsg);
                                 }
                             }
@@ -455,7 +470,7 @@ public void run() {
                         LOG.warn("Interrupted Exception while waiting for new message", e);
                     }
                 }
-                LOG.info("WorkerReceiver is down");
+                LOG.info("{} is down", getName());
             }
 
         }
@@ -470,8 +485,8 @@ class WorkerSender extends ZooKeeperThread {
             volatile boolean stop;
             QuorumCnxManager manager;
 
-            WorkerSender(QuorumCnxManager manager) {
-                super("WorkerSender");
+            WorkerSender(QuorumCnxManager manager, String threadName) {
+                super(threadName);
                 this.stop = false;
                 this.manager = manager;
             }
@@ -489,7 +504,7 @@ public void run() {
                         break;
                     }
                 }
-                LOG.info("WorkerSender is down");
+                LOG.info("{} is down", getName());
             }
 
             /**
@@ -508,8 +523,6 @@ void process(ToSend m) {
 
         WorkerSender ws;
         WorkerReceiver wr;
-        Thread wsThread = null;
-        Thread wrThread = null;
 
         /**
          * Constructor of class Messenger.
@@ -518,23 +531,19 @@ void process(ToSend m) {
          */
         Messenger(QuorumCnxManager manager) {
 
-            this.ws = new WorkerSender(manager);
-
-            this.wsThread = new Thread(this.ws, "WorkerSender[myid=" + self.getId() + "]");
-            this.wsThread.setDaemon(true);
-
-            this.wr = new WorkerReceiver(manager);
+            this.ws = new WorkerSender(manager, "WorkerSender[myid=" + self.getMyId() + "]");
+            this.ws.setDaemon(true);
 
-            this.wrThread = new Thread(this.wr, "WorkerReceiver[myid=" + self.getId() + "]");
-            this.wrThread.setDaemon(true);
+            this.wr = new WorkerReceiver(manager, "WorkerReceiver[myid=" + self.getMyId() + "]");
+            this.wr.setDaemon(true);
         }
 
         /**
          * Starts instances of WorkerSender and WorkerReceiver
          */
         void start() {
-            this.wsThread.start();
-            this.wrThread.start();
+            this.ws.start();
+            this.wr.start();
         }
 
         /**
@@ -555,7 +564,7 @@ void halt() {
     long proposedEpoch;
 
     /**
-     * Returns the current vlue of the logical clock counter
+     * Returns the current value of the logical clock counter
      */
     public long getLogicalClock() {
         return logicalclock.get();
@@ -631,8 +640,8 @@ private void starter(QuorumPeer self, QuorumCnxManager manager) {
         proposedLeader = -1;
         proposedZxid = -1;
 
-        sendqueue = new LinkedBlockingQueue<ToSend>();
-        recvqueue = new LinkedBlockingQueue<Notification>();
+        sendqueue = new LinkedBlockingQueue<>();
+        recvqueue = new LinkedBlockingQueue<>();
         this.messenger = new Messenger(manager);
     }
 
@@ -648,7 +657,7 @@ private void leaveInstance(Vote v) {
             "About to leave FLE instance: leader={}, zxid=0x{}, my id={}, my state={}",
             v.getId(),
             Long.toHexString(v.getZxid()),
-            self.getId(),
+            self.getMyId(),
             self.getPeerState());
         recvqueue.clear();
     }
@@ -684,17 +693,17 @@ private void sendNotifications() {
                 QuorumPeer.ServerState.LOOKING,
                 sid,
                 proposedEpoch,
-                qv.toString().getBytes());
+                qv.toString().getBytes(UTF_8));
 
             LOG.debug(
-                "Sending Notification: {} (n.leader), 0x{} (n.zxid), 0x{} (n.round), {} (recipient),"
-                    + " {} (myid), 0x{} (n.peerEpoch) ",
+                "Sending Notification: {} (n.leader), 0x{} (n.zxid), 0x{} (n.peerEpoch), 0x{} (n.round), {} (recipient),"
+                    + " {} (myid) ",
                 proposedLeader,
                 Long.toHexString(proposedZxid),
+                Long.toHexString(proposedEpoch),
                 Long.toHexString(logicalclock.get()),
                 sid,
-                self.getId(),
-                Long.toHexString(proposedEpoch));
+                self.getMyId());
 
             sendqueue.offer(notmsg);
         }
@@ -707,12 +716,13 @@ private void sendNotifications() {
      */
     protected boolean totalOrderPredicate(long newId, long newZxid, long newEpoch, long curId, long curZxid, long curEpoch) {
         LOG.debug(
-            "id: {}, proposed id: {}, zxid: 0x{}, proposed zxid: 0x{}",
+            "id: {}, proposed id: {}, zxid: 0x{}, proposed zxid: 0x{}, epoch: 0x{}, proposed epoch: 0x{}",
             newId,
             curId,
             Long.toHexString(newZxid),
-            Long.toHexString(curZxid));
-
+            Long.toHexString(curZxid),
+            Long.toHexString(newEpoch),
+            Long.toHexString(curEpoch));
         if (self.getQuorumVerifier().getWeight(newId) == 0) {
             return false;
         }
@@ -785,7 +795,7 @@ protected boolean checkLeader(Map<Long, Vote> votes, long leader, long electionE
          * from leader stating that it is leading, then predicate is false.
          */
 
-        if (leader != self.getId()) {
+        if (leader != self.getMyId()) {
             if (votes.get(leader) == null) {
                 predicate = false;
             } else if (votes.get(leader).getState() != ServerState.LEADING) {
@@ -824,10 +834,10 @@ public synchronized Vote getVote() {
      */
     private ServerState learningState() {
         if (self.getLearnerType() == LearnerType.PARTICIPANT) {
-            LOG.debug("I am a participant: {}", self.getId());
+            LOG.debug("I am a participant: {}", self.getMyId());
             return ServerState.FOLLOWING;
         } else {
-            LOG.debug("I am an observer: {}", self.getId());
+            LOG.debug("I am an observer: {}", self.getMyId());
             return ServerState.OBSERVING;
         }
     }
@@ -838,8 +848,8 @@ private ServerState learningState() {
      * @return long
      */
     private long getInitId() {
-        if (self.getQuorumVerifier().getVotingMembers().containsKey(self.getId())) {
-            return self.getId();
+        if (self.getQuorumVerifier().getVotingMembers().containsKey(self.getMyId())) {
+            return self.getMyId();
         } else {
             return Long.MIN_VALUE;
         }
@@ -882,7 +892,7 @@ private long getPeerEpoch() {
      * the leadingVoteSet if it becomes the leader.
      */
     private void setPeerState(long proposedLeader, SyncedLearnerTracker voteSet) {
-        ServerState ss = (proposedLeader == self.getId()) ? ServerState.LEADING : learningState();
+        ServerState ss = (proposedLeader == self.getMyId()) ? ServerState.LEADING : learningState();
         self.setPeerState(ss);
         if (ss == ServerState.LEADING) {
             leadingVoteSet = voteSet;
@@ -910,7 +920,7 @@ public Vote lookForLeader() throws InterruptedException {
              * if v.electionEpoch == logicalclock. The current participant uses recvset to deduce on whether a majority
              * of participants has voted for it.
              */
-            Map<Long, Vote> recvset = new HashMap<Long, Vote>();
+            Map<Long, Vote> recvset = new HashMap<>();
 
             /*
              * The votes from previous leader elections, as well as the votes from the current leader election are
@@ -919,7 +929,7 @@ public Vote lookForLeader() throws InterruptedException {
              * outofelection to learn which participant is the leader if it arrives late (i.e., higher logicalclock than
              * the electionEpoch of the received notifications) in a leader election.
              */
-            Map<Long, Vote> outofelection = new HashMap<Long, Vote>();
+            Map<Long, Vote> outofelection = new HashMap<>();
 
             int notTimeout = minNotificationInterval;
 
@@ -930,11 +940,11 @@ public Vote lookForLeader() throws InterruptedException {
 
             LOG.info(
                 "New election. My id = {}, proposed zxid=0x{}",
-                self.getId(),
+                self.getMyId(),
                 Long.toHexString(proposedZxid));
             sendNotifications();
 
-            SyncedLearnerTracker voteSet;
+            SyncedLearnerTracker voteSet = null;
 
             /*
              * Loop in which we exchange notifications until we find a leader
@@ -961,9 +971,25 @@ public Vote lookForLeader() throws InterruptedException {
                     /*
                      * Exponential backoff
                      */
-                    int tmpTimeOut = notTimeout * 2;
-                    notTimeout = Math.min(tmpTimeOut, maxNotificationInterval);
-                    LOG.info("Notification time out: {}", notTimeout);
+                    notTimeout = Math.min(notTimeout << 1, maxNotificationInterval);
+
+                    /*
+                     * When a leader failure happens on a master, the backup will be supposed to receive the honour from
+                     * Oracle and become a leader, but the honour is likely to be delay. We do a re-check once timeout happens
+                     *
+                     * The leader election algorithm does not provide the ability of electing a leader from a single instance
+                     * which is in a configuration of 2 instances.
+                     * */
+                    if (self.getQuorumVerifier() instanceof QuorumOracleMaj
+                            && self.getQuorumVerifier().revalidateVoteset(voteSet, notTimeout != minNotificationInterval)) {
+                        setPeerState(proposedLeader, voteSet);
+                        Vote endVote = new Vote(proposedLeader, proposedZxid, logicalclock.get(), proposedEpoch);
+                        leaveInstance(endVote);
+                        return endVote;
+                    }
+
+                    LOG.info("Notification time out: {} ms", notTimeout);
+
                 } else if (validVoter(n.sid) && validVoter(n.leader)) {
                     /*
                      * Only proceed if the vote comes from a replica in the current or next
@@ -1037,45 +1063,55 @@ public Vote lookForLeader() throws InterruptedException {
                     case OBSERVING:
                         LOG.debug("Notification from observer: {}", n.sid);
                         break;
+
+                        /*
+                        * In ZOOKEEPER-3922, we separate the behaviors of FOLLOWING and LEADING.
+                        * To avoid the duplication of codes, we create a method called followingBehavior which was used to
+                        * shared by FOLLOWING and LEADING. This method returns a Vote. When the returned Vote is null, it follows
+                        * the original idea to break switch statement; otherwise, a valid returned Vote indicates, a leader
+                        * is generated.
+                        *
+                        * The reason why we need to separate these behaviors is to make the algorithm runnable for 2-node
+                        * setting. An extra condition for generating leader is needed. Due to the majority rule, only when
+                        * there is a majority in the voteset, a leader will be generated. However, in a configuration of 2 nodes,
+                        * the number to achieve the majority remains 2, which means a recovered node cannot generate a leader which is
+                        * the existed leader. Therefore, we need the Oracle to kick in this situation. In a two-node configuration, the Oracle
+                        * only grants the permission to maintain the progress to one node. The oracle either grants the permission to the
+                        * remained node and makes it a new leader when there is a faulty machine, which is the case to maintain the progress.
+                        * Otherwise, the oracle does not grant the permission to the remained node, which further causes a service down.
+                        *
+                        * In the former case, when a failed server recovers and participate in the leader election, it would not locate a
+                        * new leader because there does not exist a majority in the voteset. It fails on the containAllQuorum() infinitely due to
+                        * two facts. First one is the fact that it does do not have a majority in the voteset. The other fact is the fact that
+                        * the oracle would not give the permission since the oracle already gave the permission to the existed leader, the healthy machine.
+                        * Logically, when the oracle replies with negative, it implies the existed leader which is LEADING notification comes from is a valid leader.
+                        * To threat this negative replies as a permission to generate the leader is the purpose to separate these two behaviors.
+                        *
+                        *
+                        * */
                     case FOLLOWING:
-                    case LEADING:
                         /*
-                         * Consider all notifications from the same epoch
-                         * together.
-                         */
-                        if (n.electionEpoch == logicalclock.get()) {
-                            recvset.put(n.sid, new Vote(n.leader, n.zxid, n.electionEpoch, n.peerEpoch, n.state));
-                            voteSet = getVoteTracker(recvset, new Vote(n.version, n.leader, n.zxid, n.electionEpoch, n.peerEpoch, n.state));
-                            if (voteSet.hasAllQuorums() && checkLeader(recvset, n.leader, n.electionEpoch)) {
-                                setPeerState(n.leader, voteSet);
-                                Vote endVote = new Vote(n.leader, n.zxid, n.electionEpoch, n.peerEpoch);
-                                leaveInstance(endVote);
-                                return endVote;
-                            }
+                        * To avoid duplicate codes
+                        * */
+                        Vote resultFN = receivedFollowingNotification(recvset, outofelection, voteSet, n);
+                        if (resultFN == null) {
+                            break;
+                        } else {
+                            return resultFN;
                         }
-
+                    case LEADING:
                         /*
-                         * Before joining an established ensemble, verify that
-                         * a majority are following the same leader.
-                         *
-                         * Note that the outofelection map also stores votes from the current leader election.
-                         * See ZOOKEEPER-1732 for more information.
-                         */
-                        outofelection.put(n.sid, new Vote(n.version, n.leader, n.zxid, n.electionEpoch, n.peerEpoch, n.state));
-                        voteSet = getVoteTracker(outofelection, new Vote(n.version, n.leader, n.zxid, n.electionEpoch, n.peerEpoch, n.state));
-
-                        if (voteSet.hasAllQuorums() && checkLeader(outofelection, n.leader, n.electionEpoch)) {
-                            synchronized (this) {
-                                logicalclock.set(n.electionEpoch);
-                                setPeerState(n.leader, voteSet);
-                            }
-                            Vote endVote = new Vote(n.leader, n.zxid, n.electionEpoch, n.peerEpoch);
-                            leaveInstance(endVote);
-                            return endVote;
+                        * In leadingBehavior(), it performs followingBehvior() first. When followingBehavior() returns
+                        * a null pointer, ask Oracle whether to follow this leader.
+                        * */
+                        Vote resultLN = receivedLeadingNotification(recvset, outofelection, voteSet, n);
+                        if (resultLN == null) {
+                            break;
+                        } else {
+                            return resultLN;
                         }
-                        break;
                     default:
-                        LOG.warn("Notification state unrecoginized: {} (n.state), {}(n.sid)", n.state, n.sid);
+                        LOG.warn("Notification state unrecognized: {} (n.state), {}(n.sid)", n.state, n.sid);
                         break;
                     }
                 } else {
@@ -1101,6 +1137,74 @@ public Vote lookForLeader() throws InterruptedException {
         }
     }
 
+    private Vote receivedFollowingNotification(Map<Long, Vote> recvset, Map<Long, Vote> outofelection, SyncedLearnerTracker voteSet, Notification n) {
+        /*
+         * Consider all notifications from the same epoch
+         * together.
+         */
+        if (n.electionEpoch == logicalclock.get()) {
+            recvset.put(n.sid, new Vote(n.leader, n.zxid, n.electionEpoch, n.peerEpoch, n.state));
+            voteSet = getVoteTracker(recvset, new Vote(n.version, n.leader, n.zxid, n.electionEpoch, n.peerEpoch, n.state));
+            if (voteSet.hasAllQuorums() && checkLeader(recvset, n.leader, n.electionEpoch)) {
+                setPeerState(n.leader, voteSet);
+                Vote endVote = new Vote(n.leader, n.zxid, n.electionEpoch, n.peerEpoch);
+                leaveInstance(endVote);
+                return endVote;
+            }
+        }
+
+        /*
+         * Before joining an established ensemble, verify that
+         * a majority are following the same leader.
+         *
+         * Note that the outofelection map also stores votes from the current leader election.
+         * See ZOOKEEPER-1732 for more information.
+         */
+        outofelection.put(n.sid, new Vote(n.version, n.leader, n.zxid, n.electionEpoch, n.peerEpoch, n.state));
+        voteSet = getVoteTracker(outofelection, new Vote(n.version, n.leader, n.zxid, n.electionEpoch, n.peerEpoch, n.state));
+
+        if (voteSet.hasAllQuorums() && checkLeader(outofelection, n.leader, n.electionEpoch)) {
+            synchronized (this) {
+                logicalclock.set(n.electionEpoch);
+                setPeerState(n.leader, voteSet);
+            }
+            Vote endVote = new Vote(n.leader, n.zxid, n.electionEpoch, n.peerEpoch);
+            leaveInstance(endVote);
+            return endVote;
+        }
+
+        return null;
+    }
+
+    private Vote receivedLeadingNotification(Map<Long, Vote> recvset, Map<Long, Vote> outofelection, SyncedLearnerTracker voteSet, Notification n) {
+        /*
+        *
+        * In a two-node configuration, a recovery nodes cannot locate a leader because of the lack of the majority in the voteset.
+        * Therefore, it is the time for Oracle to take place as a tight breaker.
+        *
+        * */
+        Vote result = receivedFollowingNotification(recvset, outofelection, voteSet, n);
+        if (result == null) {
+            /*
+            * Ask Oracle to see if it is okay to follow this leader.
+            *
+            * We don't need the CheckLeader() because itself cannot be a leader candidate
+            * */
+            if (self.getQuorumVerifier().getNeedOracle() && !self.getQuorumVerifier().askOracle()) {
+                LOG.info("Oracle indicates to follow");
+                setPeerState(n.leader, voteSet);
+                Vote endVote = new Vote(n.leader, n.zxid, n.electionEpoch, n.peerEpoch);
+                leaveInstance(endVote);
+                return endVote;
+            } else {
+                LOG.info("Oracle indicates not to follow");
+                return null;
+            }
+        } else {
+            return result;
+        }
+    }
+
     /**
      * Check if a given sid is represented in either the current or
      * the next voting view
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Follower.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Follower.java
index eb6742f5c6d..ca99974cb52 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Follower.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Follower.java
@@ -18,10 +18,12 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.io.IOException;
 import java.nio.ByteBuffer;
 import java.util.Collections;
 import java.util.Map;
+import java.util.Objects;
 import org.apache.jute.Record;
 import org.apache.zookeeper.ZooDefs.OpCode;
 import org.apache.zookeeper.common.Time;
@@ -33,7 +35,6 @@
 import org.apache.zookeeper.server.util.SerializeUtils;
 import org.apache.zookeeper.server.util.ZxidUtils;
 import org.apache.zookeeper.txn.SetDataTxn;
-import org.apache.zookeeper.txn.TxnDigest;
 import org.apache.zookeeper.txn.TxnHeader;
 
 /**
@@ -47,10 +48,10 @@ public class Follower extends Learner {
 
     ObserverMaster om;
 
-    Follower(QuorumPeer self, FollowerZooKeeperServer zk) {
-        this.self = self;
+    Follower(final QuorumPeer self, final FollowerZooKeeperServer zk) {
+        this.self = Objects.requireNonNull(self);
+        this.fzk = Objects.requireNonNull(zk);
         this.zk = zk;
-        this.fzk = zk;
     }
 
     @Override
@@ -101,16 +102,13 @@ void followLeader() throws InterruptedException {
                     throw new IOException("Error: Epoch of leader is lower");
                 }
                 long startTime = Time.currentElapsedTime();
-                try {
-                    self.setLeaderAddressAndId(leaderServer.addr, leaderServer.getId());
-                    self.setZabState(QuorumPeer.ZabState.SYNCHRONIZATION);
-                    syncWithLeader(newEpochZxid);
-                    self.setZabState(QuorumPeer.ZabState.BROADCAST);
-                    completedSync = true;
-                } finally {
-                    long syncTime = Time.currentElapsedTime() - startTime;
-                    ServerMetrics.getMetrics().FOLLOWER_SYNC_TIME.add(syncTime);
-                }
+                self.setLeaderAddressAndId(leaderServer.addr, leaderServer.getId());
+                self.setZabState(QuorumPeer.ZabState.SYNCHRONIZATION);
+                syncWithLeader(newEpochZxid);
+                self.setZabState(QuorumPeer.ZabState.BROADCAST);
+                completedSync = true;
+                long syncTime = Time.currentElapsedTime() - startTime;
+                ServerMetrics.getMetrics().FOLLOWER_SYNC_TIME.add(syncTime);
                 if (self.getObserverMasterPort() > 0) {
                     LOG.info("Starting ObserverMaster");
 
@@ -165,7 +163,6 @@ protected void processPacket(QuorumPacket qp) throws Exception {
             TxnLogEntry logEntry = SerializeUtils.deserializeTxn(qp.getData());
             TxnHeader hdr = logEntry.getHeader();
             Record txn = logEntry.getTxn();
-            TxnDigest digest = logEntry.getDigest();
             if (hdr.getZxid() != lastQueued + 1) {
                 LOG.warn(
                     "Got zxid 0x{} expected 0x{}",
@@ -176,11 +173,11 @@ protected void processPacket(QuorumPacket qp) throws Exception {
 
             if (hdr.getType() == OpCode.reconfig) {
                 SetDataTxn setDataTxn = (SetDataTxn) txn;
-                QuorumVerifier qv = self.configFromString(new String(setDataTxn.getData()));
+                QuorumVerifier qv = self.configFromString(new String(setDataTxn.getData(), UTF_8));
                 self.setLastSeenQuorumVerifier(qv, true);
             }
 
-            fzk.logRequest(hdr, txn, digest);
+            fzk.logRequest(logEntry.toRequest());
             if (hdr != null) {
                 /*
                  * Request header is created only by the leader, so this is only set
@@ -213,7 +210,7 @@ protected void processPacket(QuorumPacket qp) throws Exception {
             // get the new configuration from the request
             Request request = fzk.pendingTxns.element();
             SetDataTxn setDataTxn = (SetDataTxn) request.getTxn();
-            QuorumVerifier qv = self.configFromString(new String(setDataTxn.getData()));
+            QuorumVerifier qv = self.configFromString(new String(setDataTxn.getData(), UTF_8));
 
             // get new designated leader from (current) leader's message
             ByteBuffer buffer = ByteBuffer.wrap(qp.getData());
@@ -252,14 +249,9 @@ protected void processPacket(QuorumPacket qp) throws Exception {
      * @return zxid
      */
     public long getZxid() {
-        try {
-            synchronized (fzk) {
-                return fzk.getZxid();
-            }
-        } catch (NullPointerException e) {
-            LOG.warn("error getting zxid", e);
+        synchronized (fzk) {
+            return fzk.getZxid();
         }
-        return -1;
     }
 
     /**
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessor.java
index 88144de3602..ef01ab32242 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessor.java
@@ -24,6 +24,7 @@
 import org.apache.zookeeper.ZooDefs.OpCode;
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.RequestProcessor;
+import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.server.ZooKeeperCriticalThread;
 import org.apache.zookeeper.server.ZooTrace;
 import org.apache.zookeeper.txn.ErrorTxn;
@@ -38,11 +39,15 @@ public class FollowerRequestProcessor extends ZooKeeperCriticalThread implements
 
     private static final Logger LOG = LoggerFactory.getLogger(FollowerRequestProcessor.class);
 
+    public static final String SKIP_LEARNER_REQUEST_TO_NEXT_PROCESSOR = "zookeeper.follower.skipLearnerRequestToNextProcessor";
+
+    private final boolean skipLearnerRequestToNextProcessor;
+
     FollowerZooKeeperServer zks;
 
     RequestProcessor nextProcessor;
 
-    LinkedBlockingQueue<Request> queuedRequests = new LinkedBlockingQueue<Request>();
+    LinkedBlockingQueue<Request> queuedRequests = new LinkedBlockingQueue<>();
 
     boolean finished = false;
 
@@ -50,12 +55,17 @@ public FollowerRequestProcessor(FollowerZooKeeperServer zks, RequestProcessor ne
         super("FollowerRequestProcessor:" + zks.getServerId(), zks.getZooKeeperServerListener());
         this.zks = zks;
         this.nextProcessor = nextProcessor;
+        this.skipLearnerRequestToNextProcessor = Boolean.getBoolean(SKIP_LEARNER_REQUEST_TO_NEXT_PROCESSOR);
+        LOG.info("Initialized FollowerRequestProcessor with {} as {}", SKIP_LEARNER_REQUEST_TO_NEXT_PROCESSOR,
+                skipLearnerRequestToNextProcessor);
     }
 
     @Override
     public void run() {
         try {
             while (!finished) {
+                ServerMetrics.getMetrics().LEARNER_REQUEST_PROCESSOR_QUEUE_SIZE.add(queuedRequests.size());
+
                 Request request = queuedRequests.take();
                 if (LOG.isTraceEnabled()) {
                     ZooTrace.logRequest(LOG, ZooTrace.CLIENT_REQUEST_TRACE_MASK, 'F', request, "");
@@ -72,7 +82,11 @@ public void run() {
                 // We want to queue the request to be processed before we submit
                 // the request to the leader so that we are ready to receive
                 // the response
-                nextProcessor.processRequest(request);
+                maybeSendRequestToNextProcessor(request);
+
+                if (request.isThrottled()) {
+                    continue;
+                }
 
                 // We now ship the request to the leader. As with all
                 // other quorum operations, sync also follows this code
@@ -106,12 +120,22 @@ public void run() {
                     break;
                 }
             }
+        } catch (RuntimeException e) { // spotbugs require explicit catch of RuntimeException
+            handleException(this.getName(), e);
         } catch (Exception e) {
             handleException(this.getName(), e);
         }
         LOG.info("FollowerRequestProcessor exited loop!");
     }
 
+    private void maybeSendRequestToNextProcessor(Request request) throws RequestProcessorException {
+        if (skipLearnerRequestToNextProcessor && request.isFromLearner()) {
+            ServerMetrics.getMetrics().SKIP_LEARNER_REQUEST_TO_NEXT_PROCESSOR_COUNT.add(1);
+        } else {
+            nextProcessor.processRequest(request);
+        }
+    }
+
     public void processRequest(Request request) {
         processRequest(request, true);
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerZooKeeperServer.java
index 8d371ae5790..1b0b5cd9276 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/FollowerZooKeeperServer.java
@@ -22,7 +22,6 @@
 import java.util.concurrent.ConcurrentLinkedQueue;
 import java.util.concurrent.LinkedBlockingQueue;
 import javax.management.JMException;
-import org.apache.jute.Record;
 import org.apache.zookeeper.jmx.MBeanRegistry;
 import org.apache.zookeeper.metrics.MetricsContext;
 import org.apache.zookeeper.server.ExitCode;
@@ -33,8 +32,6 @@
 import org.apache.zookeeper.server.SyncRequestProcessor;
 import org.apache.zookeeper.server.ZKDatabase;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
-import org.apache.zookeeper.txn.TxnDigest;
-import org.apache.zookeeper.txn.TxnHeader;
 import org.apache.zookeeper.util.ServiceUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -59,7 +56,7 @@ public class FollowerZooKeeperServer extends LearnerZooKeeperServer {
      */
     FollowerZooKeeperServer(FileTxnSnapLog logFactory, QuorumPeer self, ZKDatabase zkDb) throws IOException {
         super(logFactory, self.tickTime, self.minSessionTimeout, self.maxSessionTimeout, self.clientPortListenBacklog, zkDb, self);
-        this.pendingSyncs = new ConcurrentLinkedQueue<Request>();
+        this.pendingSyncs = new ConcurrentLinkedQueue<>();
     }
 
     public Follower getFollower() {
@@ -77,17 +74,22 @@ protected void setupRequestProcessors() {
         syncProcessor.start();
     }
 
-    LinkedBlockingQueue<Request> pendingTxns = new LinkedBlockingQueue<Request>();
+    LinkedBlockingQueue<Request> pendingTxns = new LinkedBlockingQueue<>();
 
-    public void logRequest(TxnHeader hdr, Record txn, TxnDigest digest) {
-        Request request = new Request(hdr.getClientId(), hdr.getCxid(), hdr.getType(), hdr, txn, hdr.getZxid());
-        request.setTxnDigest(digest);
+    public void logRequest(Request request) {
         if ((request.zxid & 0xffffffffL) != 0) {
             pendingTxns.add(request);
         }
         syncProcessor.processRequest(request);
     }
 
+    /**
+     * Append txn request to the transaction log directly without go through request processors.
+     */
+    public void appendRequest(Request request) throws IOException {
+        getZKDatabase().append(request);
+    }
+
     /**
      * When a COMMIT message is received, eventually this method is called,
      * which matches up the zxid from the COMMIT with (hopefully) the head of
@@ -180,5 +182,4 @@ protected void unregisterMetrics() {
         rootContext.unregisterGauge("synced_observers");
 
     }
-
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
index 5371bea91d9..1561a7dae18 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Leader.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.io.BufferedInputStream;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
@@ -56,6 +57,7 @@
 import org.apache.zookeeper.ZooDefs.OpCode;
 import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.jmx.MBeanRegistry;
+import org.apache.zookeeper.server.ExitCode;
 import org.apache.zookeeper.server.FinalRequestProcessor;
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.RequestProcessor;
@@ -66,8 +68,8 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.LearnerType;
 import org.apache.zookeeper.server.quorum.auth.QuorumAuthServer;
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
-import org.apache.zookeeper.server.util.SerializeUtils;
 import org.apache.zookeeper.server.util.ZxidUtils;
+import org.apache.zookeeper.util.ServiceUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -86,14 +88,60 @@ public class Leader extends LearnerMaster {
 
     public static class Proposal extends SyncedLearnerTracker {
 
-        public QuorumPacket packet;
-        public Request request;
+        private QuorumPacket packet;
+        protected Request request;
+
+        public Proposal() {
+        }
+
+        public Proposal(QuorumPacket packet) {
+            this.packet = packet;
+        }
+
+        public Proposal(Request request, QuorumPacket packet) {
+            this.request = request;
+            this.packet = packet;
+        }
+
+        public QuorumPacket getQuorumPacket() {
+            return packet;
+        }
+
+        public Request getRequest() {
+            return request;
+        }
+
+        public long getZxid() {
+            return packet.getZxid();
+        }
 
         @Override
         public String toString() {
             return packet.getType() + ", " + packet.getZxid() + ", " + request;
         }
+    }
+
+    public static class PureRequestProposal extends Proposal {
+
+        public PureRequestProposal(Request request) {
+            this.request = request;
+        }
 
+        @Override
+        public QuorumPacket getQuorumPacket() {
+            byte[] data = request.getSerializeData();
+            return new QuorumPacket(Leader.PROPOSAL, request.zxid, data, null);
+        }
+
+        @Override
+        public long getZxid() {
+            return request.zxid;
+        }
+
+        @Override
+        public String toString() {
+            return request.toString();
+        }
     }
 
     // log ack latency if zxid is a multiple of ackLoggingFrequency. If <=0, disable logging.
@@ -124,7 +172,7 @@ public static int getAckLoggingFrequency() {
     volatile LearnerCnxAcceptor cnxAcceptor = null;
 
     // list of all the learners, including followers and observers
-    private final HashSet<LearnerHandler> learners = new HashSet<LearnerHandler>();
+    private final HashSet<LearnerHandler> learners = new HashSet<>();
 
     private final BufferStats proposalStats;
 
@@ -140,24 +188,24 @@ public BufferStats getProposalStats() {
      */
     public List<LearnerHandler> getLearners() {
         synchronized (learners) {
-            return new ArrayList<LearnerHandler>(learners);
+            return new ArrayList<>(learners);
         }
     }
 
     // list of followers that are ready to follow (i.e synced with the leader)
-    private final HashSet<LearnerHandler> forwardingFollowers = new HashSet<LearnerHandler>();
+    private final HashSet<LearnerHandler> forwardingFollowers = new HashSet<>();
 
     /**
      * Returns a copy of the current forwarding follower snapshot
      */
     public List<LearnerHandler> getForwardingFollowers() {
         synchronized (forwardingFollowers) {
-            return new ArrayList<LearnerHandler>(forwardingFollowers);
+            return new ArrayList<>(forwardingFollowers);
         }
     }
 
     public List<LearnerHandler> getNonVotingFollowers() {
-        List<LearnerHandler> nonVotingFollowers = new ArrayList<LearnerHandler>();
+        List<LearnerHandler> nonVotingFollowers = new ArrayList<>();
         synchronized (forwardingFollowers) {
             for (LearnerHandler lh : forwardingFollowers) {
                 if (!isParticipant(lh.getSid())) {
@@ -171,17 +219,21 @@ public List<LearnerHandler> getNonVotingFollowers() {
     void addForwardingFollower(LearnerHandler lh) {
         synchronized (forwardingFollowers) {
             forwardingFollowers.add(lh);
+            /*
+            * Any changes on forwardiongFollowers could possible affect the need of Oracle.
+            * */
+            self.getQuorumVerifier().updateNeedOracle(new ArrayList<>(forwardingFollowers));
         }
     }
 
-    private final HashSet<LearnerHandler> observingLearners = new HashSet<LearnerHandler>();
+    private final HashSet<LearnerHandler> observingLearners = new HashSet<>();
 
     /**
      * Returns a copy of the current observer snapshot
      */
     public List<LearnerHandler> getObservingLearners() {
         synchronized (observingLearners) {
-            return new ArrayList<LearnerHandler>(observingLearners);
+            return new ArrayList<>(observingLearners);
         }
     }
 
@@ -210,7 +262,7 @@ public void resetObserverConnectionStats() {
     }
 
     // Pending sync requests. Must access under 'this' lock.
-    private final Map<Long, List<LearnerSyncRequest>> pendingSyncs = new HashMap<Long, List<LearnerSyncRequest>>();
+    private final Map<Long, List<LearnerSyncRequest>> pendingSyncs = new HashMap<>();
 
     public synchronized int getNumPendingSyncs() {
         return pendingSyncs.size();
@@ -260,12 +312,12 @@ boolean isLearnerSynced(LearnerHandler peer) {
      * Returns true if a quorum in qv is connected and synced with the leader
      * and false otherwise
      *
-     * @param qv, a QuorumVerifier
+     * @param qv is a QuorumVerifier
      */
     public boolean isQuorumSynced(QuorumVerifier qv) {
-        HashSet<Long> ids = new HashSet<Long>();
-        if (qv.getVotingMembers().containsKey(self.getId())) {
-            ids.add(self.getId());
+        HashSet<Long> ids = new HashSet<>();
+        if (qv.getVotingMembers().containsKey(self.getMyId())) {
+            ids.add(self.getMyId());
         }
         synchronized (forwardingFollowers) {
             for (LearnerHandler learnerHandler : forwardingFollowers) {
@@ -303,6 +355,10 @@ public Leader(QuorumPeer self, LeaderZooKeeperServer zk) throws IOException {
         this.zk = zk;
     }
 
+    InetSocketAddress recreateInetSocketAddr(String hostString, int port) {
+        return new InetSocketAddress(hostString, port);
+    }
+
     Optional<ServerSocket> createServerSocket(InetSocketAddress address, boolean portUnification, boolean sslQuorum) {
         ServerSocket serverSocket;
         try {
@@ -312,7 +368,7 @@ Optional<ServerSocket> createServerSocket(InetSocketAddress address, boolean por
                 serverSocket = new ServerSocket();
             }
             serverSocket.setReuseAddress(true);
-            serverSocket.bind(address);
+            serverSocket.bind(recreateInetSocketAddr(address.getHostString(), address.getPort()));
             return Optional.of(serverSocket);
         } catch (IOException e) {
             LOG.error("Couldn't bind to {}", address.toString(), e);
@@ -354,7 +410,7 @@ Optional<ServerSocket> createServerSocket(InetSocketAddress address, boolean por
 
     /**
      * This message type is sent by the leader to indicate that the follower is
-     * now uptodate andt can start responding to clients.
+     * now uptodate and can start responding to clients.
      */
     static final int UPTODATE = 12;
 
@@ -423,9 +479,9 @@ Optional<ServerSocket> createServerSocket(InetSocketAddress address, boolean por
      */
     static final int INFORMANDACTIVATE = 19;
 
-    final ConcurrentMap<Long, Proposal> outstandingProposals = new ConcurrentHashMap<Long, Proposal>();
+    final ConcurrentMap<Long, Proposal> outstandingProposals = new ConcurrentHashMap<>();
 
-    private final ConcurrentLinkedQueue<Proposal> toBeApplied = new ConcurrentLinkedQueue<Proposal>();
+    private final ConcurrentLinkedQueue<Proposal> toBeApplied = new ConcurrentLinkedQueue<>();
 
     // VisibleForTesting
     protected final Proposal newLeaderProposal = new Proposal();
@@ -596,7 +652,7 @@ void lead() throws IOException, InterruptedException {
             cnxAcceptor = new LearnerCnxAcceptor();
             cnxAcceptor.start();
 
-            long epoch = getEpochToPropose(self.getId(), self.getAcceptedEpoch());
+            long epoch = getEpochToPropose(self.getMyId(), self.getAcceptedEpoch());
 
             zk.setZxid(ZxidUtils.makeZxid(epoch, 0));
 
@@ -633,6 +689,7 @@ void lead() throws IOException, InterruptedException {
                 // hence before they construct the NEWLEADER message containing
                 // the last-seen-quorumverifier of the leader, which we change below
                 try {
+                    LOG.debug(String.format("set lastSeenQuorumVerifier to currentQuorumVerifier (%s)", curQV.toString()));
                     QuorumVerifier newQV = self.configFromString(curQV.toString());
                     newQV.setVersion(zk.getZxid());
                     self.setLastSeenQuorumVerifier(newQV, true);
@@ -650,18 +707,18 @@ void lead() throws IOException, InterruptedException {
             // us. We do this by waiting for the NEWLEADER packet to get
             // acknowledged
 
-            waitForEpochAck(self.getId(), leaderStateSummary);
+            waitForEpochAck(self.getMyId(), leaderStateSummary);
             self.setCurrentEpoch(epoch);
-            self.setLeaderAddressAndId(self.getQuorumAddress(), self.getId());
+            self.setLeaderAddressAndId(self.getQuorumAddress(), self.getMyId());
             self.setZabState(QuorumPeer.ZabState.SYNCHRONIZATION);
 
             try {
-                waitForNewLeaderAck(self.getId(), zk.getZxid());
+                waitForNewLeaderAck(self.getMyId(), zk.getZxid());
             } catch (InterruptedException e) {
                 shutdown("Waiting for a quorum of followers, only synced with sids: [ "
                          + newLeaderProposal.ackSetsToString()
                          + " ]");
-                HashSet<Long> followerSet = new HashSet<Long>();
+                HashSet<Long> followerSet = new HashSet<>();
 
                 for (LearnerHandler f : getLearners()) {
                     if (self.getQuorumVerifier().getVotingMembers().containsKey(f.getSid())) {
@@ -708,13 +765,6 @@ void lead() throws IOException, InterruptedException {
             self.setZabState(QuorumPeer.ZabState.BROADCAST);
             self.adminServer.setZooKeeperServer(zk);
 
-            // Everything is a go, simply start counting the ticks
-            // WARNING: I couldn't find any wait statement on a synchronized
-            // block that would be notified by this notifyAll() call, so
-            // I commented it out
-            //synchronized (this) {
-            //    notifyAll();
-            //}
             // We ping twice a tick, so we only update the tick every other
             // iteration
             boolean tickSkip = true;
@@ -745,7 +795,7 @@ void lead() throws IOException, InterruptedException {
                         syncedAckSet.addQuorumVerifier(self.getLastSeenQuorumVerifier());
                     }
 
-                    syncedAckSet.addAck(self.getId());
+                    syncedAckSet.addAck(self.getMyId());
 
                     for (LearnerHandler f : getLearners()) {
                         if (f.synced()) {
@@ -760,7 +810,27 @@ void lead() throws IOException, InterruptedException {
                         break;
                     }
 
-                    if (!tickSkip && !syncedAckSet.hasAllQuorums()) {
+                    /*
+                     *
+                     * We will need to re-validate the outstandingProposal to maintain the progress of ZooKeeper.
+                     * It is likely a proposal is waiting for enough ACKs to be committed. The proposals are sent out, but the
+                     * only follower goes away which makes the proposals will not be committed until the follower recovers back.
+                     * An earlier proposal which is not committed will block any further proposals. So, We need to re-validate those
+                     * outstanding proposal with the help from Oracle. A key point in the process of re-validation is that the proposals
+                     * need to be processed in order.
+                     *
+                     * We make the whole method blocking to avoid any possible race condition on outstandingProposal and lastCommitted
+                     * as well as to avoid nested synchronization.
+                     *
+                     * As a more generic approach, we pass the object of forwardingFollowers to QuorumOracleMaj to determine if we need
+                     * the help from Oracle.
+                     *
+                     *
+                     * the size of outstandingProposals can be 1. The only one outstanding proposal is the one waiting for the ACK from
+                     * the leader itself.
+                     * */
+                    if (!tickSkip && !syncedAckSet.hasAllQuorums()
+                        && !(self.getQuorumVerifier().overrideQuorumDecision(getForwardingFollowers()) && self.getQuorumVerifier().revalidateOutstandingProp(this, new ArrayList<>(outstandingProposals.values()), lastCommitted))) {
                         // Lost quorum of last committed and/or last proposed
                         // config, set shutdown flag
                         shutdownMessage = "Not sufficient followers synced, only synced with sids: [ "
@@ -803,7 +873,7 @@ void shutdown(String reason) {
             closeSockets();
         }
 
-        // NIO should not accept conenctions
+        // NIO should not accept connections
         self.setZooKeeperServer(null);
         self.adminServer.setZooKeeperServer(null);
         self.closeAllConnections();
@@ -833,9 +903,15 @@ synchronized void closeSockets() {
        }
     }
 
+    MultipleAddresses recreateSocketAddresses(MultipleAddresses addr) {
+        return new MultipleAddresses(addr.getAllAddresses().stream()
+                .map(address -> new InetSocketAddress(address.getHostString(), address.getPort()))
+                .collect(Collectors.toSet()));
+    }
+
     /** In a reconfig operation, this method attempts to find the best leader for next configuration.
-     *  If the current leader is a voter in the next configuartion, then it remains the leader.
-     *  Otherwise, choose one of the new voters that acked the reconfiguartion, such that it is as
+     *  If the current leader is a voter in the next configuration, then it remains the leader.
+     *  Otherwise, choose one of the new voters that acked the reconfiguration, such that it is as
      * up-to-date as possible, i.e., acked as many outstanding proposals as possible.
      *
      * @param reconfigProposal
@@ -843,21 +919,22 @@ synchronized void closeSockets() {
      * @return server if of the designated leader
      */
 
-    private long getDesignatedLeader(Proposal reconfigProposal, long zxid) {
+    long getDesignatedLeader(Proposal reconfigProposal, long zxid) {
         //new configuration
         Proposal.QuorumVerifierAcksetPair newQVAcksetPair = reconfigProposal.qvAcksetPairs.get(reconfigProposal.qvAcksetPairs.size() - 1);
 
         //check if I'm in the new configuration with the same quorum address -
         // if so, I'll remain the leader
-        if (newQVAcksetPair.getQuorumVerifier().getVotingMembers().containsKey(self.getId())
-            && newQVAcksetPair.getQuorumVerifier().getVotingMembers().get(self.getId()).addr.equals(self.getQuorumAddress())) {
-            return self.getId();
+        if (newQVAcksetPair.getQuorumVerifier().getVotingMembers().containsKey(self.getMyId())
+            && recreateSocketAddresses(newQVAcksetPair.getQuorumVerifier().getVotingMembers().get(self.getMyId()).addr)
+                .equals(recreateSocketAddresses(self.getQuorumAddress()))) {
+            return self.getMyId();
         }
         // start with an initial set of candidates that are voters from new config that
         // acknowledged the reconfig op (there must be a quorum). Choose one of them as
         // current leader candidate
-        HashSet<Long> candidates = new HashSet<Long>(newQVAcksetPair.getAckset());
-        candidates.remove(self.getId()); // if we're here, I shouldn't be the leader
+        HashSet<Long> candidates = new HashSet<>(newQVAcksetPair.getAckset());
+        candidates.remove(self.getMyId()); // if we're here, I shouldn't be the leader
         long curCandidate = candidates.iterator().next();
 
         //go over outstanding ops in order, and try to find a candidate that acked the most ops.
@@ -912,10 +989,10 @@ public synchronized boolean tryToCommit(Proposal p, long zxid, SocketAddress fol
         // commit proposals in order
         if (zxid != lastCommitted + 1) {
             LOG.warn(
-                "Commiting zxid 0x{} from {} noy first!",
+                "Committing zxid 0x{} from {} not first!",
                 Long.toHexString(zxid),
                 followerAddr);
-            LOG.warn("First is {}", (lastCommitted + 1));
+            LOG.warn("First is 0x{}", Long.toHexString(lastCommitted + 1));
         }
 
         outstandingProposals.remove(zxid);
@@ -934,13 +1011,14 @@ public synchronized boolean tryToCommit(Proposal p, long zxid, SocketAddress fol
             //otherwise an up-to-date follower will be designated as leader. This saves
             //leader election time, unless the designated leader fails
             Long designatedLeader = getDesignatedLeader(p, zxid);
-            //LOG.warn("designated leader is: " + designatedLeader);
 
             QuorumVerifier newQV = p.qvAcksetPairs.get(p.qvAcksetPairs.size() - 1).getQuorumVerifier();
 
             self.processReconfig(newQV, designatedLeader, zk.getZxid(), true);
 
-            if (designatedLeader != self.getId()) {
+            if (designatedLeader != self.getMyId()) {
+                LOG.info(String.format("Committing a reconfiguration (reconfigEnabled=%s); this leader is not the designated "
+                        + "leader anymore, setting allowedToCommit=false", self.isReconfigEnabled()));
                 allowedToCommit = false;
             }
 
@@ -949,7 +1027,6 @@ public synchronized boolean tryToCommit(Proposal p, long zxid, SocketAddress fol
             // receive the commit message.
             commitAndActivate(zxid, designatedLeader);
             informAndActivate(p, designatedLeader);
-            //turnOffFollowers();
         } else {
             p.request.logLatency(ServerMetrics.getMetrics().QUORUM_ACK_LATENCY);
             commit(zxid);
@@ -969,8 +1046,8 @@ public synchronized boolean tryToCommit(Proposal p, long zxid, SocketAddress fol
      * Keep a count of acks that are received by the leader for a particular
      * proposal
      *
-     * @param zxid, the zxid of the proposal sent out
-     * @param sid, the id of the server that sent the ack
+     * @param sid is the id of the server that sent the ack
+     * @param zxid is the zxid of the proposal sent out
      * @param followerAddr
      */
     @Override
@@ -1195,8 +1272,6 @@ public synchronized long getLastProposed() {
 
     /**
      * Returns the current epoch of the leader.
-     *
-     * @return
      */
     public long getEpoch() {
         return ZxidUtils.getEpochFromZxid(lastProposed);
@@ -1218,6 +1293,10 @@ public XidRolloverException(String message) {
      * @return the proposal that is queued to send to all the members
      */
     public Proposal propose(Request request) throws XidRolloverException {
+        if (request.isThrottled()) {
+            LOG.error("Throttled request send as proposal: {}. Exiting.", request);
+            ServiceUtils.requestSystemExit(ExitCode.UNEXPECTED_ERROR.getValue());
+        }
         /**
          * Address the rollover issue. All lower 32bits set indicate a new leader
          * election. Force a re-election instead. See ZOOKEEPER-1277
@@ -1228,13 +1307,11 @@ public Proposal propose(Request request) throws XidRolloverException {
             throw new XidRolloverException(msg);
         }
 
-        byte[] data = SerializeUtils.serializeRequest(request);
+        byte[] data = request.getSerializeData();
         proposalStats.setLastBufferSize(data.length);
         QuorumPacket pp = new QuorumPacket(Leader.PROPOSAL, request.zxid, data, null);
 
-        Proposal p = new Proposal();
-        p.packet = pp;
-        p.request = request;
+        Proposal p = new Proposal(request, pp);
 
         synchronized (this) {
             p.addQuorumVerifier(self.getQuorumVerifier());
@@ -1267,12 +1344,7 @@ public synchronized void processSync(LearnerSyncRequest r) {
         if (outstandingProposals.isEmpty()) {
             sendSync(r);
         } else {
-            List<LearnerSyncRequest> l = pendingSyncs.get(lastProposed);
-            if (l == null) {
-                l = new ArrayList<LearnerSyncRequest>();
-            }
-            l.add(r);
-            pendingSyncs.put(lastProposed, l);
+            pendingSyncs.computeIfAbsent(lastProposed, k -> new ArrayList<>()).add(r);
         }
     }
 
@@ -1308,7 +1380,7 @@ public synchronized long startForwarding(LearnerHandler handler, long lastSeenZx
             }
             // Only participant need to get outstanding proposals
             if (handler.getLearnerType() == LearnerType.PARTICIPANT) {
-                List<Long> zxids = new ArrayList<Long>(outstandingProposals.keySet());
+                List<Long> zxids = new ArrayList<>(outstandingProposals.keySet());
                 Collections.sort(zxids);
                 for (Long zxid : zxids) {
                     if (zxid <= lastSeenZxid) {
@@ -1337,7 +1409,7 @@ public void waitForStartup() throws InterruptedException {
     }
 
     // VisibleForTesting
-    protected final Set<Long> connectingFollowers = new HashSet<Long>();
+    protected final Set<Long> connectingFollowers = new HashSet<>();
 
     private volatile boolean quitWaitForEpoch = false;
     private volatile long timeStartWaitForEpoch = -1;
@@ -1406,13 +1478,13 @@ public long getEpochToPropose(long sid, long lastAcceptedEpoch) throws Interrupt
                 connectingFollowers.add(sid);
             }
             QuorumVerifier verifier = self.getQuorumVerifier();
-            if (connectingFollowers.contains(self.getId()) && verifier.containsQuorum(connectingFollowers)) {
+            if (connectingFollowers.contains(self.getMyId()) && verifier.containsQuorum(connectingFollowers)) {
                 waitingForNewEpoch = false;
                 self.setAcceptedEpoch(epoch);
                 connectingFollowers.notifyAll();
             } else {
                 long start = Time.currentElapsedTime();
-                if (sid == self.getId()) {
+                if (sid == self.getMyId()) {
                     timeStartWaitForEpoch = start;
                 }
                 long cur = start;
@@ -1435,7 +1507,7 @@ public ZKDatabase getZKDatabase() {
     }
 
     // VisibleForTesting
-    protected final Set<Long> electingFollowers = new HashSet<Long>();
+    protected final Set<Long> electingFollowers = new HashSet<>();
     // VisibleForTesting
     protected boolean electionFinished = false;
 
@@ -1458,7 +1530,7 @@ public void waitForEpochAck(long id, StateSummary ss) throws IOException, Interr
                 }
             }
             QuorumVerifier verifier = self.getQuorumVerifier();
-            if (electingFollowers.contains(self.getId()) && verifier.containsQuorum(electingFollowers)) {
+            if (electingFollowers.contains(self.getMyId()) && verifier.containsQuorum(electingFollowers)) {
                 electionFinished = true;
                 electingFollowers.notifyAll();
             } else {
@@ -1502,20 +1574,25 @@ private synchronized void startZkServer() {
                  newLeaderProposal.ackSetsToString(),
                  Long.toHexString(zk.getZxid()));
 
-        /*
-         * ZOOKEEPER-1324. the leader sends the new config it must complete
-         *  to others inside a NEWLEADER message (see LearnerHandler where
-         *  the NEWLEADER message is constructed), and once it has enough
-         *  acks we must execute the following code so that it applies the
-         *  config to itself.
-         */
-        QuorumVerifier newQV = self.getLastSeenQuorumVerifier();
+        if (self.isReconfigEnabled()) {
+            /*
+             * ZOOKEEPER-1324. the leader sends the new config it must complete
+             *  to others inside a NEWLEADER message (see LearnerHandler where
+             *  the NEWLEADER message is constructed), and once it has enough
+             *  acks we must execute the following code so that it applies the
+             *  config to itself.
+             */
+            QuorumVerifier newQV = self.getLastSeenQuorumVerifier();
 
-        Long designatedLeader = getDesignatedLeader(newLeaderProposal, zk.getZxid());
+            Long designatedLeader = getDesignatedLeader(newLeaderProposal, zk.getZxid());
 
-        self.processReconfig(newQV, designatedLeader, zk.getZxid(), true);
-        if (designatedLeader != self.getId()) {
-            allowedToCommit = false;
+            self.processReconfig(newQV, designatedLeader, zk.getZxid(), true);
+            if (designatedLeader != self.getMyId()) {
+                LOG.warn("This leader is not the designated leader, it will be initialized with allowedToCommit = false");
+                allowedToCommit = false;
+            }
+        } else {
+            LOG.info("Dynamic reconfig feature is disabled, skip designatedLeader calculation and reconfig processing.");
         }
 
         leaderStartTime = Time.currentElapsedTime();
@@ -1688,7 +1765,7 @@ public String getPeerInfo(long sid) {
 
     @Override
     public byte[] getQuorumVerifierBytes() {
-        return self.getLastSeenQuorumVerifier().toString().getBytes();
+        return self.getLastSeenQuorumVerifier().toString().getBytes(UTF_8);
     }
 
     @Override
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LeaderSessionTracker.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LeaderSessionTracker.java
index e750b4dd881..3f9789f5d00 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LeaderSessionTracker.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LeaderSessionTracker.java
@@ -223,4 +223,7 @@ public Map<Long, Set<Long>> getSessionExpiryMap() {
         return sessionExpiryMap;
     }
 
+    public Set<Long> globalSessions() {
+        return globalSessionTracker.globalSessions();
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LeaderZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LeaderZooKeeperServer.java
index 8834b5fbdb1..1a3c15aeafe 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LeaderZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LeaderZooKeeperServer.java
@@ -19,7 +19,7 @@
 package org.apache.zookeeper.server.quorum;
 
 import java.io.IOException;
-import java.util.concurrent.TimeUnit;
+import java.util.function.Function;
 import javax.management.JMException;
 import org.apache.zookeeper.KeeperException.SessionExpiredException;
 import org.apache.zookeeper.jmx.MBeanRegistry;
@@ -77,13 +77,7 @@ protected void setupRequestProcessors() {
     }
 
     private synchronized void setupContainerManager() {
-        containerManager = new ContainerManager(
-            getZKDatabase(),
-            prepRequestProcessor,
-            Integer.getInteger("znode.container.checkIntervalMs", (int) TimeUnit.MINUTES.toMillis(1)),
-            Integer.getInteger("znode.container.maxPerMinute", 10000),
-            Long.getLong("znode.container.maxNeverUsedIntervalMs", 0)
-        );
+        containerManager = new ContainerManager(getZKDatabase(), prepRequestProcessor);
     }
 
     @Override
@@ -99,34 +93,41 @@ protected void registerMetrics() {
         super.registerMetrics();
 
         MetricsContext rootContext = ServerMetrics.getMetrics().getMetricsProvider().getRootContext();
-
-        rootContext.registerGauge("learners", () -> {
-            return getLeader().getLearners().size();
-        });
-        rootContext.registerGauge("synced_followers", () -> {
-            return getLeader().getForwardingFollowers().size();
-        });
-        rootContext.registerGauge("synced_non_voting_followers", () -> {
-            return getLeader().getNonVotingFollowers().size();
-        });
-
+        rootContext.registerGauge("learners", gaugeWithLeader(
+                (leader) -> leader.getLearners().size())
+        );
+        rootContext.registerGauge("synced_followers", gaugeWithLeader(
+                (leader) -> leader.getForwardingFollowers().size()
+        ));
+        rootContext.registerGauge("synced_non_voting_followers", gaugeWithLeader(
+                (leader) -> leader.getNonVotingFollowers().size()
+        ));
         rootContext.registerGauge("synced_observers", self::getSynced_observers_metric);
+        rootContext.registerGauge("pending_syncs", gaugeWithLeader(
+                (leader) -> leader.getNumPendingSyncs()
+        ));
+        rootContext.registerGauge("leader_uptime", gaugeWithLeader(
+                (leader) -> leader.getUptime()
+        ));
+        rootContext.registerGauge("last_proposal_size", gaugeWithLeader(
+                (leader) -> leader.getProposalStats().getLastBufferSize()
+        ));
+        rootContext.registerGauge("max_proposal_size", gaugeWithLeader(
+                (leader) -> leader.getProposalStats().getMaxBufferSize()
+        ));
+        rootContext.registerGauge("min_proposal_size", gaugeWithLeader(
+                (leader) -> leader.getProposalStats().getMinBufferSize()
+        ));
+    }
 
-        rootContext.registerGauge("pending_syncs", () -> {
-            return getLeader().getNumPendingSyncs();
-        });
-        rootContext.registerGauge("leader_uptime", () -> {
-            return getLeader().getUptime();
-        });
-        rootContext.registerGauge("last_proposal_size", () -> {
-            return getLeader().getProposalStats().getLastBufferSize();
-        });
-        rootContext.registerGauge("max_proposal_size", () -> {
-            return getLeader().getProposalStats().getMaxBufferSize();
-        });
-        rootContext.registerGauge("min_proposal_size", () -> {
-            return getLeader().getProposalStats().getMinBufferSize();
-        });
+    private org.apache.zookeeper.metrics.Gauge gaugeWithLeader(Function<Leader, Number> supplier) {
+        return () -> {
+            final Leader leader = getLeader();
+            if (leader == null) {
+                return null;
+            }
+            return supplier.apply(leader);
+        };
     }
 
     @Override
@@ -147,11 +148,11 @@ protected void unregisterMetrics() {
     }
 
     @Override
-    public synchronized void shutdown() {
+    protected synchronized void shutdownComponents() {
         if (containerManager != null) {
             containerManager.stop();
         }
-        super.shutdown();
+        super.shutdownComponents();
     }
 
     @Override
@@ -167,7 +168,7 @@ public void createSessionTracker() {
             this,
             getZKDatabase().getSessionWithTimeOuts(),
             tickTime,
-            self.getId(),
+            self.getMyId(),
             self.areLocalSessionsEnabled(),
             getZooKeeperServerListener());
     }
@@ -283,7 +284,7 @@ public String getState() {
      */
     @Override
     public long getServerId() {
-        return self.getId();
+        return self.getMyId();
     }
 
     @Override
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
index 8a0cac17ad6..adf0ef6e510 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Learner.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.io.BufferedInputStream;
 import java.io.BufferedOutputStream;
 import java.io.ByteArrayInputStream;
@@ -38,6 +39,7 @@
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
 import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicReference;
 import javax.net.ssl.SSLSocket;
 import org.apache.jute.BinaryInputArchive;
@@ -46,14 +48,17 @@
 import org.apache.jute.OutputArchive;
 import org.apache.jute.Record;
 import org.apache.zookeeper.ZooDefs.OpCode;
+import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.common.X509Exception;
 import org.apache.zookeeper.server.ExitCode;
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.ServerCnxn;
+import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.server.TxnLogEntry;
 import org.apache.zookeeper.server.ZooTrace;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
+import org.apache.zookeeper.server.util.ConfigUtils;
 import org.apache.zookeeper.server.util.MessageTracker;
 import org.apache.zookeeper.server.util.SerializeUtils;
 import org.apache.zookeeper.server.util.ZxidUtils;
@@ -77,6 +82,10 @@ static class PacketInFlight {
         Record rec;
         TxnDigest digest;
 
+        Request toRequest() {
+            return new Request(hdr, rec, digest);
+        }
+
     }
 
     QuorumPeer self;
@@ -86,10 +95,10 @@ static class PacketInFlight {
 
     protected Socket sock;
     protected MultipleAddresses leaderAddr;
+    protected AtomicBoolean sockBeingClosed = new AtomicBoolean(false);
 
     /**
      * Socket getter
-     * @return
      */
     public Socket getSocket() {
         return sock;
@@ -114,15 +123,21 @@ public Socket getSocket() {
 
     private static final boolean nodelay = System.getProperty("follower.nodelay", "true").equals("true");
 
-    public static final String LEARNER_ASYNC_SENDING = "learner.asyncSending";
-    private static boolean asyncSending = Boolean.getBoolean(LEARNER_ASYNC_SENDING);
+    public static final String LEARNER_ASYNC_SENDING = "zookeeper.learner.asyncSending";
+    private static boolean asyncSending =
+        Boolean.parseBoolean(ConfigUtils.getPropertyBackwardCompatibleWay(LEARNER_ASYNC_SENDING));
+    public static final String LEARNER_CLOSE_SOCKET_ASYNC = "zookeeper.learner.closeSocketAsync";
+    public static final boolean closeSocketAsync = Boolean
+        .parseBoolean(ConfigUtils.getPropertyBackwardCompatibleWay(LEARNER_CLOSE_SOCKET_ASYNC));
+
     static {
         LOG.info("leaderConnectDelayDuringRetryMs: {}", leaderConnectDelayDuringRetryMs);
         LOG.info("TCP NoDelay set to: {}", nodelay);
         LOG.info("{} = {}", LEARNER_ASYNC_SENDING, asyncSending);
+        LOG.info("{} = {}", LEARNER_CLOSE_SOCKET_ASYNC, closeSocketAsync);
     }
 
-    final ConcurrentHashMap<Long, ServerCnxn> pendingRevalidations = new ConcurrentHashMap<Long, ServerCnxn>();
+    final ConcurrentHashMap<Long, ServerCnxn> pendingRevalidations = new ConcurrentHashMap<>();
 
     public int getPendingRevalidationsCount() {
         return pendingRevalidations.size();
@@ -234,18 +249,18 @@ void readPacket(QuorumPacket pp) throws IOException {
      * @throws IOException
      */
     void request(Request request) throws IOException {
+        if (request.isThrottled()) {
+            LOG.error("Throttled request sent to leader: {}. Exiting", request);
+            ServiceUtils.requestSystemExit(ExitCode.UNEXPECTED_ERROR.getValue());
+        }
         ByteArrayOutputStream baos = new ByteArrayOutputStream();
         DataOutputStream oa = new DataOutputStream(baos);
         oa.writeLong(request.sessionId);
         oa.writeInt(request.cxid);
         oa.writeInt(request.type);
-        if (request.request != null) {
-            request.request.rewind();
-            int len = request.request.remaining();
-            byte[] b = new byte[len];
-            request.request.get(b);
-            request.request.rewind();
-            oa.write(b);
+        byte[] payload = request.readRequestBytes();
+        if (payload != null) {
+            oa.write(payload);
         }
         oa.close();
         QuorumPacket qp = new QuorumPacket(Leader.REQUEST, -1, baos.toByteArray(), request.authInfo);
@@ -284,7 +299,7 @@ protected long nanoTime() {
 
     /**
      * Overridable helper method to simply call sock.connect(). This can be
-     * overriden in tests to fake connection success/failure for connectToLeader.
+     * overridden in tests to fake connection success/failure for connectToLeader.
      */
     protected void sockConnect(Socket sock, InetSocketAddress addr, int timeout) throws IOException {
         sock.connect(addr, timeout);
@@ -333,6 +348,7 @@ protected void connectToLeader(MultipleAddresses multiAddr, String hostname) thr
             throw new IOException("Failed connect to " + multiAddr);
         } else {
             sock = socket.get();
+            sockBeingClosed.set(false);
         }
 
         self.authLearner.authenticate(sock, hostname);
@@ -479,7 +495,7 @@ protected long registerWithLeader(int pktType) throws IOException {
         /*
          * Add sid to payload
          */
-        LearnerInfo li = new LearnerInfo(self.getId(), 0x10000, self.getQuorumVerifier().getVersion());
+        LearnerInfo li = new LearnerInfo(self.getMyId(), 0x10000, self.getQuorumVerifier().getVersion());
         ByteArrayOutputStream bsid = new ByteArrayOutputStream();
         BinaryOutputArchive boa = BinaryOutputArchive.getArchive(bsid);
         boa.writeRecord(li, "LearnerInfo");
@@ -523,6 +539,27 @@ protected long registerWithLeader(int pktType) throws IOException {
         }
     }
 
+    long enforceContinuousProposal(long lastQueued, PacketInFlight pif) throws Exception {
+        if (lastQueued == 0) {
+            LOG.info("DIFF sync got first proposal 0x{}", Long.toHexString(pif.hdr.getZxid()));
+        } else if (pif.hdr.getZxid() != lastQueued + 1) {
+            if (ZxidUtils.getEpochFromZxid(pif.hdr.getZxid()) <= ZxidUtils.getEpochFromZxid(lastQueued)) {
+                String msg = String.format(
+                    "DIFF sync got proposal 0x%s, last queued 0x%s, expected 0x%s",
+                    Long.toHexString(pif.hdr.getZxid()), Long.toHexString(lastQueued),
+                    Long.toHexString(lastQueued + 1));
+                LOG.error(msg);
+                throw new Exception(msg);
+            }
+            // We can't tell whether it is a data loss. Given that new epoch is rare,
+            // log at warn should not be too verbose.
+            LOG.warn("DIFF sync got new epoch proposal 0x{}, last queued 0x{}, expected 0x{}",
+                Long.toHexString(pif.hdr.getZxid()), Long.toHexString(lastQueued),
+                Long.toHexString(lastQueued + 1));
+        }
+        return pif.hdr.getZxid();
+    }
+
     /**
      * Finally, synchronize our history with the Leader (if Follower)
      * or the LearnerMaster (if Observer).
@@ -543,12 +580,19 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
         boolean syncSnapshot = false;
         readPacket(qp);
         Deque<Long> packetsCommitted = new ArrayDeque<>();
-        Deque<PacketInFlight> packetsNotCommitted = new ArrayDeque<>();
+        Deque<PacketInFlight> packetsNotLogged = new ArrayDeque<>();
+
         synchronized (zk) {
             if (qp.getType() == Leader.DIFF) {
                 LOG.info("Getting a diff from the leader 0x{}", Long.toHexString(qp.getZxid()));
                 self.setSyncMode(QuorumPeer.SyncMode.DIFF);
-                snapshotNeeded = false;
+                if (zk.shouldForceWriteInitialSnapshotAfterLeaderElection()) {
+                    LOG.info("Forcing a snapshot write as part of upgrading from an older Zookeeper. This should only happen while upgrading.");
+                    snapshotNeeded = true;
+                    syncSnapshot = true;
+                } else {
+                    snapshotNeeded = false;
+                }
             } else if (qp.getType() == Leader.SNAP) {
                 self.setSyncMode(QuorumPeer.SyncMode.SNAP);
                 LOG.info("Getting a snapshot from leader 0x{}", Long.toHexString(qp.getZxid()));
@@ -558,7 +602,7 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
                 // ZOOKEEPER-2819: overwrite config node content extracted
                 // from leader snapshot with local config, to avoid potential
                 // inconsistency of config node content during rolling restart.
-                if (!QuorumPeerConfig.isReconfigEnabled()) {
+                if (!self.isReconfigEnabled()) {
                     LOG.debug("Reset config node content from local config after deserialization of snapshot.");
                     zk.getZKDatabase().initConfigInZKDatabase(self.getQuorumVerifier());
                 }
@@ -590,6 +634,8 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
             zk.getZKDatabase().initConfigInZKDatabase(self.getQuorumVerifier());
             zk.createSessionTracker();
 
+            // TODO: Ideally, this should be lastProcessZxid(a.k.a. QuorumPacket::zxid from above), but currently
+            // LearnerHandler does not guarantee this. So, let's be conservative and keep it unchange for now.
             long lastQueued = 0;
 
             // in Zab V1.0 (ZK 3.4+) we might take a snapshot when we get the NEWLEADER message, but in pre V1.0
@@ -611,27 +657,21 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
                     pif.hdr = logEntry.getHeader();
                     pif.rec = logEntry.getTxn();
                     pif.digest = logEntry.getDigest();
-                    if (pif.hdr.getZxid() != lastQueued + 1) {
-                        LOG.warn(
-                            "Got zxid 0x{} expected 0x{}",
-                            Long.toHexString(pif.hdr.getZxid()),
-                            Long.toHexString(lastQueued + 1));
-                    }
-                    lastQueued = pif.hdr.getZxid();
+                    lastQueued = enforceContinuousProposal(lastQueued, pif);
 
                     if (pif.hdr.getType() == OpCode.reconfig) {
                         SetDataTxn setDataTxn = (SetDataTxn) pif.rec;
-                        QuorumVerifier qv = self.configFromString(new String(setDataTxn.getData()));
+                        QuorumVerifier qv = self.configFromString(new String(setDataTxn.getData(), UTF_8));
                         self.setLastSeenQuorumVerifier(qv, true);
                     }
 
-                    packetsNotCommitted.add(pif);
+                    packetsNotLogged.add(pif);
                     break;
                 case Leader.COMMIT:
                 case Leader.COMMITANDACTIVATE:
-                    pif = packetsNotCommitted.peekFirst();
+                    pif = packetsNotLogged.peekFirst();
                     if (pif.hdr.getZxid() == qp.getZxid() && qp.getType() == Leader.COMMITANDACTIVATE) {
-                        QuorumVerifier qv = self.configFromString(new String(((SetDataTxn) pif.rec).getData()));
+                        QuorumVerifier qv = self.configFromString(new String(((SetDataTxn) pif.rec).getData(), UTF_8));
                         boolean majorChange = self.processReconfig(
                             qv,
                             ByteBuffer.wrap(qp.getData()).getLong(), qp.getZxid(),
@@ -647,8 +687,8 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
                                 Long.toHexString(qp.getZxid()),
                                 Long.toHexString(pif.hdr.getZxid()));
                         } else {
-                            zk.processTxn(pif.hdr, pif.rec);
-                            packetsNotCommitted.remove();
+                            zk.processTxn(pif.toRequest());
+                            packetsNotLogged.remove();
                         }
                     } else {
                         packetsCommitted.add(qp.getZxid());
@@ -667,7 +707,7 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
                         packet.hdr = logEntry.getHeader();
                         packet.rec = logEntry.getTxn();
                         packet.digest = logEntry.getDigest();
-                        QuorumVerifier qv = self.configFromString(new String(((SetDataTxn) packet.rec).getData()));
+                        QuorumVerifier qv = self.configFromString(new String(((SetDataTxn) packet.rec).getData(), UTF_8));
                         boolean majorChange = self.processReconfig(qv, suggestedLeaderId, qp.getZxid(), true);
                         if (majorChange) {
                             throw new Exception("changes proposed in reconfig");
@@ -677,20 +717,13 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
                         packet.rec = logEntry.getTxn();
                         packet.hdr = logEntry.getHeader();
                         packet.digest = logEntry.getDigest();
-                        // Log warning message if txn comes out-of-order
-                        if (packet.hdr.getZxid() != lastQueued + 1) {
-                            LOG.warn(
-                                "Got zxid 0x{} expected 0x{}",
-                                Long.toHexString(packet.hdr.getZxid()),
-                                Long.toHexString(lastQueued + 1));
-                        }
-                        lastQueued = packet.hdr.getZxid();
+                        lastQueued = enforceContinuousProposal(lastQueued, packet);
                     }
                     if (!writeToTxnLog) {
                         // Apply to db directly if we haven't taken the snapshot
-                        zk.processTxn(packet.hdr, packet.rec);
+                        zk.processTxn(packet.toRequest());
                     } else {
-                        packetsNotCommitted.add(packet);
+                        packetsNotLogged.add(packet);
                         packetsCommitted.add(qp.getZxid());
                     }
 
@@ -715,7 +748,7 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
                     LOG.info("Learner received NEWLEADER message");
                     if (qp.getData() != null && qp.getData().length > 1) {
                         try {
-                            QuorumVerifier qv = self.configFromString(new String(qp.getData()));
+                            QuorumVerifier qv = self.configFromString(new String(qp.getData(), UTF_8));
                             self.setLastSeenQuorumVerifier(qv, true);
                             newLeaderQV = qv;
                         } catch (Exception e) {
@@ -727,18 +760,70 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
                         zk.takeSnapshot(syncSnapshot);
                     }
 
-                    self.setCurrentEpoch(newEpoch);
-                    writeToTxnLog = true; //Anything after this needs to go to the transaction log, not applied directly in memory
+
+                    writeToTxnLog = true;
+                    //Anything after this needs to go to the transaction log, not applied directly in memory
                     isPreZAB1_0 = false;
+
+                    // ZOOKEEPER-3911: make sure sync the uncommitted logs before commit them (ACK NEWLEADER).
+                    if (zk instanceof FollowerZooKeeperServer && !packetsCommitted.isEmpty()) {
+                        long startTime = Time.currentElapsedTime();
+                        FollowerZooKeeperServer fzk = (FollowerZooKeeperServer) zk;
+
+                        /*
+                         * @see https://github.com/apache/zookeeper/pull/1848
+                         * Persist and process the committed txns in "packetsNotLogged"
+                         * according to "packetsCommitted", which have been committed by
+                         * the leader. For these committed proposals, there is no need to
+                         * reply ack.
+                         *
+                         * @see https://issues.apache.org/jira/browse/ZOOKEEPER-4394
+                         * Keep the outstanding proposals in "packetsNotLogged" to avoid
+                         * NullPointerException when the follower receives COMMIT packet(s)
+                         * right after replying NEWLEADER ack.
+                         */
+                        while (!packetsCommitted.isEmpty()) {
+                            long zxid = packetsCommitted.removeFirst();
+                            pif = packetsNotLogged.peekFirst();
+                            if (pif == null) {
+                                LOG.warn("Committing 0x{}, but got no proposal", Long.toHexString(zxid));
+                                continue;
+                            } else if (pif.hdr.getZxid() != zxid) {
+                                LOG.warn("Committing 0x{}, but next proposal is 0x{}",
+                                        Long.toHexString(zxid), Long.toHexString(pif.hdr.getZxid()));
+                                continue;
+                            }
+                            packetsNotLogged.removeFirst();
+                            Request request = pif.toRequest();
+                            fzk.appendRequest(request);
+                            fzk.processTxn(request);
+                        }
+
+                        // @see https://issues.apache.org/jira/browse/ZOOKEEPER-4646
+                        // Make sure to persist the txns to disk before replying NEWLEADER ack.
+                        fzk.getZKDatabase().commit();
+                        LOG.info("It took {}ms to persist and commit txns in packetsCommitted. "
+                                        + "{} outstanding txns left in packetsNotLogged",
+                                Time.currentElapsedTime() - startTime, packetsNotLogged.size());
+                    }
+
+                    // @see https://issues.apache.org/jira/browse/ZOOKEEPER-4643
+                    // @see https://issues.apache.org/jira/browse/ZOOKEEPER-4785
+                    // Update current epoch after the committed txns are persisted
+                    self.setCurrentEpoch(newEpoch);
+                    LOG.info("Set the current epoch to {}", newEpoch);
+                    sock.setSoTimeout(self.tickTime * self.syncLimit);
+                    self.setSyncMode(QuorumPeer.SyncMode.NONE);
+
+                    // send NEWLEADER ack after the committed txns are persisted
                     writePacket(new QuorumPacket(Leader.ACK, newLeaderZxid, null, null), true);
+                    LOG.info("Sent NEWLEADER ack to leader with zxid {}", Long.toHexString(newLeaderZxid));
                     break;
                 }
             }
         }
         ack.setZxid(ZxidUtils.makeZxid(newEpoch, 0));
         writePacket(ack, true);
-        sock.setSoTimeout(self.tickTime * self.syncLimit);
-        self.setSyncMode(QuorumPeer.SyncMode.NONE);
         zk.startup();
         /*
          * Update the election vote here to ensure that all members of the
@@ -752,17 +837,20 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
         // We need to log the stuff that came in between the snapshot and the uptodate
         if (zk instanceof FollowerZooKeeperServer) {
             FollowerZooKeeperServer fzk = (FollowerZooKeeperServer) zk;
-            for (PacketInFlight p : packetsNotCommitted) {
-                fzk.logRequest(p.hdr, p.rec, p.digest);
+            for (PacketInFlight p : packetsNotLogged) {
+                fzk.logRequest(p.toRequest());
             }
+            LOG.info("{} txns have been logged asynchronously", packetsNotLogged.size());
+
             for (Long zxid : packetsCommitted) {
                 fzk.commit(zxid);
             }
+            LOG.info("{} txns have been committed", packetsCommitted.size());
         } else if (zk instanceof ObserverZooKeeperServer) {
             // Similar to follower, we need to log requests between the snapshot
             // and UPTODATE
             ObserverZooKeeperServer ozk = (ObserverZooKeeperServer) zk;
-            for (PacketInFlight p : packetsNotCommitted) {
+            for (PacketInFlight p : packetsNotLogged) {
                 Long zxid = packetsCommitted.peekFirst();
                 if (p.hdr.getZxid() != zxid) {
                     // log warning message if there is no matching commit
@@ -774,10 +862,7 @@ protected void syncWithLeader(long newLeaderZxid) throws Exception {
                     continue;
                 }
                 packetsCommitted.remove();
-                Request request = new Request(null, p.hdr.getClientId(), p.hdr.getCxid(), p.hdr.getType(), null, null);
-                request.setTxn(p.rec);
-                request.setHdr(p.hdr);
-                request.setTxnDigest(p.digest);
+                Request request = p.toRequest();
                 ozk.commitRequest(request);
             }
         } else {
@@ -834,7 +919,9 @@ public void shutdown() {
         closeSocket();
         // shutdown previous zookeeper
         if (zk != null) {
-            zk.shutdown();
+            // If we haven't finished SNAP sync, force fully shutdown
+            // to avoid potential inconsistency
+            zk.shutdown(self.getSyncMode().equals(QuorumPeer.SyncMode.SNAP));
         }
     }
 
@@ -843,10 +930,27 @@ boolean isRunning() {
     }
 
     void closeSocket() {
-        try {
-            if (sock != null) {
-                sock.close();
+        if (sockBeingClosed.compareAndSet(false, true)) {
+            if (sock == null) { // Closing before establishing the connection is a noop
+                return;
+            }
+            Socket socket = sock;
+            sock = null;
+            if (closeSocketAsync) {
+                final Thread closingThread = new Thread(() -> closeSockSync(socket), "CloseSocketThread(sid:" + zk.getServerId());
+                closingThread.setDaemon(true);
+                closingThread.start();
+            } else {
+                closeSockSync(socket);
             }
+        }
+    }
+
+    private static void closeSockSync(Socket socket) {
+        try {
+            long startTime = Time.currentElapsedTime();
+            socket.close();
+            ServerMetrics.getMetrics().SOCKET_CLOSING_TIME.add(Time.currentElapsedTime() - startTime);
         } catch (IOException e) {
             LOG.warn("Ignoring error closing connection to leader", e);
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
index 3bab398b41e..57947daa86c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerHandler.java
@@ -32,6 +32,7 @@
 import java.util.Objects;
 import java.util.Queue;
 import java.util.concurrent.LinkedBlockingQueue;
+import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicInteger;
 import java.util.concurrent.atomic.AtomicLong;
 import java.util.concurrent.locks.ReentrantReadWriteLock;
@@ -40,7 +41,9 @@
 import org.apache.jute.BinaryInputArchive;
 import org.apache.jute.BinaryOutputArchive;
 import org.apache.zookeeper.ZooDefs.OpCode;
+import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.server.Request;
+import org.apache.zookeeper.server.RequestRecord;
 import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.server.TxnLogProposalIterator;
 import org.apache.zookeeper.server.ZKDatabase;
@@ -49,6 +52,7 @@
 import org.apache.zookeeper.server.quorum.Leader.Proposal;
 import org.apache.zookeeper.server.quorum.QuorumPeer.LearnerType;
 import org.apache.zookeeper.server.quorum.auth.QuorumAuthServer;
+import org.apache.zookeeper.server.util.ConfigUtils;
 import org.apache.zookeeper.server.util.MessageTracker;
 import org.apache.zookeeper.server.util.ZxidUtils;
 import org.slf4j.Logger;
@@ -63,12 +67,23 @@ public class LearnerHandler extends ZooKeeperThread {
 
     private static final Logger LOG = LoggerFactory.getLogger(LearnerHandler.class);
 
+    public static final String LEADER_CLOSE_SOCKET_ASYNC = "zookeeper.leader.closeSocketAsync";
+
+    public static final boolean closeSocketAsync = Boolean
+        .parseBoolean(ConfigUtils.getPropertyBackwardCompatibleWay(LEADER_CLOSE_SOCKET_ASYNC));
+
+    static {
+        LOG.info("{} = {}", LEADER_CLOSE_SOCKET_ASYNC, closeSocketAsync);
+    }
+
     protected final Socket sock;
 
     public Socket getSocket() {
         return sock;
     }
 
+    AtomicBoolean sockBeingClosed = new AtomicBoolean(false);
+
     final LearnerMaster learnerMaster;
 
     /** Deadline for receiving the next ack. If we are bootstrapping then
@@ -99,7 +114,7 @@ int getVersion() {
     /**
      * The packets to be sent to the learner
      */
-    final LinkedBlockingQueue<QuorumPacket> queuedPackets = new LinkedBlockingQueue<QuorumPacket>();
+    final LinkedBlockingQueue<QuorumPacket> queuedPackets = new LinkedBlockingQueue<>();
     private final AtomicLong queuedPacketsSize = new AtomicLong();
 
     protected final AtomicLong packetsReceived = new AtomicLong();
@@ -277,11 +292,8 @@ protected void setBufferedOutput(BufferedOutputStream bufferedOutput) {
             }
         } catch (IOException e) {
             LOG.error("Server failed to authenticate quorum learner, addr: {}, closing connection", sock.getRemoteSocketAddress(), e);
-            try {
-                sock.close();
-            } catch (IOException ie) {
-                LOG.error("Exception while closing socket", ie);
-            }
+            closeSocket();
+
             throw new SaslException("Authentication failure: " + e.getMessage());
         }
 
@@ -315,7 +327,6 @@ public LearnerType getLearnerType() {
      * @throws InterruptedException
      */
     private void sendPackets() throws InterruptedException {
-        long traceMask = ZooTrace.SERVER_PACKET_TRACE_MASK;
         while (true) {
             try {
                 QuorumPacket p;
@@ -339,13 +350,15 @@ private void sendPackets() throws InterruptedException {
                     // Packet of death!
                     break;
                 }
-                if (p.getType() == Leader.PING) {
-                    traceMask = ZooTrace.SERVER_PING_TRACE_MASK;
-                }
+
                 if (p.getType() == Leader.PROPOSAL) {
                     syncLimitCheck.updateProposal(p.getZxid(), System.nanoTime());
                 }
                 if (LOG.isTraceEnabled()) {
+                    long traceMask = ZooTrace.SERVER_PACKET_TRACE_MASK;
+                    if (p.getType() == Leader.PING) {
+                        traceMask = ZooTrace.SERVER_PING_TRACE_MASK;
+                    }
                     ZooTrace.logQuorumPacket(LOG, traceMask, 'o', p);
                 }
 
@@ -357,17 +370,11 @@ private void sendPackets() throws InterruptedException {
                 packetsSent.incrementAndGet();
                 messageTracker.trackSent(p.getType());
             } catch (IOException e) {
-                if (!sock.isClosed()) {
-                    LOG.warn("Unexpected exception at {}", this, e);
-                    try {
-                        // this will cause everything to shutdown on
-                        // this learner handler and will help notify
-                        // the learner/observer instantaneously
-                        sock.close();
-                    } catch (IOException ie) {
-                        LOG.warn("Error closing socket for handler {}", this, ie);
-                    }
-                }
+                LOG.error("Exception while sending packets in LearnerHandler", e);
+                // this will cause everything to shutdown on
+                // this learner handler and will help notify
+                // the learner/observer instantaneously
+                closeSocket();
                 break;
             }
         }
@@ -549,13 +556,14 @@ public void run() {
             boolean needSnap = syncFollower(peerLastZxid, learnerMaster);
 
             // syncs between followers and the leader are exempt from throttling because it
-            // is importatnt to keep the state of quorum servers up-to-date. The exempted syncs
+            // is important to keep the state of quorum servers up-to-date. The exempted syncs
             // are counted as concurrent syncs though
             boolean exemptFromThrottle = getLearnerType() != LearnerType.OBSERVER;
             /* if we are not truncating or sending a diff just send a snapshot */
             if (needSnap) {
                 syncThrottler = learnerMaster.getLearnerSnapSyncThrottler();
                 syncThrottler.beginSync(exemptFromThrottle);
+                ServerMetrics.getMetrics().INFLIGHT_SNAP_COUNT.add(syncThrottler.getSyncInProgress());
                 try {
                     long zxidToSend = learnerMaster.getZKDatabase().getDataTreeLastProcessedZxid();
                     oa.writeRecord(new QuorumPacket(Leader.SNAP, zxidToSend, null, null), "packet");
@@ -581,6 +589,7 @@ public void run() {
             } else {
                 syncThrottler = learnerMaster.getLearnerDiffSyncThrottler();
                 syncThrottler.beginSync(exemptFromThrottle);
+                ServerMetrics.getMetrics().INFLIGHT_DIFF_COUNT.add(syncThrottler.getSyncInProgress());
                 ServerMetrics.getMetrics().DIFF_COUNT.add(1);
             }
 
@@ -621,6 +630,11 @@ public void run() {
             syncLimitCheck.start();
             // sync ends when NEWLEADER-ACK is received
             syncThrottler.endSync();
+            if (needSnap) {
+                ServerMetrics.getMetrics().INFLIGHT_SNAP_COUNT.add(syncThrottler.getSyncInProgress());
+            } else {
+                ServerMetrics.getMetrics().INFLIGHT_DIFF_COUNT.add(syncThrottler.getSyncInProgress());
+            }
             syncThrottler = null;
 
             // now that the ack has been processed expect the syncLimit
@@ -643,11 +657,11 @@ public void run() {
                 ia.readRecord(qp, "packet");
                 messageTracker.trackReceived(qp.getType());
 
-                long traceMask = ZooTrace.SERVER_PACKET_TRACE_MASK;
-                if (qp.getType() == Leader.PING) {
-                    traceMask = ZooTrace.SERVER_PING_TRACE_MASK;
-                }
                 if (LOG.isTraceEnabled()) {
+                    long traceMask = ZooTrace.SERVER_PACKET_TRACE_MASK;
+                    if (qp.getType() == Leader.PING) {
+                        traceMask = ZooTrace.SERVER_PING_TRACE_MASK;
+                    }
                     ZooTrace.logQuorumPacket(LOG, traceMask, 'i', qp);
                 }
                 tickOfNextAckDeadline = learnerMaster.getTickOfNextAckDeadline();
@@ -689,9 +703,9 @@ public void run() {
                     bb = bb.slice();
                     Request si;
                     if (type == OpCode.sync) {
-                        si = new LearnerSyncRequest(this, sessionId, cxid, type, bb, qp.getAuthinfo());
+                        si = new LearnerSyncRequest(this, sessionId, cxid, type, RequestRecord.fromBytes(bb), qp.getAuthinfo());
                     } else {
-                        si = new Request(null, sessionId, cxid, type, bb, qp.getAuthinfo());
+                        si = new Request(null, sessionId, cxid, type, RequestRecord.fromBytes(bb), qp.getAuthinfo());
                     }
                     si.setOwner(this);
                     learnerMaster.submitLearnerRequest(si);
@@ -703,16 +717,8 @@ public void run() {
                 }
             }
         } catch (IOException e) {
-            if (sock != null && !sock.isClosed()) {
-                LOG.error("Unexpected exception causing shutdown while sock still open", e);
-                //close the socket to make sure the
-                //other side can see it being close
-                try {
-                    sock.close();
-                } catch (IOException ie) {
-                    // do nothing
-                }
-            }
+            LOG.error("Unexpected exception in LearnerHandler: ", e);
+            closeSocket();
         } catch (InterruptedException e) {
             LOG.error("Unexpected exception in LearnerHandler.", e);
         } catch (SyncThrottleException e) {
@@ -727,7 +733,7 @@ public void run() {
                 syncThrottler = null;
             }
             String remoteAddr = getRemoteAddress();
-            LOG.warn("******* GOODBYE {} ********", remoteAddr);
+            LOG.warn("******* GOODBYE sid:{} {} ********", getSid(), remoteAddr);
             messageTracker.dumpToLog(remoteAddr);
             shutdown();
         }
@@ -951,7 +957,7 @@ protected long queueCommittedProposals(Iterator<Proposal> itr, long peerLastZxid
         while (itr.hasNext()) {
             Proposal propose = itr.next();
 
-            long packetZxid = propose.packet.getZxid();
+            long packetZxid = propose.getZxid();
             // abort if we hit the limit
             if ((maxZxid != null) && (packetZxid > maxZxid)) {
                 break;
@@ -1014,7 +1020,7 @@ protected long queueCommittedProposals(Iterator<Proposal> itr, long peerLastZxid
 
             // Since this is already a committed proposal, we need to follow
             // it by a commit packet
-            queuePacket(propose.packet);
+            queuePacket(propose.getQuorumPacket());
             queueOpPacket(Leader.COMMIT, packetZxid);
             queuedZxid = packetZxid;
 
@@ -1025,7 +1031,7 @@ protected long queueCommittedProposals(Iterator<Proposal> itr, long peerLastZxid
             // is the catch when our history older than learner and there is
             // no new txn since then. So we need an empty diff
             LOG.info(
-                "Sending TRUNC zxid=0x{}  for peer sid: {}",
+                "Sending DIFF zxid=0x{}  for peer sid: {}",
                 Long.toHexString(lastCommittedZxid),
                 getSid());
             queueOpPacket(Leader.DIFF, lastCommittedZxid);
@@ -1043,13 +1049,9 @@ public void shutdown() {
         } catch (InterruptedException e) {
             LOG.warn("Ignoring unexpected exception", e);
         }
-        try {
-            if (sock != null && !sock.isClosed()) {
-                sock.close();
-            }
-        } catch (IOException e) {
-            LOG.warn("Ignoring unexpected exception during socket close", e);
-        }
+
+        closeSocket();
+
         this.interrupt();
         learnerMaster.removeLearnerHandler(this);
         learnerMaster.unregisterLearnerHandlerBean(this);
@@ -1137,7 +1139,6 @@ public synchronized void resetObserverConnectionStats() {
 
     /**
      * For testing, return packet queue
-     * @return
      */
     public Queue<QuorumPacket> getQueuedPackets() {
         return queuedPackets;
@@ -1150,4 +1151,33 @@ public void setFirstPacket(boolean value) {
         needOpPacket = value;
     }
 
+    void closeSocket() {
+        if (sock != null && !sock.isClosed() && sockBeingClosed.compareAndSet(false, true)) {
+            if (closeSocketAsync) {
+                LOG.info("Asynchronously closing socket to learner {}.", getSid());
+                closeSockAsync();
+            } else {
+                LOG.info("Synchronously closing socket to learner {}.", getSid());
+                closeSockSync();
+            }
+        }
+    }
+
+    void closeSockAsync() {
+        final Thread closingThread = new Thread(() -> closeSockSync(), "CloseSocketThread(sid:" + this.sid);
+        closingThread.setDaemon(true);
+        closingThread.start();
+    }
+
+    void closeSockSync() {
+        try {
+            if (sock != null) {
+                long startTime = Time.currentElapsedTime();
+                sock.close();
+                ServerMetrics.getMetrics().SOCKET_CLOSING_TIME.add(Time.currentElapsedTime() - startTime);
+            }
+        } catch (IOException e) {
+            LOG.warn("Ignoring error closing connection to learner {}", getSid(), e);
+        }
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerMaster.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerMaster.java
index 64333b1b4f7..9bf6032af68 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerMaster.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerMaster.java
@@ -124,7 +124,7 @@ public LearnerSyncThrottler getLearnerDiffSyncThrottler() {
      * get the first zxid of the next epoch
      * @param sid learner id
      * @param lastAcceptedEpoch
-     * @return
+     * @return the first zxid of the next epoch
      * @throws InterruptedException
      * @throws IOException
      */
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerSessionTracker.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerSessionTracker.java
index b12a62c0644..8983bdf3bbe 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerSessionTracker.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerSessionTracker.java
@@ -54,7 +54,7 @@ public class LearnerSessionTracker extends UpgradeableSessionTracker {
 
     private final SessionExpirer expirer;
     // Touch table for the global sessions
-    private final AtomicReference<Map<Long, Integer>> touchTable = new AtomicReference<Map<Long, Integer>>();
+    private final AtomicReference<Map<Long, Integer>> touchTable = new AtomicReference<>();
     private final long serverId;
     private final AtomicLong nextSessionId = new AtomicLong();
 
@@ -62,7 +62,7 @@ public class LearnerSessionTracker extends UpgradeableSessionTracker {
 
     public LearnerSessionTracker(SessionExpirer expirer, ConcurrentMap<Long, Integer> sessionsWithTimeouts, int tickTime, long id, boolean localSessionsEnabled, ZooKeeperServerListener listener) {
         this.expirer = expirer;
-        this.touchTable.set(new ConcurrentHashMap<Long, Integer>());
+        this.touchTable.set(new ConcurrentHashMap<>());
         this.globalSessionsWithTimeouts = sessionsWithTimeouts;
         this.serverId = id;
         nextSessionId.set(SessionTrackerImpl.initializeNextSessionId(serverId));
@@ -150,7 +150,7 @@ public boolean touchSession(long sessionId, int sessionTimeout) {
     }
 
     public Map<Long, Integer> snapshot() {
-        return touchTable.getAndSet(new ConcurrentHashMap<Long, Integer>());
+        return touchTable.getAndSet(new ConcurrentHashMap<>());
     }
 
     public long createSession(int sessionTimeout) {
@@ -202,7 +202,7 @@ public void dumpSessions(PrintWriter pwriter) {
         pwriter.print("Global Sessions(");
         pwriter.print(globalSessionsWithTimeouts.size());
         pwriter.println("):");
-        SortedSet<Long> sessionIds = new TreeSet<Long>(globalSessionsWithTimeouts.keySet());
+        SortedSet<Long> sessionIds = new TreeSet<>(globalSessionsWithTimeouts.keySet());
         for (long sessionId : sessionIds) {
             pwriter.print("0x");
             pwriter.print(Long.toHexString(sessionId));
@@ -222,7 +222,10 @@ public void setSessionClosing(long sessionId) {
 
     @Override
     public Map<Long, Set<Long>> getSessionExpiryMap() {
-        return new HashMap<Long, Set<Long>>();
+        return new HashMap<>();
     }
 
+    public Set<Long> globalSessions() {
+        return globalSessionsWithTimeouts.keySet();
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerSyncRequest.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerSyncRequest.java
index d4c83aeab7b..6892d3dd8a7 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerSyncRequest.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerSyncRequest.java
@@ -18,17 +18,17 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import java.nio.ByteBuffer;
 import java.util.List;
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.server.Request;
+import org.apache.zookeeper.server.RequestRecord;
 
 public class LearnerSyncRequest extends Request {
 
     LearnerHandler fh;
     public LearnerSyncRequest(
-        LearnerHandler fh, long sessionId, int xid, int type, ByteBuffer bb, List<Id> authInfo) {
-        super(null, sessionId, xid, type, bb, authInfo);
+        LearnerHandler fh, long sessionId, int xid, int type, RequestRecord request, List<Id> authInfo) {
+        super(null, sessionId, xid, type, request, authInfo);
         this.fh = fh;
     }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerZooKeeperServer.java
index cab95b05621..a7c345d0757 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LearnerZooKeeperServer.java
@@ -71,7 +71,7 @@ protected Map<Long, Integer> getTouchSnapshot() {
      */
     @Override
     public long getServerId() {
-        return self.getId();
+        return self.getMyId();
     }
 
     @Override
@@ -80,7 +80,7 @@ public void createSessionTracker() {
             this,
             getZKDatabase().getSessionWithTimeOuts(),
             this.tickTime,
-            self.getId(),
+            self.getMyId(),
             self.areLocalSessionsEnabled(),
             getZooKeeperServerListener());
     }
@@ -152,17 +152,7 @@ protected void unregisterJMX(Learner peer) {
     }
 
     @Override
-    public synchronized void shutdown() {
-        if (!canShutdown()) {
-            LOG.debug("ZooKeeper server is not running, so not proceeding to shutdown!");
-            return;
-        }
-        LOG.info("Shutting down");
-        try {
-            super.shutdown();
-        } catch (Exception e) {
-            LOG.warn("Ignoring unexpected exception during shutdown", e);
-        }
+    protected void shutdownComponents() {
         try {
             if (syncProcessor != null) {
                 syncProcessor.shutdown();
@@ -170,6 +160,11 @@ public synchronized void shutdown() {
         } catch (Exception e) {
             LOG.warn("Ignoring unexpected exception in syncprocessor shutdown", e);
         }
+        try {
+            super.shutdownComponents();
+        } catch (Exception e) {
+            LOG.warn("Ignoring unexpected exception during shutdown", e);
+        }
     }
 
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LocalPeerBean.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LocalPeerBean.java
index f5d0dbedaf9..f1649ff93e2 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LocalPeerBean.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LocalPeerBean.java
@@ -35,7 +35,7 @@ public LocalPeerBean(QuorumPeer peer) {
     }
 
     public String getName() {
-        return "replica." + peer.getId();
+        return "replica." + peer.getMyId();
     }
 
     public boolean isHidden() {
@@ -119,12 +119,12 @@ public String getQuorumSystemInfo() {
 
     @Override
     public boolean isPartOfEnsemble() {
-        return peer.getView().containsKey(peer.getId());
+        return peer.getView().containsKey(peer.getMyId());
     }
 
     @Override
     public boolean isLeader() {
-        return peer.isLeader(peer.getId());
+        return peer.isLeader(peer.getMyId());
     }
 
     @Override
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LocalSessionTracker.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LocalSessionTracker.java
index 009fe03b6c2..b3231221139 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LocalSessionTracker.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/LocalSessionTracker.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import java.util.Set;
 import java.util.concurrent.ConcurrentMap;
 import org.apache.zookeeper.server.SessionTrackerImpl;
 import org.apache.zookeeper.server.ZooKeeperServerListener;
@@ -26,7 +27,6 @@
  * Local session tracker.
  */
 public class LocalSessionTracker extends SessionTrackerImpl {
-
     public LocalSessionTracker(SessionExpirer expirer, ConcurrentMap<Long, Integer> sessionsWithTimeouts, int tickTime, long id, ZooKeeperServerListener listener) {
         super(expirer, sessionsWithTimeouts, tickTime, id, listener);
     }
@@ -45,4 +45,7 @@ public long createSession(int sessionTimeout) {
         return sessionId;
     }
 
+    public Set<Long> localSessions() {
+        return sessionsWithTimeout.keySet();
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Observer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Observer.java
index 47c58b938cd..334fa54c1bc 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Observer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/Observer.java
@@ -18,9 +18,12 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.nio.ByteBuffer;
+import java.util.concurrent.ThreadLocalRandom;
 import java.util.concurrent.atomic.AtomicReference;
 import org.apache.jute.Record;
+import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.server.ObserverBean;
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.ServerMetrics;
@@ -112,11 +115,14 @@ void observeLeader() throws Exception {
                     throw new Exception("learned about role change");
                 }
 
+                final long startTime = Time.currentElapsedTime();
                 self.setLeaderAddressAndId(master.addr, master.getId());
                 self.setZabState(QuorumPeer.ZabState.SYNCHRONIZATION);
                 syncWithLeader(newLeaderZxid);
                 self.setZabState(QuorumPeer.ZabState.BROADCAST);
                 completedSync = true;
+                final long syncTime = Time.currentElapsedTime() - startTime;
+                ServerMetrics.getMetrics().OBSERVER_SYNC_TIME.add(syncTime);
                 QuorumPacket qp = new QuorumPacket();
                 while (this.isRunning() && nextLearnerMaster.get() == null) {
                     readPacket(qp);
@@ -196,12 +202,8 @@ protected void processPacket(QuorumPacket qp) throws Exception {
         case Leader.INFORM:
             ServerMetrics.getMetrics().LEARNER_COMMIT_RECEIVED_COUNT.add(1);
             logEntry = SerializeUtils.deserializeTxn(qp.getData());
-            hdr = logEntry.getHeader();
-            txn = logEntry.getTxn();
-            digest = logEntry.getDigest();
-            Request request = new Request(hdr.getClientId(), hdr.getCxid(), hdr.getType(), hdr, txn, 0);
+            Request request = logEntry.toRequest();
             request.logLatency(ServerMetrics.getMetrics().COMMIT_PROPAGATION_LATENCY);
-            request.setTxnDigest(digest);
             ObserverZooKeeperServer obs = (ObserverZooKeeperServer) zk;
             obs.commitRequest(request);
             break;
@@ -213,13 +215,10 @@ protected void processPacket(QuorumPacket qp) throws Exception {
             byte[] remainingdata = new byte[buffer.remaining()];
             buffer.get(remainingdata);
             logEntry = SerializeUtils.deserializeTxn(remainingdata);
-            hdr = logEntry.getHeader();
             txn = logEntry.getTxn();
-            digest = logEntry.getDigest();
-            QuorumVerifier qv = self.configFromString(new String(((SetDataTxn) txn).getData()));
+            QuorumVerifier qv = self.configFromString(new String(((SetDataTxn) txn).getData(), UTF_8));
 
-            request = new Request(hdr.getClientId(), hdr.getCxid(), hdr.getType(), hdr, txn, 0);
-            request.setTxnDigest(digest);
+            request = logEntry.toRequest();
             obs = (ObserverZooKeeperServer) zk;
 
             boolean majorChange = self.processReconfig(qv, suggestedLeaderId, qp.getZxid(), true);
@@ -254,7 +253,7 @@ static void waitForObserverElectionDelay() {
 
     private static void waitForReconnectDelayHelper(long delayValueMs) {
         if (delayValueMs > 0) {
-            long randomDelay = (long) (delayValueMs * Math.random());
+            long randomDelay = ThreadLocalRandom.current().nextLong(delayValueMs);
             LOG.info("Waiting for {} ms before reconnecting with the leader", randomDelay);
             try {
                 Thread.sleep(randomDelay);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverMaster.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverMaster.java
index 54a22c2ecbd..2369eabe36c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverMaster.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverMaster.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import java.io.BufferedInputStream;
 import java.io.ByteArrayInputStream;
 import java.io.DataInputStream;
@@ -73,7 +74,7 @@ public class ObserverMaster extends LearnerMaster implements Runnable {
     private FollowerZooKeeperServer zks;
     private int port;
 
-    private Set<LearnerHandler> activeObservers = Collections.newSetFromMap(new ConcurrentHashMap<LearnerHandler, Boolean>());
+    private Set<LearnerHandler> activeObservers = Collections.newSetFromMap(new ConcurrentHashMap<>());
 
     private final ConcurrentHashMap<LearnerHandler, LearnerHandlerBean> connectionBeans = new ConcurrentHashMap<>();
 
@@ -343,7 +344,7 @@ public String getPeerInfo(long sid) {
 
     @Override
     public byte[] getQuorumVerifierBytes() {
-        return self.getLastSeenQuorumVerifier().toString().getBytes();
+        return self.getLastSeenQuorumVerifier().toString().getBytes(UTF_8);
     }
 
     @Override
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverRequestProcessor.java
index 46662032951..1d7e5c5c37e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverRequestProcessor.java
@@ -24,6 +24,7 @@
 import org.apache.zookeeper.ZooDefs.OpCode;
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.RequestProcessor;
+import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.server.ZooKeeperCriticalThread;
 import org.apache.zookeeper.server.ZooTrace;
 import org.apache.zookeeper.txn.ErrorTxn;
@@ -44,7 +45,7 @@ public class ObserverRequestProcessor extends ZooKeeperCriticalThread implements
 
     // We keep a queue of requests. As requests get submitted they are
     // stored here. The queue is drained in the run() method.
-    LinkedBlockingQueue<Request> queuedRequests = new LinkedBlockingQueue<Request>();
+    LinkedBlockingQueue<Request> queuedRequests = new LinkedBlockingQueue<>();
 
     boolean finished = false;
 
@@ -64,6 +65,8 @@ public ObserverRequestProcessor(ObserverZooKeeperServer zks, RequestProcessor ne
     public void run() {
         try {
             while (!finished) {
+                ServerMetrics.getMetrics().LEARNER_REQUEST_PROCESSOR_QUEUE_SIZE.add(queuedRequests.size());
+
                 Request request = queuedRequests.take();
                 if (LOG.isTraceEnabled()) {
                     ZooTrace.logRequest(LOG, ZooTrace.CLIENT_REQUEST_TRACE_MASK, 'F', request, "");
@@ -82,6 +85,10 @@ public void run() {
                 // the response
                 nextProcessor.processRequest(request);
 
+                if (request.isThrottled()) {
+                    continue;
+                }
+
                 // We now ship the request to the leader. As with all
                 // other quorum operations, sync also follows this code
                 // path, but different from others, we need to keep track
@@ -114,6 +121,8 @@ public void run() {
                     break;
                 }
             }
+        } catch (RuntimeException e) { // spotbugs require explicit catch of RuntimeException
+            handleException(this.getName(), e);
         } catch (Exception e) {
             handleException(this.getName(), e);
         }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverZooKeeperServer.java
index a41a9187743..74663a9c136 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ObserverZooKeeperServer.java
@@ -44,11 +44,11 @@ public class ObserverZooKeeperServer extends LearnerZooKeeperServer {
      * take periodic snapshot. Default is ON.
      */
 
-    private boolean syncRequestProcessorEnabled = this.self.getSyncEnabled();
+    private final boolean syncRequestProcessorEnabled = this.self.getSyncEnabled();
 
     /*
      * Pending sync requests
-     */ ConcurrentLinkedQueue<Request> pendingSyncs = new ConcurrentLinkedQueue<Request>();
+     */ ConcurrentLinkedQueue<Request> pendingSyncs = new ConcurrentLinkedQueue<>();
 
     ObserverZooKeeperServer(FileTxnSnapLog logFactory, QuorumPeer self, ZKDatabase zkDb) throws IOException {
         super(logFactory, self.tickTime, self.minSessionTimeout, self.maxSessionTimeout, self.clientPortListenBacklog, zkDb, self);
@@ -82,7 +82,7 @@ public void commitRequest(Request request) {
 
     /**
      * Set up the request processors for an Observer:
-     * firstProcesor-&gt;commitProcessor-&gt;finalProcessor
+     * firstProcessor-&gt;commitProcessor-&gt;finalProcessor
      */
     @Override
     protected void setupRequestProcessors() {
@@ -127,18 +127,6 @@ public String getState() {
         return "observer";
     }
 
-    @Override
-    public synchronized void shutdown() {
-        if (!canShutdown()) {
-            LOG.debug("ZooKeeper server is not running, so not proceeding to shutdown!");
-            return;
-        }
-        super.shutdown();
-        if (syncRequestProcessorEnabled && syncProcessor != null) {
-            syncProcessor.shutdown();
-        }
-    }
-
     @Override
     public void dumpMonitorValues(BiConsumer<String, Object> response) {
         super.dumpMonitorValues(response);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ProposalRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ProposalRequestProcessor.java
index c4b5a6e30b3..c1e2fe16e43 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ProposalRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ProposalRequestProcessor.java
@@ -20,6 +20,7 @@
 
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.RequestProcessor;
+import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.server.SyncRequestProcessor;
 import org.apache.zookeeper.server.quorum.Leader.XidRolloverException;
 import org.slf4j.Logger;
@@ -39,11 +40,22 @@ public class ProposalRequestProcessor implements RequestProcessor {
 
     SyncRequestProcessor syncProcessor;
 
+    // If this property is set, requests from Learners won't be forwarded
+    // to the CommitProcessor in order to save resources
+    public static final String FORWARD_LEARNER_REQUESTS_TO_COMMIT_PROCESSOR_DISABLED =
+          "zookeeper.forward_learner_requests_to_commit_processor_disabled";
+    private final boolean forwardLearnerRequestsToCommitProcessorDisabled;
+
     public ProposalRequestProcessor(LeaderZooKeeperServer zks, RequestProcessor nextProcessor) {
         this.zks = zks;
         this.nextProcessor = nextProcessor;
         AckRequestProcessor ackProcessor = new AckRequestProcessor(zks.getLeader());
         syncProcessor = new SyncRequestProcessor(zks, ackProcessor);
+
+        forwardLearnerRequestsToCommitProcessorDisabled = Boolean.getBoolean(
+                FORWARD_LEARNER_REQUESTS_TO_COMMIT_PROCESSOR_DISABLED);
+        LOG.info("{} = {}", FORWARD_LEARNER_REQUESTS_TO_COMMIT_PROCESSOR_DISABLED,
+                forwardLearnerRequestsToCommitProcessorDisabled);
     }
 
     /**
@@ -54,11 +66,6 @@ public void initialize() {
     }
 
     public void processRequest(Request request) throws RequestProcessorException {
-        // LOG.warn("Ack>>> cxid = " + request.cxid + " type = " +
-        // request.type + " id = " + request.sessionId);
-        // request.addRQRec(">prop");
-
-
         /* In the following IF-THEN-ELSE block, we process syncs on the leader.
          * If the sync is coming from a follower, then the follower
          * handler adds it to syncHandler. Otherwise, if it is a client of
@@ -66,11 +73,12 @@ public void processRequest(Request request) throws RequestProcessorException {
          * contain the handler. In this case, we add it to syncHandler, and
          * call processRequest on the next processor.
          */
-
         if (request instanceof LearnerSyncRequest) {
             zks.getLeader().processSync((LearnerSyncRequest) request);
         } else {
-            nextProcessor.processRequest(request);
+            if (shouldForwardToNextProcessor(request)) {
+                nextProcessor.processRequest(request);
+            }
             if (request.getHdr() != null) {
                 // We need to sync and get consensus on any transactions
                 try {
@@ -89,4 +97,14 @@ public void shutdown() {
         syncProcessor.shutdown();
     }
 
+    private boolean shouldForwardToNextProcessor(Request request) {
+        if (!forwardLearnerRequestsToCommitProcessorDisabled) {
+            return true;
+        }
+        if (request.getOwner() instanceof LearnerHandler) {
+            ServerMetrics.getMetrics().REQUESTS_NOT_FORWARDED_TO_COMMIT_PROCESSOR.add(1);
+            return false;
+        }
+        return true;
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumBean.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumBean.java
index aae4552f498..46db6865b8a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumBean.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumBean.java
@@ -28,7 +28,7 @@ public class QuorumBean implements QuorumMXBean, ZKMBeanInfo {
 
     public QuorumBean(QuorumPeer peer) {
         this.peer = peer;
-        name = "ReplicatedServer_id" + peer.getId();
+        name = "ReplicatedServer_id" + peer.getMyId();
     }
 
     @Override
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
index 66f6883470a..7a16014848e 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumCnxManager.java
@@ -18,6 +18,7 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import static org.apache.zookeeper.common.NetUtils.formatInetAddr;
 import java.io.BufferedInputStream;
 import java.io.BufferedOutputStream;
@@ -27,7 +28,6 @@
 import java.io.IOException;
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
-import java.net.NoRouteToHostException;
 import java.net.ServerSocket;
 import java.net.Socket;
 import java.net.SocketException;
@@ -58,13 +58,14 @@
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicInteger;
 import java.util.concurrent.atomic.AtomicLong;
+import java.util.function.Supplier;
 import java.util.stream.Collectors;
 import javax.net.ssl.SSLSocket;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.common.NetUtils;
 import org.apache.zookeeper.common.X509Exception;
 import org.apache.zookeeper.server.ExitCode;
 import org.apache.zookeeper.server.ZooKeeperThread;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
 import org.apache.zookeeper.server.quorum.auth.QuorumAuthLearner;
 import org.apache.zookeeper.server.quorum.auth.QuorumAuthServer;
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
@@ -186,6 +187,17 @@ public class QuorumCnxManager {
      */
     private final boolean tcpKeepAlive = Boolean.getBoolean("zookeeper.tcpKeepAlive");
 
+
+    /*
+     * Socket factory, allowing the injection of custom socket implementations for testing
+     */
+    static final Supplier<Socket> DEFAULT_SOCKET_FACTORY = () -> new Socket();
+    private static Supplier<Socket> SOCKET_FACTORY = DEFAULT_SOCKET_FACTORY;
+    static void setSocketFactory(Supplier<Socket> factory) {
+        SOCKET_FACTORY = factory;
+    }
+
+
     public static class Message {
 
         Message(ByteBuffer buffer, long sid) {
@@ -244,7 +256,7 @@ public static InitialMessage parse(Long protocolVersion, DataInputStream din) th
 
             // in PROTOCOL_VERSION_V1 we expect to get a single address here represented as a 'host:port' string
             // in PROTOCOL_VERSION_V2 we expect to get multiple addresses like: 'host1:port1|host2:port2|...'
-            String[] addressStrings = new String(b).split("\\|");
+            String[] addressStrings = new String(b, UTF_8).split("\\|");
             List<InetSocketAddress> addresses = new ArrayList<>(addressStrings.length);
             for (String addr : addressStrings) {
 
@@ -316,41 +328,27 @@ public QuorumCnxManager(QuorumPeer self, final long mySid, Map<Long, QuorumPeer.
         this.socketTimeout = socketTimeout;
         this.view = view;
         this.listenOnAllIPs = listenOnAllIPs;
+        this.authServer = authServer;
+        this.authLearner = authLearner;
+        this.quorumSaslAuthEnabled = quorumSaslAuthEnabled;
 
-        initializeAuth(mySid, authServer, authLearner, quorumCnxnThreadsSize, quorumSaslAuthEnabled);
+        initializeConnectionExecutor(mySid, quorumCnxnThreadsSize);
 
         // Starts listener thread that waits for connection requests
         listener = new Listener();
         listener.setName("QuorumPeerListener");
     }
 
-    private void initializeAuth(final long mySid, final QuorumAuthServer authServer,
-        final QuorumAuthLearner authLearner, final int quorumCnxnThreadsSize, final boolean quorumSaslAuthEnabled) {
-
-        this.authServer = authServer;
-        this.authLearner = authLearner;
-        this.quorumSaslAuthEnabled = quorumSaslAuthEnabled;
-        if (!this.quorumSaslAuthEnabled) {
-            LOG.debug("Not initializing connection executor as quorum sasl auth is disabled");
-            return;
-        }
-
-        // init connection executors
+    // we always use the Connection Executor during connection initiation (to handle connection
+    // timeouts), and optionally use it during receiving connections (as the Quorum SASL authentication
+    // can take extra time)
+    private void initializeConnectionExecutor(final long mySid, final int quorumCnxnThreadsSize) {
         final AtomicInteger threadIndex = new AtomicInteger(1);
-        SecurityManager s = System.getSecurityManager();
-        final ThreadGroup group = (s != null) ? s.getThreadGroup() : Thread.currentThread().getThreadGroup();
-        ThreadFactory daemonThFactory = new ThreadFactory() {
+        final ThreadFactory daemonThFactory = runnable -> new Thread(runnable,
+            String.format("QuorumConnectionThread-[myid=%d]-%d", mySid, threadIndex.getAndIncrement()));
 
-            @Override
-            public Thread newThread(Runnable r) {
-                Thread t = new Thread(
-                    group,
-                    r,
-                    "QuorumConnectionThread-[myid=" + mySid + "]-" + threadIndex.getAndIncrement());
-                return t;
-            }
-        };
-        this.connectionExecutor = new ThreadPoolExecutor(3, quorumCnxnThreadsSize, 60, TimeUnit.SECONDS, new SynchronousQueue<Runnable>(), daemonThFactory);
+        this.connectionExecutor = new ThreadPoolExecutor(3, quorumCnxnThreadsSize, 60, TimeUnit.SECONDS,
+                                                         new SynchronousQueue<>(), daemonThFactory);
         this.connectionExecutor.allowCoreThreadTimeOut(true);
     }
 
@@ -359,20 +357,49 @@ public Thread newThread(Runnable r) {
      *
      * @param sid
      */
-    public void testInitiateConnection(long sid) throws Exception {
+    public void testInitiateConnection(long sid) {
         LOG.debug("Opening channel to server {}", sid);
-        Socket sock = new Socket();
-        setSockOpts(sock);
-        InetSocketAddress address = self.getVotingView().get(sid).electionAddr.getReachableOrOne();
-        sock.connect(address, cnxTO);
-        initiateConnection(sock, sid);
+        initiateConnection(self.getVotingView().get(sid).electionAddr, sid);
     }
 
     /**
+     * First we create the socket, perform SSL handshake and authentication if needed.
+     * Then we perform the initiation protocol.
      * If this server has initiated the connection, then it gives up on the
      * connection if it loses challenge. Otherwise, it keeps the connection.
      */
-    public void initiateConnection(final Socket sock, final Long sid) {
+    public void initiateConnection(final MultipleAddresses electionAddr, final Long sid) {
+        Socket sock = null;
+        try {
+            LOG.debug("Opening channel to server {}", sid);
+            if (self.isSslQuorum()) {
+                sock = self.getX509Util().createSSLSocket();
+            } else {
+                sock = SOCKET_FACTORY.get();
+            }
+            setSockOpts(sock);
+            sock.connect(electionAddr.getReachableOrOne(), cnxTO);
+            if (sock instanceof SSLSocket) {
+                SSLSocket sslSock = (SSLSocket) sock;
+                sslSock.startHandshake();
+                LOG.info("SSL handshake complete with {} - {} - {}",
+                         sslSock.getRemoteSocketAddress(),
+                         sslSock.getSession().getProtocol(),
+                         sslSock.getSession().getCipherSuite());
+            }
+
+            LOG.debug("Connected to server {} using election address: {}:{}",
+                      sid, sock.getInetAddress(), sock.getPort());
+        } catch (X509Exception e) {
+            LOG.warn("Cannot open secure channel to {} at election address {}", sid, electionAddr, e);
+            closeSocket(sock);
+            return;
+        } catch (UnresolvedAddressException | IOException e) {
+            LOG.warn("Cannot open channel to {} at election address {}", sid, electionAddr, e);
+            closeSocket(sock);
+            return;
+        }
+
         try {
             startConnection(sock, sid);
         } catch (IOException e) {
@@ -389,16 +416,15 @@ public void initiateConnection(final Socket sock, final Long sid) {
      * Server will initiate the connection request to its peer server
      * asynchronously via separate connection thread.
      */
-    public void initiateConnectionAsync(final Socket sock, final Long sid) {
+    public boolean initiateConnectionAsync(final MultipleAddresses electionAddr, final Long sid) {
         if (!inprogressConnections.add(sid)) {
             // simply return as there is a connection request to
             // server 'sid' already in progress.
             LOG.debug("Connection request to server id: {} is already in progress, so skipping this request", sid);
-            closeSocket(sock);
-            return;
+            return true;
         }
         try {
-            connectionExecutor.execute(new QuorumConnectionReqThread(sock, sid));
+            connectionExecutor.execute(new QuorumConnectionReqThread(electionAddr, sid));
             connectionThreadCnt.incrementAndGet();
         } catch (Throwable e) {
             // Imp: Safer side catching all type of exceptions and remove 'sid'
@@ -406,27 +432,27 @@ public void initiateConnectionAsync(final Socket sock, final Long sid) {
             // connection requests from this 'sid' in case of errors.
             inprogressConnections.remove(sid);
             LOG.error("Exception while submitting quorum connection request", e);
-            closeSocket(sock);
+            return false;
         }
+        return true;
     }
 
     /**
      * Thread to send connection request to peer server.
      */
     private class QuorumConnectionReqThread extends ZooKeeperThread {
-
-        final Socket sock;
+        final MultipleAddresses electionAddr;
         final Long sid;
-        QuorumConnectionReqThread(final Socket sock, final Long sid) {
+        QuorumConnectionReqThread(final MultipleAddresses electionAddr, final Long sid) {
             super("QuorumConnectionReqThread-" + sid);
-            this.sock = sock;
+            this.electionAddr = electionAddr;
             this.sid = sid;
         }
 
         @Override
         public void run() {
             try {
-                initiateConnection(sock, sid);
+                initiateConnection(electionAddr, sid);
             } finally {
                 inprogressConnections.remove(sid);
             }
@@ -437,7 +463,7 @@ public void run() {
     private boolean startConnection(Socket sock, Long sid) throws IOException {
         DataOutputStream dout = null;
         DataInputStream din = null;
-        LOG.debug("startConnection (myId:{} --> sid:{})", self.getId(), sid);
+        LOG.debug("startConnection (myId:{} --> sid:{})", self.getMyId(), sid);
         try {
             // Use BufferedOutputStream to reduce the number of IP packets. This is
             // important for x-DC scenarios.
@@ -452,7 +478,7 @@ private boolean startConnection(Socket sock, Long sid) throws IOException {
             // understand the protocol version we use to avoid multiple partitions. see ZOOKEEPER-3720
             long protocolVersion = self.isMultiAddressEnabled() ? PROTOCOL_VERSION_V2 : PROTOCOL_VERSION_V1;
             dout.writeLong(protocolVersion);
-            dout.writeLong(self.getId());
+            dout.writeLong(self.getMyId());
 
             // now we send our election address. For the new protocol version, we can send multiple addresses.
             Collection<InetSocketAddress> addressesToSend = protocolVersion == PROTOCOL_VERSION_V2
@@ -461,7 +487,7 @@ private boolean startConnection(Socket sock, Long sid) throws IOException {
 
             String addr = addressesToSend.stream()
                     .map(NetUtils::formatInetAddr).collect(Collectors.joining("|"));
-            byte[] addr_bytes = addr.getBytes();
+            byte[] addr_bytes = addr.getBytes(UTF_8);
             dout.writeInt(addr_bytes.length);
             dout.write(addr_bytes);
             dout.flush();
@@ -474,19 +500,19 @@ private boolean startConnection(Socket sock, Long sid) throws IOException {
         }
 
         // authenticate learner
-        QuorumPeer.QuorumServer qps = self.getVotingView().get(sid);
+        QuorumPeer.QuorumServer qps = self.getView().get(sid);
         if (qps != null) {
             // TODO - investigate why reconfig makes qps null.
             authLearner.authenticate(sock, qps.hostname);
         }
 
         // If lost the challenge, then drop the new connection
-        if (sid > self.getId()) {
-            LOG.info("Have smaller server identifier, so dropping the connection: (myId:{} --> sid:{})", self.getId(), sid);
+        if (sid > self.getMyId()) {
+            LOG.info("Have smaller server identifier, so dropping the connection: (myId:{} --> sid:{})", self.getMyId(), sid);
             closeSocket(sock);
             // Otherwise proceed with the connection
         } else {
-            LOG.debug("Have larger server identifier, so keeping the connection: (myId:{} --> sid:{})", self.getId(), sid);
+            LOG.debug("Have larger server identifier, so keeping the connection: (myId:{} --> sid:{})", self.getMyId(), sid);
             SendWorker sw = new SendWorker(sock, sid);
             RecvWorker rw = new RecvWorker(sock, din, sid, sw);
             sw.setRecv(rw);
@@ -581,7 +607,7 @@ private void handleConnection(Socket sock, DataInputStream din) throws IOExcepti
                         electionAddr = new MultipleAddresses(init.electionAddr,
                                 Duration.ofMillis(self.getMultiAddressReachabilityCheckTimeoutMs()));
                     }
-                    LOG.debug("Initial message parsed by {}: {}", self.getId(), init.toString());
+                    LOG.debug("Initial message parsed by {}: {}", self.getMyId(), init.toString());
                 } catch (InitialMessage.InitialMessageException ex) {
                     LOG.error("Initial message parsing error!", ex);
                     closeSocket(sock);
@@ -606,7 +632,7 @@ private void handleConnection(Socket sock, DataInputStream din) throws IOExcepti
         // do authenticating learner
         authServer.authenticate(sock, din);
         //If wins the challenge, then close the new connection.
-        if (sid < self.getId()) {
+        if (sid < self.getMyId()) {
             /*
              * This replica might still believe that the connection to sid is
              * up, so we have to shut down the workers before trying to open a
@@ -629,7 +655,7 @@ private void handleConnection(Socket sock, DataInputStream din) throws IOExcepti
                 connectOne(sid);
             }
 
-        } else if (sid == self.getId()) {
+        } else if (sid == self.getMyId()) {
             // we saw this case in ZOOKEEPER-2164
             LOG.warn("We got a connection request from a server with our own ID. "
                      + "This should be either a configuration error, or a bug.");
@@ -679,6 +705,7 @@ public void toSend(Long sid, ByteBuffer b) {
 
     /**
      * Try to establish a connection to server with id sid using its electionAddr.
+     * The function will return quickly and the connection will be established asynchronously.
      *
      * VisibleForTesting.
      *
@@ -697,62 +724,15 @@ synchronized boolean connectOne(long sid, MultipleAddresses electionAddr) {
             return true;
         }
 
-        Socket sock = null;
-        try {
-            LOG.debug("Opening channel to server {}", sid);
-            if (self.isSslQuorum()) {
-                sock = self.getX509Util().createSSLSocket();
-            } else {
-                sock = new Socket();
-            }
-            setSockOpts(sock);
-            sock.connect(electionAddr.getReachableOrOne(), cnxTO);
-            if (sock instanceof SSLSocket) {
-                SSLSocket sslSock = (SSLSocket) sock;
-                sslSock.startHandshake();
-                LOG.info("SSL handshake complete with {} - {} - {}",
-                         sslSock.getRemoteSocketAddress(),
-                         sslSock.getSession().getProtocol(),
-                         sslSock.getSession().getCipherSuite());
-            }
-
-            LOG.debug("Connected to server {} using election address: {}:{}",
-                      sid, sock.getInetAddress(), sock.getPort());
-            // Sends connection request asynchronously if the quorum
-            // sasl authentication is enabled. This is required because
-            // sasl server authentication process may take few seconds to
-            // finish, this may delay next peer connection requests.
-            if (quorumSaslAuthEnabled) {
-                initiateConnectionAsync(sock, sid);
-            } else {
-                initiateConnection(sock, sid);
-            }
-            return true;
-        } catch (UnresolvedAddressException e) {
-            // Sun doesn't include the address that causes this
-            // exception to be thrown, also UAE cannot be wrapped cleanly
-            // so we log the exception in order to capture this critical
-            // detail.
-            LOG.warn("Cannot open channel to {} at election address {}", sid, electionAddr, e);
-            closeSocket(sock);
-            throw e;
-        } catch (X509Exception e) {
-            LOG.warn("Cannot open secure channel to {} at election address {}", sid, electionAddr, e);
-            closeSocket(sock);
-            return false;
-        } catch (NoRouteToHostException e) {
-            LOG.warn("None of the addresses ({}) are reachable for sid {}", electionAddr, sid, e);
-            closeSocket(sock);
-            return false;
-        } catch (IOException e) {
-            LOG.warn("Cannot open channel to {} at election address {}", sid, electionAddr, e);
-            closeSocket(sock);
-            return false;
-        }
+        // we are doing connection initiation always asynchronously, since it is possible that
+        // the socket connection timeouts or the SSL handshake takes too long and don't want
+        // to keep the rest of the connections to wait
+        return initiateConnectionAsync(electionAddr, sid);
     }
 
     /**
      * Try to establish a connection to server with id sid.
+     * The function will return quickly and the connection will be established asynchronously.
      *
      *  @param sid  server id
      */
@@ -777,7 +757,7 @@ synchronized void connectOne(long sid) {
             Map<Long, QuorumPeer.QuorumServer> lastProposedView = lastSeenQV.getAllMembers();
             if (lastCommittedView.containsKey(sid)) {
                 knownId = true;
-                LOG.debug("Server {} knows {} already, it is in the lastCommittedView", self.getId(), sid);
+                LOG.debug("Server {} knows {} already, it is in the lastCommittedView", self.getMyId(), sid);
                 if (connectOne(sid, lastCommittedView.get(sid).electionAddr)) {
                     return;
                 }
@@ -785,9 +765,9 @@ synchronized void connectOne(long sid) {
             if (lastSeenQV != null
                 && lastProposedView.containsKey(sid)
                 && (!knownId
-                    || (lastProposedView.get(sid).electionAddr != lastCommittedView.get(sid).electionAddr))) {
+                    || !lastProposedView.get(sid).electionAddr.equals(lastCommittedView.get(sid).electionAddr))) {
                 knownId = true;
-                LOG.debug("Server {} knows {} already, it is in the lastProposedView", self.getId(), sid);
+                LOG.debug("Server {} knows {} already, it is in the lastProposedView", self.getMyId(), sid);
 
                 if (connectOne(sid, lastProposedView.get(sid).electionAddr)) {
                     return;
@@ -856,7 +836,7 @@ public void halt() {
      */
     public void softHalt() {
         for (SendWorker sw : senderWorkerMap.values()) {
-            LOG.debug("Server {} is soft-halting sender towards: {}", self.getId(), sw);
+            LOG.debug("Server {} is soft-halting sender towards: {}", self.getMyId(), sw);
             sw.finish();
         }
     }
@@ -960,7 +940,7 @@ void setSocketBindErrorHandler(Runnable errorHandler) {
         @Override
         public void run() {
             if (!shutdown) {
-                LOG.debug("Listener thread started, myId: {}", self.getId());
+                LOG.debug("Listener thread started, myId: {}", self.getMyId());
                 Set<InetSocketAddress> addresses;
 
                 if (self.getQuorumListenOnAllIPs()) {
@@ -974,8 +954,13 @@ public void run() {
                                 new ListenerHandler(address, self.shouldUsePortUnification(), self.isSslQuorum(), latch))
                         .collect(Collectors.toList());
 
-                ExecutorService executor = Executors.newFixedThreadPool(addresses.size());
-                listenerHandlers.forEach(executor::submit);
+                final ExecutorService executor = Executors.newFixedThreadPool(addresses.size());
+                try {
+                    listenerHandlers.forEach(executor::submit);
+                } finally {
+                    // prevent executor's threads to leak after ListenerHandler tasks complete
+                    executor.shutdown();
+                }
 
                 try {
                     latch.await();
@@ -1108,7 +1093,7 @@ private void acceptConnections() {
                             break;
                         }
 
-                        LOG.error("Exception while listening", e);
+                        LOG.error("Exception while listening to address {}", address, e);
 
                         if (e instanceof SocketException) {
                             socketException.set(true);
@@ -1149,6 +1134,7 @@ private ServerSocket createNewServerSocket() throws IOException {
                 }
 
                 socket.setReuseAddress(true);
+                address = new InetSocketAddress(address.getHostString(), address.getPort());
                 socket.bind(address);
 
                 return socket;
@@ -1308,7 +1294,7 @@ public void run() {
             }
             this.finish();
 
-            LOG.warn("Send worker leaving thread id {} my id = {}", sid, self.getId());
+            LOG.warn("Send worker leaving thread id {} my id = {}", sid, self.getMyId());
         }
 
 
@@ -1494,4 +1480,8 @@ public boolean connectedToPeer(long peerSid) {
         return senderWorkerMap.get(peerSid) != null;
     }
 
+    public boolean isReconfigEnabled() {
+        return self.isReconfigEnabled();
+    }
+
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
index 32f597e61a4..296ea05374b 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeer.java
@@ -19,6 +19,7 @@
 package org.apache.zookeeper.server.quorum;
 
 import static org.apache.zookeeper.common.NetUtils.formatInetAddr;
+import static org.apache.zookeeper.server.quorum.QuorumPeerConfig.configureSSLAuth;
 import java.io.BufferedReader;
 import java.io.File;
 import java.io.FileNotFoundException;
@@ -43,17 +44,22 @@
 import java.util.Map.Entry;
 import java.util.Properties;
 import java.util.Set;
+import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicInteger;
 import java.util.concurrent.atomic.AtomicLong;
 import java.util.concurrent.atomic.AtomicReference;
+import java.util.function.Function;
 import java.util.stream.Collectors;
 import java.util.stream.IntStream;
 import javax.security.sasl.SaslException;
 import org.apache.yetus.audience.InterfaceAudience;
 import org.apache.zookeeper.KeeperException.BadArgumentsException;
+import org.apache.zookeeper.common.AtomicFileOutputStream;
 import org.apache.zookeeper.common.AtomicFileWritingIdiom;
 import org.apache.zookeeper.common.AtomicFileWritingIdiom.WriterStatement;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.common.QuorumX509Util;
+import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.common.X509Exception;
 import org.apache.zookeeper.jmx.MBeanRegistry;
 import org.apache.zookeeper.jmx.ZKMBeanInfo;
@@ -67,7 +73,6 @@
 import org.apache.zookeeper.server.admin.AdminServer.AdminServerException;
 import org.apache.zookeeper.server.admin.AdminServerFactory;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
 import org.apache.zookeeper.server.quorum.auth.NullQuorumAuthLearner;
 import org.apache.zookeeper.server.quorum.auth.NullQuorumAuthServer;
 import org.apache.zookeeper.server.quorum.auth.QuorumAuth;
@@ -76,6 +81,7 @@
 import org.apache.zookeeper.server.quorum.auth.SaslQuorumAuthLearner;
 import org.apache.zookeeper.server.quorum.auth.SaslQuorumAuthServer;
 import org.apache.zookeeper.server.quorum.flexible.QuorumMaj;
+import org.apache.zookeeper.server.quorum.flexible.QuorumOracleMaj;
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
 import org.apache.zookeeper.server.util.ConfigUtils;
 import org.apache.zookeeper.server.util.JvmPauseMonitor;
@@ -114,6 +120,9 @@ public class QuorumPeer extends ZooKeeperThread implements QuorumStats.Provider
 
     private static final Logger LOG = LoggerFactory.getLogger(QuorumPeer.class);
 
+    public static final String CONFIG_KEY_KERBEROS_CANONICALIZE_HOST_NAMES = "zookeeper.kerberos.canonicalizeHostNames";
+    public static final String CONFIG_DEFAULT_KERBEROS_CANONICALIZE_HOST_NAMES = "false";
+
     private QuorumBean jmxQuorumBean;
     LocalPeerBean jmxLocalPeerBean;
     private Map<Long, RemotePeerBean> jmxRemotePeerBean;
@@ -137,20 +146,27 @@ public class QuorumPeer extends ZooKeeperThread implements QuorumStats.Provider
 
     private JvmPauseMonitor jvmPauseMonitor;
 
+    private final AtomicBoolean suspended = new AtomicBoolean(false);
+
     public static final class AddressTuple {
 
         public final MultipleAddresses quorumAddr;
         public final MultipleAddresses electionAddr;
         public final InetSocketAddress clientAddr;
+        public final InetSocketAddress secureClientAddr;
 
-        public AddressTuple(MultipleAddresses quorumAddr, MultipleAddresses electionAddr, InetSocketAddress clientAddr) {
+        public AddressTuple(MultipleAddresses quorumAddr, MultipleAddresses electionAddr, InetSocketAddress clientAddr, InetSocketAddress secureClientAddr) {
             this.quorumAddr = quorumAddr;
             this.electionAddr = electionAddr;
             this.clientAddr = clientAddr;
+            this.secureClientAddr = secureClientAddr;
         }
 
     }
 
+    private Boolean isClientAddrFromStatic = null;
+    private Boolean isSecureClientAddrFromStatic = null;
+
     private int observerMasterPort;
 
     public int getObserverMasterPort() {
@@ -206,6 +222,7 @@ public static class QuorumServer {
         public MultipleAddresses electionAddr = new MultipleAddresses();
 
         public InetSocketAddress clientAddr = null;
+        public InetSocketAddress secureClientAddr = null;
 
         public long id;
 
@@ -214,20 +231,31 @@ public static class QuorumServer {
         public LearnerType type = LearnerType.PARTICIPANT;
 
         public boolean isClientAddrFromStatic = false;
+        public boolean isSecureClientAddrFromStatic = false;
 
         private List<InetSocketAddress> myAddrs;
 
         public QuorumServer(long id, InetSocketAddress addr, InetSocketAddress electionAddr, InetSocketAddress clientAddr) {
-            this(id, addr, electionAddr, clientAddr, LearnerType.PARTICIPANT);
+            this(id, addr, electionAddr, clientAddr, null, LearnerType.PARTICIPANT);
+        }
+
+        public QuorumServer(long id, InetSocketAddress addr, InetSocketAddress electionAddr, InetSocketAddress clientAddr,
+            InetSocketAddress secureClientAddr) {
+            this(id, addr, electionAddr, clientAddr, secureClientAddr, LearnerType.PARTICIPANT);
+        }
+
+        public QuorumServer(long id, InetSocketAddress addr, InetSocketAddress electionAddr, InetSocketAddress clientAddr,
+            LearnerType learnerType) {
+            this(id, addr, electionAddr, clientAddr, null, learnerType);
         }
 
         public QuorumServer(long id, InetSocketAddress addr, InetSocketAddress electionAddr) {
-            this(id, addr, electionAddr, null, LearnerType.PARTICIPANT);
+            this(id, addr, electionAddr, null, null, LearnerType.PARTICIPANT);
         }
 
         // VisibleForTesting
         public QuorumServer(long id, InetSocketAddress addr) {
-            this(id, addr, null, null, LearnerType.PARTICIPANT);
+            this(id, addr, null, null, null, LearnerType.PARTICIPANT);
         }
 
         public long getId() {
@@ -264,64 +292,134 @@ private LearnerType getType(String s) throws ConfigException {
             }
         }
 
+        public QuorumServer(long sid, String addressStr) throws ConfigException {
+            this(sid, addressStr, QuorumServer::getInetAddress);
+        }
+
+        QuorumServer(long sid, String addressStr, Function<InetSocketAddress, InetAddress> getInetAddress) throws ConfigException {
+            this.id = sid;
+            initializeWithAddressString(addressStr, getInetAddress);
+        }
+
+        public QuorumServer(long id, InetSocketAddress addr, InetSocketAddress electionAddr, LearnerType type) {
+            this(id, addr, electionAddr, null, null, type);
+        }
+
+        public QuorumServer(long id, InetSocketAddress addr, InetSocketAddress electionAddr, InetSocketAddress clientAddr, InetSocketAddress secureClientAddr, LearnerType type) {
+            this.id = id;
+            if (addr != null) {
+                this.addr.addAddress(addr);
+            }
+            if (electionAddr != null) {
+                this.electionAddr.addAddress(electionAddr);
+            }
+            this.type = type;
+            this.clientAddr = clientAddr;
+            this.secureClientAddr = secureClientAddr;
+
+            setMyAddrs();
+        }
+
         private static final String wrongFormat =
             " does not have the form server_config or server_config;client_config"
             + " where server_config is the pipe separated list of host:port:port or host:port:port:type"
-            + " and client_config is port or host:port";
+            + " and client_config is host:clientPort;host:secureClientPort or clientPort or host:clientPort"
+            + " or ';secureClientPort' or ';host:secureClientPort'";
 
-        public QuorumServer(long sid, String addressStr) throws ConfigException {
-            this.id = sid;
+        private void initializeWithAddressString(String addressStr, Function<InetSocketAddress, InetAddress> getInetAddress) throws ConfigException {
             LearnerType newType = null;
             String[] serverClientParts = addressStr.split(";");
             String[] serverAddresses = serverClientParts[0].split("\\|");
 
-            if (serverClientParts.length == 2) {
+            if (serverClientParts.length >= 2 && !serverClientParts[1].isEmpty()) {
                 String[] clientParts = ConfigUtils.getHostAndPort(serverClientParts[1]);
                 if (clientParts.length > 2) {
                     throw new ConfigException(addressStr + wrongFormat);
                 }
 
                 // is client_config a host:port or just a port
-                hostname = (clientParts.length == 2) ? clientParts[0] : "0.0.0.0";
+                String clientHostName = (clientParts.length == 2) ? clientParts[0] : "0.0.0.0";
                 try {
-                    clientAddr = new InetSocketAddress(hostname, Integer.parseInt(clientParts[clientParts.length - 1]));
+                    clientAddr = new InetSocketAddress(clientHostName, Integer.parseInt(clientParts[clientParts.length - 1]));
                 } catch (NumberFormatException e) {
-                    throw new ConfigException("Address unresolved: " + hostname + ":" + clientParts[clientParts.length - 1]);
+                    throw new ConfigException("Address unresolved: " + clientHostName + ":" + clientParts[clientParts.length - 1]);
                 }
             }
 
+            if (serverClientParts.length == 3 && !serverClientParts[2].isEmpty()) {
+                String[] secureClientParts = ConfigUtils.getHostAndPort(serverClientParts[2]);
+                if (secureClientParts.length > 2) {
+                    throw new ConfigException(addressStr + wrongFormat);
+                }
+
+                // is secure client config a host:port or just a port
+                String secureClientHostName = (secureClientParts.length == 2) ? secureClientParts[0] : "0.0.0.0";
+                try {
+                    secureClientAddr = new InetSocketAddress(secureClientHostName, Integer.parseInt(secureClientParts[secureClientParts.length - 1]));
+                } catch (NumberFormatException e) {
+                    throw new ConfigException("Address unresolved: " + secureClientHostName + ":" + secureClientParts[secureClientParts.length - 1]);
+                }
+                // set x509 auth provider if not already set
+                configureSSLAuth();
+            }
+
             boolean multiAddressEnabled = Boolean.parseBoolean(
                 System.getProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_ENABLED, QuorumPeer.CONFIG_DEFAULT_MULTI_ADDRESS_ENABLED));
             if (!multiAddressEnabled && serverAddresses.length > 1) {
-                throw new ConfigException("Multiple address feature is disabled, but multiple addresses were specified for sid " + sid);
+                throw new ConfigException("Multiple address feature is disabled, but multiple addresses were specified for sid " + this.id);
             }
 
+            boolean canonicalize = Boolean.parseBoolean(
+                System.getProperty(
+                    CONFIG_KEY_KERBEROS_CANONICALIZE_HOST_NAMES,
+                    CONFIG_DEFAULT_KERBEROS_CANONICALIZE_HOST_NAMES));
+
             for (String serverAddress : serverAddresses) {
-                String serverParts[] = ConfigUtils.getHostAndPort(serverAddress);
-                if ((serverClientParts.length > 2) || (serverParts.length < 3)
-                        || (serverParts.length > 4)) {
+                String[] serverParts = ConfigUtils.getHostAndPort(serverAddress);
+                if ((serverParts.length < 3) || (serverParts.length > 4)) {
                     throw new ConfigException(addressStr + wrongFormat);
                 }
 
+                String serverHostName = serverParts[0];
+
                 // server_config should be either host:port:port or host:port:port:type
                 InetSocketAddress tempAddress;
                 InetSocketAddress tempElectionAddress;
                 try {
-                    tempAddress = new InetSocketAddress(serverParts[0], Integer.parseInt(serverParts[1]));
+                    tempAddress = new InetSocketAddress(serverHostName, Integer.parseInt(serverParts[1]));
                     addr.addAddress(tempAddress);
                 } catch (NumberFormatException e) {
-                    throw new ConfigException("Address unresolved: " + serverParts[0] + ":" + serverParts[1]);
+                    throw new ConfigException("Address unresolved: " + serverHostName + ":" + serverParts[1]);
                 }
                 try {
-                    tempElectionAddress = new InetSocketAddress(serverParts[0], Integer.parseInt(serverParts[2]));
+                    tempElectionAddress = new InetSocketAddress(serverHostName, Integer.parseInt(serverParts[2]));
                     electionAddr.addAddress(tempElectionAddress);
                 } catch (NumberFormatException e) {
-                    throw new ConfigException("Address unresolved: " + serverParts[0] + ":" + serverParts[2]);
+                    throw new ConfigException("Address unresolved: " + serverHostName + ":" + serverParts[2]);
                 }
 
                 if (tempAddress.getPort() == tempElectionAddress.getPort()) {
                     throw new ConfigException("Client and election port must be different! Please update the "
-                            + "configuration file on server." + sid);
+                            + "configuration file on server." + this.id);
+                }
+
+                if (canonicalize) {
+                    InetAddress ia = getInetAddress.apply(tempAddress);
+                    if (ia == null) {
+                        throw new ConfigException("Unable to canonicalize address " + serverHostName + " because it's not resolvable");
+                    }
+
+                    String canonicalHostName = ia.getCanonicalHostName();
+
+                    if (!canonicalHostName.equals(serverHostName)
+                        // Avoid using literal IP address when
+                        // security check fails
+                        && !canonicalHostName.equals(ia.getHostAddress())) {
+                        LOG.info("Host name for quorum server {} "
+                            + "canonicalized from {} to {}",
+                            this.id, serverHostName, canonicalHostName);
+                        serverHostName = canonicalHostName;
+                    }
                 }
 
                 if (serverParts.length == 4) {
@@ -335,7 +433,7 @@ public QuorumServer(long sid, String addressStr) throws ConfigException {
                     }
                 }
 
-                this.hostname = serverParts[0];
+                this.hostname = serverHostName;
             }
 
             if (newType != null) {
@@ -345,28 +443,15 @@ public QuorumServer(long sid, String addressStr) throws ConfigException {
             setMyAddrs();
         }
 
-        public QuorumServer(long id, InetSocketAddress addr, InetSocketAddress electionAddr, LearnerType type) {
-            this(id, addr, electionAddr, null, type);
-        }
-
-        public QuorumServer(long id, InetSocketAddress addr, InetSocketAddress electionAddr, InetSocketAddress clientAddr, LearnerType type) {
-            this.id = id;
-            if (addr != null) {
-                this.addr.addAddress(addr);
-            }
-            if (electionAddr != null) {
-                this.electionAddr.addAddress(electionAddr);
-            }
-            this.type = type;
-            this.clientAddr = clientAddr;
-
-            setMyAddrs();
+        private static InetAddress getInetAddress(InetSocketAddress addr) {
+            return addr.getAddress();
         }
 
         private void setMyAddrs() {
             this.myAddrs = new ArrayList<>();
             this.myAddrs.addAll(this.addr.getAllAddresses());
             this.myAddrs.add(this.clientAddr);
+            this.myAddrs.add(this.secureClientAddr);
             this.myAddrs.addAll(this.electionAddr.getAllAddresses());
             this.myAddrs = excludedSpecialAddresses(this.myAddrs);
         }
@@ -400,13 +485,24 @@ public String toString() {
                 sw.append(":participant");
             }
 
+            boolean clientPortSpecAdded = false;
             if (clientAddr != null && !isClientAddrFromStatic) {
+                clientPortSpecAdded = true;
                 sw.append(";");
                 sw.append(delimitedHostString(clientAddr));
                 sw.append(":");
                 sw.append(String.valueOf(clientAddr.getPort()));
             }
 
+            if (secureClientAddr != null & !isSecureClientAddrFromStatic) {
+                if (!clientPortSpecAdded) {
+                    sw.append(";");
+                }
+                sw.append(";");
+                sw.append(delimitedHostString(secureClientAddr));
+                sw.append(":");
+                sw.append(String.valueOf(secureClientAddr.getPort()));
+            }
             return sw.toString();
         }
 
@@ -415,7 +511,7 @@ public int hashCode() {
             return 42; // any arbitrary constant will do
         }
 
-        private boolean checkAddressesEqual(InetSocketAddress addr1, InetSocketAddress addr2) {
+        private static boolean checkAddressesEqual(InetSocketAddress addr1, InetSocketAddress addr2) {
             return (addr1 != null || addr2 == null)
                    && (addr1 == null || addr2 != null)
                    && (addr1 == null || addr2 == null || addr1.equals(addr2));
@@ -435,12 +531,16 @@ public boolean equals(Object o) {
             if (!electionAddr.equals(qs.electionAddr)) {
                 return false;
             }
-            return checkAddressesEqual(clientAddr, qs.clientAddr);
+            if (!checkAddressesEqual(clientAddr, qs.clientAddr)) {
+                return false;
+            }
+            return checkAddressesEqual(secureClientAddr, qs.secureClientAddr);
         }
 
         public void checkAddressDuplicate(QuorumServer s) throws BadArgumentsException {
             List<InetSocketAddress> otherAddrs = new ArrayList<>(s.addr.getAllAddresses());
             otherAddrs.add(s.clientAddr);
+            otherAddrs.add(s.secureClientAddr);
             otherAddrs.addAll(s.electionAddr.getAllAddresses());
             otherAddrs = excludedSpecialAddresses(otherAddrs);
 
@@ -464,8 +564,8 @@ private List<InetSocketAddress> excludedSpecialAddresses(List<InetSocketAddress>
                 }
                 InetAddress inetaddr = addr.getAddress();
 
-                if (inetaddr == null || inetaddr.isAnyLocalAddress() || // wildCard addresses (0.0.0.0 or [::])
-                    inetaddr.isLoopbackAddress()) { // loopback address(localhost/127.0.0.1)
+                if (inetaddr == null || inetaddr.isAnyLocalAddress() // wildCard addresses (0.0.0.0 or [::])
+                    || inetaddr.isLoopbackAddress()) { // loopback address(localhost/127.0.0.1)
                     continue;
                 }
                 included.add(addr);
@@ -530,6 +630,7 @@ public enum LearnerType {
      */
     public long start_fle, end_fle; // fle = fast leader election
     public static final String FLE_TIME_UNIT = "MS";
+    private long unavailableStartTime;
 
     /*
      * Default value of peer is participant
@@ -582,7 +683,7 @@ public void setJvmPauseMonitor(JvmPauseMonitor jvmPauseMonitor) {
     /**
      * get the id of this quorum peer.
      */
-    public long getId() {
+    public long getMyId() {
         return myid;
     }
 
@@ -660,6 +761,7 @@ public synchronized void setCurrentVote(Vote v) {
      * value of one indicates the default backlog will be used.
      */
     protected int clientPortListenBacklog = -1;
+    protected int maxClientCnxns = -1;
 
     /**
      * The number of ticks that the initial synchronization phase can take
@@ -760,7 +862,7 @@ public synchronized void setCurrentVote(Vote v) {
      * This class simply responds to requests for the current leader of this
      * node.
      * <p>
-     * The request contains just an xid generated by the requestor.
+     * The request contains just an xid generated by the requester.
      * <p>
      * The response has the xid, the id of this server, the id of the leader,
      * and the zxid of the leader.
@@ -843,7 +945,7 @@ public void run() {
 
     private AtomicReference<ZabState> zabState = new AtomicReference<>(ZabState.ELECTION);
     private AtomicReference<SyncMode> syncMode = new AtomicReference<>(SyncMode.NONE);
-    private AtomicReference<String> leaderAddress = new AtomicReference<String>("");
+    private AtomicReference<String> leaderAddress = new AtomicReference<>("");
     private AtomicLong leaderId = new AtomicLong(-1);
 
     private boolean reconfigFlag = false; // indicates that a reconfig just committed
@@ -859,6 +961,14 @@ public synchronized void setPeerState(ServerState newState) {
     }
 
     public void setZabState(ZabState zabState) {
+        if ((zabState == ZabState.BROADCAST) && (unavailableStartTime != 0)) {
+            long unavailableTime = Time.currentElapsedTime() - unavailableStartTime;
+            ServerMetrics.getMetrics().UNAVAILABLE_TIME.add(unavailableTime);
+            if (getPeerState() == ServerState.LEADING) {
+                ServerMetrics.getMetrics().LEADER_UNAVAILABLE_TIME.add(unavailableTime);
+            }
+            unavailableStartTime = 0;
+        }
         this.zabState.set(zabState);
         LOG.info("Peer state changed: {}", getDetailedPeerState());
     }
@@ -926,7 +1036,7 @@ public synchronized ServerState getPeerState() {
     /**
      * Resolves hostname for a given server ID.
      *
-     * This method resolves hostname for a given server ID in both quorumVerifer
+     * This method resolves hostname for a given server ID in both quorumVerifier
      * and lastSeenQuorumVerifier. If the server ID matches the local server ID,
      * it also updates myAddrs.
      */
@@ -936,8 +1046,8 @@ public void recreateSocketAddresses(long id) {
             QuorumServer qs = qv.getAllMembers().get(id);
             if (qs != null) {
                 qs.recreateSocketAddresses();
-                if (id == getId()) {
-                    setAddrs(qs.addr, qs.electionAddr, qs.clientAddr);
+                if (id == getMyId()) {
+                    setAddrs(qs.addr, qs.electionAddr, qs.clientAddr, qs.secureClientAddr);
                 }
             }
         }
@@ -983,9 +1093,15 @@ public InetSocketAddress getClientAddress() {
         return (addrs == null) ? null : addrs.clientAddr;
     }
 
-    private void setAddrs(MultipleAddresses quorumAddr, MultipleAddresses electionAddr, InetSocketAddress clientAddr) {
+    public InetSocketAddress getSecureClientAddress() {
+        final AddressTuple addrs = myAddrs.get();
+        return (addrs == null) ? null : addrs.secureClientAddr;
+    }
+
+    private void setAddrs(MultipleAddresses quorumAddr, MultipleAddresses electionAddr, InetSocketAddress clientAddr,
+        InetSocketAddress secureClientAddr) {
         synchronized (QV_LOCK) {
-            myAddrs.set(new AddressTuple(quorumAddr, electionAddr, clientAddr));
+            myAddrs.set(new AddressTuple(quorumAddr, electionAddr, clientAddr, secureClientAddr));
             QV_LOCK.notifyAll();
         }
     }
@@ -1003,6 +1119,8 @@ private void setAddrs(MultipleAddresses quorumAddr, MultipleAddresses electionAd
 
     AdminServer adminServer;
 
+    private final boolean reconfigEnabled;
+
     public static QuorumPeer testingQuorumPeer() throws SaslException {
         return new QuorumPeer();
     }
@@ -1010,10 +1128,11 @@ public static QuorumPeer testingQuorumPeer() throws SaslException {
     public QuorumPeer() throws SaslException {
         super("QuorumPeer");
         quorumStats = new QuorumStats(this);
-        jmxRemotePeerBean = new HashMap<Long, RemotePeerBean>();
+        jmxRemotePeerBean = new HashMap<>();
         adminServer = AdminServerFactory.createAdminServer();
         x509Util = createX509Util();
         initialize();
+        reconfigEnabled = QuorumPeerConfig.isReconfigEnabled();
     }
 
     // VisibleForTesting
@@ -1051,7 +1170,7 @@ public QuorumPeer(Map<Long, QuorumServer> quorumPeers, File dataDir, File dataLo
     public void initialize() throws SaslException {
         // init quorum auth server & learner
         if (isQuorumSaslAuthEnabled()) {
-            Set<String> authzHosts = new HashSet<String>();
+            Set<String> authzHosts = new HashSet<>();
             for (QuorumServer qs : getView().values()) {
                 authzHosts.add(qs.hostname);
             }
@@ -1078,7 +1197,6 @@ public synchronized void start() {
             adminServer.start();
         } catch (AdminServerException e) {
             LOG.warn("Problem starting AdminServer", e);
-            System.out.println(e);
         }
         startLeaderElection();
         startJvmPauseMonitor();
@@ -1107,10 +1225,18 @@ private void loadDataBase() {
                 writeLongToFile(CURRENT_EPOCH_FILENAME, currentEpoch);
             }
             if (epochOfZxid > currentEpoch) {
-                throw new IOException("The current epoch, "
-                                      + ZxidUtils.zxidToString(currentEpoch)
-                                      + ", is older than the last zxid, "
-                                      + lastProcessedZxid);
+                // acceptedEpoch.tmp file in snapshot directory
+                File currentTmp = new File(getTxnFactory().getSnapDir(),
+                    CURRENT_EPOCH_FILENAME + AtomicFileOutputStream.TMP_EXTENSION);
+                if (currentTmp.exists()) {
+                    long epochOfTmp = readLongFromFile(currentTmp.getName());
+                    LOG.info("{} found. Setting current epoch to {}.", currentTmp, epochOfTmp);
+                    setCurrentEpoch(epochOfTmp);
+                } else {
+                    throw new IOException(
+                        "The current epoch, " + ZxidUtils.zxidToString(currentEpoch)
+                            + ", is older than the last zxid, " + lastProcessedZxid);
+                }
             }
             try {
                 acceptedEpoch = readLongFromFile(ACCEPTED_EPOCH_FILENAME);
@@ -1199,6 +1325,22 @@ public QuorumPeer(Map<Long, QuorumServer> quorumPeers, File snapDir, File logDir
             new QuorumMaj(quorumPeers));
     }
 
+    public QuorumPeer(Map<Long, QuorumServer> quorumPeers, File snapDir, File logDir, int clientPort, int electionAlg, long myid, int tickTime, int initLimit, int syncLimit, int connectToLearnerMasterLimit, String oraclePath) throws IOException {
+        this(
+                quorumPeers,
+                snapDir,
+                logDir,
+                electionAlg,
+                myid,
+                tickTime,
+                initLimit,
+                syncLimit,
+                connectToLearnerMasterLimit,
+                false,
+                ServerCnxnFactory.createFactory(getClientAddress(quorumPeers, myid, clientPort), -1),
+                new QuorumOracleMaj(quorumPeers, oraclePath));
+    }
+
     /**
      * This constructor is only used by the existing unit test code.
      * It defaults to FileLogProvider persistence provider.
@@ -1222,7 +1364,7 @@ public QuorumPeer(Map<Long, QuorumServer> quorumPeers, File snapDir, File logDir
     private static InetSocketAddress getClientAddress(Map<Long, QuorumServer> quorumPeers, long myid, int clientPort) throws IOException {
         QuorumServer quorumServer = quorumPeers.get(myid);
         if (null == quorumServer) {
-            throw new IOException("No QuorumServer correspoding to myid " + myid);
+            throw new IOException("No QuorumServer corresponding to myid " + myid);
         }
         if (null == quorumServer.clientAddr) {
             return new InetSocketAddress(clientPort);
@@ -1297,7 +1439,6 @@ protected Election createElectionAlgorithm(int electionAlgorithm) {
         return le;
     }
 
-    @SuppressWarnings("deprecation")
     protected Election makeLEStrategy() {
         LOG.debug("Initializing leader election protocol...");
         return electionAlg;
@@ -1328,6 +1469,19 @@ public synchronized ZooKeeperServer getActiveServer() {
 
     boolean shuttingDownLE = false;
 
+    public void setSuspended(boolean suspended) {
+        this.suspended.set(suspended);
+    }
+    private void checkSuspended() {
+        try {
+            while (suspended.get()) {
+                Thread.sleep(10);
+            }
+        } catch (InterruptedException err) {
+            Thread.currentThread().interrupt();
+        }
+    }
+
     @Override
     public void run() {
         updateThreadName();
@@ -1338,7 +1492,7 @@ public void run() {
             MBeanRegistry.getInstance().register(jmxQuorumBean, null);
             for (QuorumServer s : getView().values()) {
                 ZKMBeanInfo p;
-                if (getId() == s.id) {
+                if (getMyId() == s.id) {
                     p = jmxLocalPeerBean = new LocalPeerBean(this);
                     try {
                         MBeanRegistry.getInstance().register(p, jmxQuorumBean);
@@ -1366,6 +1520,10 @@ public void run() {
              * Main loop
              */
             while (running) {
+                if (unavailableStartTime == 0) {
+                    unavailableStartTime = Time.currentElapsedTime();
+                }
+
                 switch (getPeerState()) {
                 case LOOKING:
                     LOG.info("LOOKING");
@@ -1406,11 +1564,12 @@ public void run() {
                                 startLeaderElection();
                             }
                             setCurrentVote(makeLEStrategy().lookForLeader());
+                            checkSuspended();
                         } catch (Exception e) {
                             LOG.warn("Unexpected exception", e);
                             setPeerState(ServerState.LOOKING);
                         } finally {
-                            // If the thread is in the the grace period, interrupt
+                            // If the thread is in the grace period, interrupt
                             // to come out of waiting.
                             roZkMgr.interrupt();
                             roZk.shutdown();
@@ -1418,6 +1577,7 @@ public void run() {
                     } else {
                         try {
                             reconfigFlagClear();
+                            checkSuspended();
                             if (shuttingDownLE) {
                                 shuttingDownLE = false;
                                 startLeaderElection();
@@ -1502,7 +1662,7 @@ private synchronized void updateServerState() {
             return;
         }
 
-        if (getId() == getCurrentVote().getId()) {
+        if (getMyId() == getCurrentVote().getId()) {
             setPeerState(ServerState.LEADING);
             LOG.debug("PeerState set to LEADING");
         } else if (getLearnerType() == LearnerType.PARTICIPANT) {
@@ -1545,10 +1705,12 @@ public void shutdown() {
             this.interrupt();
             getElectionAlg().shutdown();
         }
-        try {
-            zkDb.close();
-        } catch (IOException ie) {
-            LOG.warn("Error closing logs ", ie);
+        if (zkDb != null) {
+            try {
+                zkDb.close();
+            } catch (IOException ie) {
+                LOG.warn("Error closing logs ", ie);
+            }
         }
     }
 
@@ -1576,7 +1738,7 @@ public Map<Long, QuorumPeer.QuorumServer> getObservingView() {
     }
 
     public synchronized Set<Long> getCurrentAndNextConfigVoters() {
-        Set<Long> voterIds = new HashSet<Long>(getQuorumVerifier().getVotingMembers().keySet());
+        Set<Long> voterIds = new HashSet<>(getQuorumVerifier().getVotingMembers().keySet());
         if (getLastSeenQuorumVerifier() != null) {
             voterIds.addAll(getLastSeenQuorumVerifier().getVotingMembers().keySet());
         }
@@ -1596,7 +1758,7 @@ public boolean viewContains(Long sid) {
      * Only used by QuorumStats at the moment
      */
     public String[] getQuorumPeers() {
-        List<String> l = new ArrayList<String>();
+        List<String> l = new ArrayList<>();
         synchronized (this) {
             if (leader != null) {
                 for (LearnerHandler fh : leader.getLearners()) {
@@ -1724,6 +1886,16 @@ public void setClientPortListenBacklog(int backlog) {
         this.clientPortListenBacklog = backlog;
     }
 
+    /** The server max client connections */
+    public int getMaxClientCnxns() {
+        return maxClientCnxns;
+    }
+
+    /** Sets the server's max client connections */
+    public void setMaxClientCnxns(int maxClientCnxns) {
+        this.maxClientCnxns = maxClientCnxns;
+    }
+
     /**
      * Get the number of ticks that the initial synchronization phase can take
      */
@@ -1749,7 +1921,7 @@ public int getTick() {
     public QuorumVerifier configFromString(String s) throws IOException, ConfigException {
         Properties props = new Properties();
         props.load(new StringReader(s));
-        return QuorumPeerConfig.parseDynamicConfig(props, electionType, false, false);
+        return QuorumPeerConfig.parseDynamicConfig(props, electionType, false, false, getQuorumVerifier().getOraclePath());
     }
 
     /**
@@ -1796,7 +1968,7 @@ private void connectNewPeers(QuorumCnxManager qcm) {
         if (quorumVerifier != null && lastSeenQuorumVerifier != null) {
             Map<Long, QuorumServer> committedView = quorumVerifier.getAllMembers();
             for (Entry<Long, QuorumServer> e : lastSeenQuorumVerifier.getAllMembers().entrySet()) {
-                if (e.getKey() != getId() && !committedView.containsKey(e.getKey())) {
+                if (e.getKey() != getMyId() && !committedView.containsKey(e.getKey())) {
                     qcm.connectOne(e.getKey());
                 }
             }
@@ -1804,6 +1976,11 @@ private void connectNewPeers(QuorumCnxManager qcm) {
     }
 
     public void setLastSeenQuorumVerifier(QuorumVerifier qv, boolean writeToDisk) {
+        if (!isReconfigEnabled()) {
+            LOG.info("Dynamic reconfig is disabled, we don't store the last seen config.");
+            return;
+        }
+
         // If qcm is non-null, we may call qcm.connectOne(), which will take the lock on qcm
         // and then take QV_LOCK.  Take the locks in the same order to ensure that we don't
         // deadlock against other callers of connectOne().  If qcmRef gets set in another
@@ -1852,7 +2029,7 @@ public QuorumVerifier setQuorumVerifier(QuorumVerifier qv, boolean writeToDisk)
                 // and then got the same config in UPTODATE message so its already known
                 LOG.debug(
                     "{} setQuorumVerifier called with known or old config {}. Current version: {}",
-                    getId(),
+                    getMyId(),
                     qv.getVersion(),
                     quorumVerifier.getVersion());
                 return quorumVerifier;
@@ -1869,7 +2046,7 @@ public QuorumVerifier setQuorumVerifier(QuorumVerifier qv, boolean writeToDisk)
                     try {
                         String dynamicConfigFilename = makeDynamicConfigFilename(qv.getVersion());
                         QuorumPeerConfig.writeDynamicConfig(dynamicConfigFilename, qv, false);
-                        QuorumPeerConfig.editStaticConfig(configFilename, dynamicConfigFilename, needEraseClientInfoFromStaticConfig());
+                        QuorumPeerConfig.editStaticConfig(configFilename, dynamicConfigFilename, needEraseClientInfoFromStaticConfig(), needEraseSecureClientInfoFromStaticConfig());
                     } catch (IOException e) {
                         LOG.error("Error closing file", e);
                     }
@@ -1881,9 +2058,18 @@ public QuorumVerifier setQuorumVerifier(QuorumVerifier qv, boolean writeToDisk)
             if (qv.getVersion() == lastSeenQuorumVerifier.getVersion()) {
                 QuorumPeerConfig.deleteFile(getNextDynamicConfigFilename());
             }
-            QuorumServer qs = qv.getAllMembers().get(getId());
+            QuorumServer qs = qv.getAllMembers().get(getMyId());
             if (qs != null) {
-                setAddrs(qs.addr, qs.electionAddr, qs.clientAddr);
+                setAddrs(qs.addr, qs.electionAddr, qs.clientAddr, qs.secureClientAddr);
+
+                // we only set this once, because quorum verifier can change based on dynamic reconfig
+                if (isClientAddrFromStatic == null) {
+                    isClientAddrFromStatic = qs.isClientAddrFromStatic;
+                }
+
+                if (isSecureClientAddrFromStatic == null) {
+                    isSecureClientAddrFromStatic = qs.isSecureClientAddrFromStatic;
+                }
             }
             updateObserverMasterList();
             return prevQV;
@@ -1895,10 +2081,15 @@ private String makeDynamicConfigFilename(long version) {
     }
 
     private boolean needEraseClientInfoFromStaticConfig() {
-        QuorumServer server = quorumVerifier.getAllMembers().get(getId());
+        QuorumServer server = quorumVerifier.getAllMembers().get(getMyId());
         return (server != null && server.clientAddr != null && !server.isClientAddrFromStatic);
     }
 
+    private boolean needEraseSecureClientInfoFromStaticConfig() {
+        QuorumServer server = quorumVerifier.getAllMembers().get(getMyId());
+        return (server != null && server.secureClientAddr != null && !server.isSecureClientAddrFromStatic);
+    }
+
     /**
      * Get an instance of LeaderElection
      */
@@ -1943,8 +2134,6 @@ public void setConnectToLearnerMasterLimit(int connectToLearnerMasterLimit) {
 
     /**
      * Return syncEnabled.
-     *
-     * @return
      */
     public boolean getSyncEnabled() {
         if (System.getProperty(SYNC_ENABLED) != null) {
@@ -2052,6 +2241,13 @@ public int getClientPort() {
         return -1;
     }
 
+    public int getSecureClientPort() {
+        if (secureCnxnFactory != null) {
+            return secureCnxnFactory.getLocalPort();
+        }
+        return -1;
+    }
+
     public void setTxnFactory(FileTxnSnapLog factory) {
         this.logFactory = factory;
     }
@@ -2152,13 +2348,20 @@ public void setAcceptedEpoch(long e) throws IOException {
         acceptedEpoch = e;
     }
 
+    private void recreateSocketAddressesFromQV(QuorumVerifier qv) {
+        for (QuorumServer qs : qv.getAllMembers().values()) {
+            qs.recreateSocketAddresses();
+        }
+    }
+
     public boolean processReconfig(QuorumVerifier qv, Long suggestedLeaderId, Long zxid, boolean restartLE) {
-        if (!QuorumPeerConfig.isReconfigEnabled()) {
+        if (!isReconfigEnabled()) {
             LOG.debug("Reconfig feature is disabled, skip reconfig processing.");
             return false;
         }
 
         InetSocketAddress oldClientAddr = getClientAddress();
+        InetSocketAddress oldSecureClientAddr = getSecureClientAddress();
 
         // update last committed quorum verifier, write the new config to disk
         // and restart leader election if config changed.
@@ -2174,6 +2377,9 @@ public boolean processReconfig(QuorumVerifier qv, Long suggestedLeaderId, Long z
         // for Learner):
         initConfigInZKDatabase();
 
+        recreateSocketAddressesFromQV(prevQV);
+        recreateSocketAddressesFromQV(qv);
+
         if (prevQV.getVersion() < qv.getVersion() && !prevQV.equals(qv)) {
             Map<Long, QuorumServer> newMembers = qv.getAllMembers();
             updateRemotePeerMXBeans(newMembers);
@@ -2181,9 +2387,54 @@ public boolean processReconfig(QuorumVerifier qv, Long suggestedLeaderId, Long z
                 restartLeaderElection(prevQV, qv);
             }
 
-            QuorumServer myNewQS = newMembers.get(getId());
-            if (myNewQS != null && myNewQS.clientAddr != null && !myNewQS.clientAddr.equals(oldClientAddr)) {
-                cnxnFactory.reconfigure(myNewQS.clientAddr);
+            QuorumServer myNewQS = newMembers.get(getMyId());
+            if (myNewQS != null) {
+                if (myNewQS.clientAddr == null) {
+                    if (!isClientAddrFromStatic && oldClientAddr != null && cnxnFactory != null) {
+                        // clientAddr omitted in new config, shutdown cnxnFactory
+                         cnxnFactory.shutdown();
+                         cnxnFactory = null;
+                    }
+                } else if (!myNewQS.clientAddr.equals(oldClientAddr)) {
+                    // clientAddr has changed
+                    if (cnxnFactory == null) {
+                        // start cnxnFactory first
+                        try {
+                            cnxnFactory = ServerCnxnFactory.createFactory();
+                            cnxnFactory.configure(myNewQS.clientAddr, getMaxClientCnxns(), getClientPortListenBacklog(), false);
+                            cnxnFactory.start();
+                        } catch (IOException e) {
+                            throw new RuntimeException(e);
+                        }
+                    } else {
+                        cnxnFactory.reconfigure(myNewQS.clientAddr);
+                    }
+                }
+
+                if (myNewQS.secureClientAddr == null) {
+                    if (!isSecureClientAddrFromStatic && oldSecureClientAddr != null && secureCnxnFactory != null) {
+                        // secureClientAddr omitted in new config, shutdown secureCnxnFactory
+                         secureCnxnFactory.shutdown();
+                         secureCnxnFactory = null;
+                    }
+                } else if (!myNewQS.secureClientAddr.equals(oldSecureClientAddr)) {
+                    // secureClientAddr has changed
+                    if (secureCnxnFactory == null) {
+                        // start secureCnxnFactory first
+                        try {
+                            configureSSLAuth();
+                            secureCnxnFactory = ServerCnxnFactory.createFactory();
+                            secureCnxnFactory.configure(myNewQS.secureClientAddr, getMaxClientCnxns(), getClientPortListenBacklog(), true);
+                            secureCnxnFactory.start();
+
+                        } catch (IOException | ConfigException e) {
+                            throw new RuntimeException(e);
+                        }
+                    } else {
+                        secureCnxnFactory.reconfigure(myNewQS.secureClientAddr);
+                    }
+                }
+
                 updateThreadName();
             }
 
@@ -2212,16 +2463,16 @@ public boolean processReconfig(QuorumVerifier qv, Long suggestedLeaderId, Long z
     }
 
     private void updateRemotePeerMXBeans(Map<Long, QuorumServer> newMembers) {
-        Set<Long> existingMembers = new HashSet<Long>(newMembers.keySet());
+        Set<Long> existingMembers = new HashSet<>(newMembers.keySet());
         existingMembers.retainAll(jmxRemotePeerBean.keySet());
         for (Long id : existingMembers) {
             RemotePeerBean rBean = jmxRemotePeerBean.get(id);
             rBean.setQuorumServer(newMembers.get(id));
         }
 
-        Set<Long> joiningMembers = new HashSet<Long>(newMembers.keySet());
+        Set<Long> joiningMembers = new HashSet<>(newMembers.keySet());
         joiningMembers.removeAll(jmxRemotePeerBean.keySet());
-        joiningMembers.remove(getId()); // remove self as it is local bean
+        joiningMembers.remove(getMyId()); // remove self as it is local bean
         for (Long id : joiningMembers) {
             QuorumServer qs = newMembers.get(id);
             RemotePeerBean rBean = new RemotePeerBean(this, qs);
@@ -2233,7 +2484,7 @@ private void updateRemotePeerMXBeans(Map<Long, QuorumServer> newMembers) {
             }
         }
 
-        Set<Long> leavingMembers = new HashSet<Long>(jmxRemotePeerBean.keySet());
+        Set<Long> leavingMembers = new HashSet<>(jmxRemotePeerBean.keySet());
         leavingMembers.removeAll(newMembers.keySet());
         for (Long id : leavingMembers) {
             RemotePeerBean rBean = jmxRemotePeerBean.remove(id);
@@ -2334,7 +2585,7 @@ QuorumServer validateLearnerMaster(String desiredMaster) {
 
     private boolean updateLearnerType(QuorumVerifier newQV) {
         //check if I'm an observer in new config
-        if (newQV.getObservingMembers().containsKey(getId())) {
+        if (newQV.getObservingMembers().containsKey(getMyId())) {
             if (getLearnerType() != LearnerType.OBSERVER) {
                 setLearnerType(LearnerType.OBSERVER);
                 LOG.info("Becoming an observer");
@@ -2343,7 +2594,7 @@ private boolean updateLearnerType(QuorumVerifier newQV) {
             } else {
                 return false;
             }
-        } else if (newQV.getVotingMembers().containsKey(getId())) {
+        } else if (newQV.getVotingMembers().containsKey(getMyId())) {
             if (getLearnerType() != LearnerType.PARTICIPANT) {
                 setLearnerType(LearnerType.PARTICIPANT);
                 LOG.info("Becoming a voting participant");
@@ -2427,7 +2678,7 @@ private void updateThreadName() {
                     : "disabled"
                 : "disabled";
         String secure = secureCnxnFactory != null ? formatInetAddr(secureCnxnFactory.getLocalAddress()) : "disabled";
-        setName(String.format("QuorumPeer[myid=%d](plain=%s)(secure=%s)", getId(), plain, secure));
+        setName(String.format("QuorumPeer[myid=%d](plain=%s)(secure=%s)", getMyId(), plain, secure));
     }
 
     /**
@@ -2504,7 +2755,7 @@ public QuorumCnxManager createCnxnManager() {
         LOG.info("Using {}ms as the quorum cnxn socket timeout", timeout);
         return new QuorumCnxManager(
             this,
-            this.getId(),
+            this.getMyId(),
             this.getView(),
             this.authServer,
             this.authLearner,
@@ -2519,6 +2770,10 @@ boolean isLeader(long id) {
         return vote != null && id == vote.getId();
     }
 
+    public boolean isReconfigEnabled() {
+        return reconfigEnabled;
+    }
+
     @InterfaceAudience.Private
     /**
      * This is a metric that depends on the status of the peer.
@@ -2532,4 +2787,67 @@ boolean isLeader(long id) {
         }
     }
 
+    /**
+     * Create a new QuorumPeer and apply all the values per the already-parsed config.
+     *
+     * @param config The appertained quorum peer config.
+     * @return A QuorumPeer instantiated with specified peer config. Note this peer
+     *         is not fully initialized; caller should finish initialization through
+     *         additional configurations (connection factory settings, etc).
+     *
+     * @throws IOException
+     */
+    public static QuorumPeer createFromConfig(QuorumPeerConfig config) throws IOException {
+        QuorumPeer quorumPeer = new QuorumPeer();
+        quorumPeer.setTxnFactory(new FileTxnSnapLog(config.getDataLogDir(), config.getDataDir()));
+        quorumPeer.enableLocalSessions(config.areLocalSessionsEnabled());
+        quorumPeer.enableLocalSessionsUpgrading(config.isLocalSessionsUpgradingEnabled());
+        quorumPeer.setElectionType(config.getElectionAlg());
+        quorumPeer.setMyid(config.getServerId());
+        quorumPeer.setTickTime(config.getTickTime());
+        quorumPeer.setMinSessionTimeout(config.getMinSessionTimeout());
+        quorumPeer.setMaxSessionTimeout(config.getMaxSessionTimeout());
+        quorumPeer.setInitLimit(config.getInitLimit());
+        quorumPeer.setSyncLimit(config.getSyncLimit());
+        quorumPeer.setConnectToLearnerMasterLimit(config.getConnectToLearnerMasterLimit());
+        quorumPeer.setObserverMasterPort(config.getObserverMasterPort());
+        quorumPeer.setConfigFileName(config.getConfigFilename());
+        quorumPeer.setClientPortListenBacklog(config.getClientPortListenBacklog());
+        quorumPeer.setMaxClientCnxns(config.getMaxClientCnxns());
+        quorumPeer.setZKDatabase(new ZKDatabase(quorumPeer.getTxnFactory()));
+        quorumPeer.setQuorumVerifier(config.getQuorumVerifier(), false);
+        if (config.getLastSeenQuorumVerifier() != null) {
+            quorumPeer.setLastSeenQuorumVerifier(config.getLastSeenQuorumVerifier(), false);
+        }
+        quorumPeer.initConfigInZKDatabase();
+        quorumPeer.setSslQuorum(config.isSslQuorum());
+        quorumPeer.setUsePortUnification(config.shouldUsePortUnification());
+        quorumPeer.setLearnerType(config.getPeerType());
+        quorumPeer.setSyncEnabled(config.getSyncEnabled());
+        quorumPeer.setQuorumListenOnAllIPs(config.getQuorumListenOnAllIPs());
+        if (config.sslQuorumReloadCertFiles) {
+            quorumPeer.getX509Util().enableCertFileReloading();
+        }
+        quorumPeer.setMultiAddressEnabled(config.isMultiAddressEnabled());
+        quorumPeer.setMultiAddressReachabilityCheckEnabled(config.isMultiAddressReachabilityCheckEnabled());
+        quorumPeer.setMultiAddressReachabilityCheckTimeoutMs(config.getMultiAddressReachabilityCheckTimeoutMs());
+
+        // sets quorum sasl authentication configurations
+        quorumPeer.setQuorumSaslEnabled(config.quorumEnableSasl);
+        if (quorumPeer.isQuorumSaslAuthEnabled()) {
+            quorumPeer.setQuorumServerSaslRequired(config.quorumServerRequireSasl);
+            quorumPeer.setQuorumLearnerSaslRequired(config.quorumLearnerRequireSasl);
+            quorumPeer.setQuorumServicePrincipal(config.quorumServicePrincipal);
+            quorumPeer.setQuorumServerLoginContext(config.quorumServerLoginContext);
+            quorumPeer.setQuorumLearnerLoginContext(config.quorumLearnerLoginContext);
+        }
+        quorumPeer.setQuorumCnxnThreadsSize(config.quorumCnxnThreadsSize);
+
+        if (config.jvmPauseMonitorToRun) {
+            quorumPeer.setJvmPauseMonitor(new JvmPauseMonitor(config));
+        }
+
+        return quorumPeer;
+    }
+
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
index ae73ef35e0c..eb034527c2a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerConfig.java
@@ -42,15 +42,19 @@
 import org.apache.zookeeper.common.AtomicFileWritingIdiom.OutputStreamStatement;
 import org.apache.zookeeper.common.AtomicFileWritingIdiom.WriterStatement;
 import org.apache.zookeeper.common.ClientX509Util;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.common.PathUtils;
 import org.apache.zookeeper.common.StringUtils;
+import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.metrics.impl.DefaultMetricsProvider;
 import org.apache.zookeeper.server.ZooKeeperServer;
+import org.apache.zookeeper.server.auth.ProviderRegistry;
 import org.apache.zookeeper.server.quorum.QuorumPeer.LearnerType;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
 import org.apache.zookeeper.server.quorum.auth.QuorumAuth;
 import org.apache.zookeeper.server.quorum.flexible.QuorumHierarchical;
 import org.apache.zookeeper.server.quorum.flexible.QuorumMaj;
+import org.apache.zookeeper.server.quorum.flexible.QuorumOracleMaj;
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
 import org.apache.zookeeper.server.util.JvmPauseMonitor;
 import org.apache.zookeeper.server.util.VerifyingFileFactory;
@@ -102,7 +106,7 @@ public class QuorumPeerConfig {
 
     protected QuorumVerifier quorumVerifier = null, lastSeenQuorumVerifier = null;
     protected int snapRetainCount = 3;
-    protected int purgeInterval = 0;
+    protected int purgeIntervalInMs = 0;
     protected boolean syncEnabled = true;
 
     protected String initialConfig;
@@ -129,6 +133,8 @@ public class QuorumPeerConfig {
         Integer.parseInt(System.getProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_REACHABILITY_CHECK_TIMEOUT_MS,
                                             String.valueOf(MultipleAddresses.DEFAULT_TIMEOUT.toMillis())));
 
+    protected String oraclePath;
+
     /**
      * Minimum snapshot retain count.
      * @see org.apache.zookeeper.server.PurgeTxnLog#purge(File, File, int)
@@ -152,18 +158,6 @@ public class QuorumPeerConfig {
      */
     protected long jvmPauseSleepTimeMs = JvmPauseMonitor.SLEEP_TIME_MS_DEFAULT;
 
-    @SuppressWarnings("serial")
-    public static class ConfigException extends Exception {
-
-        public ConfigException(String msg) {
-            super(msg);
-        }
-        public ConfigException(String msg, Exception e) {
-            super(msg, e);
-        }
-
-    }
-
     /**
      * Parse a ZooKeeper configuration file
      * @param path the patch of the configuration file
@@ -179,12 +173,9 @@ public void parse(String path) throws ConfigException {
                 .build()).create(path);
 
             Properties cfg = new Properties();
-            FileInputStream in = new FileInputStream(configFile);
-            try {
+            try (FileInputStream in = new FileInputStream(configFile)) {
                 cfg.load(in);
                 configFileStr = path;
-            } finally {
-                in.close();
             }
 
             /* Read entire config file as initial configuration */
@@ -200,8 +191,7 @@ public void parse(String path) throws ConfigException {
         if (dynamicConfigFileStr != null) {
             try {
                 Properties dynamicCfg = new Properties();
-                FileInputStream inConfig = new FileInputStream(dynamicConfigFileStr);
-                try {
+                try (FileInputStream inConfig = new FileInputStream(dynamicConfigFileStr)) {
                     dynamicCfg.load(inConfig);
                     if (dynamicCfg.getProperty("version") != null) {
                         throw new ConfigException("dynamic file shouldn't have version inside");
@@ -213,8 +203,6 @@ public void parse(String path) throws ConfigException {
                     if (version != null) {
                         dynamicCfg.setProperty("version", version);
                     }
-                } finally {
-                    inConfig.close();
                 }
                 setupQuorumPeerConfig(dynamicCfg, false);
 
@@ -227,11 +215,8 @@ public void parse(String path) throws ConfigException {
             if (nextDynamicConfigFile.exists()) {
                 try {
                     Properties dynamicConfigNextCfg = new Properties();
-                    FileInputStream inConfigNext = new FileInputStream(nextDynamicConfigFile);
-                    try {
+                    try (FileInputStream inConfigNext = new FileInputStream(nextDynamicConfigFile)) {
                         dynamicConfigNextCfg.load(inConfigNext);
-                    } finally {
-                        inConfigNext.close();
                     }
                     boolean isHierarchical = false;
                     for (Entry<Object, Object> entry : dynamicConfigNextCfg.entrySet()) {
@@ -276,8 +261,8 @@ public static String getVersionFromFilename(String filename) {
      * @throws ConfigException
      */
     public void parseProperties(Properties zkProp) throws IOException, ConfigException {
-        int clientPort = 0;
-        int secureClientPort = 0;
+        Integer clientPort = null;
+        Integer secureClientPort = null;
         int observerMasterPort = 0;
         String clientPortAddress = null;
         String secureClientPortAddress = null;
@@ -292,9 +277,9 @@ public void parseProperties(Properties zkProp) throws IOException, ConfigExcepti
             } else if (key.equals("clientPort")) {
                 clientPort = Integer.parseInt(value);
             } else if (key.equals("localSessionsEnabled")) {
-                localSessionsEnabled = Boolean.parseBoolean(value);
+                localSessionsEnabled = parseBoolean(key, value);
             } else if (key.equals("localSessionsUpgradingEnabled")) {
-                localSessionsUpgradingEnabled = Boolean.parseBoolean(value);
+                localSessionsUpgradingEnabled = parseBoolean(key, value);
             } else if (key.equals("clientPortAddress")) {
                 clientPortAddress = value.trim();
             } else if (key.equals("secureClientPort")) {
@@ -325,7 +310,7 @@ public void parseProperties(Properties zkProp) throws IOException, ConfigExcepti
                     throw new ConfigException("Invalid electionAlg value. Only 3 is supported.");
                 }
             } else if (key.equals("quorumListenOnAllIPs")) {
-                quorumListenOnAllIPs = Boolean.parseBoolean(value);
+                quorumListenOnAllIPs = parseBoolean(key, value);
             } else if (key.equals("peerType")) {
                 if (value.toLowerCase().equals("observer")) {
                     peerType = LearnerType.OBSERVER;
@@ -335,48 +320,36 @@ public void parseProperties(Properties zkProp) throws IOException, ConfigExcepti
                     throw new ConfigException("Unrecognised peertype: " + value);
                 }
             } else if (key.equals("syncEnabled")) {
-                syncEnabled = Boolean.parseBoolean(value);
+                syncEnabled = parseBoolean(key, value);
             } else if (key.equals("dynamicConfigFile")) {
                 dynamicConfigFileStr = value;
             } else if (key.equals("autopurge.snapRetainCount")) {
                 snapRetainCount = Integer.parseInt(value);
             } else if (key.equals("autopurge.purgeInterval")) {
-                purgeInterval = Integer.parseInt(value);
-            } else if (key.equals("standaloneEnabled")) {
-                if (value.toLowerCase().equals("true")) {
-                    setStandaloneEnabled(true);
-                } else if (value.toLowerCase().equals("false")) {
-                    setStandaloneEnabled(false);
+                if (Character.isDigit(value.charAt(value.length() - 1))) {
+                    purgeIntervalInMs = Time.parseTimeInterval(value) * Time.HOUR; // default is hours for backward compatibility
                 } else {
-                    throw new ConfigException("Invalid option "
-                                              + value
-                                              + " for standalone mode. Choose 'true' or 'false.'");
+                    purgeIntervalInMs = Time.parseTimeInterval(value);
                 }
+            } else if (key.equals("standaloneEnabled")) {
+                setStandaloneEnabled(parseBoolean(key, value));
             } else if (key.equals("reconfigEnabled")) {
-                if (value.toLowerCase().equals("true")) {
-                    setReconfigEnabled(true);
-                } else if (value.toLowerCase().equals("false")) {
-                    setReconfigEnabled(false);
-                } else {
-                    throw new ConfigException("Invalid option "
-                                              + value
-                                              + " for reconfigEnabled flag. Choose 'true' or 'false.'");
-                }
+                setReconfigEnabled(parseBoolean(key, value));
             } else if (key.equals("sslQuorum")) {
-                sslQuorum = Boolean.parseBoolean(value);
+                sslQuorum = parseBoolean(key, value);
             } else if (key.equals("portUnification")) {
-                shouldUsePortUnification = Boolean.parseBoolean(value);
+                shouldUsePortUnification = parseBoolean(key, value);
             } else if (key.equals("sslQuorumReloadCertFiles")) {
-                sslQuorumReloadCertFiles = Boolean.parseBoolean(value);
+                sslQuorumReloadCertFiles = parseBoolean(key, value);
             } else if ((key.startsWith("server.") || key.startsWith("group") || key.startsWith("weight"))
                        && zkProp.containsKey("dynamicConfigFile")) {
                 throw new ConfigException("parameter: " + key + " must be in a separate dynamic config file");
             } else if (key.equals(QuorumAuth.QUORUM_SASL_AUTH_ENABLED)) {
-                quorumEnableSasl = Boolean.parseBoolean(value);
+                quorumEnableSasl = parseBoolean(key, value);
             } else if (key.equals(QuorumAuth.QUORUM_SERVER_SASL_AUTH_REQUIRED)) {
-                quorumServerRequireSasl = Boolean.parseBoolean(value);
+                quorumServerRequireSasl = parseBoolean(key, value);
             } else if (key.equals(QuorumAuth.QUORUM_LEARNER_SASL_AUTH_REQUIRED)) {
-                quorumLearnerRequireSasl = Boolean.parseBoolean(value);
+                quorumLearnerRequireSasl = parseBoolean(key, value);
             } else if (key.equals(QuorumAuth.QUORUM_LEARNER_SASL_LOGIN_CONTEXT)) {
                 quorumLearnerLoginContext = value;
             } else if (key.equals(QuorumAuth.QUORUM_SERVER_SASL_LOGIN_CONTEXT)) {
@@ -392,18 +365,20 @@ public void parseProperties(Properties zkProp) throws IOException, ConfigExcepti
             } else if (key.equals(JvmPauseMonitor.SLEEP_TIME_MS_KEY)) {
                 jvmPauseSleepTimeMs = Long.parseLong(value);
             } else if (key.equals(JvmPauseMonitor.JVM_PAUSE_MONITOR_FEATURE_SWITCH_KEY)) {
-                jvmPauseMonitorToRun = Boolean.parseBoolean(value);
+                jvmPauseMonitorToRun = parseBoolean(key, value);
             } else if (key.equals("metricsProvider.className")) {
                 metricsProviderClassName = value;
             } else if (key.startsWith("metricsProvider.")) {
                 String keyForMetricsProvider = key.substring(16);
                 metricsProviderConfiguration.put(keyForMetricsProvider, value);
             } else if (key.equals("multiAddress.enabled")) {
-                multiAddressEnabled = Boolean.parseBoolean(value);
+                multiAddressEnabled = parseBoolean(key, value);
             } else if (key.equals("multiAddress.reachabilityCheckTimeoutMs")) {
                 multiAddressReachabilityCheckTimeoutMs = Integer.parseInt(value);
             } else if (key.equals("multiAddress.reachabilityCheckEnabled")) {
-                multiAddressReachabilityCheckEnabled = Boolean.parseBoolean(value);
+                multiAddressReachabilityCheckEnabled = parseBoolean(key, value);
+            } else if (key.equals("oraclePath")) {
+                oraclePath = value;
             } else {
                 System.setProperty("zookeeper." + key, value);
             }
@@ -446,7 +421,7 @@ public void parseProperties(Properties zkProp) throws IOException, ConfigExcepti
             dataLogDir = dataDir;
         }
 
-        if (clientPort == 0) {
+        if (clientPort == null) {
             LOG.info("clientPort is not set");
             if (clientPortAddress != null) {
                 throw new IllegalArgumentException("clientPortAddress is set but clientPort is not set");
@@ -459,7 +434,7 @@ public void parseProperties(Properties zkProp) throws IOException, ConfigExcepti
             LOG.info("clientPortAddress is {}", formatInetAddr(this.clientPortAddress));
         }
 
-        if (secureClientPort == 0) {
+        if (secureClientPort == null) {
             LOG.info("secureClientPort is not set");
             if (secureClientPortAddress != null) {
                 throw new IllegalArgumentException("secureClientPortAddress is set but secureClientPort is not set");
@@ -521,11 +496,12 @@ public void parseProperties(Properties zkProp) throws IOException, ConfigExcepti
      */
     public static void configureSSLAuth() throws ConfigException {
         try (ClientX509Util clientX509Util = new ClientX509Util()) {
-            String sslAuthProp = "zookeeper.authProvider."
+            String sslAuthProp = ProviderRegistry.AUTHPROVIDER_PROPERTY_PREFIX
                                  + System.getProperty(clientX509Util.getSslAuthProviderProperty(), "x509");
             if (System.getProperty(sslAuthProp) == null) {
-                if ("zookeeper.authProvider.x509".equals(sslAuthProp)) {
-                    System.setProperty("zookeeper.authProvider.x509", "org.apache.zookeeper.server.auth.X509AuthenticationProvider");
+                if ((ProviderRegistry.AUTHPROVIDER_PROPERTY_PREFIX + "x509").equals(sslAuthProp)) {
+                    System.setProperty(ProviderRegistry.AUTHPROVIDER_PROPERTY_PREFIX + "x509",
+                        "org.apache.zookeeper.server.auth.X509AuthenticationProvider");
                 } else {
                     throw new ConfigException("No auth provider configured for the SSL authentication scheme '"
                                               + System.getProperty(clientX509Util.getSslAuthProviderProperty())
@@ -543,18 +519,12 @@ private void backupOldConfig() throws IOException {
         new AtomicFileWritingIdiom(new File(configFileStr + ".bak"), new OutputStreamStatement() {
             @Override
             public void write(OutputStream output) throws IOException {
-                InputStream input = null;
-                try {
-                    input = new FileInputStream(new File(configFileStr));
+                try (InputStream input = new FileInputStream(new File(configFileStr))) {
                     byte[] buf = new byte[1024];
                     int bytesRead;
                     while ((bytesRead = input.read(buf)) > 0) {
                         output.write(buf, 0, bytesRead);
                     }
-                } finally {
-                    if (input != null) {
-                        input.close();
-                    }
                 }
             }
         });
@@ -571,7 +541,7 @@ public void write(Writer out) throws IOException {
                 Properties cfg = new Properties();
                 cfg.load(new StringReader(qv.toString()));
 
-                List<String> servers = new ArrayList<String>();
+                List<String> servers = new ArrayList<>();
                 for (Entry<Object, Object> entry : cfg.entrySet()) {
                     String key = entry.getKey().toString().trim();
                     if (!needKeepVersion && key.startsWith("version")) {
@@ -594,9 +564,11 @@ public void write(Writer out) throws IOException {
      * it will remove them.
      * If it needs to erase client port information left by the old config,
      * "eraseClientPortAddress" should be set true.
+     * If it needs to erase secure client port information left by the old config,
+     * "eraseSecureClientPortAddress" should be set true.
      * It should also updates dynamic file pointer on reconfig.
      */
-    public static void editStaticConfig(final String configFileStr, final String dynamicFileStr, final boolean eraseClientPortAddress) throws IOException {
+    public static void editStaticConfig(final String configFileStr, final String dynamicFileStr, final boolean eraseClientPortAddress, final boolean eraseSecureClientPortAddress) throws IOException {
         // Some tests may not have a static config file.
         if (configFileStr == null) {
             return;
@@ -611,11 +583,8 @@ public static void editStaticConfig(final String configFileStr, final String dyn
             .build()).create(dynamicFileStr);
 
         final Properties cfg = new Properties();
-        FileInputStream in = new FileInputStream(configFile);
-        try {
+        try (FileInputStream in = new FileInputStream(configFile)) {
             cfg.load(in);
-        } finally {
-            in.close();
         }
 
         new AtomicFileWritingIdiom(new File(configFileStr), new WriterStatement() {
@@ -631,7 +600,10 @@ public void write(Writer out) throws IOException {
                         || key.startsWith("peerType")
                         || (eraseClientPortAddress
                             && (key.startsWith("clientPort")
-                                || key.startsWith("clientPortAddress")))) {
+                                || key.startsWith("clientPortAddress")))
+                        || (eraseSecureClientPortAddress
+                            && (key.startsWith("secureClientPort")
+                                || key.startsWith("secureClientPortAddress")))) {
                         // not writing them back to static file
                         continue;
                     }
@@ -661,6 +633,15 @@ public static void deleteFile(String filename) {
         }
     }
 
+
+    private static QuorumVerifier createQuorumVerifier(Properties dynamicConfigProp, boolean isHierarchical, String oraclePath) throws ConfigException {
+        if (oraclePath == null) {
+            return createQuorumVerifier(dynamicConfigProp, isHierarchical);
+        } else {
+            return new QuorumOracleMaj(dynamicConfigProp, oraclePath);
+        }
+    }
+
     private static QuorumVerifier createQuorumVerifier(Properties dynamicConfigProp, boolean isHierarchical) throws ConfigException {
         if (isHierarchical) {
             return new QuorumHierarchical(dynamicConfigProp);
@@ -674,9 +655,10 @@ private static QuorumVerifier createQuorumVerifier(Properties dynamicConfigProp,
     }
 
     void setupQuorumPeerConfig(Properties prop, boolean configBackwardCompatibilityMode) throws IOException, ConfigException {
-        quorumVerifier = parseDynamicConfig(prop, electionAlg, true, configBackwardCompatibilityMode);
+        quorumVerifier = parseDynamicConfig(prop, electionAlg, true, configBackwardCompatibilityMode, oraclePath);
         setupMyId();
         setupClientPort();
+        setupSecureClientPort();
         setupPeerType();
         checkValidity();
     }
@@ -688,7 +670,7 @@ void setupQuorumPeerConfig(Properties prop, boolean configBackwardCompatibilityM
      * @throws IOException
      * @throws ConfigException
      */
-    public static QuorumVerifier parseDynamicConfig(Properties dynamicConfigProp, int eAlg, boolean warnings, boolean configBackwardCompatibilityMode) throws IOException, ConfigException {
+    public static QuorumVerifier parseDynamicConfig(Properties dynamicConfigProp, int eAlg, boolean warnings, boolean configBackwardCompatibilityMode, String oraclePath) throws IOException, ConfigException {
         boolean isHierarchical = false;
         for (Entry<Object, Object> entry : dynamicConfigProp.entrySet()) {
             String key = entry.getKey().toString().trim();
@@ -700,7 +682,7 @@ public static QuorumVerifier parseDynamicConfig(Properties dynamicConfigProp, in
             }
         }
 
-        QuorumVerifier qv = createQuorumVerifier(dynamicConfigProp, isHierarchical);
+        QuorumVerifier qv = createQuorumVerifier(dynamicConfigProp, isHierarchical, oraclePath);
 
         int numParticipators = qv.getVotingMembers().size();
         int numObservers = qv.getObservingMembers().size();
@@ -726,7 +708,7 @@ public static QuorumVerifier parseDynamicConfig(Properties dynamicConfigProp, in
                 if (numParticipators <= 2) {
                     LOG.warn("No server failure will be tolerated. You need at least 3 servers.");
                 } else if (numParticipators % 2 == 0) {
-                    LOG.warn("Non-optimial configuration, consider an odd number of servers.");
+                    LOG.warn("Non-optimal configuration, consider an odd number of servers.");
                 }
             }
 
@@ -783,6 +765,29 @@ private void setupClientPort() throws ConfigException {
         }
     }
 
+    private void setupSecureClientPort() throws ConfigException {
+        if (serverId == UNSET_SERVERID) {
+            return;
+        }
+        QuorumServer qs = quorumVerifier.getAllMembers().get(serverId);
+        if (secureClientPortAddress != null && qs != null && qs.secureClientAddr != null) {
+            if ((!secureClientPortAddress.getAddress().isAnyLocalAddress() && !secureClientPortAddress.equals(qs.secureClientAddr)) || (
+                secureClientPortAddress.getAddress().isAnyLocalAddress()
+                    && secureClientPortAddress.getPort() != qs.secureClientAddr.getPort())) {
+                throw new ConfigException("secure client address for this server (id = " + serverId
+                    + ") in static config file is " + secureClientPortAddress
+                    + " is different from secure client address found in dynamic file: " + qs.secureClientAddr);
+            }
+        }
+        if (qs != null && qs.secureClientAddr != null) {
+            secureClientPortAddress = qs.secureClientAddr;
+        }
+        if (qs != null && qs.secureClientAddr == null) {
+            qs.secureClientAddr = secureClientPortAddress;
+            qs.isSecureClientAddrFromStatic = true;
+        }
+    }
+
     private void setupPeerType() {
         // Warn about inconsistent peer type
         LearnerType roleByServersList = quorumVerifier.getObservingMembers().containsKey(serverId)
@@ -887,8 +892,18 @@ public int getSnapRetainCount() {
         return snapRetainCount;
     }
 
+    /**
+     * Use {@link #getPurgeIntervalInMs()} instead.
+     *
+     * @return purge interval in hour unit or 0 if less than one hour.
+     */
+    @Deprecated
     public int getPurgeInterval() {
-        return purgeInterval;
+        return purgeIntervalInMs / Time.HOUR;
+    }
+
+    public int getPurgeIntervalInMs() {
+        return purgeIntervalInMs;
     }
 
     public boolean getSyncEnabled() {
@@ -969,4 +984,17 @@ public static void setReconfigEnabled(boolean enabled) {
         reconfigEnabled = enabled;
     }
 
+    private boolean parseBoolean(String key, String value) throws ConfigException {
+        if (value.equalsIgnoreCase("true")) {
+            return true;
+        } else if (value.equalsIgnoreCase("false")) {
+            return false;
+        } else {
+            throw new ConfigException("Invalid option "
+                                      + value
+                                      + " for "
+                                      + key
+                                      + ". Choose 'true' or 'false.'");
+        }
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java
index a6f94ec3bd1..c126ea2e290 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumPeerMain.java
@@ -23,6 +23,7 @@
 import javax.security.sasl.SaslException;
 import org.apache.yetus.audience.InterfaceAudience;
 import org.apache.zookeeper.audit.ZKAuditProvider;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.jmx.ManagedUtil;
 import org.apache.zookeeper.metrics.MetricsProvider;
 import org.apache.zookeeper.metrics.MetricsProviderLifeCycleException;
@@ -34,9 +35,9 @@
 import org.apache.zookeeper.server.ZKDatabase;
 import org.apache.zookeeper.server.ZooKeeperServerMain;
 import org.apache.zookeeper.server.admin.AdminServer.AdminServerException;
+import org.apache.zookeeper.server.auth.ProviderRegistry;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog.DatadirException;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
 import org.apache.zookeeper.server.util.JvmPauseMonitor;
 import org.apache.zookeeper.util.ServiceUtils;
 import org.slf4j.Logger;
@@ -124,12 +125,12 @@ protected void initializeAndRun(String[] args) throws ConfigException, IOExcepti
             config.parse(args[0]);
         }
 
-        // Start and schedule the the purge task
+        // Start and schedule the purge task
         DatadirCleanupManager purgeMgr = new DatadirCleanupManager(
             config.getDataDir(),
             config.getDataLogDir(),
             config.getSnapRetainCount(),
-            config.getPurgeInterval());
+            config.getPurgeIntervalInMs());
         purgeMgr.start();
 
         if (args.length == 1 && config.isDistributed()) {
@@ -148,8 +149,8 @@ public void runFromConfig(QuorumPeerConfig config) throws IOException, AdminServ
             LOG.warn("Unable to register log4j JMX control", e);
         }
 
-        LOG.info("Starting quorum peer");
-        MetricsProvider metricsProvider;
+        LOG.info("Starting quorum peer, myid=" + config.getServerId());
+        final MetricsProvider metricsProvider;
         try {
             metricsProvider = MetricsProviderBootstrap.startMetricsProvider(
                 config.getMetricsProviderClassName(),
@@ -159,6 +160,7 @@ public void runFromConfig(QuorumPeerConfig config) throws IOException, AdminServ
         }
         try {
             ServerMetrics.metricsProviderInitialized(metricsProvider);
+            ProviderRegistry.initialize();
             ServerCnxnFactory cnxnFactory = null;
             ServerCnxnFactory secureCnxnFactory = null;
 
@@ -188,6 +190,7 @@ public void runFromConfig(QuorumPeerConfig config) throws IOException, AdminServ
             quorumPeer.setObserverMasterPort(config.getObserverMasterPort());
             quorumPeer.setConfigFileName(config.getConfigFilename());
             quorumPeer.setClientPortListenBacklog(config.getClientPortListenBacklog());
+            quorumPeer.setMaxClientCnxns(config.getMaxClientCnxns());
             quorumPeer.setZKDatabase(new ZKDatabase(quorumPeer.getTxnFactory()));
             quorumPeer.setQuorumVerifier(config.getQuorumVerifier(), false);
             if (config.getLastSeenQuorumVerifier() != null) {
@@ -231,12 +234,10 @@ public void runFromConfig(QuorumPeerConfig config) throws IOException, AdminServ
             // warn, but generally this is ok
             LOG.warn("Quorum Peer interrupted", e);
         } finally {
-            if (metricsProvider != null) {
-                try {
-                    metricsProvider.stop();
-                } catch (Throwable error) {
-                    LOG.warn("Error while stopping metrics", error);
-                }
+            try {
+                metricsProvider.stop();
+            } catch (Throwable error) {
+                LOG.warn("Error while stopping metrics", error);
             }
         }
     }
@@ -246,4 +247,23 @@ protected QuorumPeer getQuorumPeer() throws SaslException {
         return new QuorumPeer();
     }
 
+    /**
+     * Shutdowns properly the service, this method is not a public API.
+     */
+    public void close() {
+        if (quorumPeer != null) {
+            try {
+                quorumPeer.shutdown();
+            } finally {
+                quorumPeer = null;
+            }
+        }
+    }
+
+    @Override
+    public String toString() {
+        QuorumPeer peer = quorumPeer;
+        return peer == null ? "" : peer.toString();
+    }
+
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumZooKeeperServer.java
index c6cd93b4d18..240936956fc 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/QuorumZooKeeperServer.java
@@ -20,7 +20,6 @@
 
 import java.io.IOException;
 import java.io.PrintWriter;
-import java.nio.ByteBuffer;
 import java.util.Objects;
 import java.util.function.BiConsumer;
 import java.util.stream.Collectors;
@@ -31,12 +30,13 @@
 import org.apache.zookeeper.ZooDefs.OpCode;
 import org.apache.zookeeper.metrics.MetricsContext;
 import org.apache.zookeeper.proto.CreateRequest;
-import org.apache.zookeeper.server.ByteBufferInputStream;
 import org.apache.zookeeper.server.Request;
+import org.apache.zookeeper.server.RequestRecord;
 import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.server.ZKDatabase;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
+import org.apache.zookeeper.txn.CreateSessionTxn;
 
 /**
  * Abstract base class for all ZooKeeperServers that participate in
@@ -49,7 +49,8 @@ public abstract class QuorumZooKeeperServer extends ZooKeeperServer {
 
     protected QuorumZooKeeperServer(FileTxnSnapLog logFactory, int tickTime, int minSessionTimeout,
                                     int maxSessionTimeout, int listenBacklog, ZKDatabase zkDb, QuorumPeer self) {
-        super(logFactory, tickTime, minSessionTimeout, maxSessionTimeout, listenBacklog, zkDb, self.getInitialConfig());
+        super(logFactory, tickTime, minSessionTimeout, maxSessionTimeout, listenBacklog, zkDb, self.getInitialConfig(),
+              self.isReconfigEnabled());
         this.self = self;
     }
 
@@ -60,6 +61,10 @@ protected void startSessionTracker() {
     }
 
     public Request checkUpgradeSession(Request request) throws IOException, KeeperException {
+        if (request.isThrottled()) {
+            return null;
+        }
+
         // If this is a request for a local session and it is to
         // create an ephemeral node, then upgrade the session and return
         // a new session request for the leader.
@@ -72,10 +77,7 @@ public Request checkUpgradeSession(Request request) throws IOException, KeeperEx
         }
 
         if (OpCode.multi == request.type) {
-            MultiOperationRecord multiTransactionRecord = new MultiOperationRecord();
-            request.request.rewind();
-            ByteBufferInputStream.byteBuffer2Record(request.request, multiTransactionRecord);
-            request.request.rewind();
+            MultiOperationRecord multiTransactionRecord = request.readRequestRecord(MultiOperationRecord::new);
             boolean containsEphemeralCreate = false;
             for (Op op : multiTransactionRecord) {
                 if (op.getType() == OpCode.create || op.getType() == OpCode.create2) {
@@ -91,10 +93,7 @@ public Request checkUpgradeSession(Request request) throws IOException, KeeperEx
                 return null;
             }
         } else {
-            CreateRequest createRequest = new CreateRequest();
-            request.request.rewind();
-            ByteBufferInputStream.byteBuffer2Record(request.request, createRequest);
-            request.request.rewind();
+            CreateRequest createRequest = request.readRequestRecord(CreateRequest::new);
             CreateMode createMode = CreateMode.fromFlag(createRequest.getFlags());
             if (!createMode.isEphemeral()) {
                 return null;
@@ -116,9 +115,8 @@ private Request makeUpgradeRequest(long sessionId) {
         synchronized (upgradeableSessionTracker) {
             if (upgradeableSessionTracker.isLocalSession(sessionId)) {
                 int timeout = upgradeableSessionTracker.upgradeSession(sessionId);
-                ByteBuffer to = ByteBuffer.allocate(4);
-                to.putInt(timeout);
-                return new Request(null, sessionId, 0, OpCode.createSession, to, null);
+                CreateSessionTxn txn = new CreateSessionTxn(timeout);
+                return new Request(null, sessionId, 0, OpCode.createSession, RequestRecord.fromRecord(txn), null);
             }
         }
         return null;
@@ -181,7 +179,7 @@ public void dumpConf(PrintWriter pwriter) {
         pwriter.print("peerType=");
         pwriter.println(self.getLearnerType().ordinal());
         pwriter.println("membership: ");
-        pwriter.print(new String(self.getQuorumVerifier().toString().getBytes()));
+        pwriter.print(self.getQuorumVerifier().toString());
     }
 
     @Override
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyRequestProcessor.java
index c50dd539f4e..671d328ff43 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyRequestProcessor.java
@@ -41,9 +41,9 @@ public class ReadOnlyRequestProcessor extends ZooKeeperCriticalThread implements
 
     private static final Logger LOG = LoggerFactory.getLogger(ReadOnlyRequestProcessor.class);
 
-    private final LinkedBlockingQueue<Request> queuedRequests = new LinkedBlockingQueue<Request>();
+    private final LinkedBlockingQueue<Request> queuedRequests = new LinkedBlockingQueue<>();
 
-    private boolean finished = false;
+    private volatile boolean finished = false;
 
     private final RequestProcessor nextProcessor;
 
@@ -61,11 +61,11 @@ public void run() {
                 Request request = queuedRequests.take();
 
                 // log request
-                long traceMask = ZooTrace.CLIENT_REQUEST_TRACE_MASK;
-                if (request.type == OpCode.ping) {
-                    traceMask = ZooTrace.CLIENT_PING_TRACE_MASK;
-                }
                 if (LOG.isTraceEnabled()) {
+                    long traceMask = ZooTrace.CLIENT_REQUEST_TRACE_MASK;
+                    if (request.type == OpCode.ping) {
+                        traceMask = ZooTrace.CLIENT_PING_TRACE_MASK;
+                    }
                     ZooTrace.logRequest(LOG, traceMask, 'R', request, "");
                 }
                 if (Request.requestOfDeath == request) {
@@ -86,16 +86,14 @@ public void run() {
                 case OpCode.setACL:
                 case OpCode.multi:
                 case OpCode.check:
-                    ReplyHeader hdr = new ReplyHeader(
-                        request.cxid,
-                        zks.getZKDatabase().getDataTreeLastProcessedZxid(),
-                        Code.NOTREADONLY.intValue());
-                    try {
-                        request.cnxn.sendResponse(hdr, null, null);
-                    } catch (IOException e) {
-                        LOG.error("IO exception while sending response", e);
-                    }
+                    sendErrorResponse(request);
                     continue;
+                case OpCode.closeSession:
+                case OpCode.createSession:
+                    if (!request.isLocalSession()) {
+                        sendErrorResponse(request);
+                        continue;
+                    }
                 }
 
                 // proceed to the next processor
@@ -109,6 +107,18 @@ public void run() {
         LOG.info("ReadOnlyRequestProcessor exited loop!");
     }
 
+    private void sendErrorResponse(Request request) {
+        ReplyHeader hdr = new ReplyHeader(
+                request.cxid,
+                zks.getZKDatabase().getDataTreeLastProcessedZxid(),
+                Code.NOTREADONLY.intValue());
+        try {
+            request.cnxn.sendResponse(hdr, null, null);
+        } catch (IOException e) {
+            LOG.error("IO exception while sending response", e);
+        }
+    }
+
     @Override
     public void processRequest(Request request) {
         if (!finished) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServer.java
index b1a72c4e972..7e9ff925251 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServer.java
@@ -18,14 +18,18 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import java.io.IOException;
 import java.io.PrintWriter;
 import java.util.Objects;
 import java.util.stream.Collectors;
+import org.apache.zookeeper.ZooDefs.OpCode;
 import org.apache.zookeeper.jmx.MBeanRegistry;
 import org.apache.zookeeper.server.DataTreeBean;
 import org.apache.zookeeper.server.FinalRequestProcessor;
 import org.apache.zookeeper.server.PrepRequestProcessor;
+import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.RequestProcessor;
+import org.apache.zookeeper.server.ServerCnxn;
 import org.apache.zookeeper.server.ZKDatabase;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.ZooKeeperServerBean;
@@ -52,7 +56,8 @@ public class ReadOnlyZooKeeperServer extends ZooKeeperServer {
             self.maxSessionTimeout,
             self.clientPortListenBacklog,
             zkDb,
-            self.getInitialConfig());
+            self.getInitialConfig(),
+            self.isReconfigEnabled());
         this.self = self;
     }
 
@@ -79,6 +84,49 @@ public synchronized void startup() {
         LOG.info("Read-only server started");
     }
 
+    @Override
+    public void createSessionTracker() {
+        sessionTracker = new LearnerSessionTracker(
+                this, getZKDatabase().getSessionWithTimeOuts(),
+                this.tickTime, self.getMyId(), self.areLocalSessionsEnabled(),
+                getZooKeeperServerListener());
+    }
+
+    @Override
+    protected void startSessionTracker() {
+        ((LearnerSessionTracker) sessionTracker).start();
+    }
+
+    @Override
+    protected void setLocalSessionFlag(Request si) {
+        switch (si.type) {
+            case OpCode.createSession:
+                if (self.areLocalSessionsEnabled()) {
+                    si.setLocalSession(true);
+                }
+                break;
+            case OpCode.closeSession:
+                if (((UpgradeableSessionTracker) sessionTracker).isLocalSession(si.sessionId)) {
+                    si.setLocalSession(true);
+                } else {
+                    LOG.warn("Submitting global closeSession request for session 0x{} in ReadOnly mode",
+                            Long.toHexString(si.sessionId));
+                }
+                break;
+            default:
+                break;
+        }
+    }
+
+    @Override
+    protected void validateSession(ServerCnxn cnxn, long sessionId) throws IOException {
+        if (((LearnerSessionTracker) sessionTracker).isGlobalSession(sessionId)) {
+            String msg = "Refusing global session reconnection in RO mode " + cnxn.getRemoteSocketAddress();
+            LOG.info(msg);
+            throw new ServerCnxn.CloseRequestException(msg, ServerCnxn.DisconnectReason.RENEW_GLOBAL_SESSION_IN_RO_MODE);
+        }
+    }
+
     @Override
     protected void registerJMX() {
         // register with JMX
@@ -138,15 +186,11 @@ public String getState() {
      */
     @Override
     public long getServerId() {
-        return self.getId();
+        return self.getMyId();
     }
 
     @Override
-    public synchronized void shutdown() {
-        if (!canShutdown()) {
-            LOG.debug("ZooKeeper server is not running, so not proceeding to shutdown!");
-            return;
-        }
+    protected void shutdownComponents() {
         shutdown = true;
         unregisterJMX(this);
 
@@ -158,7 +202,7 @@ public synchronized void shutdown() {
         self.adminServer.setZooKeeperServer(null);
 
         // shutdown the server itself
-        super.shutdown();
+        super.shutdownComponents();
     }
 
     @Override
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/RemotePeerBean.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/RemotePeerBean.java
index 2d9d7d3dd65..522ba3ad345 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/RemotePeerBean.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/RemotePeerBean.java
@@ -18,7 +18,9 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static org.apache.zookeeper.common.NetUtils.formatInetAddr;
 import java.util.stream.Collectors;
+import org.apache.zookeeper.common.NetUtils;
 import org.apache.zookeeper.jmx.ZKMBeanInfo;
 
 /**
@@ -47,22 +49,20 @@ public boolean isHidden() {
     }
 
     public String getQuorumAddress() {
-        return peer.addr.getAllAddresses().stream()
-                .map(address -> String.format("%s:%d", address.getHostString(), address.getPort()))
-                .collect(Collectors.joining("|"));
+        return peer.addr.getAllAddresses().stream().map(NetUtils::formatInetAddr)
+            .collect(Collectors.joining("|"));
     }
 
     public String getElectionAddress() {
-        return peer.electionAddr.getAllAddresses().stream()
-                .map(address -> String.format("%s:%d", address.getHostString(), address.getPort()))
-                .collect(Collectors.joining("|"));
+        return peer.electionAddr.getAllAddresses().stream().map(NetUtils::formatInetAddr)
+            .collect(Collectors.joining("|"));
     }
 
     public String getClientAddress() {
         if (null == peer.clientAddr) {
             return "";
         }
-        return peer.clientAddr.getHostString() + ":" + peer.clientAddr.getPort();
+        return formatInetAddr(peer.clientAddr);
     }
 
     public String getLearnerType() {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/SendAckRequestProcessor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/SendAckRequestProcessor.java
index 8218ddae4ae..3f42c2bd30f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/SendAckRequestProcessor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/SendAckRequestProcessor.java
@@ -46,14 +46,7 @@ public void processRequest(Request si) {
                 learner.writePacket(qp, false);
             } catch (IOException e) {
                 LOG.warn("Closing connection to leader, exception during packet send", e);
-                try {
-                    if (!learner.sock.isClosed()) {
-                        learner.sock.close();
-                    }
-                } catch (IOException e1) {
-                    // Nothing to do, we are shutting things down, so an exception here is irrelevant
-                    LOG.debug("Ignoring error closing the connection", e1);
-                }
+                learner.closeSocket();
             }
         }
     }
@@ -63,14 +56,7 @@ public void flush() throws IOException {
             learner.writePacket(null, true);
         } catch (IOException e) {
             LOG.warn("Closing connection to leader, exception during packet send", e);
-            try {
-                if (!learner.sock.isClosed()) {
-                    learner.sock.close();
-                }
-            } catch (IOException e1) {
-                // Nothing to do, we are shutting things down, so an exception here is irrelevant
-                LOG.debug("Ignoring error closing the connection", e1);
-            }
+            learner.closeSocket();
         }
     }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/SyncedLearnerTracker.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/SyncedLearnerTracker.java
index 461f46a0827..88260764328 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/SyncedLearnerTracker.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/SyncedLearnerTracker.java
@@ -24,7 +24,7 @@
 
 public class SyncedLearnerTracker {
 
-    protected ArrayList<QuorumVerifierAcksetPair> qvAcksetPairs = new ArrayList<QuorumVerifierAcksetPair>();
+    protected ArrayList<QuorumVerifierAcksetPair> qvAcksetPairs = new ArrayList<>();
 
     public void addQuorumVerifier(QuorumVerifier qv) {
         qvAcksetPairs.add(new QuorumVerifierAcksetPair(qv, new HashSet<Long>(qv.getVotingMembers().size())));
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/UnifiedServerSocket.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/UnifiedServerSocket.java
index 387a6c7d765..c101e9e2dc5 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/UnifiedServerSocket.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/UnifiedServerSocket.java
@@ -255,7 +255,7 @@ private void detectMode() throws IOException {
                 bytesRead = 0;
             }
 
-            if (bytesRead == litmus.length && SslHandler.isEncrypted(Unpooled.wrappedBuffer(litmus))) {
+            if (bytesRead == litmus.length && SslHandler.isEncrypted(Unpooled.wrappedBuffer(litmus), false)) {
                 try {
                     sslSocket = x509Util.createSSLSocket(prependableSocket, litmus);
                 } catch (X509Exception e) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/UpgradeableSessionTracker.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/UpgradeableSessionTracker.java
index 69dfd47a0e5..66dfcbae7f3 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/UpgradeableSessionTracker.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/UpgradeableSessionTracker.java
@@ -18,6 +18,8 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import java.util.Collections;
+import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentMap;
 import org.apache.zookeeper.KeeperException;
@@ -42,9 +44,9 @@ public void start() {
     }
 
     public void createLocalSessionTracker(SessionExpirer expirer, int tickTime, long id, ZooKeeperServerListener listener) {
-        this.localSessionsWithTimeouts = new ConcurrentHashMap<Long, Integer>();
+        this.localSessionsWithTimeouts = new ConcurrentHashMap<>();
         this.localSessionTracker = new LocalSessionTracker(expirer, this.localSessionsWithTimeouts, tickTime, id, listener);
-        this.upgradingSessions = new ConcurrentHashMap<Long, Integer>();
+        this.upgradingSessions = new ConcurrentHashMap<>();
     }
 
     public boolean isTrackingSession(long sessionId) {
@@ -111,7 +113,8 @@ protected void removeLocalSession(long sessionId) {
         localSessionTracker.removeSession(sessionId);
     }
 
-    public void checkGlobalSession(long sessionId, Object owner) throws KeeperException.SessionExpiredException, KeeperException.SessionMovedException {
+    public void checkGlobalSession(long sessionId, Object owner)
+        throws KeeperException.SessionExpiredException, KeeperException.SessionMovedException {
         throw new UnsupportedOperationException();
     }
 
@@ -122,4 +125,8 @@ public long getLocalSessionCount() {
         return localSessionsWithTimeouts.size();
     }
 
+    public Set<Long> localSessions() {
+        return (localSessionTracker == null) ? Collections.<Long>emptySet()
+            : localSessionTracker.localSessions();
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumAuthLearner.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumAuthLearner.java
index 12cec788a65..3151a57567d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumAuthLearner.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumAuthLearner.java
@@ -25,7 +25,9 @@
 import java.net.Socket;
 import java.security.PrivilegedActionException;
 import java.security.PrivilegedExceptionAction;
+import java.util.function.Supplier;
 import javax.security.auth.Subject;
+import javax.security.auth.callback.CallbackHandler;
 import javax.security.auth.login.AppConfigurationEntry;
 import javax.security.auth.login.Configuration;
 import javax.security.auth.login.LoginException;
@@ -62,9 +64,13 @@ public SaslQuorumAuthLearner(
                     "SASL-authentication failed because the specified JAAS configuration section '%s' could not be found.",
                     loginContext));
             }
+
+            Supplier<CallbackHandler> callbackSupplier = () -> {
+                return new SaslClientCallbackHandler(null, "QuorumLearner");
+            };
             this.learnerLogin = new Login(
                 loginContext,
-                new SaslClientCallbackHandler(null, "QuorumLearner"),
+                callbackSupplier,
                 new ZKConfig());
             this.learnerLogin.startThreadIfNeeded();
         } catch (LoginException e) {
@@ -88,6 +94,7 @@ public void authenticate(Socket sock, String hostName) throws IOException {
             DataInputStream din = new DataInputStream(sock.getInputStream());
             byte[] responseToken = new byte[0];
             sc = SecurityUtils.createSaslClient(
+                new ZKConfig(),
                 learnerLogin.getSubject(),
                 principalConfig,
                 QuorumAuth.QUORUM_SERVER_PROTOCOL_NAME,
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumAuthServer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumAuthServer.java
index 9b5f48c3b88..ca651115d0a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumAuthServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumAuthServer.java
@@ -24,6 +24,8 @@
 import java.io.IOException;
 import java.net.Socket;
 import java.util.Set;
+import java.util.function.Supplier;
+import javax.security.auth.callback.CallbackHandler;
 import javax.security.auth.login.AppConfigurationEntry;
 import javax.security.auth.login.Configuration;
 import javax.security.auth.login.LoginException;
@@ -45,6 +47,7 @@ public class SaslQuorumAuthServer implements QuorumAuthServer {
     private static final int MAX_RETRIES = 5;
     private final Login serverLogin;
     private final boolean quorumRequireSasl;
+    private final ZKConfig zkConfig;
 
     public SaslQuorumAuthServer(boolean quorumRequireSasl, String loginContext, Set<String> authzHosts) throws SaslException {
         this.quorumRequireSasl = quorumRequireSasl;
@@ -55,9 +58,11 @@ public SaslQuorumAuthServer(boolean quorumRequireSasl, String loginContext, Set<
                     "SASL-authentication failed because the specified JAAS configuration section '%s' could not be found.",
                     loginContext));
             }
-            SaslQuorumServerCallbackHandler saslServerCallbackHandler = new SaslQuorumServerCallbackHandler(
-                Configuration.getConfiguration(), loginContext, authzHosts);
-            serverLogin = new Login(loginContext, saslServerCallbackHandler, new ZKConfig());
+            Supplier<CallbackHandler> callbackSupplier = () -> {
+                return new SaslQuorumServerCallbackHandler(entries, authzHosts);
+            };
+            zkConfig = new ZKConfig();
+            serverLogin = new Login(loginContext, callbackSupplier, zkConfig);
             serverLogin.startThreadIfNeeded();
         } catch (Throwable e) {
             throw new SaslException("Failed to initialize authentication mechanism using SASL", e);
@@ -83,11 +88,15 @@ public void authenticate(Socket sock, DataInputStream din) throws SaslException
             dout = new DataOutputStream(sock.getOutputStream());
             byte[] challenge = null;
             ss = SecurityUtils.createSaslServer(
+                zkConfig,
                 serverLogin.getSubject(),
                 QuorumAuth.QUORUM_SERVER_PROTOCOL_NAME,
                 QuorumAuth.QUORUM_SERVER_SASL_DIGEST,
-                serverLogin.callbackHandler,
+                serverLogin.newCallbackHandler(),
                 LOG);
+            if (ss == null) {
+                throw new SaslException("Failed to create SaslServer (FIPS mode may be blocking DIGEST-MD5)");
+            }
             while (!ss.isComplete()) {
                 challenge = ss.evaluateResponse(token);
                 if (!ss.isComplete()) {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumServerCallbackHandler.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumServerCallbackHandler.java
index 4b711a6b5f7..e17c16f89cb 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumServerCallbackHandler.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/SaslQuorumServerCallbackHandler.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.server.quorum.auth;
 
-import java.io.IOException;
+import java.util.Collections;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Set;
@@ -28,9 +28,9 @@
 import javax.security.auth.callback.PasswordCallback;
 import javax.security.auth.callback.UnsupportedCallbackException;
 import javax.security.auth.login.AppConfigurationEntry;
-import javax.security.auth.login.Configuration;
 import javax.security.sasl.AuthorizeCallback;
 import javax.security.sasl.RealmCallback;
+import org.apache.zookeeper.server.auth.DigestLoginModule;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -46,34 +46,42 @@ public class SaslQuorumServerCallbackHandler implements CallbackHandler {
     private static final Logger LOG = LoggerFactory.getLogger(SaslQuorumServerCallbackHandler.class);
 
     private String userName;
-    private final Map<String, String> credentials = new HashMap<>();
+    private final boolean isDigestAuthn;
+    private final Map<String, String> credentials;
     private final Set<String> authzHosts;
 
     public SaslQuorumServerCallbackHandler(
-        Configuration configuration,
-        String serverSection,
-        Set<String> authzHosts) throws IOException {
-        AppConfigurationEntry[] configurationEntries = configuration.getAppConfigurationEntry(serverSection);
-
-        if (configurationEntries == null) {
-            String errorMessage = "Could not find a '" + serverSection + "' entry in this configuration: Server cannot start.";
-            LOG.error(errorMessage);
-            throw new IOException(errorMessage);
-        }
-        credentials.clear();
+        AppConfigurationEntry[] configurationEntries,
+        Set<String> authzHosts) {
+
+        Map<String, String> credentials = new HashMap<>();
+        boolean isDigestAuthn = true;
+
         for (AppConfigurationEntry entry : configurationEntries) {
-            Map<String, ?> options = entry.getOptions();
-            // Populate DIGEST-MD5 user -> password map with JAAS configuration entries from the "QuorumServer" section.
-            // Usernames are distinguished from other options by prefixing the username with a "user_" prefix.
-            for (Map.Entry<String, ?> pair : options.entrySet()) {
-                String key = pair.getKey();
-                if (key.startsWith(USER_PREFIX)) {
-                    String userName = key.substring(USER_PREFIX.length());
-                    credentials.put(userName, (String) pair.getValue());
+            if (entry.getLoginModuleName().equals(DigestLoginModule.class.getName())) {
+                Map<String, ?> options = entry.getOptions();
+                // Populate DIGEST-MD5 user -> password map with JAAS configuration entries from the "QuorumServer" section.
+                // Usernames are distinguished from other options by prefixing the username with a "user_" prefix.
+                for (Map.Entry<String, ?> pair : options.entrySet()) {
+                    String key = pair.getKey();
+                    if (key.startsWith(USER_PREFIX)) {
+                        String userName = key.substring(USER_PREFIX.length());
+                        credentials.put(userName, (String) pair.getValue());
+                    }
                 }
+            } else {
+                isDigestAuthn = false;
             }
         }
 
+        this.isDigestAuthn = isDigestAuthn;
+        if (isDigestAuthn) {
+            this.credentials = Collections.unmodifiableMap(credentials);
+            LOG.warn("Using DIGEST-MD5 for quorum authorization");
+        } else {
+            this.credentials = Collections.emptyMap();
+        }
+
         // authorized host lists
         this.authzHosts = authzHosts;
     }
@@ -126,13 +134,15 @@ private void handleAuthorizeCallback(AuthorizeCallback ac) {
         // 2. Verify whether the connecting host is present in authorized hosts.
         // If not exists, then connecting peer is not authorized to join the
         // ensemble and will reject it.
-        if (authzFlag) {
+        if (!isDigestAuthn && authzFlag) {
             String[] components = authorizationID.split("[/@]");
             if (components.length == 3) {
                 authzFlag = authzHosts.contains(components[1]);
+            } else {
+                authzFlag = false;
             }
             if (!authzFlag) {
-                LOG.error("SASL authorization completed, {} is not authorized to connect", components[1]);
+                LOG.error("SASL authorization completed, {} is not authorized to connect", authorizationID);
             }
         }
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumHierarchical.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumHierarchical.java
index ced966f58c2..2b7c97463e3 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumHierarchical.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumHierarchical.java
@@ -27,9 +27,9 @@
 import java.util.Map.Entry;
 import java.util.Properties;
 import java.util.Set;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.server.quorum.QuorumPeer.LearnerType;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -66,15 +66,15 @@ public class QuorumHierarchical implements QuorumVerifier {
 
     private static final Logger LOG = LoggerFactory.getLogger(QuorumHierarchical.class);
 
-    private HashMap<Long, Long> serverWeight = new HashMap<Long, Long>();
-    private HashMap<Long, Long> serverGroup = new HashMap<Long, Long>();
-    private HashMap<Long, Long> groupWeight = new HashMap<Long, Long>();
+    private HashMap<Long, Long> serverWeight = new HashMap<>();
+    private HashMap<Long, Long> serverGroup = new HashMap<>();
+    private HashMap<Long, Long> groupWeight = new HashMap<>();
 
     private int numGroups = 0;
 
-    private Map<Long, QuorumServer> allMembers = new HashMap<Long, QuorumServer>();
-    private Map<Long, QuorumServer> participatingMembers = new HashMap<Long, QuorumServer>();
-    private Map<Long, QuorumServer> observingMembers = new HashMap<Long, QuorumServer>();
+    private Map<Long, QuorumServer> allMembers = new HashMap<>();
+    private Map<Long, QuorumServer> participatingMembers = new HashMap<>();
+    private Map<Long, QuorumServer> observingMembers = new HashMap<>();
 
     private long version = 0;
 
@@ -120,6 +120,7 @@ public boolean equals(Object o) {
         }
         return true;
     }
+
     /**
      * This constructor requires the quorum configuration
      * to be declared in a separate file, and it takes the
@@ -254,7 +255,7 @@ public String toString() {
             sw.append('\n');
         }
 
-        Map<Long, String> groups = new HashMap<Long, String>();
+        Map<Long, String> groups = new HashMap<>();
         for (Entry<Long, Long> pair : serverGroup.entrySet()) {
             Long sid = pair.getKey();
             Long gid = pair.getValue();
@@ -325,7 +326,7 @@ private void computeGroupWeight() {
      * Verifies if a given set is a quorum.
      */
     public boolean containsQuorum(Set<Long> set) {
-        HashMap<Long, Long> expansion = new HashMap<Long, Long>();
+        HashMap<Long, Long> expansion = new HashMap<>();
 
         /*
          * Adds up weights per group
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumMaj.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumMaj.java
index 6e6f1c2887d..ab111f7f1c7 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumMaj.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumMaj.java
@@ -23,9 +23,11 @@
 import java.util.Map.Entry;
 import java.util.Properties;
 import java.util.Set;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.server.quorum.QuorumPeer.LearnerType;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 /**
  * This class implements a validator for majority quorums. The implementation is
@@ -34,11 +36,13 @@
  */
 public class QuorumMaj implements QuorumVerifier {
 
-    private Map<Long, QuorumServer> allMembers = new HashMap<Long, QuorumServer>();
-    private Map<Long, QuorumServer> votingMembers = new HashMap<Long, QuorumServer>();
-    private Map<Long, QuorumServer> observingMembers = new HashMap<Long, QuorumServer>();
+    private static final Logger LOG = LoggerFactory.getLogger(QuorumMaj.class);
+
+    private Map<Long, QuorumServer> allMembers = new HashMap<>();
+    private Map<Long, QuorumServer> votingMembers = new HashMap<>();
+    private Map<Long, QuorumServer> observingMembers = new HashMap<>();
     private long version = 0;
-    private int half;
+    protected int half;
 
     public int hashCode() {
         assert false : "hashCode not designed";
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumOracleMaj.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumOracleMaj.java
new file mode 100644
index 00000000000..2622db4a0b1
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumOracleMaj.java
@@ -0,0 +1,200 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.quorum.flexible;
+
+import java.io.FileReader;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.Properties;
+import java.util.Set;
+import java.util.concurrent.atomic.AtomicBoolean;
+import org.apache.commons.io.FilenameUtils;
+import org.apache.zookeeper.common.ConfigException;
+import org.apache.zookeeper.server.quorum.Leader;
+import org.apache.zookeeper.server.quorum.LearnerHandler;
+import org.apache.zookeeper.server.quorum.QuorumPeer;
+import org.apache.zookeeper.server.quorum.SyncedLearnerTracker;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/*
+ *
+ * QuorumOracleMaj is a subclass of QuorumMaj.
+ *
+ * QuorumOracleMaj is designed to be functional in a 2-nodes configuration. The only method that this class overrides super
+ * class' method is containsQuorum(). Besides the check of oracle, it also checks the number of voting member. Whenever the
+ * number of voting members is greater than 2. QuorumOracleMaj shall function as hook to its super class.
+ * */
+public class QuorumOracleMaj extends QuorumMaj {
+    private static final Logger LOG = LoggerFactory.getLogger(QuorumOracleMaj.class);
+
+    private String oracle = null;
+
+    private final AtomicBoolean needOracle = new AtomicBoolean(true);
+
+    public QuorumOracleMaj(Map<Long, QuorumPeer.QuorumServer> allMembers, String oraclePath) {
+        super(allMembers);
+        setOracle(oraclePath);
+    }
+
+    public QuorumOracleMaj(Properties props, String oraclePath) throws ConfigException {
+        super(props);
+        setOracle(oraclePath);
+    }
+
+    private void setOracle(String path) {
+        if (oracle == null) {
+            oracle = path;
+            LOG.info("Oracle is set to {}", path);
+        } else {
+            LOG.warn("Oracle is already set. Ignore:{}", path);
+        }
+    }
+
+    @Override
+    public boolean updateNeedOracle(List<LearnerHandler> forwardingFollowers) {
+        // Do we have the quorum
+        needOracle.set(forwardingFollowers.isEmpty() && super.getVotingMembers().size() == 2);
+        return needOracle.get();
+    }
+
+    @Override
+    public boolean askOracle() {
+        FileReader fr = null;
+        try {
+            int read;
+            fr = new FileReader(FilenameUtils.getFullPath(oracle) + FilenameUtils.getName(oracle));
+            read = fr.read();
+            LOG.debug("Oracle says:{}", (char) read);
+            fr.close();
+            return (char) read == '1';
+        } catch (Exception e) {
+            e.printStackTrace();
+            if (oracle == null) {
+                LOG.error("Oracle is not set, return false");
+            }
+            return false;
+        } finally {
+            if (fr != null) {
+                try {
+                    fr.close();
+                } catch (IOException e) {
+                    e.printStackTrace();
+                }
+            }
+        }
+    }
+
+    @Override
+    public boolean getNeedOracle() {
+        return needOracle.get();
+    }
+
+    @Override
+    public String getOraclePath() {
+        return oracle;
+    }
+
+    @Override
+    public boolean overrideQuorumDecision(List<LearnerHandler> forwardingFollowers) {
+        return updateNeedOracle(forwardingFollowers) && askOracle();
+    }
+
+    @Override
+    public boolean revalidateOutstandingProp(Leader self, ArrayList<Leader.Proposal> outstandingProposal, long lastCommitted) {
+        LOG.debug("Start Revalidation outstandingProposals");
+        try {
+            while (outstandingProposal.size() >= 1) {
+                outstandingProposal.sort((o1, o2) -> (int) (o1.getZxid() - o2.getZxid()));
+
+                Leader.Proposal p;
+                int i = 0;
+                while (i < outstandingProposal.size()) {
+                    p = outstandingProposal.get(i);
+                    if (p.getZxid() > lastCommitted) {
+                        LOG.debug("Re-validate outstanding proposal: 0x{} size:{} lastCommitted:{}", Long.toHexString(p.getZxid()), outstandingProposal.size(), Long.toHexString(lastCommitted));
+                        if (!self.tryToCommit(p, p.getZxid(), null)) {
+                            break;
+                        } else {
+                            lastCommitted = p.getZxid();
+                            outstandingProposal.remove(p);
+                        }
+                    }
+                }
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+            return false;
+        }
+
+        LOG.debug("Finish Revalidation outstandingProposals");
+        return true;
+    }
+
+    @Override
+    public boolean revalidateVoteset(SyncedLearnerTracker voteSet, boolean timeout) {
+        return voteSet != null && voteSet.hasAllQuorums() && timeout;
+    }
+
+    @Override
+    public boolean containsQuorum(Set<Long> ackSet) {
+        if (oracle == null || getVotingMembers().size() > 2) {
+            return super.containsQuorum(ackSet);
+        } else if (!super.containsQuorum(ackSet)) {
+            if (getNeedOracle()) {
+                LOG.debug("We lose the quorum, but we do not have any valid followers Oracle:{}", askOracle());
+                return askOracle();
+            } else {
+                return false;
+            }
+        } else {
+            return true;
+        }
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (o == null || getClass() != o.getClass()) {
+            return false;
+        }
+        QuorumOracleMaj qm = (QuorumOracleMaj) o;
+        if (qm.getVersion() == super.getVersion()) {
+            return true;
+        }
+        if (super.getAllMembers().size() != qm.getAllMembers().size()) {
+            return false;
+        }
+        for (QuorumPeer.QuorumServer qs : super.getAllMembers().values()) {
+            QuorumPeer.QuorumServer qso = qm.getAllMembers().get(qs.id);
+            if (qso == null || !qs.equals(qso)) {
+                return false;
+            }
+        }
+        return true;
+    }
+
+    @Override
+    public int hashCode() {
+        assert false : "hashCode not designed";
+        return 43; // any arbitrary constant will do
+    }
+}
+
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumVerifier.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumVerifier.java
index 12d84890f06..7362313552c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumVerifier.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/flexible/QuorumVerifier.java
@@ -18,9 +18,14 @@
 
 package org.apache.zookeeper.server.quorum.flexible;
 
+import java.util.ArrayList;
+import java.util.List;
 import java.util.Map;
 import java.util.Set;
+import org.apache.zookeeper.server.quorum.Leader;
+import org.apache.zookeeper.server.quorum.LearnerHandler;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
+import org.apache.zookeeper.server.quorum.SyncedLearnerTracker;
 
 /**
  * All quorum validators have to implement a method called
@@ -39,6 +44,37 @@ public interface QuorumVerifier {
     Map<Long, QuorumServer> getVotingMembers();
     Map<Long, QuorumServer> getObservingMembers();
     boolean equals(Object o);
+    /*
+    * Only QuorumOracleMaj will implement these methods. Other class will raise warning if the methods are called and
+    * return false always.
+    * */
+    default boolean updateNeedOracle(List<LearnerHandler> forwardingFollowers) {
+        return false;
+    }
+    default boolean getNeedOracle() {
+        return false;
+    }
+
+    default boolean askOracle() {
+        return false;
+    }
+
+    default boolean overrideQuorumDecision(List<LearnerHandler> forwardingFollowers) {
+        return false;
+    }
+
+    default boolean revalidateOutstandingProp(Leader self, ArrayList<Leader.Proposal> outstandingProposal, long lastCommitted) {
+        return false;
+    }
+
+    default boolean revalidateVoteset(SyncedLearnerTracker voteSet, boolean timeout) {
+        return false;
+    }
+
+    default String getOraclePath() {
+        return null;
+    };
+
     String toString();
 
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/AuthUtil.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/AuthUtil.java
index 3b0b7e43d7e..f404e2516f9 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/AuthUtil.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/AuthUtil.java
@@ -17,6 +17,10 @@
  */
 package org.apache.zookeeper.server.util;
 
+import java.util.ArrayList;
+import java.util.List;
+import java.util.stream.Collectors;
+import org.apache.zookeeper.data.ClientInfo;
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.server.auth.AuthenticationProvider;
 import org.apache.zookeeper.server.auth.ProviderRegistry;
@@ -36,4 +40,45 @@ public static String getUser(Id id) {
         AuthenticationProvider provider = ProviderRegistry.getProvider(id.getScheme());
         return provider == null ? null : provider.getUserName(id.getId());
     }
+
+    /**
+     * Returns a formatted, comma-separated list of the user IDs held
+     * in {@code authInfo}, or {@code null} if no user IDs were found.
+     *
+     * Note that while the result may be easy on the eyes, it is
+     * underspecified: it does not mention the corresponding {@code
+     * scheme}, nor are its components escaped.  It is intended for
+     * for logging, and is not a security feature.
+     *
+     * @param authInfo A list of {@code Id} objects, or {@code null}.
+     * @return a comma-separated list of user IDs, or {@code null} if
+     * no user IDs were found.
+     */
+    public static String getUsers(List<Id> authInfo) {
+        if (authInfo == null) {
+            return null;
+        }
+
+        String formatted = authInfo.stream()
+            .map(AuthUtil::getUser)
+            .filter(name -> name != null && !name.trim().isEmpty())
+            .collect(Collectors.joining(","));
+
+        return formatted.isEmpty() ? null : formatted;
+    }
+
+    /**
+     * Gets user from id to prepare ClientInfo.
+     *
+     * @param authInfo List of id objects. id contains scheme and authentication info
+     * @return list of client authentication info
+     */
+    public static List<ClientInfo> getClientInfos(List<Id> authInfo) {
+        List<ClientInfo> clientAuthInfo = new ArrayList<>(authInfo.size());
+        authInfo.forEach(id -> {
+            String user = getUser(id);
+            clientAuthInfo.add(new ClientInfo(id.getScheme(), user == null ? "" : user));
+        });
+        return clientAuthInfo;
+    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/BitHashSet.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/BitHashSet.java
index 5788e6adf5c..2af2f53c946 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/BitHashSet.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/BitHashSet.java
@@ -53,7 +53,7 @@ public class BitHashSet implements Iterable<Integer> {
      * HashSet we need to go through all the words before return that
      * element, which is not efficient.
      */
-    private final Set<Integer> cache = new HashSet<Integer>();
+    private final Set<Integer> cache = new HashSet<>();
 
     private final int cacheSize;
 
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/BitMap.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/BitMap.java
index da76f467f57..19062403944 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/BitMap.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/BitMap.java
@@ -30,8 +30,8 @@
  */
 public class BitMap<T> {
 
-    private final Map<T, Integer> value2Bit = new HashMap<T, Integer>();
-    private final Map<Integer, T> bit2Value = new HashMap<Integer, T>();
+    private final Map<T, Integer> value2Bit = new HashMap<>();
+    private final Map<Integer, T> bit2Value = new HashMap<>();
 
     private final BitSet freedBitSet = new BitSet();
     private Integer nextBit = Integer.valueOf(0);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/CircularBuffer.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/CircularBuffer.java
index d338120048e..b851d640db3 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/CircularBuffer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/CircularBuffer.java
@@ -63,9 +63,9 @@ public synchronized void write(T element) {
 
     /**
      * Reads from the buffer in a FIFO manner.
-     * Returns the oldest element in the buffer if the buffer ie not empty
+     * Returns the oldest element in the buffer if the buffer is not empty
      * Returns null if the buffer is empty
-     * @return
+     * @return the oldest element in the buffer
      */
     public synchronized T take() {
         int newSize = numberOfElements.decrementAndGet();
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/ConfigUtils.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/ConfigUtils.java
index 508dc112565..850d432af10 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/ConfigUtils.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/ConfigUtils.java
@@ -22,8 +22,8 @@
 import java.io.StringReader;
 import java.util.Map.Entry;
 import java.util.Properties;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.server.quorum.QuorumPeer;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
 
 public class ConfigUtils {
 
@@ -95,4 +95,29 @@ public static String[] getHostAndPort(String s) throws ConfigException {
         }
     }
 
+    /**
+     * Some old configuration properties are not configurable in zookeeper configuration file
+     * zoo.cfg. To make these properties configurable in zoo.cfg old properties are prepended
+     * with zookeeper. For example prop.x.y.z changed to zookeeper.prop.x.y.z. But for backward
+     * compatibility both prop.x.y.z and zookeeper.prop.x.y.z should be supported.
+     * This method first gets value from new property, if first property is not configured
+     * then gets value from old property
+     *
+     * @param newPropertyKey new property key which starts with zookeeper.
+     * @return either new or old system property value. Null if none of the properties are set.
+     */
+    public static String getPropertyBackwardCompatibleWay(String newPropertyKey) {
+        String newKeyValue = System.getProperty(newPropertyKey);
+        if (newKeyValue != null) {
+            return newKeyValue.trim();
+        }
+        String oldPropertyKey = newPropertyKey.replace("zookeeper.", "");
+        String oldKeyValue = System.getProperty(oldPropertyKey);
+
+        if (oldKeyValue != null) {
+            return oldKeyValue.trim();
+        }
+        return null;
+    }
+
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/JvmPauseMonitor.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/JvmPauseMonitor.java
index 0a50c1668be..cdefb5d297c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/JvmPauseMonitor.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/JvmPauseMonitor.java
@@ -28,6 +28,7 @@
 import java.util.Map;
 import java.util.Set;
 import org.apache.zookeeper.server.ServerConfig;
+import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -191,8 +192,10 @@ public void run() {
                 }
                 long endTime = Instant.now().toEpochMilli();
                 long extraSleepTime = (endTime - startTime) - sleepTimeMs;
+                if (extraSleepTime >= 0) {
+                    ServerMetrics.getMetrics().JVM_PAUSE_TIME.add(extraSleepTime);
+                }
                 Map<String, GcTimes> gcTimesAfterSleep = getGcTimes();
-
                 if (extraSleepTime > warnThresholdMs) {
                     ++numGcWarnThresholdExceeded;
                     LOG.warn(formatMessage(extraSleepTime, gcTimesAfterSleep, gcTimesBeforeSleep));
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/OSMXBean.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/OSMXBean.java
index 0ea41442235..49633046673 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/OSMXBean.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/OSMXBean.java
@@ -84,7 +84,7 @@ private Long getOSUnixMXBeanMethod(String mBeanMethodName) {
                 return (Long) mBeanMethod.invoke(unixos);
             }
         } catch (Exception e) {
-            LOG.warn("Not able to load class or method for com.sun.managment.UnixOperatingSystemMXBean.", e);
+            LOG.warn("Not able to load class or method for com.sun.management.UnixOperatingSystemMXBean.", e);
         }
         return null;
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/QuotaMetricsUtils.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/QuotaMetricsUtils.java
new file mode 100644
index 00000000000..f989b342364
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/QuotaMetricsUtils.java
@@ -0,0 +1,167 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.util;
+
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+import org.apache.zookeeper.Quotas;
+import org.apache.zookeeper.StatsTrack;
+import org.apache.zookeeper.common.PathUtils;
+import org.apache.zookeeper.server.DataNode;
+import org.apache.zookeeper.server.DataTree;
+
+public final class QuotaMetricsUtils {
+    public static final String QUOTA_COUNT_LIMIT_PER_NAMESPACE = "quota_count_limit_per_namespace";
+    public static final String QUOTA_BYTES_LIMIT_PER_NAMESPACE = "quota_bytes_limit_per_namespace";
+    public static final String QUOTA_COUNT_USAGE_PER_NAMESPACE = "quota_count_usage_per_namespace";
+    public static final String QUOTA_BYTES_USAGE_PER_NAMESPACE = "quota_bytes_usage_per_namespace";
+    public static final String QUOTA_EXCEEDED_ERROR_PER_NAMESPACE = "quota_exceeded_error_per_namespace";
+
+    enum QUOTA_LIMIT_USAGE_METRIC_TYPE {QUOTA_COUNT_LIMIT, QUOTA_BYTES_LIMIT, QUOTA_COUNT_USAGE, QUOTA_BYTES_USAGE}
+    static final String LIMIT_END_STRING = "/" + Quotas.limitNode;
+    static final String STATS_END_STRING = "/" + Quotas.statNode;
+
+    private QuotaMetricsUtils() {
+    }
+
+    /**
+     * Traverse the quota subtree and return per namespace quota count limit
+     *
+     * @param dataTree dataTree that contains the quota limit and usage data
+     * @return a map with top namespace as the key and quota count limit as the value
+     *
+     */
+    public static Map<String, Number> getQuotaCountLimit(final DataTree dataTree) {
+        return getQuotaLimitOrUsage(dataTree, QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_COUNT_LIMIT);
+    }
+
+    /**
+     * Traverse the quota subtree and return per namespace quota bytes limit
+     *`
+     * @param dataTree dataTree that contains the quota limit and usage data
+     * @return a map with top namespace as the key and quota bytes limit as the value
+     *
+     */
+    public static Map<String, Number> getQuotaBytesLimit(final DataTree dataTree) {
+        return getQuotaLimitOrUsage(dataTree, QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_BYTES_LIMIT);
+    }
+
+    /**
+     * Traverse the quota subtree and return per namespace quota count usage
+     *
+     * @param dataTree dataTree that contains the quota limit and usage data
+     * @return a map with top namespace as the key and quota count usage as the value
+     *
+     */
+    public static Map<String, Number> getQuotaCountUsage(final DataTree dataTree) {
+        return getQuotaLimitOrUsage(dataTree, QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_COUNT_USAGE);
+    }
+
+    /**
+     * Traverse the quota subtree and return per namespace quota bytes usage
+     *
+     * @param dataTree dataTree that contains the quota limit and usage data
+     * @return  a map with top namespace as the key and quota bytes usage as the value
+     *
+     */
+    public static Map<String, Number> getQuotaBytesUsage(final DataTree dataTree) {
+        return getQuotaLimitOrUsage(dataTree, QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_BYTES_USAGE);
+    }
+
+    // traverse the quota subtree and read the quota limit or usage data
+    private static Map<String, Number> getQuotaLimitOrUsage(final DataTree dataTree,
+                                                            final QUOTA_LIMIT_USAGE_METRIC_TYPE type) {
+        final Map<String, Number> metricsMap = new ConcurrentHashMap<>();
+        if (dataTree != null) {
+            getQuotaLimitOrUsage(Quotas.quotaZookeeper, metricsMap, type, dataTree);
+        }
+        return metricsMap;
+    }
+
+    private static void getQuotaLimitOrUsage(final String path,
+                                     final Map<String, Number> metricsMap,
+                                     final QUOTA_LIMIT_USAGE_METRIC_TYPE type,
+                                     final DataTree dataTree) {
+        final DataNode node = dataTree.getNode(path);
+        if (node == null) {
+            return;
+        }
+        final String[] children;
+        synchronized (node) {
+            children = node.getChildren().toArray(new String[0]);
+        }
+        if (children.length == 0) {
+            if (shouldCollect(path, type)) {
+                collectQuotaLimitOrUsage(path, node, metricsMap, type);
+            }
+            return;
+        }
+        for (final String child : children) {
+            getQuotaLimitOrUsage(path + "/" + child, metricsMap, type, dataTree);
+        }
+    }
+
+    static boolean shouldCollect(final String path, final QUOTA_LIMIT_USAGE_METRIC_TYPE type) {
+        return path.endsWith(LIMIT_END_STRING)
+                && (QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_COUNT_LIMIT == type || QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_BYTES_LIMIT == type)
+                || path.endsWith(STATS_END_STRING)
+                && (QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_COUNT_USAGE == type || QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_BYTES_USAGE == type);
+    }
+
+    static void collectQuotaLimitOrUsage(final String path,
+                                         final DataNode node,
+                                         final Map<String, Number> metricsMap,
+                                         final QUOTA_LIMIT_USAGE_METRIC_TYPE type) {
+        final String namespace = PathUtils.getTopNamespace(Quotas.trimQuotaPath(path));
+        if (namespace == null) {
+            return;
+        }
+        final byte[] data = node.getData();
+        if (data == null) {
+            return;
+        }
+        final StatsTrack statsTrack = new StatsTrack(data);
+        switch (type) {
+            case QUOTA_COUNT_LIMIT:
+                aggregateQuotaLimitOrUsage(namespace, metricsMap, getQuotaLimit(statsTrack.getCountHardLimit(), statsTrack.getCount()));
+                break;
+            case QUOTA_BYTES_LIMIT:
+                aggregateQuotaLimitOrUsage(namespace, metricsMap, getQuotaLimit(statsTrack.getByteHardLimit(), statsTrack.getBytes()));
+                break;
+            case QUOTA_COUNT_USAGE:
+                aggregateQuotaLimitOrUsage(namespace, metricsMap, statsTrack.getCount());
+                break;
+            case QUOTA_BYTES_USAGE:
+                aggregateQuotaLimitOrUsage(namespace, metricsMap, statsTrack.getBytes());
+                break;
+            default:
+        }
+    }
+
+    // hard limit takes precedence if specified
+    static long getQuotaLimit(final long hardLimit, final long limit) {
+        return hardLimit > -1 ? hardLimit : limit;
+    }
+
+    private static void aggregateQuotaLimitOrUsage(final String namespace,
+                                           final Map<String, Number> metricsMap,
+                                           final long limitOrUsage) {
+        metricsMap.put(namespace, metricsMap.getOrDefault(namespace, 0).longValue() + limitOrUsage);
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/RateLimiter.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/RateLimiter.java
new file mode 100644
index 00000000000..cb9473306ab
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/RateLimiter.java
@@ -0,0 +1,60 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.util;
+
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicInteger;
+import org.apache.zookeeper.common.Time;
+
+/**
+ * A class that provides simple interval-based rate limiting implementation.
+ */
+public class RateLimiter {
+    private final int rate;
+    private final long intervalInMs;
+    private long lastTimeReset;
+    private final AtomicInteger remained;
+
+    public RateLimiter(final int rate, final long interval, final TimeUnit unit) {
+        this.rate = rate;
+        this.intervalInMs = unit.toMillis(interval);
+        this.lastTimeReset = Time.currentElapsedTime();
+        this.remained = new AtomicInteger(rate);
+    }
+
+    public boolean allow() {
+        final long now = Time.currentElapsedTime();
+
+        // reset the rate if interval passed
+        if (now > lastTimeReset + intervalInMs) {
+            remained.set(rate);
+            lastTimeReset = now;
+        }
+
+        int value = remained.get();
+        boolean allowed = false;
+
+        // to handle race condition
+        while (!allowed && value > 0) {
+            allowed = remained.compareAndSet(value, value - 1);
+            value = remained.get();
+        }
+        return allowed;
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/RequestPathMetricsCollector.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/RequestPathMetricsCollector.java
index f3ec1fcea92..5332b1aaea8 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/RequestPathMetricsCollector.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/RequestPathMetricsCollector.java
@@ -40,13 +40,13 @@
 import java.util.Comparator;
 import java.util.HashMap;
 import java.util.Map;
-import java.util.Random;
 import java.util.StringTokenizer;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentLinkedQueue;
 import java.util.concurrent.Executors;
 import java.util.concurrent.LinkedBlockingQueue;
 import java.util.concurrent.ScheduledThreadPoolExecutor;
+import java.util.concurrent.ThreadLocalRandom;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.Consumer;
@@ -83,10 +83,9 @@ public class RequestPathMetricsCollector {
     public static final String PATH_STATS_COLLECTOR_DELAY = "zookeeper.pathStats.delay";
     public static final String PATH_STATS_TOP_PATH_MAX = "zookeeper.pathStats.topPathMax";
     public static final String PATH_STATS_ENABLED = "zookeeper.pathStats.enabled";
-    private static final String PATH_SEPERATOR = "/";
+    private static final String PATH_SEPARATOR = "/";
 
     private final Map<String, PathStatsQueue> immutableRequestsMap;
-    private final Random sampler;
     private final ScheduledThreadPoolExecutor scheduledExecutor;
     private final boolean accurateMode;
 
@@ -96,7 +95,6 @@ public RequestPathMetricsCollector() {
 
     public RequestPathMetricsCollector(boolean accurateMode) {
         final Map<String, PathStatsQueue> requestsMap = new HashMap<>();
-        this.sampler = new Random(System.currentTimeMillis());
         this.accurateMode = accurateMode;
 
         REQUEST_PREPROCESS_TOPPATH_MAX = Integer.getInteger(PATH_STATS_TOP_PATH_MAX, 20);
@@ -158,9 +156,9 @@ static boolean isWriteOp(int requestType) {
     static String trimPathDepth(String path, int maxDepth) {
         int count = 0;
         StringBuilder sb = new StringBuilder();
-        StringTokenizer pathTokenizer = new StringTokenizer(path, PATH_SEPERATOR);
+        StringTokenizer pathTokenizer = new StringTokenizer(path, PATH_SEPARATOR);
         while (pathTokenizer.hasMoreElements() && count++ < maxDepth) {
-            sb.append(PATH_SEPERATOR);
+            sb.append(PATH_SEPARATOR);
             sb.append(pathTokenizer.nextToken());
         }
         path = sb.toString();
@@ -204,7 +202,7 @@ public void registerRequest(int type, String path) {
         if (!enabled) {
             return;
         }
-        if (sampler.nextFloat() <= REQUEST_PREPROCESS_SAMPLE_RATE) {
+        if (ThreadLocalRandom.current().nextFloat() <= REQUEST_PREPROCESS_SAMPLE_RATE) {
             PathStatsQueue pathStatsQueue = immutableRequestsMap.get(Request.op2String(type));
             if (pathStatsQueue != null) {
                 pathStatsQueue.registerRequest(path);
@@ -357,7 +355,7 @@ public void start() {
                 return;
             }
             // Staggered start and then run every 15 seconds no matter what
-            int delay = sampler.nextInt(REQUEST_STATS_SLOT_DURATION);
+            int delay = ThreadLocalRandom.current().nextInt(REQUEST_STATS_SLOT_DURATION);
             // We need to use fixed Delay as the fixed rate will start the next one right
             // after the previous one finishes if it runs overtime instead of overlapping it.
             scheduledExecutor.scheduleWithFixedDelay(() -> {
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/SerializeUtils.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/SerializeUtils.java
index fcc5c8f4b70..96440eeeb7f 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/SerializeUtils.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/SerializeUtils.java
@@ -30,11 +30,9 @@
 import org.apache.jute.Record;
 import org.apache.zookeeper.ZooDefs.OpCode;
 import org.apache.zookeeper.server.DataTree;
-import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.TxnLogEntry;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.ZooTrace;
-import org.apache.zookeeper.server.persistence.Util;
 import org.apache.zookeeper.txn.CloseSessionTxn;
 import org.apache.zookeeper.txn.CreateContainerTxn;
 import org.apache.zookeeper.txn.CreateSessionTxn;
@@ -101,7 +99,7 @@ public static TxnLogEntry deserializeTxn(byte[] txnBytes) throws IOException {
             txn = new MultiTxn();
             break;
         default:
-            throw new IOException("Unsupported Txn with type=%d" + hdr.getType());
+            throw new IOException("Unsupported Txn with type=" + hdr.getType());
         }
         if (txn != null) {
             try {
@@ -162,7 +160,7 @@ public static void deserializeSnapshot(DataTree dt, InputArchive ia, Map<Long, I
     }
 
     public static void serializeSnapshot(DataTree dt, OutputArchive oa, Map<Long, Integer> sessions) throws IOException {
-        HashMap<Long, Integer> sessSnap = new HashMap<Long, Integer>(sessions);
+        HashMap<Long, Integer> sessSnap = new HashMap<>(sessions);
         oa.writeInt(sessSnap.size(), "count");
         for (Entry<Long, Integer> entry : sessSnap.entrySet()) {
             oa.writeLong(entry.getKey().longValue(), "id");
@@ -170,18 +168,4 @@ public static void serializeSnapshot(DataTree dt, OutputArchive oa, Map<Long, In
         }
         dt.serialize(oa, "tree");
     }
-
-    public static byte[] serializeRequest(Request request) {
-        if (request == null || request.getHdr() == null) {
-            return null;
-        }
-        byte[] data = new byte[32];
-        try {
-            data = Util.marshallTxnEntry(request.getHdr(), request.getTxn(), request.getTxnDigest());
-        } catch (IOException e) {
-            LOG.error("This really should be impossible", e);
-        }
-        return data;
-    }
-
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/IWatchManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/IWatchManager.java
index 1bc44c805a0..3e27698555d 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/IWatchManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/IWatchManager.java
@@ -19,8 +19,11 @@
 package org.apache.zookeeper.server.watch;
 
 import java.io.PrintWriter;
+import java.util.List;
+import javax.annotation.Nullable;
 import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.Watcher.Event.EventType;
+import org.apache.zookeeper.data.ACL;
 
 public interface IWatchManager {
 
@@ -60,6 +63,21 @@ default boolean addWatch(String path, Watcher watcher, WatcherMode watcherMode)
      */
     boolean containsWatcher(String path, Watcher watcher);
 
+    /**
+     * Checks the specified watcher exists for the given path and mode.
+     *
+     * @param path znode path
+     * @param watcher watcher object reference
+     * @param watcherMode watcher mode, null for any mode
+     * @return true if the watcher exists, false otherwise
+     */
+    default boolean containsWatcher(String path, Watcher watcher, @Nullable WatcherMode watcherMode) {
+        if (watcherMode == null || watcherMode == WatcherMode.DEFAULT_WATCHER_MODE) {
+            return containsWatcher(path, watcher);
+        }
+        throw new UnsupportedOperationException("persistent watch");
+    }
+
     /**
      * Removes the specified watcher for the given path.
      *
@@ -70,6 +88,21 @@ default boolean addWatch(String path, Watcher watcher, WatcherMode watcherMode)
      */
     boolean removeWatcher(String path, Watcher watcher);
 
+    /**
+     * Removes the specified watcher for the given path and mode.
+     *
+     * @param path znode path
+     * @param watcher watcher object reference
+     * @param watcherMode watcher mode, null to remove all modes
+     * @return true if the watcher successfully removed, false otherwise
+     */
+    default boolean removeWatcher(String path, Watcher watcher, WatcherMode watcherMode) {
+        if (watcherMode == null || watcherMode == WatcherMode.DEFAULT_WATCHER_MODE) {
+            return removeWatcher(path, watcher);
+        }
+        throw new UnsupportedOperationException("persistent watch");
+    }
+
     /**
      * The entry to remove the watcher when the cnxn is closed.
      *
@@ -82,10 +115,12 @@ default boolean addWatch(String path, Watcher watcher, WatcherMode watcherMode)
      *
      * @param path znode path
      * @param type the watch event type
+     * @param zxid the zxid for the corresponding change that triggered this event
+     * @param acl ACL of the znode in path
      *
      * @return the watchers have been notified
      */
-    WatcherOrBitSet triggerWatch(String path, EventType type);
+    WatcherOrBitSet triggerWatch(String path, EventType type, long zxid, List<ACL> acl);
 
     /**
      * Distribute the watch event for the given path, but ignore those
@@ -93,11 +128,12 @@ default boolean addWatch(String path, Watcher watcher, WatcherMode watcherMode)
      *
      * @param path znode path
      * @param type the watch event type
+     * @param zxid the zxid for the corresponding change that triggered this event
      * @param suppress the suppressed watcher set
      *
      * @return the watchers have been notified
      */
-    WatcherOrBitSet triggerWatch(String path, EventType type, WatcherOrBitSet suppress);
+    WatcherOrBitSet triggerWatch(String path, EventType type, long zxid, List<ACL> acl, WatcherOrBitSet suppress);
 
     /**
      * Get the size of watchers.
@@ -144,13 +180,4 @@ default boolean addWatch(String path, Watcher watcher, WatcherMode watcherMode)
      *
      */
     void dumpWatches(PrintWriter pwriter, boolean byPath);
-
-    /**
-     * Return the current number of recursive watchers
-     *
-     * @return qty
-     */
-    default int getRecursiveWatchQty() {
-        return 0;
-    }
 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManager.java
index c5b133059b2..014c944fc84 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManager.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManager.java
@@ -19,9 +19,11 @@
 package org.apache.zookeeper.server.watch;
 
 import java.io.PrintWriter;
+import java.util.Collections;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.Iterator;
+import java.util.List;
 import java.util.Map;
 import java.util.Map.Entry;
 import java.util.Set;
@@ -29,8 +31,10 @@
 import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.Watcher.Event.EventType;
 import org.apache.zookeeper.Watcher.Event.KeeperState;
+import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.server.ServerCnxn;
 import org.apache.zookeeper.server.ServerMetrics;
+import org.apache.zookeeper.server.ServerWatcher;
 import org.apache.zookeeper.server.ZooTrace;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -45,9 +49,9 @@ public class WatchManager implements IWatchManager {
 
     private final Map<String, Set<Watcher>> watchTable = new HashMap<>();
 
-    private final Map<Watcher, Set<String>> watch2Paths = new HashMap<>();
+    private final Map<Watcher, Map<String, WatchStats>> watch2Paths = new HashMap<>();
 
-    private final WatcherModeManager watcherModeManager = new WatcherModeManager();
+    private int recursiveWatchQty = 0;
 
     @Override
     public synchronized int size() {
@@ -84,25 +88,34 @@ public synchronized boolean addWatch(String path, Watcher watcher, WatcherMode w
         }
         list.add(watcher);
 
-        Set<String> paths = watch2Paths.get(watcher);
+        Map<String, WatchStats> paths = watch2Paths.get(watcher);
         if (paths == null) {
             // cnxns typically have many watches, so use default cap here
-            paths = new HashSet<>();
+            paths = new HashMap<>();
             watch2Paths.put(watcher, paths);
         }
 
-        watcherModeManager.setWatcherMode(watcher, path, watcherMode);
+        WatchStats stats = paths.getOrDefault(path, WatchStats.NONE);
+        WatchStats newStats = stats.addMode(watcherMode);
 
-        return paths.add(path);
+        if (newStats != stats) {
+            paths.put(path, newStats);
+            if (watcherMode.isRecursive()) {
+                ++recursiveWatchQty;
+            }
+            return true;
+        }
+
+        return false;
     }
 
     @Override
     public synchronized void removeWatcher(Watcher watcher) {
-        Set<String> paths = watch2Paths.remove(watcher);
+        Map<String, WatchStats> paths = watch2Paths.remove(watcher);
         if (paths == null) {
             return;
         }
-        for (String p : paths) {
+        for (String p : paths.keySet()) {
             Set<Watcher> list = watchTable.get(p);
             if (list != null) {
                 list.remove(watcher);
@@ -110,21 +123,25 @@ public synchronized void removeWatcher(Watcher watcher) {
                     watchTable.remove(p);
                 }
             }
-            watcherModeManager.removeWatcher(watcher, p);
+        }
+        for (WatchStats stats : paths.values()) {
+            if (stats.hasMode(WatcherMode.PERSISTENT_RECURSIVE)) {
+                --recursiveWatchQty;
+            }
         }
     }
 
     @Override
-    public WatcherOrBitSet triggerWatch(String path, EventType type) {
-        return triggerWatch(path, type, null);
+    public WatcherOrBitSet triggerWatch(String path, EventType type, long zxid, List<ACL> acl) {
+        return triggerWatch(path, type, zxid, acl, null);
     }
 
     @Override
-    public WatcherOrBitSet triggerWatch(String path, EventType type, WatcherOrBitSet supress) {
-        WatchedEvent e = new WatchedEvent(type, KeeperState.SyncConnected, path);
+    public WatcherOrBitSet triggerWatch(String path, EventType type, long zxid, List<ACL> acl, WatcherOrBitSet suppress) {
+        WatchedEvent e = new WatchedEvent(type, KeeperState.SyncConnected, path, zxid);
         Set<Watcher> watchers = new HashSet<>();
-        PathParentIterator pathParentIterator = getPathParentIterator(path);
         synchronized (this) {
+            PathParentIterator pathParentIterator = getPathParentIterator(path);
             for (String localPath : pathParentIterator.asIterable()) {
                 Set<Watcher> thisWatchers = watchTable.get(localPath);
                 if (thisWatchers == null || thisWatchers.isEmpty()) {
@@ -133,20 +150,23 @@ public WatcherOrBitSet triggerWatch(String path, EventType type, WatcherOrBitSet
                 Iterator<Watcher> iterator = thisWatchers.iterator();
                 while (iterator.hasNext()) {
                     Watcher watcher = iterator.next();
-                    WatcherMode watcherMode = watcherModeManager.getWatcherMode(watcher, localPath);
-                    if (watcherMode.isRecursive()) {
-                        if (type != EventType.NodeChildrenChanged) {
-                            watchers.add(watcher);
-                        }
-                    } else if (!pathParentIterator.atParentPath()) {
+                    Map<String, WatchStats> paths = watch2Paths.getOrDefault(watcher, Collections.emptyMap());
+                    WatchStats stats = paths.get(localPath);
+                    if (stats == null) {
+                        LOG.warn("inconsistent watch table for watcher {}, {} not in path list", watcher, localPath);
+                        continue;
+                    }
+                    if (!pathParentIterator.atParentPath()) {
                         watchers.add(watcher);
-                        if (!watcherMode.isPersistent()) {
+                        WatchStats newStats = stats.removeMode(WatcherMode.STANDARD);
+                        if (newStats == WatchStats.NONE) {
                             iterator.remove();
-                            Set<String> paths = watch2Paths.get(watcher);
-                            if (paths != null) {
-                                paths.remove(localPath);
-                            }
+                            paths.remove(localPath);
+                        } else if (newStats != stats) {
+                            paths.put(localPath, newStats);
                         }
+                    } else if (stats.hasMode(WatcherMode.PERSISTENT_RECURSIVE)) {
+                        watchers.add(watcher);
                     }
                 }
                 if (thisWatchers.isEmpty()) {
@@ -162,10 +182,14 @@ public WatcherOrBitSet triggerWatch(String path, EventType type, WatcherOrBitSet
         }
 
         for (Watcher w : watchers) {
-            if (supress != null && supress.contains(w)) {
+            if (suppress != null && suppress.contains(w)) {
                 continue;
             }
-            w.process(e);
+            if (w instanceof ServerWatcher) {
+                ((ServerWatcher) w).process(e, acl);
+            } else {
+                w.process(e);
+            }
         }
 
         switch (type) {
@@ -199,7 +223,7 @@ public synchronized String toString() {
         sb.append(watch2Paths.size()).append(" connections watching ").append(watchTable.size()).append(" paths\n");
 
         int total = 0;
-        for (Set<String> paths : watch2Paths.values()) {
+        for (Map<String, WatchStats> paths : watch2Paths.values()) {
             total += paths.size();
         }
         sb.append("Total watches:").append(total);
@@ -219,10 +243,10 @@ public synchronized void dumpWatches(PrintWriter pwriter, boolean byPath) {
                 }
             }
         } else {
-            for (Entry<Watcher, Set<String>> e : watch2Paths.entrySet()) {
+            for (Entry<Watcher, Map<String, WatchStats>> e : watch2Paths.entrySet()) {
                 pwriter.print("0x");
                 pwriter.println(Long.toHexString(((ServerCnxn) e.getKey()).getSessionId()));
-                for (String path : e.getValue()) {
+                for (String path : e.getValue().keySet()) {
                     pwriter.print("\t");
                     pwriter.println(path);
                 }
@@ -232,49 +256,82 @@ public synchronized void dumpWatches(PrintWriter pwriter, boolean byPath) {
 
     @Override
     public synchronized boolean containsWatcher(String path, Watcher watcher) {
-        WatcherMode watcherMode = watcherModeManager.getWatcherMode(watcher, path);
-        PathParentIterator pathParentIterator = getPathParentIterator(path);
-        for (String localPath : pathParentIterator.asIterable()) {
-            Set<Watcher> watchers = watchTable.get(localPath);
-            if (!pathParentIterator.atParentPath()) {
-                if (watchers != null) {
-                    return true;    // at the leaf node, all watcher types match
-                }
-            }
-            if (watcherMode.isRecursive()) {
-                return true;
-            }
-        }
-        return false;
+        return containsWatcher(path, watcher, null);
     }
 
     @Override
-    public synchronized boolean removeWatcher(String path, Watcher watcher) {
-        Set<String> paths = watch2Paths.get(watcher);
-        if (paths == null || !paths.remove(path)) {
+    public synchronized boolean containsWatcher(String path, Watcher watcher, WatcherMode watcherMode) {
+        Map<String, WatchStats> paths = watch2Paths.get(watcher);
+        if (paths == null) {
             return false;
         }
+        WatchStats stats = paths.get(path);
+        return stats != null && (watcherMode == null || stats.hasMode(watcherMode));
+    }
 
-        Set<Watcher> list = watchTable.get(path);
-        if (list == null || !list.remove(watcher)) {
+    private WatchStats unwatch(String path, Watcher watcher, Map<String, WatchStats> paths, Set<Watcher> watchers) {
+        WatchStats stats = paths.remove(path);
+        if (stats == null) {
+            return WatchStats.NONE;
+        }
+        if (paths.isEmpty()) {
+            watch2Paths.remove(watcher);
+        }
+        watchers.remove(watcher);
+        if (watchers.isEmpty()) {
+            watchTable.remove(path);
+        }
+        return stats;
+    }
+
+    @Override
+    public synchronized boolean removeWatcher(String path, Watcher watcher, WatcherMode watcherMode) {
+        Map<String, WatchStats> paths = watch2Paths.get(watcher);
+        Set<Watcher> watchers = watchTable.get(path);
+        if (paths == null || watchers == null) {
             return false;
         }
 
-        if (list.isEmpty()) {
-            watchTable.remove(path);
+        WatchStats oldStats;
+        WatchStats newStats;
+        if (watcherMode != null) {
+            oldStats = paths.getOrDefault(path, WatchStats.NONE);
+            newStats = oldStats.removeMode(watcherMode);
+            if (newStats != WatchStats.NONE) {
+                if (newStats != oldStats) {
+                    paths.put(path, newStats);
+                }
+            } else if (oldStats != WatchStats.NONE) {
+                unwatch(path, watcher, paths, watchers);
+            }
+        } else {
+            oldStats = unwatch(path, watcher, paths, watchers);
+            newStats = WatchStats.NONE;
         }
 
-        watcherModeManager.removeWatcher(watcher, path);
+        if (oldStats.hasMode(WatcherMode.PERSISTENT_RECURSIVE) && !newStats.hasMode(WatcherMode.PERSISTENT_RECURSIVE)) {
+            --recursiveWatchQty;
+        }
+
+        return oldStats != newStats;
+    }
+
+    @Override
+    public synchronized boolean removeWatcher(String path, Watcher watcher) {
+        return removeWatcher(path, watcher, null);
+    }
 
-        return true;
+    // VisibleForTesting
+    Map<Watcher, Map<String, WatchStats>> getWatch2Paths() {
+        return watch2Paths;
     }
 
     @Override
     public synchronized WatchesReport getWatches() {
         Map<Long, Set<String>> id2paths = new HashMap<>();
-        for (Entry<Watcher, Set<String>> e : watch2Paths.entrySet()) {
+        for (Entry<Watcher, Map<String, WatchStats>> e : watch2Paths.entrySet()) {
             Long id = ((ServerCnxn) e.getKey()).getSessionId();
-            Set<String> paths = new HashSet<>(e.getValue());
+            Set<String> paths = new HashSet<>(e.getValue().keySet());
             id2paths.put(id, paths);
         }
         return new WatchesReport(id2paths);
@@ -296,7 +353,7 @@ public synchronized WatchesPathReport getWatchesByPath() {
     @Override
     public synchronized WatchesSummary getWatchesSummary() {
         int totalWatches = 0;
-        for (Set<String> paths : watch2Paths.values()) {
+        for (Map<String, WatchStats> paths : watch2Paths.values()) {
             totalWatches += paths.size();
         }
         return new WatchesSummary(watch2Paths.size(), watchTable.size(), totalWatches);
@@ -305,13 +362,13 @@ public synchronized WatchesSummary getWatchesSummary() {
     @Override
     public void shutdown() { /* do nothing */ }
 
-    @Override
-    public int getRecursiveWatchQty() {
-        return watcherModeManager.getRecursiveQty();
+    // VisibleForTesting
+    synchronized int getRecursiveWatchQty() {
+        return recursiveWatchQty;
     }
 
     private PathParentIterator getPathParentIterator(String path) {
-        if (watcherModeManager.getRecursiveQty() == 0) {
+        if (getRecursiveWatchQty() == 0) {
             return PathParentIterator.forPathOnly(path);
         }
         return PathParentIterator.forAll(path);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManagerOptimized.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManagerOptimized.java
index 1cc7deb9dc0..84cf2c73d13 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManagerOptimized.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchManagerOptimized.java
@@ -22,6 +22,7 @@
 import java.util.BitSet;
 import java.util.HashMap;
 import java.util.HashSet;
+import java.util.List;
 import java.util.Map;
 import java.util.Map.Entry;
 import java.util.Set;
@@ -31,8 +32,10 @@
 import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.Watcher.Event.EventType;
 import org.apache.zookeeper.Watcher.Event.KeeperState;
+import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.server.ServerCnxn;
 import org.apache.zookeeper.server.ServerMetrics;
+import org.apache.zookeeper.server.ServerWatcher;
 import org.apache.zookeeper.server.util.BitHashSet;
 import org.apache.zookeeper.server.util.BitMap;
 import org.slf4j.Logger;
@@ -55,10 +58,10 @@ public class WatchManagerOptimized implements IWatchManager, IDeadWatcherListene
 
     private static final Logger LOG = LoggerFactory.getLogger(WatchManagerOptimized.class);
 
-    private final ConcurrentHashMap<String, BitHashSet> pathWatches = new ConcurrentHashMap<String, BitHashSet>();
+    private final ConcurrentHashMap<String, BitHashSet> pathWatches = new ConcurrentHashMap<>();
 
     // watcher to bit id mapping
-    private final BitMap<Watcher> watcherBitIdMap = new BitMap<Watcher>();
+    private final BitMap<Watcher> watcherBitIdMap = new BitMap<>();
 
     // used to lazily remove the dead watchers
     private final WatcherCleaner watcherCleaner;
@@ -202,13 +205,13 @@ public void processDeadWatchers(Set<Integer> deadWatchers) {
     }
 
     @Override
-    public WatcherOrBitSet triggerWatch(String path, EventType type) {
-        return triggerWatch(path, type, null);
+    public WatcherOrBitSet triggerWatch(String path, EventType type, long zxid, List<ACL> acl) {
+        return triggerWatch(path, type, zxid, acl, null);
     }
 
     @Override
-    public WatcherOrBitSet triggerWatch(String path, EventType type, WatcherOrBitSet suppress) {
-        WatchedEvent e = new WatchedEvent(type, KeeperState.SyncConnected, path);
+    public WatcherOrBitSet triggerWatch(String path, EventType type, long zxid, List<ACL> acl, WatcherOrBitSet suppress) {
+        WatchedEvent e = new WatchedEvent(type, KeeperState.SyncConnected, path, zxid);
 
         BitHashSet watchers = remove(path);
         if (watchers == null) {
@@ -232,7 +235,11 @@ public WatcherOrBitSet triggerWatch(String path, EventType type, WatcherOrBitSet
                     continue;
                 }
 
-                w.process(e);
+                if (w instanceof ServerWatcher) {
+                    ((ServerWatcher) w).process(e, acl);
+                } else {
+                    w.process(e);
+                }
                 triggeredWatches++;
             }
         }
@@ -304,10 +311,10 @@ public WatchesSummary getWatchesSummary() {
 
     @Override
     public WatchesReport getWatches() {
-        Map<Long, Set<String>> id2paths = new HashMap<Long, Set<String>>();
+        Map<Long, Set<String>> id2paths = new HashMap<>();
         for (Entry<Watcher, Set<String>> e : getWatcher2PathesMap().entrySet()) {
             Long id = ((ServerCnxn) e.getKey()).getSessionId();
-            Set<String> paths = new HashSet<String>(e.getValue());
+            Set<String> paths = new HashSet<>(e.getValue());
             id2paths.put(id, paths);
         }
         return new WatchesReport(id2paths);
@@ -321,11 +328,11 @@ public WatchesReport getWatches() {
      */
     @Override
     public WatchesPathReport getWatchesByPath() {
-        Map<String, Set<Long>> path2ids = new HashMap<String, Set<Long>>();
+        Map<String, Set<Long>> path2ids = new HashMap<>();
         for (Entry<String, BitHashSet> e : pathWatches.entrySet()) {
             BitHashSet watchers = e.getValue();
             synchronized (watchers) {
-                Set<Long> ids = new HashSet<Long>(watchers.size());
+                Set<Long> ids = new HashSet<>(watchers.size());
                 path2ids.put(e.getKey(), ids);
                 for (Integer wbit : watchers) {
                     Watcher watcher = watcherBitIdMap.get(wbit);
@@ -343,7 +350,7 @@ public WatchesPathReport getWatchesByPath() {
      * it in this class.
      */
     public Map<Watcher, Set<String>> getWatcher2PathesMap() {
-        Map<Watcher, Set<String>> watcher2paths = new HashMap<Watcher, Set<String>>();
+        Map<Watcher, Set<String>> watcher2paths = new HashMap<>();
         for (Entry<String, BitHashSet> e : pathWatches.entrySet()) {
             String path = e.getKey();
             BitHashSet watchers = e.getValue();
@@ -355,7 +362,7 @@ public Map<Watcher, Set<String>> getWatcher2PathesMap() {
                         continue;
                     }
                     if (!watcher2paths.containsKey(w)) {
-                        watcher2paths.put(w, new HashSet<String>());
+                        watcher2paths.put(w, new HashSet<>());
                     }
                     watcher2paths.get(w).add(path);
                 }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchStats.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchStats.java
new file mode 100644
index 00000000000..fd0c0259edd
--- /dev/null
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchStats.java
@@ -0,0 +1,89 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.watch;
+
+/**
+ * Statistics for multiple different watches on one node.
+ */
+public final class WatchStats {
+    private static final WatchStats[] WATCH_STATS = new WatchStats[] {
+            new WatchStats(0), // NONE
+            new WatchStats(1), // STANDARD
+            new WatchStats(2), // PERSISTENT
+            new WatchStats(3), // STANDARD + PERSISTENT
+            new WatchStats(4), // PERSISTENT_RECURSIVE
+            new WatchStats(5), // STANDARD + PERSISTENT_RECURSIVE
+            new WatchStats(6), // PERSISTENT + PERSISTENT_RECURSIVE
+            new WatchStats(7), // STANDARD + PERSISTENT + PERSISTENT_RECURSIVE
+    };
+
+    /**
+     * Stats that have no watchers attached.
+     *
+     * <p>This could be used as start point to compute new stats using {@link #addMode(WatcherMode)}.
+     */
+    public static final WatchStats NONE = WATCH_STATS[0];
+
+    private final int flags;
+
+    private WatchStats(int flags) {
+        this.flags = flags;
+    }
+
+    private static int modeToFlag(WatcherMode mode) {
+        return 1 << mode.ordinal();
+    }
+
+    /**
+     * Compute stats after given mode attached to node.
+     *
+     * @param mode watcher mode
+     * @return a new stats if given mode is not attached to this node before, otherwise old stats
+     */
+    public WatchStats addMode(WatcherMode mode) {
+        int flags = this.flags | modeToFlag(mode);
+        return WATCH_STATS[flags];
+    }
+
+    /**
+     * Compute stats after given mode removed from node.
+     *
+     * @param mode watcher mode
+     * @return null if given mode is the last attached mode, otherwise a new stats
+     */
+    public WatchStats removeMode(WatcherMode mode) {
+        int mask = ~modeToFlag(mode);
+        int flags = this.flags & mask;
+        if (flags == 0) {
+            return NONE;
+        }
+        return WATCH_STATS[flags];
+    }
+
+    /**
+     * Check whether given mode is attached to this node.
+     *
+     * @param mode watcher mode
+     * @return true if given mode is attached to this node.
+     */
+    public boolean hasMode(WatcherMode mode) {
+        int flags = modeToFlag(mode);
+        return (this.flags & flags) != 0;
+    }
+}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatcherCleaner.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatcherCleaner.java
index 1f809cf4919..c3b7e602f1c 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatcherCleaner.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatcherCleaner.java
@@ -19,8 +19,8 @@
 package org.apache.zookeeper.server.watch;
 
 import java.util.HashSet;
-import java.util.Random;
 import java.util.Set;
+import java.util.concurrent.ThreadLocalRandom;
 import java.util.concurrent.atomic.AtomicInteger;
 import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.server.RateLogger;
@@ -50,7 +50,6 @@ public class WatcherCleaner extends Thread {
     private volatile boolean stopped = false;
     private final Object cleanEvent = new Object();
     private final Object processingCompletedEvent = new Object();
-    private final Random r = new Random(System.nanoTime());
     private final WorkerService cleaners;
 
     private final Set<Integer> deadWatchers;
@@ -81,7 +80,7 @@ public WatcherCleaner(IDeadWatcherListener listener, int watcherCleanThreshold,
                 maxInProcessingDeadWatchers);
         }
         this.maxInProcessingDeadWatchers = maxInProcessingDeadWatchers;
-        this.deadWatchers = new HashSet<Integer>();
+        this.deadWatchers = new HashSet<>();
         this.cleaners = new WorkerService("DeadWatcherCleanner", watcherCleanThreadsNum, false);
 
         LOG.info(
@@ -133,7 +132,7 @@ public void run() {
                     // same time in the quorum
                     if (!stopped && deadWatchers.size() < watcherCleanThreshold) {
                         int maxWaitMs = (watcherCleanIntervalInSeconds
-                                         + r.nextInt(watcherCleanIntervalInSeconds / 2 + 1)) * 1000;
+                                         + ThreadLocalRandom.current().nextInt(watcherCleanIntervalInSeconds / 2 + 1)) * 1000;
                         cleanEvent.wait(maxWaitMs);
                     }
                 } catch (InterruptedException e) {
@@ -152,7 +151,7 @@ public void run() {
                 // there are millions of watches, that's why we're doing lazily
                 // batch clean up in a separate thread with a snapshot of the
                 // current dead watchers.
-                final Set<Integer> snapshot = new HashSet<Integer>(deadWatchers);
+                final Set<Integer> snapshot = new HashSet<>(deadWatchers);
                 deadWatchers.clear();
                 int total = snapshot.size();
                 LOG.info("Processing {} dead watchers", total);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatcherMode.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatcherMode.java
index b8a1dda7408..e05ba900e51 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatcherMode.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatcherMode.java
@@ -23,7 +23,7 @@
 public enum WatcherMode {
     STANDARD(false, false),
     PERSISTENT(true, false),
-    PERSISTENT_RECURSIVE(true, true)
+    PERSISTENT_RECURSIVE(true, true),
     ;
 
     public static final WatcherMode DEFAULT_WATCHER_MODE = WatcherMode.STANDARD;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatcherModeManager.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatcherModeManager.java
deleted file mode 100644
index c1a8225f8ae..00000000000
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatcherModeManager.java
+++ /dev/null
@@ -1,96 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- * <p>
- * http://www.apache.org/licenses/LICENSE-2.0
- * <p>
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.apache.zookeeper.server.watch;
-
-import java.util.Map;
-import java.util.Objects;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.atomic.AtomicInteger;
-import org.apache.zookeeper.Watcher;
-
-class WatcherModeManager {
-    private final Map<Key, WatcherMode> watcherModes = new ConcurrentHashMap<>();
-    private final AtomicInteger recursiveQty = new AtomicInteger(0);
-
-    private static class Key {
-        private final Watcher watcher;
-        private final String path;
-
-        Key(Watcher watcher, String path) {
-            this.watcher = watcher;
-            this.path = path;
-        }
-
-        @Override
-        public boolean equals(Object o) {
-            if (this == o) {
-                return true;
-            }
-            if (o == null || getClass() != o.getClass()) {
-                return false;
-            }
-            Key key = (Key) o;
-            return watcher.equals(key.watcher) && path.equals(key.path);
-        }
-
-        @Override
-        public int hashCode() {
-            return Objects.hash(watcher, path);
-        }
-    }
-
-    // VisibleForTesting
-    Map<Key, WatcherMode> getWatcherModes() {
-        return watcherModes;
-    }
-
-    void setWatcherMode(Watcher watcher, String path, WatcherMode mode) {
-        if (mode == WatcherMode.DEFAULT_WATCHER_MODE) {
-            removeWatcher(watcher, path);
-        } else {
-            adjustRecursiveQty(watcherModes.put(new Key(watcher, path), mode), mode);
-        }
-    }
-
-    WatcherMode getWatcherMode(Watcher watcher, String path) {
-        return watcherModes.getOrDefault(new Key(watcher, path), WatcherMode.DEFAULT_WATCHER_MODE);
-    }
-
-    void removeWatcher(Watcher watcher, String path) {
-        adjustRecursiveQty(watcherModes.remove(new Key(watcher, path)), WatcherMode.DEFAULT_WATCHER_MODE);
-    }
-
-    int getRecursiveQty() {
-        return recursiveQty.get();
-    }
-
-    // recursiveQty is an optimization to avoid having to walk the map every time this value is needed
-    private void adjustRecursiveQty(WatcherMode oldMode, WatcherMode newMode) {
-        if (oldMode == null) {
-            oldMode = WatcherMode.DEFAULT_WATCHER_MODE;
-        }
-        if (oldMode.isRecursive() != newMode.isRecursive()) {
-            if (newMode.isRecursive()) {
-                recursiveQty.incrementAndGet();
-            } else {
-                recursiveQty.decrementAndGet();
-            }
-        }
-    }
-}
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchesPathReport.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchesPathReport.java
index 9d244b07609..527d75b12d8 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchesPathReport.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchesPathReport.java
@@ -42,9 +42,9 @@ public class WatchesPathReport {
     }
 
     private static Map<String, Set<Long>> deepCopy(Map<String, Set<Long>> m) {
-        Map<String, Set<Long>> m2 = new HashMap<String, Set<Long>>();
+        Map<String, Set<Long>> m2 = new HashMap<>();
         for (Map.Entry<String, Set<Long>> e : m.entrySet()) {
-            m2.put(e.getKey(), new HashSet<Long>(e.getValue()));
+            m2.put(e.getKey(), new HashSet<>(e.getValue()));
         }
         return m2;
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchesReport.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchesReport.java
index e506143f1d1..1f3519bc9e6 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchesReport.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchesReport.java
@@ -42,9 +42,9 @@ public class WatchesReport {
     }
 
     private static Map<Long, Set<String>> deepCopy(Map<Long, Set<String>> m) {
-        Map<Long, Set<String>> m2 = new HashMap<Long, Set<String>>();
+        Map<Long, Set<String>> m2 = new HashMap<>();
         for (Map.Entry<Long, Set<String>> e : m.entrySet()) {
-            m2.put(e.getKey(), new HashSet<String>(e.getValue()));
+            m2.put(e.getKey(), new HashSet<>(e.getValue()));
         }
         return m2;
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchesSummary.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchesSummary.java
index 9cd36ca16de..f423a9c97a2 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchesSummary.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/watch/WatchesSummary.java
@@ -89,7 +89,7 @@ public int getTotalWatches() {
      * @return map representation of summary
      */
     public Map<String, Object> toMap() {
-        Map<String, Object> summary = new LinkedHashMap<String, Object>();
+        Map<String, Object> summary = new LinkedHashMap<>();
         summary.put(KEY_NUM_CONNECTIONS, numConnections);
         summary.put(KEY_NUM_PATHS, numPaths);
         summary.put(KEY_NUM_TOTAL_WATCHES, totalWatches);
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/util/PemReader.java b/zookeeper-server/src/main/java/org/apache/zookeeper/util/PemReader.java
index 9ab2241864b..20e4adc6ea2 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/util/PemReader.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/util/PemReader.java
@@ -49,7 +49,6 @@
 import javax.crypto.SecretKey;
 import javax.crypto.SecretKeyFactory;
 import javax.crypto.spec.PBEKeySpec;
-import javax.security.auth.x500.X500Principal;
 
 /**
  * Note: this class is copied from io.airlift.security.pem.PemReader (see
@@ -67,21 +66,21 @@
 public final class PemReader {
 
     private static final Pattern CERT_PATTERN = Pattern.compile(
-        "-+BEGIN\\s+.*CERTIFICATE[^-]*-+(?:\\s|\\r|\\n)+" + // Header
-        "([a-z0-9+/=\\r\\n]+)" +                    // Base64 text
-        "-+END\\s+.*CERTIFICATE[^-]*-+",            // Footer
+        "-+BEGIN\\s+.*CERTIFICATE[^-]*-+(?:\\s|\\r|\\n)+" // Header
+        + "([a-z0-9+/=\\r\\n]+)"                     // Base64 text
+        + "-+END\\s+.*CERTIFICATE[^-]*-+",           // Footer
         CASE_INSENSITIVE);
 
     private static final Pattern PRIVATE_KEY_PATTERN = Pattern.compile(
-        "-+BEGIN\\s+.*PRIVATE\\s+KEY[^-]*-+(?:\\s|\\r|\\n)+" + // Header
-        "([a-z0-9+/=\\r\\n]+)" +                       // Base64 text
-        "-+END\\s+.*PRIVATE\\s+KEY[^-]*-+",            // Footer
+        "-+BEGIN\\s+.*PRIVATE\\s+KEY[^-]*-+(?:\\s|\\r|\\n)+" // Header
+        + "([a-z0-9+/=\\r\\n]+)"                       // Base64 text
+        + "-+END\\s+.*PRIVATE\\s+KEY[^-]*-+",            // Footer
         CASE_INSENSITIVE);
 
     private static final Pattern PUBLIC_KEY_PATTERN = Pattern.compile(
-        "-+BEGIN\\s+.*PUBLIC\\s+KEY[^-]*-+(?:\\s|\\r|\\n)+" + // Header
-        "([a-z0-9+/=\\r\\n]+)" +                      // Base64 text
-        "-+END\\s+.*PUBLIC\\s+KEY[^-]*-+",            // Footer
+        "-+BEGIN\\s+.*PUBLIC\\s+KEY[^-]*-+(?:\\s|\\r|\\n)+" // Header
+        + "([a-z0-9+/=\\r\\n]+)"                      // Base64 text
+        + "-+END\\s+.*PUBLIC\\s+KEY[^-]*-+",            // Footer
         CASE_INSENSITIVE);
 
     private PemReader() {
@@ -93,8 +92,13 @@ public static KeyStore loadTrustStore(File certificateChainFile) throws IOExcept
 
         List<X509Certificate> certificateChain = readCertificateChain(certificateChainFile);
         for (X509Certificate certificate : certificateChain) {
-            X500Principal principal = certificate.getSubjectX500Principal();
-            keyStore.setCertificateEntry(principal.getName("RFC2253"), certificate);
+            String subject = certificate.getSubjectX500Principal().getName("RFC2253");
+            String alias = subject;
+            // Append a suffix alias-1, alias-2 ... if the same alias (subject) already exists.
+            for (int i = 1; keyStore.containsAlias(alias); i++) {
+                alias = subject + "-" + i;
+            }
+            keyStore.setCertificateEntry(alias, certificate);
         }
         return keyStore;
     }
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/util/SecurityUtils.java b/zookeeper-server/src/main/java/org/apache/zookeeper/util/SecurityUtils.java
index 6ac3fff2a40..e29dabcf01a 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/util/SecurityUtils.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/util/SecurityUtils.java
@@ -28,6 +28,8 @@
 import javax.security.sasl.SaslException;
 import javax.security.sasl.SaslServer;
 import org.apache.zookeeper.SaslClientCallbackHandler;
+import org.apache.zookeeper.common.X509Util;
+import org.apache.zookeeper.common.ZKConfig;
 import org.apache.zookeeper.server.auth.KerberosName;
 import org.ietf.jgss.GSSContext;
 import org.ietf.jgss.GSSCredential;
@@ -55,6 +57,7 @@ public final class SecurityUtils {
      * @throws SaslException
      */
     public static SaslClient createSaslClient(
+        ZKConfig config,
         final Subject subject,
         final String servicePrincipal,
         final String protocol,
@@ -67,6 +70,11 @@ public static SaslClient createSaslClient(
         if (subject.getPrincipals().isEmpty()) {
             // no principals: must not be GSSAPI: use DIGEST-MD5 mechanism
             // instead.
+            // FIPS-mode: don't try DIGEST-MD5, just return error
+            if (X509Util.getFipsMode(config)) {
+                LOG.warn("{} will not use DIGEST-MD5 as SASL mechanism, because FIPS mode is enabled.", entity);
+                return null;
+            }
             LOG.info("{} will use DIGEST-MD5 as SASL mechanism.", entity);
             String[] mechs = {"DIGEST-MD5"};
             String username = (String) (subject.getPublicCredentials().toArray()[0]);
@@ -145,6 +153,7 @@ public SaslClient run() throws SaslException {
     /**
      * Create an instance of a SaslServer. It will return null if there is an exception.
      *
+     * @param config to check whether FIPS mode is enabled.
      * @param subject subject
      * @param protocol protocol
      * @param serverName server name
@@ -153,6 +162,7 @@ public SaslClient run() throws SaslException {
      * @return sasl server object
      */
     public static SaslServer createSaslServer(
+        final ZKConfig config,
         final Subject subject,
         final String protocol,
         final String serverName,
@@ -243,6 +253,11 @@ public SaslServer run() {
                 // JAAS non-GSSAPI authentication: assuming and supporting only
                 // DIGEST-MD5 mechanism for now.
                 // TODO: use 'authMech=' value in zoo.cfg.
+                // FIPS-mode: don't try DIGEST-MD5, just return error
+                if (X509Util.getFipsMode(config)) {
+                    LOG.warn("SaslServer will not use DIGEST-MD5 as SASL mechanism, because FIPS mode is enabled.");
+                    return null;
+                }
                 try {
                     SaslServer saslServer = Sasl.createSaslServer("DIGEST-MD5", protocol, serverName, null, callbackHandler);
                     return saslServer;
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/util/ServiceUtils.java b/zookeeper-server/src/main/java/org/apache/zookeeper/util/ServiceUtils.java
index 68a25ebb487..944bbc03cd9 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/util/ServiceUtils.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/util/ServiceUtils.java
@@ -39,7 +39,14 @@ private ServiceUtils() {
      */
     @SuppressFBWarnings("DM_EXIT")
     public static final Consumer<Integer> SYSTEM_EXIT = (code) -> {
-        LOG.error("Exiting JVM with code {}", code);
+        String msg = "Exiting JVM with code {}";
+        if (code == 0) {
+            // JVM exits normally
+            LOG.info(msg, code);
+        } else {
+            // JVM exits with error
+            LOG.error(msg, code);
+        }
         System.exit(code);
     };
 
@@ -47,11 +54,15 @@ private ServiceUtils() {
      * No-op strategy, useful for tests.
      */
     public static final Consumer<Integer> LOG_ONLY = (code) -> {
-        LOG.error("Fatal error, JVM should exit with code {}. "
+        if (code != 0) {
+            LOG.error("Fatal error, JVM should exit with code {}. "
                 + "Actually System.exit is disabled", code);
+        } else {
+            LOG.info("JVM should exit with code {}. Actually System.exit is disabled", code);
+        }
     };
 
-    private static Consumer<Integer> systemExitProcedure = SYSTEM_EXIT;
+    private static volatile Consumer<Integer> systemExitProcedure = SYSTEM_EXIT;
 
     /**
      * Override system callback. Useful for preventing the JVM to exit in tests
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/version/util/VerGen.java b/zookeeper-server/src/main/java/org/apache/zookeeper/version/util/VerGen.java
deleted file mode 100644
index 25bffd72866..00000000000
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/version/util/VerGen.java
+++ /dev/null
@@ -1,201 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.apache.zookeeper.version.util;
-
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
-import java.io.File;
-import java.io.FileWriter;
-import java.io.IOException;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
-import org.apache.zookeeper.server.ExitCode;
-
-@SuppressFBWarnings("DM_EXIT")
-public class VerGen {
-
-    private static final String PACKAGE_NAME = "org.apache.zookeeper.version";
-    private static final String VERSION_CLASS_NAME = "VersionInfoMain";
-    private static final String VERSION_INTERFACE_NAME = "Info";
-
-    static void printUsage() {
-        System.out.print("Usage:\tjava  -cp <classpath> org.apache.zookeeper."
-                         + "version.util.VerGen maj.min.micro[-qualifier] rev buildDate outputDirectory");
-        System.exit(ExitCode.UNEXPECTED_ERROR.getValue());
-    }
-
-    public static void generateFile(File outputDir, Version version, String rev, String buildDate) {
-        String path = PACKAGE_NAME.replaceAll("\\.", "/");
-        File pkgdir = new File(outputDir, path);
-        if (!pkgdir.exists()) {
-            // create the pkg directory
-            boolean ret = pkgdir.mkdirs();
-            if (!ret) {
-                System.out.println("Cannnot create directory: " + path);
-                System.exit(ExitCode.UNEXPECTED_ERROR.getValue());
-            }
-        } else if (!pkgdir.isDirectory()) {
-            // not a directory
-            System.out.println(path + " is not a directory.");
-            System.exit(ExitCode.UNEXPECTED_ERROR.getValue());
-        }
-
-        try (FileWriter w = new FileWriter(new File(pkgdir, VERSION_INTERFACE_NAME + ".java"))) {
-            w.write("// Do not edit!\n// File generated by org.apache.zookeeper" + ".version.util.VerGen.\n");
-            w.write("/**\n");
-            w.write("* Licensed to the Apache Software Foundation (ASF) under one\n");
-            w.write("* or more contributor license agreements.  See the NOTICE file\n");
-            w.write("* distributed with this work for additional information\n");
-            w.write("* regarding copyright ownership.  The ASF licenses this file\n");
-            w.write("* to you under the Apache License, Version 2.0 (the\n");
-            w.write("* \"License\"); you may not use this file except in compliance\n");
-            w.write("* with the License.  You may obtain a copy of the License at\n");
-            w.write("*\n");
-            w.write("*     http://www.apache.org/licenses/LICENSE-2.0\n");
-            w.write("*\n");
-            w.write("* Unless required by applicable law or agreed to in writing, software\n");
-            w.write("* distributed under the License is distributed on an \"AS IS\" BASIS,\n");
-            w.write("* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n");
-            w.write("* See the License for the specific language governing permissions and\n");
-            w.write("* limitations under the License.\n");
-            w.write("*/\n");
-            w.write("\n");
-            w.write("package " + PACKAGE_NAME + ";\n\n");
-            w.write("public interface " + VERSION_INTERFACE_NAME + " {\n");
-            w.write("    int MAJOR=" + version.maj + ";\n");
-            w.write("    int MINOR=" + version.min + ";\n");
-            w.write("    int MICRO=" + version.micro + ";\n");
-            w.write("    String QUALIFIER=" + (version.qualifier == null ? "\"\"" : "\"" + version.qualifier + "\"") + ";\n");
-            if (rev.equals("-1")) {
-                System.out.println("Unknown REVISION number, using " + rev);
-            }
-            w.write("    String REVISION_HASH=\"" + rev + "\";\n");
-            w.write("    String BUILD_DATE=\"" + buildDate + "\";\n");
-            w.write("}\n");
-        } catch (IOException e) {
-            System.out.println("Unable to generate version.Info file: " + e.getMessage());
-            System.exit(ExitCode.UNEXPECTED_ERROR.getValue());
-        }
-
-        // Generate a main class to display version data
-        // that can be exec'd in zkServer.sh
-        try (FileWriter w = new FileWriter(new File(pkgdir, VERSION_CLASS_NAME + ".java"))) {
-            w.write("// Do not edit!\n// File generated by org.apache.zookeeper" + ".version.util.VerGen.\n");
-            w.write("/**\n");
-            w.write("* Licensed to the Apache Software Foundation (ASF) under one\n");
-            w.write("* or more contributor license agreements.  See the NOTICE file\n");
-            w.write("* distributed with this work for additional information\n");
-            w.write("* regarding copyright ownership.  The ASF licenses this file\n");
-            w.write("* to you under the Apache License, Version 2.0 (the\n");
-            w.write("* \"License\"); you may not use this file except in compliance\n");
-            w.write("* with the License.  You may obtain a copy of the License at\n");
-            w.write("*\n");
-            w.write("*     http://www.apache.org/licenses/LICENSE-2.0\n");
-            w.write("*\n");
-            w.write("* Unless required by applicable law or agreed to in writing, software\n");
-            w.write("* distributed under the License is distributed on an \"AS IS\" BASIS,\n");
-            w.write("* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n");
-            w.write("* See the License for the specific language governing permissions and\n");
-            w.write("* limitations under the License.\n");
-            w.write("*/\n");
-            w.write("\n");
-            w.write("package " + PACKAGE_NAME + ";\n\n");
-            w.write("public class " + VERSION_CLASS_NAME + " implements " + PACKAGE_NAME + ".Info {\n");
-            w.write("    public static void main(String[] args) {\n");
-            w.write("        final String VER_STRING = MAJOR + \".\" + MINOR + \".\" + MICRO +");
-            w.write("            (QUALIFIER == null ? \"\" : \"-\" + QUALIFIER)  + \" \" +");
-            w.write("            BUILD_DATE;" + "\n");
-            w.write("        System.out.println(\"Apache ZooKeeper, version \" + VER_STRING);\n");
-            w.write("    }\n");
-            w.write("}\n");
-        } catch (IOException e) {
-            System.out.println("Unable to generate version.VersionInfoMain file: " + e.getMessage());
-            System.exit(ExitCode.UNEXPECTED_ERROR.getValue());
-        }
-    }
-
-    public static class Version {
-
-        public int maj;
-        public int min;
-        public int micro;
-        public String qualifier;
-
-    }
-
-    public static Version parseVersionString(String input) {
-        Version result = new Version();
-
-        Pattern p = Pattern.compile("^(\\d+)\\.(\\d+)\\.(\\d+)((\\.\\d+)*)(-(.+))?$");
-        Matcher m = p.matcher(input);
-
-        if (!m.matches()) {
-            return null;
-        }
-        result.maj = Integer.parseInt(m.group(1));
-        result.min = Integer.parseInt(m.group(2));
-        result.micro = Integer.parseInt(m.group(3));
-        if (m.groupCount() == 7) {
-            result.qualifier = m.group(7);
-        } else {
-            result.qualifier = null;
-        }
-        return result;
-    }
-
-    /**
-     * Emits a org.apache.zookeeper.version.Info interface file with version and
-     * revision information constants set to the values passed in as command
-     * line parameters. The file is created in the current directory. <br>
-     * Usage: java org.apache.zookeeper.version.util.VerGen maj.min.micro[-qualifier]
-     * rev buildDate
-     *
-     * @param args
-     *            <ul>
-     *            <li>maj - major version number
-     *            <li>min - minor version number
-     *            <li>micro - minor minor version number
-     *            <li>qualifier - optional qualifier (dash followed by qualifier text)
-     *            <li>rev - current Git revision number
-     *            <li>buildDate - date the build
-     *            </ul>
-     */
-    public static void main(String[] args) {
-        if (args.length != 4) {
-            printUsage();
-        }
-        try {
-            Version version = parseVersionString(args[0]);
-            if (version == null) {
-                System.err.println("Invalid version number format, must be \"x.y.z(-.*)?\"");
-                System.exit(ExitCode.UNEXPECTED_ERROR.getValue());
-            }
-            String rev = args[1];
-            if (rev == null || rev.trim().isEmpty()) {
-                rev = "-1";
-            } else {
-                rev = rev.trim();
-            }
-            generateFile(new File(args[3]), version, rev, args[2]);
-        } catch (NumberFormatException e) {
-            System.err.println("All version-related parameters must be valid integers!");
-            throw e;
-        }
-    }
-
-}
diff --git a/zookeeper-server/src/main/resources/LICENSE.txt b/zookeeper-server/src/main/resources/LICENSE.txt
index b1264c0ec4d..76741750a67 100644
--- a/zookeeper-server/src/main/resources/LICENSE.txt
+++ b/zookeeper-server/src/main/resources/LICENSE.txt
@@ -206,19 +206,10 @@ This distribution bundles javacc, which is available under the
 3-clause BSD License. For details, see a copy of the license in
 lib/javacc.LICENSE.txt
 
-This distribution bundles jline 2.11, which is available under the
-2-clause BSD License. For details, see a copy of the license in
-lib/jline-2.11.LICENSE.txt
+This distribution bundles jline 3.25.1, which is available under the
+3-clause BSD License. For details, see a copy of the license in
+lib/jline-3.25.1.LICENSE.txt
 
-This distribution bundles SLF4J 1.7.5, which is available under the MIT
+This distribution bundles SLF4J 2.0.13, which is available under the MIT
 License. For details, see a copy of the license in
-lib/slf4j-1.7.5.LICENSE.txt
-
-This distribution bundles json-simple v1.1.1, which is available under the
-Apache Software License, Version 2.0. For details, see a copy of the license in
-lib/json-simple-1.1.1.LICENSE.txt
-
-This distribution bundles a modified version of 'JZLib' as part of
-Netty-3.7.0, which is available under the 3-clause BSD licence. For
-details, see a copy of the licence in META-INF/license/LICENSE-jzlib.txt
-as part of the Netty jar in lib/netty-3.7.0.Final.jar.
+lib/slf4j-2.0.13.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/NOTICE.txt b/zookeeper-server/src/main/resources/NOTICE.txt
index 4900830b30f..03601608eba 100644
--- a/zookeeper-server/src/main/resources/NOTICE.txt
+++ b/zookeeper-server/src/main/resources/NOTICE.txt
@@ -1,5 +1,5 @@
 Apache ZooKeeper
-Copyright 2009-2020 The Apache Software Foundation
+Copyright 2009-2021 The Apache Software Foundation
 
 This product includes software developed at
 The Apache Software Foundation (http://www.apache.org/).
@@ -11,10 +11,10 @@ for Airlift code can be found at:
 https://github.com/airlift/airlift/blob/master/LICENSE
 
 This product includes software developed by
-The Netty Project (http://netty.io/)
-Copyright 2011 The Netty Project
-
-The Netty NOTICE file contains the following items:
+The Netty Project (http://netty.io/) Copyright 2011 The Netty Project
+The Netty NOTICE file (https://github.com/netty/netty/blob/4.1/NOTICE.txt)
+contains the following items:
+---------------- start of netty NOTICE file ----------------
 This product contains the extensions to Java Collections Framework which has
 been derived from the works by JSR-166 EG, Doug Lea, and Jason T. Greene:
 
@@ -32,29 +32,112 @@ Base64 Encoder and Decoder, which can be obtained at:
   * HOMEPAGE:
     * http://iharder.sourceforge.net/current/java/base64/
 
-This product contains a modified version of 'JZlib', a re-implementation of
-zlib in pure Java, which can be obtained at:
+This product contains a modified portion of 'Webbit', an event based
+WebSocket and HTTP server, which can be obtained at:
+
+  * LICENSE:
+    * license/LICENSE.webbit.txt (BSD License)
+  * HOMEPAGE:
+    * https://github.com/joewalnes/webbit
+
+This product contains a modified portion of 'SLF4J', a simple logging
+facade for Java, which can be obtained at:
+
+  * LICENSE:
+    * license/LICENSE.slf4j.txt (MIT License)
+  * HOMEPAGE:
+    * https://www.slf4j.org/
+
+This product contains a modified portion of 'Apache Harmony', an open source
+Java SE, which can be obtained at:
 
+  * NOTICE:
+    * license/NOTICE.harmony.txt
   * LICENSE:
-    * license/LICENSE.jzlib.txt (BSD Style License)
+    * license/LICENSE.harmony.txt (Apache License 2.0)
+  * HOMEPAGE:
+    * https://archive.apache.org/dist/harmony/
+
+This product contains a modified portion of 'jbzip2', a Java bzip2 compression
+and decompression library written by Matthew J. Francis. It can be obtained at:
+
+  * LICENSE:
+    * license/LICENSE.jbzip2.txt (MIT License)
+  * HOMEPAGE:
+    * https://code.google.com/p/jbzip2/
+
+This product contains a modified portion of 'libdivsufsort', a C API library to construct
+the suffix array and the Burrows-Wheeler transformed string for any input string of
+a constant-size alphabet written by Yuta Mori. It can be obtained at:
+
+  * LICENSE:
+    * license/LICENSE.libdivsufsort.txt (MIT License)
+  * HOMEPAGE:
+    * https://github.com/y-256/libdivsufsort
+
+This product contains a modified portion of Nitsan Wakart's 'JCTools', Java Concurrency Tools for the JVM,
+ which can be obtained at:
+
+  * LICENSE:
+    * license/LICENSE.jctools.txt (ASL2 License)
+  * HOMEPAGE:
+    * https://github.com/JCTools/JCTools
+
+This product optionally depends on 'JZlib', a re-implementation of zlib in
+pure Java, which can be obtained at:
+
+  * LICENSE:
+    * license/LICENSE.jzlib.txt (BSD style License)
   * HOMEPAGE:
     * http://www.jcraft.com/jzlib/
 
-This product contains a modified version of 'Webbit', a Java event based
-WebSocket and HTTP server:
+This product optionally depends on 'Compress-LZF', a Java library for encoding and
+decoding data in LZF format, written by Tatu Saloranta. It can be obtained at:
 
   * LICENSE:
-    * license/LICENSE.webbit.txt (BSD License)
+    * license/LICENSE.compress-lzf.txt (Apache License 2.0)
   * HOMEPAGE:
-    * https://github.com/joewalnes/webbit
+    * https://github.com/ning/compress
+
+This product optionally depends on 'lz4', a LZ4 Java compression
+and decompression library written by Adrien Grand. It can be obtained at:
+
+  * LICENSE:
+    * license/LICENSE.lz4.txt (Apache License 2.0)
+  * HOMEPAGE:
+    * https://github.com/jpountz/lz4-java
+
+This product optionally depends on 'lzma-java', a LZMA Java compression
+and decompression library, which can be obtained at:
 
-This product optionally depends on 'Protocol Buffers', Google's data
+  * LICENSE:
+    * license/LICENSE.lzma-java.txt (Apache License 2.0)
+  * HOMEPAGE:
+    * https://github.com/jponge/lzma-java
+
+This product optionally depends on 'zstd-jni', a zstd-jni Java compression
+and decompression library, which can be obtained at:
+
+  * LICENSE:
+    * license/LICENSE.zstd-jni.txt (Apache License 2.0)
+  * HOMEPAGE:
+    * https://github.com/luben/zstd-jni
+
+This product contains a modified portion of 'jfastlz', a Java port of FastLZ compression
+and decompression library written by William Kinney. It can be obtained at:
+
+  * LICENSE:
+    * license/LICENSE.jfastlz.txt (MIT License)
+  * HOMEPAGE:
+    * https://code.google.com/p/jfastlz/
+
+This product contains a modified portion of and optionally depends on 'Protocol Buffers', Google's data
 interchange format, which can be obtained at:
 
   * LICENSE:
     * license/LICENSE.protobuf.txt (New BSD License)
   * HOMEPAGE:
-    * http://code.google.com/p/protobuf/
+    * https://github.com/google/protobuf
 
 This product optionally depends on 'Bouncy Castle Crypto APIs' to generate
 a temporary self-signed X.509 certificate when the JVM does not provide the
@@ -63,15 +146,31 @@ equivalent functionality.  It can be obtained at:
   * LICENSE:
     * license/LICENSE.bouncycastle.txt (MIT License)
   * HOMEPAGE:
-    * http://www.bouncycastle.org/
+    * https://www.bouncycastle.org/
 
-This product optionally depends on 'SLF4J', a simple logging facade for Java,
-which can be obtained at:
+This product optionally depends on 'Snappy', a compression library produced
+by Google Inc, which can be obtained at:
 
   * LICENSE:
-    * license/LICENSE.slf4j.txt (MIT License)
+    * license/LICENSE.snappy.txt (New BSD License)
   * HOMEPAGE:
-    * http://www.slf4j.org/
+    * https://github.com/google/snappy
+
+This product optionally depends on 'JBoss Marshalling', an alternative Java
+serialization API, which can be obtained at:
+
+  * LICENSE:
+    * license/LICENSE.jboss-marshalling.txt (Apache License 2.0)
+  * HOMEPAGE:
+    * https://github.com/jboss-remoting/jboss-marshalling
+
+This product optionally depends on 'Caliper', Google's micro-
+benchmarking framework, which can be obtained at:
+
+  * LICENSE:
+    * license/LICENSE.caliper.txt (Apache License 2.0)
+  * HOMEPAGE:
+    * https://github.com/google/caliper
 
 This product optionally depends on 'Apache Commons Logging', a logging
 framework, which can be obtained at:
@@ -79,61 +178,79 @@ framework, which can be obtained at:
   * LICENSE:
     * license/LICENSE.commons-logging.txt (Apache License 2.0)
   * HOMEPAGE:
-    * http://commons.apache.org/logging/
+    * https://commons.apache.org/logging/
 
-This product optionally depends on 'Apache Log4J', a logging framework,
-which can be obtained at:
+This product optionally depends on 'Apache Log4J', a logging framework, which
+can be obtained at:
 
   * LICENSE:
     * license/LICENSE.log4j.txt (Apache License 2.0)
   * HOMEPAGE:
-    * http://logging.apache.org/log4j/
+    * https://logging.apache.org/log4j/
 
-This product optionally depends on 'JBoss Logging', a logging framework,
-which can be obtained at:
+This product optionally depends on 'Aalto XML', an ultra-high performance
+non-blocking XML processor, which can be obtained at:
 
   * LICENSE:
-    * license/LICENSE.jboss-logging.txt (GNU LGPL 2.1)
+    * license/LICENSE.aalto-xml.txt (Apache License 2.0)
   * HOMEPAGE:
-    * http://anonsvn.jboss.org/repos/common/common-logging-spi/
+    * https://wiki.fasterxml.com/AaltoHome
 
-This product optionally depends on 'Apache Felix', an open source OSGi
-framework implementation, which can be obtained at:
+This product contains a modified version of 'HPACK', a Java implementation of
+the HTTP/2 HPACK algorithm written by Twitter. It can be obtained at:
 
   * LICENSE:
-    * license/LICENSE.felix.txt (Apache License 2.0)
+    * license/LICENSE.hpack.txt (Apache License 2.0)
   * HOMEPAGE:
-    * http://felix.apache.org/
+    * https://github.com/twitter/hpack
 
-The bundled library Metrics Core NOTICE file reports the following items
+This product contains a modified version of 'HPACK', a Java implementation of
+the HTTP/2 HPACK algorithm written by Cory Benfield. It can be obtained at:
 
-Metrics
-Copyright 2010-2013 Coda Hale and Yammer, Inc.
+  * LICENSE:
+    * license/LICENSE.hyper-hpack.txt (MIT License)
+  * HOMEPAGE:
+    * https://github.com/python-hyper/hpack/
 
-This product includes software developed by Coda Hale and Yammer, Inc.
+This product contains a modified version of 'HPACK', a Java implementation of
+the HTTP/2 HPACK algorithm written by Tatsuhiro Tsujikawa. It can be obtained at:
 
-This product includes code derived from the JSR-166 project (ThreadLocalRandom, Striped64,
-LongAdder), which was released with the following comments:
+  * LICENSE:
+    * license/LICENSE.nghttp2-hpack.txt (MIT License)
+  * HOMEPAGE:
+    * https://github.com/nghttp2/nghttp2/
 
-    Written by Doug Lea with assistance from members of JCP JSR-166
-    Expert Group and released to the public domain, as explained at
-    http://creativecommons.org/publicdomain/zero/1.0/
+This product contains a modified portion of 'Apache Commons Lang', a Java library
+provides utilities for the java.lang API, which can be obtained at:
 
-The Nappy Java NOTICE file reports the following items:
+  * LICENSE:
+    * license/LICENSE.commons-lang.txt (Apache License 2.0)
+  * HOMEPAGE:
+    * https://commons.apache.org/proper/commons-lang/
 
-This product includes software developed by Google
- Snappy: http://code.google.com/p/snappy/ (New BSD License)
 
-This product includes software developed by Apache
- PureJavaCrc32C from apache-hadoop-common http://hadoop.apache.org/
- (Apache 2.0 license)
+This product contains the Maven wrapper scripts from 'Maven Wrapper', that provides an easy way to ensure a user has everything necessary to run the Maven build.
 
-This library containd statically linked libstdc++. This inclusion is allowed by
-"GCC RUntime Library Exception"
-http://gcc.gnu.org/onlinedocs/libstdc++/manual/license.html
+  * LICENSE:
+    * license/LICENSE.mvn-wrapper.txt (Apache License 2.0)
+  * HOMEPAGE:
+    * https://github.com/takari/maven-wrapper
+
+This product contains the dnsinfo.h header file, that provides a way to retrieve the system DNS configuration on MacOS.
+This private header is also used by Apple's open source
+ mDNSResponder (https://opensource.apple.com/tarballs/mDNSResponder/).
+
+ * LICENSE:
+    * license/LICENSE.dnsinfo.txt (Apple Public Source License 2.0)
+  * HOMEPAGE:
+    * https://www.opensource.apple.com/source/configd/configd-453.19/dnsinfo/dnsinfo.h
+
+This product optionally depends on 'Brotli4j', Brotli compression and
+decompression for Java., which can be obtained at:
+
+  * LICENSE:
+    * license/LICENSE.brotli4j.txt (Apache License 2.0)
+  * HOMEPAGE:
+    * https://github.com/hyperxpro/Brotli4j
 
-== Contributors ==
-  * Tatu Saloranta
-    * Providing benchmark suite
-  * Alec Wysoker
-    * Performance and memory usage improvement
+---------------- end of netty NOTICE file ----------------
\ No newline at end of file
diff --git a/zookeeper-server/src/main/resources/lastRevision.bat b/zookeeper-server/src/main/resources/lastRevision.bat
deleted file mode 100644
index 68999471db6..00000000000
--- a/zookeeper-server/src/main/resources/lastRevision.bat
+++ /dev/null
@@ -1,22 +0,0 @@
-echo off
-rem Licensed to the Apache Software Foundation (ASF) under one
-rem or more contributor license agreements.  See the NOTICE file
-rem distributed with this work for additional information
-rem regarding copyright ownership.  The ASF licenses this file
-rem to you under the Apache License, Version 2.0 (the
-rem "License"); you may not use this file except in compliance
-rem with the License.  You may obtain a copy of the License at
-rem
-rem     http://www.apache.org/licenses/LICENSE-2.0
-rem
-rem Unless required by applicable law or agreed to in writing, software
-rem distributed under the License is distributed on an "AS IS" BASIS,
-rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-rem See the License for the specific language governing permissions and
-rem limitations under the License.
-
-rem Find the current revision, store it in a file, for DOS
-
-for /f "delims=" %%i in ('git rev-parse HEAD') do set rev=%%i
-       echo lastRevision=%rev% > %1
-)
diff --git a/zookeeper-server/src/main/resources/lastRevision.sh b/zookeeper-server/src/main/resources/lastRevision.sh
deleted file mode 100755
index 0690c7da916..00000000000
--- a/zookeeper-server/src/main/resources/lastRevision.sh
+++ /dev/null
@@ -1,21 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Find the current revision, store it in a file
-FILE=$1
-LASTREV=`git rev-parse HEAD`
-
-echo "lastRevision=${LASTREV}" > $FILE
diff --git a/zookeeper-server/src/main/resources/lib/netty-common-4.1.45.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/commons-cli-1.5.0.LICENSE.txt
similarity index 99%
rename from zookeeper-server/src/main/resources/lib/netty-common-4.1.45.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/commons-cli-1.5.0.LICENSE.txt
index 6279e5206de..6b0b1270ff0 100644
--- a/zookeeper-server/src/main/resources/lib/netty-common-4.1.45.Final.LICENSE.txt
+++ b/zookeeper-server/src/main/resources/lib/commons-cli-1.5.0.LICENSE.txt
@@ -187,7 +187,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright 1999-2005 The Apache Software Foundation
+   Copyright [yyyy] [name of copyright owner]
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.
@@ -200,3 +200,4 @@
    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    See the License for the specific language governing permissions and
    limitations under the License.
+
diff --git a/zookeeper-server/src/main/resources/lib/netty-handler-4.1.45.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/commons-io-2.17.0.LICENSE.txt
similarity index 99%
rename from zookeeper-server/src/main/resources/lib/netty-handler-4.1.45.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/commons-io-2.17.0.LICENSE.txt
index 6279e5206de..6b0b1270ff0 100644
--- a/zookeeper-server/src/main/resources/lib/netty-handler-4.1.45.Final.LICENSE.txt
+++ b/zookeeper-server/src/main/resources/lib/commons-io-2.17.0.LICENSE.txt
@@ -187,7 +187,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright 1999-2005 The Apache Software Foundation
+   Copyright [yyyy] [name of copyright owner]
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.
@@ -200,3 +200,4 @@
    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    See the License for the specific language governing permissions and
    limitations under the License.
+
diff --git a/zookeeper-server/src/main/resources/lib/jetty-client-9.4.58.v20250814.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-client-9.4.58.v20250814.LICENSE.txt
new file mode 100644
index 00000000000..46f4f252464
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/jetty-client-9.4.58.v20250814.LICENSE.txt
@@ -0,0 +1,414 @@
+This program and the accompanying materials are made available under the
+terms of the Eclipse Public License 2.0 which is available at
+http://www.eclipse.org/legal/epl-2.0, or the Apache Software License
+2.0 which is available at https://www.apache.org/licenses/LICENSE-2.0.
+
+
+
+Eclipse Public License - v 1.0
+
+THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
+LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
+CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
+
+1. DEFINITIONS
+
+"Contribution" means:
+
+a) in the case of the initial Contributor, the initial code and documentation
+   distributed under this Agreement, and
+b) in the case of each subsequent Contributor:
+    i) changes to the Program, and
+   ii) additions to the Program;
+
+   where such changes and/or additions to the Program originate from and are
+   distributed by that particular Contributor. A Contribution 'originates'
+   from a Contributor if it was added to the Program by such Contributor
+   itself or anyone acting on such Contributor's behalf. Contributions do not
+   include additions to the Program which: (i) are separate modules of
+   software distributed in conjunction with the Program under their own
+   license agreement, and (ii) are not derivative works of the Program.
+
+"Contributor" means any person or entity that distributes the Program.
+
+"Licensed Patents" mean patent claims licensable by a Contributor which are
+necessarily infringed by the use or sale of its Contribution alone or when
+combined with the Program.
+
+"Program" means the Contributions distributed in accordance with this
+Agreement.
+
+"Recipient" means anyone who receives the Program under this Agreement,
+including all Contributors.
+
+2. GRANT OF RIGHTS
+  a) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free copyright license to
+     reproduce, prepare derivative works of, publicly display, publicly
+     perform, distribute and sublicense the Contribution of such Contributor,
+     if any, and such derivative works, in source code and object code form.
+  b) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free patent license under
+     Licensed Patents to make, use, sell, offer to sell, import and otherwise
+     transfer the Contribution of such Contributor, if any, in source code and
+     object code form. This patent license shall apply to the combination of
+     the Contribution and the Program if, at the time the Contribution is
+     added by the Contributor, such addition of the Contribution causes such
+     combination to be covered by the Licensed Patents. The patent license
+     shall not apply to any other combinations which include the Contribution.
+     No hardware per se is licensed hereunder.
+  c) Recipient understands that although each Contributor grants the licenses
+     to its Contributions set forth herein, no assurances are provided by any
+     Contributor that the Program does not infringe the patent or other
+     intellectual property rights of any other entity. Each Contributor
+     disclaims any liability to Recipient for claims brought by any other
+     entity based on infringement of intellectual property rights or
+     otherwise. As a condition to exercising the rights and licenses granted
+     hereunder, each Recipient hereby assumes sole responsibility to secure
+     any other intellectual property rights needed, if any. For example, if a
+     third party patent license is required to allow Recipient to distribute
+     the Program, it is Recipient's responsibility to acquire that license
+     before distributing the Program.
+  d) Each Contributor represents that to its knowledge it has sufficient
+     copyright rights in its Contribution, if any, to grant the copyright
+     license set forth in this Agreement.
+
+3. REQUIREMENTS
+
+A Contributor may choose to distribute the Program in object code form under
+its own license agreement, provided that:
+
+  a) it complies with the terms and conditions of this Agreement; and
+  b) its license agreement:
+      i) effectively disclaims on behalf of all Contributors all warranties
+         and conditions, express and implied, including warranties or
+         conditions of title and non-infringement, and implied warranties or
+         conditions of merchantability and fitness for a particular purpose;
+     ii) effectively excludes on behalf of all Contributors all liability for
+         damages, including direct, indirect, special, incidental and
+         consequential damages, such as lost profits;
+    iii) states that any provisions which differ from this Agreement are
+         offered by that Contributor alone and not by any other party; and
+     iv) states that source code for the Program is available from such
+         Contributor, and informs licensees how to obtain it in a reasonable
+         manner on or through a medium customarily used for software exchange.
+
+When the Program is made available in source code form:
+
+  a) it must be made available under this Agreement; and
+  b) a copy of this Agreement must be included with each copy of the Program.
+     Contributors may not remove or alter any copyright notices contained
+     within the Program.
+
+Each Contributor must identify itself as the originator of its Contribution,
+if
+any, in a manner that reasonably allows subsequent Recipients to identify the
+originator of the Contribution.
+
+4. COMMERCIAL DISTRIBUTION
+
+Commercial distributors of software may accept certain responsibilities with
+respect to end users, business partners and the like. While this license is
+intended to facilitate the commercial use of the Program, the Contributor who
+includes the Program in a commercial product offering should do so in a manner
+which does not create potential liability for other Contributors. Therefore,
+if a Contributor includes the Program in a commercial product offering, such
+Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
+every other Contributor ("Indemnified Contributor") against any losses,
+damages and costs (collectively "Losses") arising from claims, lawsuits and
+other legal actions brought by a third party against the Indemnified
+Contributor to the extent caused by the acts or omissions of such Commercial
+Contributor in connection with its distribution of the Program in a commercial
+product offering. The obligations in this section do not apply to any claims
+or Losses relating to any actual or alleged intellectual property
+infringement. In order to qualify, an Indemnified Contributor must:
+a) promptly notify the Commercial Contributor in writing of such claim, and
+b) allow the Commercial Contributor to control, and cooperate with the
+Commercial Contributor in, the defense and any related settlement
+negotiations. The Indemnified Contributor may participate in any such claim at
+its own expense.
+
+For example, a Contributor might include the Program in a commercial product
+offering, Product X. That Contributor is then a Commercial Contributor. If
+that Commercial Contributor then makes performance claims, or offers
+warranties related to Product X, those performance claims and warranties are
+such Commercial Contributor's responsibility alone. Under this section, the
+Commercial Contributor would have to defend claims against the other
+Contributors related to those performance claims and warranties, and if a
+court requires any other Contributor to pay any damages as a result, the
+Commercial Contributor must pay those damages.
+
+5. NO WARRANTY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
+IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
+NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each
+Recipient is solely responsible for determining the appropriateness of using
+and distributing the Program and assumes all risks associated with its
+exercise of rights under this Agreement , including but not limited to the
+risks and costs of program errors, compliance with applicable laws, damage to
+or loss of data, programs or equipment, and unavailability or interruption of
+operations.
+
+6. DISCLAIMER OF LIABILITY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
+CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
+LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE
+EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY
+OF SUCH DAMAGES.
+
+7. GENERAL
+
+If any provision of this Agreement is invalid or unenforceable under
+applicable law, it shall not affect the validity or enforceability of the
+remainder of the terms of this Agreement, and without further action by the
+parties hereto, such provision shall be reformed to the minimum extent
+necessary to make such provision valid and enforceable.
+
+If Recipient institutes patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Program itself
+(excluding combinations of the Program with other software or hardware)
+infringes such Recipient's patent(s), then such Recipient's rights granted
+under Section 2(b) shall terminate as of the date such litigation is filed.
+
+All Recipient's rights under this Agreement shall terminate if it fails to
+comply with any of the material terms or conditions of this Agreement and does
+not cure such failure in a reasonable period of time after becoming aware of
+such noncompliance. If all Recipient's rights under this Agreement terminate,
+Recipient agrees to cease use and distribution of the Program as soon as
+reasonably practicable. However, Recipient's obligations under this Agreement
+and any licenses granted by Recipient relating to the Program shall continue
+and survive.
+
+Everyone is permitted to copy and distribute copies of this Agreement, but in
+order to avoid inconsistency the Agreement is copyrighted and may only be
+modified in the following manner. The Agreement Steward reserves the right to
+publish new versions (including revisions) of this Agreement from time to
+time. No one other than the Agreement Steward has the right to modify this
+Agreement. The Eclipse Foundation is the initial Agreement Steward. The
+Eclipse Foundation may assign the responsibility to serve as the Agreement
+Steward to a suitable separate entity. Each new version of the Agreement will
+be given a distinguishing version number. The Program (including
+Contributions) may always be distributed subject to the version of the
+Agreement under which it was received. In addition, after a new version of the
+Agreement is published, Contributor may elect to distribute the Program
+(including its Contributions) under the new version. Except as expressly
+stated in Sections 2(a) and 2(b) above, Recipient receives no rights or
+licenses to the intellectual property of any Contributor under this Agreement,
+whether expressly, by implication, estoppel or otherwise. All rights in the
+Program not expressly granted under this Agreement are reserved.
+
+This Agreement is governed by the laws of the State of New York and the
+intellectual property laws of the United States of America. No party to this
+Agreement will bring a legal action under this Agreement more than one year
+after the cause of action arose. Each party waives its rights to a jury trial in
+any resulting litigation.
+
+
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-http-9.4.58.v20250814.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-http-9.4.58.v20250814.LICENSE.txt
new file mode 100644
index 00000000000..46f4f252464
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/jetty-http-9.4.58.v20250814.LICENSE.txt
@@ -0,0 +1,414 @@
+This program and the accompanying materials are made available under the
+terms of the Eclipse Public License 2.0 which is available at
+http://www.eclipse.org/legal/epl-2.0, or the Apache Software License
+2.0 which is available at https://www.apache.org/licenses/LICENSE-2.0.
+
+
+
+Eclipse Public License - v 1.0
+
+THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
+LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
+CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
+
+1. DEFINITIONS
+
+"Contribution" means:
+
+a) in the case of the initial Contributor, the initial code and documentation
+   distributed under this Agreement, and
+b) in the case of each subsequent Contributor:
+    i) changes to the Program, and
+   ii) additions to the Program;
+
+   where such changes and/or additions to the Program originate from and are
+   distributed by that particular Contributor. A Contribution 'originates'
+   from a Contributor if it was added to the Program by such Contributor
+   itself or anyone acting on such Contributor's behalf. Contributions do not
+   include additions to the Program which: (i) are separate modules of
+   software distributed in conjunction with the Program under their own
+   license agreement, and (ii) are not derivative works of the Program.
+
+"Contributor" means any person or entity that distributes the Program.
+
+"Licensed Patents" mean patent claims licensable by a Contributor which are
+necessarily infringed by the use or sale of its Contribution alone or when
+combined with the Program.
+
+"Program" means the Contributions distributed in accordance with this
+Agreement.
+
+"Recipient" means anyone who receives the Program under this Agreement,
+including all Contributors.
+
+2. GRANT OF RIGHTS
+  a) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free copyright license to
+     reproduce, prepare derivative works of, publicly display, publicly
+     perform, distribute and sublicense the Contribution of such Contributor,
+     if any, and such derivative works, in source code and object code form.
+  b) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free patent license under
+     Licensed Patents to make, use, sell, offer to sell, import and otherwise
+     transfer the Contribution of such Contributor, if any, in source code and
+     object code form. This patent license shall apply to the combination of
+     the Contribution and the Program if, at the time the Contribution is
+     added by the Contributor, such addition of the Contribution causes such
+     combination to be covered by the Licensed Patents. The patent license
+     shall not apply to any other combinations which include the Contribution.
+     No hardware per se is licensed hereunder.
+  c) Recipient understands that although each Contributor grants the licenses
+     to its Contributions set forth herein, no assurances are provided by any
+     Contributor that the Program does not infringe the patent or other
+     intellectual property rights of any other entity. Each Contributor
+     disclaims any liability to Recipient for claims brought by any other
+     entity based on infringement of intellectual property rights or
+     otherwise. As a condition to exercising the rights and licenses granted
+     hereunder, each Recipient hereby assumes sole responsibility to secure
+     any other intellectual property rights needed, if any. For example, if a
+     third party patent license is required to allow Recipient to distribute
+     the Program, it is Recipient's responsibility to acquire that license
+     before distributing the Program.
+  d) Each Contributor represents that to its knowledge it has sufficient
+     copyright rights in its Contribution, if any, to grant the copyright
+     license set forth in this Agreement.
+
+3. REQUIREMENTS
+
+A Contributor may choose to distribute the Program in object code form under
+its own license agreement, provided that:
+
+  a) it complies with the terms and conditions of this Agreement; and
+  b) its license agreement:
+      i) effectively disclaims on behalf of all Contributors all warranties
+         and conditions, express and implied, including warranties or
+         conditions of title and non-infringement, and implied warranties or
+         conditions of merchantability and fitness for a particular purpose;
+     ii) effectively excludes on behalf of all Contributors all liability for
+         damages, including direct, indirect, special, incidental and
+         consequential damages, such as lost profits;
+    iii) states that any provisions which differ from this Agreement are
+         offered by that Contributor alone and not by any other party; and
+     iv) states that source code for the Program is available from such
+         Contributor, and informs licensees how to obtain it in a reasonable
+         manner on or through a medium customarily used for software exchange.
+
+When the Program is made available in source code form:
+
+  a) it must be made available under this Agreement; and
+  b) a copy of this Agreement must be included with each copy of the Program.
+     Contributors may not remove or alter any copyright notices contained
+     within the Program.
+
+Each Contributor must identify itself as the originator of its Contribution,
+if
+any, in a manner that reasonably allows subsequent Recipients to identify the
+originator of the Contribution.
+
+4. COMMERCIAL DISTRIBUTION
+
+Commercial distributors of software may accept certain responsibilities with
+respect to end users, business partners and the like. While this license is
+intended to facilitate the commercial use of the Program, the Contributor who
+includes the Program in a commercial product offering should do so in a manner
+which does not create potential liability for other Contributors. Therefore,
+if a Contributor includes the Program in a commercial product offering, such
+Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
+every other Contributor ("Indemnified Contributor") against any losses,
+damages and costs (collectively "Losses") arising from claims, lawsuits and
+other legal actions brought by a third party against the Indemnified
+Contributor to the extent caused by the acts or omissions of such Commercial
+Contributor in connection with its distribution of the Program in a commercial
+product offering. The obligations in this section do not apply to any claims
+or Losses relating to any actual or alleged intellectual property
+infringement. In order to qualify, an Indemnified Contributor must:
+a) promptly notify the Commercial Contributor in writing of such claim, and
+b) allow the Commercial Contributor to control, and cooperate with the
+Commercial Contributor in, the defense and any related settlement
+negotiations. The Indemnified Contributor may participate in any such claim at
+its own expense.
+
+For example, a Contributor might include the Program in a commercial product
+offering, Product X. That Contributor is then a Commercial Contributor. If
+that Commercial Contributor then makes performance claims, or offers
+warranties related to Product X, those performance claims and warranties are
+such Commercial Contributor's responsibility alone. Under this section, the
+Commercial Contributor would have to defend claims against the other
+Contributors related to those performance claims and warranties, and if a
+court requires any other Contributor to pay any damages as a result, the
+Commercial Contributor must pay those damages.
+
+5. NO WARRANTY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
+IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
+NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each
+Recipient is solely responsible for determining the appropriateness of using
+and distributing the Program and assumes all risks associated with its
+exercise of rights under this Agreement , including but not limited to the
+risks and costs of program errors, compliance with applicable laws, damage to
+or loss of data, programs or equipment, and unavailability or interruption of
+operations.
+
+6. DISCLAIMER OF LIABILITY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
+CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
+LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE
+EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY
+OF SUCH DAMAGES.
+
+7. GENERAL
+
+If any provision of this Agreement is invalid or unenforceable under
+applicable law, it shall not affect the validity or enforceability of the
+remainder of the terms of this Agreement, and without further action by the
+parties hereto, such provision shall be reformed to the minimum extent
+necessary to make such provision valid and enforceable.
+
+If Recipient institutes patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Program itself
+(excluding combinations of the Program with other software or hardware)
+infringes such Recipient's patent(s), then such Recipient's rights granted
+under Section 2(b) shall terminate as of the date such litigation is filed.
+
+All Recipient's rights under this Agreement shall terminate if it fails to
+comply with any of the material terms or conditions of this Agreement and does
+not cure such failure in a reasonable period of time after becoming aware of
+such noncompliance. If all Recipient's rights under this Agreement terminate,
+Recipient agrees to cease use and distribution of the Program as soon as
+reasonably practicable. However, Recipient's obligations under this Agreement
+and any licenses granted by Recipient relating to the Program shall continue
+and survive.
+
+Everyone is permitted to copy and distribute copies of this Agreement, but in
+order to avoid inconsistency the Agreement is copyrighted and may only be
+modified in the following manner. The Agreement Steward reserves the right to
+publish new versions (including revisions) of this Agreement from time to
+time. No one other than the Agreement Steward has the right to modify this
+Agreement. The Eclipse Foundation is the initial Agreement Steward. The
+Eclipse Foundation may assign the responsibility to serve as the Agreement
+Steward to a suitable separate entity. Each new version of the Agreement will
+be given a distinguishing version number. The Program (including
+Contributions) may always be distributed subject to the version of the
+Agreement under which it was received. In addition, after a new version of the
+Agreement is published, Contributor may elect to distribute the Program
+(including its Contributions) under the new version. Except as expressly
+stated in Sections 2(a) and 2(b) above, Recipient receives no rights or
+licenses to the intellectual property of any Contributor under this Agreement,
+whether expressly, by implication, estoppel or otherwise. All rights in the
+Program not expressly granted under this Agreement are reserved.
+
+This Agreement is governed by the laws of the State of New York and the
+intellectual property laws of the United States of America. No party to this
+Agreement will bring a legal action under this Agreement more than one year
+after the cause of action arose. Each party waives its rights to a jury trial in
+any resulting litigation.
+
+
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-io-9.4.58.v20250814.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-io-9.4.58.v20250814.LICENSE.txt
new file mode 100644
index 00000000000..46f4f252464
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/jetty-io-9.4.58.v20250814.LICENSE.txt
@@ -0,0 +1,414 @@
+This program and the accompanying materials are made available under the
+terms of the Eclipse Public License 2.0 which is available at
+http://www.eclipse.org/legal/epl-2.0, or the Apache Software License
+2.0 which is available at https://www.apache.org/licenses/LICENSE-2.0.
+
+
+
+Eclipse Public License - v 1.0
+
+THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
+LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
+CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
+
+1. DEFINITIONS
+
+"Contribution" means:
+
+a) in the case of the initial Contributor, the initial code and documentation
+   distributed under this Agreement, and
+b) in the case of each subsequent Contributor:
+    i) changes to the Program, and
+   ii) additions to the Program;
+
+   where such changes and/or additions to the Program originate from and are
+   distributed by that particular Contributor. A Contribution 'originates'
+   from a Contributor if it was added to the Program by such Contributor
+   itself or anyone acting on such Contributor's behalf. Contributions do not
+   include additions to the Program which: (i) are separate modules of
+   software distributed in conjunction with the Program under their own
+   license agreement, and (ii) are not derivative works of the Program.
+
+"Contributor" means any person or entity that distributes the Program.
+
+"Licensed Patents" mean patent claims licensable by a Contributor which are
+necessarily infringed by the use or sale of its Contribution alone or when
+combined with the Program.
+
+"Program" means the Contributions distributed in accordance with this
+Agreement.
+
+"Recipient" means anyone who receives the Program under this Agreement,
+including all Contributors.
+
+2. GRANT OF RIGHTS
+  a) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free copyright license to
+     reproduce, prepare derivative works of, publicly display, publicly
+     perform, distribute and sublicense the Contribution of such Contributor,
+     if any, and such derivative works, in source code and object code form.
+  b) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free patent license under
+     Licensed Patents to make, use, sell, offer to sell, import and otherwise
+     transfer the Contribution of such Contributor, if any, in source code and
+     object code form. This patent license shall apply to the combination of
+     the Contribution and the Program if, at the time the Contribution is
+     added by the Contributor, such addition of the Contribution causes such
+     combination to be covered by the Licensed Patents. The patent license
+     shall not apply to any other combinations which include the Contribution.
+     No hardware per se is licensed hereunder.
+  c) Recipient understands that although each Contributor grants the licenses
+     to its Contributions set forth herein, no assurances are provided by any
+     Contributor that the Program does not infringe the patent or other
+     intellectual property rights of any other entity. Each Contributor
+     disclaims any liability to Recipient for claims brought by any other
+     entity based on infringement of intellectual property rights or
+     otherwise. As a condition to exercising the rights and licenses granted
+     hereunder, each Recipient hereby assumes sole responsibility to secure
+     any other intellectual property rights needed, if any. For example, if a
+     third party patent license is required to allow Recipient to distribute
+     the Program, it is Recipient's responsibility to acquire that license
+     before distributing the Program.
+  d) Each Contributor represents that to its knowledge it has sufficient
+     copyright rights in its Contribution, if any, to grant the copyright
+     license set forth in this Agreement.
+
+3. REQUIREMENTS
+
+A Contributor may choose to distribute the Program in object code form under
+its own license agreement, provided that:
+
+  a) it complies with the terms and conditions of this Agreement; and
+  b) its license agreement:
+      i) effectively disclaims on behalf of all Contributors all warranties
+         and conditions, express and implied, including warranties or
+         conditions of title and non-infringement, and implied warranties or
+         conditions of merchantability and fitness for a particular purpose;
+     ii) effectively excludes on behalf of all Contributors all liability for
+         damages, including direct, indirect, special, incidental and
+         consequential damages, such as lost profits;
+    iii) states that any provisions which differ from this Agreement are
+         offered by that Contributor alone and not by any other party; and
+     iv) states that source code for the Program is available from such
+         Contributor, and informs licensees how to obtain it in a reasonable
+         manner on or through a medium customarily used for software exchange.
+
+When the Program is made available in source code form:
+
+  a) it must be made available under this Agreement; and
+  b) a copy of this Agreement must be included with each copy of the Program.
+     Contributors may not remove or alter any copyright notices contained
+     within the Program.
+
+Each Contributor must identify itself as the originator of its Contribution,
+if
+any, in a manner that reasonably allows subsequent Recipients to identify the
+originator of the Contribution.
+
+4. COMMERCIAL DISTRIBUTION
+
+Commercial distributors of software may accept certain responsibilities with
+respect to end users, business partners and the like. While this license is
+intended to facilitate the commercial use of the Program, the Contributor who
+includes the Program in a commercial product offering should do so in a manner
+which does not create potential liability for other Contributors. Therefore,
+if a Contributor includes the Program in a commercial product offering, such
+Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
+every other Contributor ("Indemnified Contributor") against any losses,
+damages and costs (collectively "Losses") arising from claims, lawsuits and
+other legal actions brought by a third party against the Indemnified
+Contributor to the extent caused by the acts or omissions of such Commercial
+Contributor in connection with its distribution of the Program in a commercial
+product offering. The obligations in this section do not apply to any claims
+or Losses relating to any actual or alleged intellectual property
+infringement. In order to qualify, an Indemnified Contributor must:
+a) promptly notify the Commercial Contributor in writing of such claim, and
+b) allow the Commercial Contributor to control, and cooperate with the
+Commercial Contributor in, the defense and any related settlement
+negotiations. The Indemnified Contributor may participate in any such claim at
+its own expense.
+
+For example, a Contributor might include the Program in a commercial product
+offering, Product X. That Contributor is then a Commercial Contributor. If
+that Commercial Contributor then makes performance claims, or offers
+warranties related to Product X, those performance claims and warranties are
+such Commercial Contributor's responsibility alone. Under this section, the
+Commercial Contributor would have to defend claims against the other
+Contributors related to those performance claims and warranties, and if a
+court requires any other Contributor to pay any damages as a result, the
+Commercial Contributor must pay those damages.
+
+5. NO WARRANTY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
+IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
+NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each
+Recipient is solely responsible for determining the appropriateness of using
+and distributing the Program and assumes all risks associated with its
+exercise of rights under this Agreement , including but not limited to the
+risks and costs of program errors, compliance with applicable laws, damage to
+or loss of data, programs or equipment, and unavailability or interruption of
+operations.
+
+6. DISCLAIMER OF LIABILITY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
+CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
+LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE
+EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY
+OF SUCH DAMAGES.
+
+7. GENERAL
+
+If any provision of this Agreement is invalid or unenforceable under
+applicable law, it shall not affect the validity or enforceability of the
+remainder of the terms of this Agreement, and without further action by the
+parties hereto, such provision shall be reformed to the minimum extent
+necessary to make such provision valid and enforceable.
+
+If Recipient institutes patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Program itself
+(excluding combinations of the Program with other software or hardware)
+infringes such Recipient's patent(s), then such Recipient's rights granted
+under Section 2(b) shall terminate as of the date such litigation is filed.
+
+All Recipient's rights under this Agreement shall terminate if it fails to
+comply with any of the material terms or conditions of this Agreement and does
+not cure such failure in a reasonable period of time after becoming aware of
+such noncompliance. If all Recipient's rights under this Agreement terminate,
+Recipient agrees to cease use and distribution of the Program as soon as
+reasonably practicable. However, Recipient's obligations under this Agreement
+and any licenses granted by Recipient relating to the Program shall continue
+and survive.
+
+Everyone is permitted to copy and distribute copies of this Agreement, but in
+order to avoid inconsistency the Agreement is copyrighted and may only be
+modified in the following manner. The Agreement Steward reserves the right to
+publish new versions (including revisions) of this Agreement from time to
+time. No one other than the Agreement Steward has the right to modify this
+Agreement. The Eclipse Foundation is the initial Agreement Steward. The
+Eclipse Foundation may assign the responsibility to serve as the Agreement
+Steward to a suitable separate entity. Each new version of the Agreement will
+be given a distinguishing version number. The Program (including
+Contributions) may always be distributed subject to the version of the
+Agreement under which it was received. In addition, after a new version of the
+Agreement is published, Contributor may elect to distribute the Program
+(including its Contributions) under the new version. Except as expressly
+stated in Sections 2(a) and 2(b) above, Recipient receives no rights or
+licenses to the intellectual property of any Contributor under this Agreement,
+whether expressly, by implication, estoppel or otherwise. All rights in the
+Program not expressly granted under this Agreement are reserved.
+
+This Agreement is governed by the laws of the State of New York and the
+intellectual property laws of the United States of America. No party to this
+Agreement will bring a legal action under this Agreement more than one year
+after the cause of action arose. Each party waives its rights to a jury trial in
+any resulting litigation.
+
+
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-security-9.4.58.v20250814.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-security-9.4.58.v20250814.LICENSE.txt
new file mode 100644
index 00000000000..46f4f252464
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/jetty-security-9.4.58.v20250814.LICENSE.txt
@@ -0,0 +1,414 @@
+This program and the accompanying materials are made available under the
+terms of the Eclipse Public License 2.0 which is available at
+http://www.eclipse.org/legal/epl-2.0, or the Apache Software License
+2.0 which is available at https://www.apache.org/licenses/LICENSE-2.0.
+
+
+
+Eclipse Public License - v 1.0
+
+THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
+LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
+CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
+
+1. DEFINITIONS
+
+"Contribution" means:
+
+a) in the case of the initial Contributor, the initial code and documentation
+   distributed under this Agreement, and
+b) in the case of each subsequent Contributor:
+    i) changes to the Program, and
+   ii) additions to the Program;
+
+   where such changes and/or additions to the Program originate from and are
+   distributed by that particular Contributor. A Contribution 'originates'
+   from a Contributor if it was added to the Program by such Contributor
+   itself or anyone acting on such Contributor's behalf. Contributions do not
+   include additions to the Program which: (i) are separate modules of
+   software distributed in conjunction with the Program under their own
+   license agreement, and (ii) are not derivative works of the Program.
+
+"Contributor" means any person or entity that distributes the Program.
+
+"Licensed Patents" mean patent claims licensable by a Contributor which are
+necessarily infringed by the use or sale of its Contribution alone or when
+combined with the Program.
+
+"Program" means the Contributions distributed in accordance with this
+Agreement.
+
+"Recipient" means anyone who receives the Program under this Agreement,
+including all Contributors.
+
+2. GRANT OF RIGHTS
+  a) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free copyright license to
+     reproduce, prepare derivative works of, publicly display, publicly
+     perform, distribute and sublicense the Contribution of such Contributor,
+     if any, and such derivative works, in source code and object code form.
+  b) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free patent license under
+     Licensed Patents to make, use, sell, offer to sell, import and otherwise
+     transfer the Contribution of such Contributor, if any, in source code and
+     object code form. This patent license shall apply to the combination of
+     the Contribution and the Program if, at the time the Contribution is
+     added by the Contributor, such addition of the Contribution causes such
+     combination to be covered by the Licensed Patents. The patent license
+     shall not apply to any other combinations which include the Contribution.
+     No hardware per se is licensed hereunder.
+  c) Recipient understands that although each Contributor grants the licenses
+     to its Contributions set forth herein, no assurances are provided by any
+     Contributor that the Program does not infringe the patent or other
+     intellectual property rights of any other entity. Each Contributor
+     disclaims any liability to Recipient for claims brought by any other
+     entity based on infringement of intellectual property rights or
+     otherwise. As a condition to exercising the rights and licenses granted
+     hereunder, each Recipient hereby assumes sole responsibility to secure
+     any other intellectual property rights needed, if any. For example, if a
+     third party patent license is required to allow Recipient to distribute
+     the Program, it is Recipient's responsibility to acquire that license
+     before distributing the Program.
+  d) Each Contributor represents that to its knowledge it has sufficient
+     copyright rights in its Contribution, if any, to grant the copyright
+     license set forth in this Agreement.
+
+3. REQUIREMENTS
+
+A Contributor may choose to distribute the Program in object code form under
+its own license agreement, provided that:
+
+  a) it complies with the terms and conditions of this Agreement; and
+  b) its license agreement:
+      i) effectively disclaims on behalf of all Contributors all warranties
+         and conditions, express and implied, including warranties or
+         conditions of title and non-infringement, and implied warranties or
+         conditions of merchantability and fitness for a particular purpose;
+     ii) effectively excludes on behalf of all Contributors all liability for
+         damages, including direct, indirect, special, incidental and
+         consequential damages, such as lost profits;
+    iii) states that any provisions which differ from this Agreement are
+         offered by that Contributor alone and not by any other party; and
+     iv) states that source code for the Program is available from such
+         Contributor, and informs licensees how to obtain it in a reasonable
+         manner on or through a medium customarily used for software exchange.
+
+When the Program is made available in source code form:
+
+  a) it must be made available under this Agreement; and
+  b) a copy of this Agreement must be included with each copy of the Program.
+     Contributors may not remove or alter any copyright notices contained
+     within the Program.
+
+Each Contributor must identify itself as the originator of its Contribution,
+if
+any, in a manner that reasonably allows subsequent Recipients to identify the
+originator of the Contribution.
+
+4. COMMERCIAL DISTRIBUTION
+
+Commercial distributors of software may accept certain responsibilities with
+respect to end users, business partners and the like. While this license is
+intended to facilitate the commercial use of the Program, the Contributor who
+includes the Program in a commercial product offering should do so in a manner
+which does not create potential liability for other Contributors. Therefore,
+if a Contributor includes the Program in a commercial product offering, such
+Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
+every other Contributor ("Indemnified Contributor") against any losses,
+damages and costs (collectively "Losses") arising from claims, lawsuits and
+other legal actions brought by a third party against the Indemnified
+Contributor to the extent caused by the acts or omissions of such Commercial
+Contributor in connection with its distribution of the Program in a commercial
+product offering. The obligations in this section do not apply to any claims
+or Losses relating to any actual or alleged intellectual property
+infringement. In order to qualify, an Indemnified Contributor must:
+a) promptly notify the Commercial Contributor in writing of such claim, and
+b) allow the Commercial Contributor to control, and cooperate with the
+Commercial Contributor in, the defense and any related settlement
+negotiations. The Indemnified Contributor may participate in any such claim at
+its own expense.
+
+For example, a Contributor might include the Program in a commercial product
+offering, Product X. That Contributor is then a Commercial Contributor. If
+that Commercial Contributor then makes performance claims, or offers
+warranties related to Product X, those performance claims and warranties are
+such Commercial Contributor's responsibility alone. Under this section, the
+Commercial Contributor would have to defend claims against the other
+Contributors related to those performance claims and warranties, and if a
+court requires any other Contributor to pay any damages as a result, the
+Commercial Contributor must pay those damages.
+
+5. NO WARRANTY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
+IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
+NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each
+Recipient is solely responsible for determining the appropriateness of using
+and distributing the Program and assumes all risks associated with its
+exercise of rights under this Agreement , including but not limited to the
+risks and costs of program errors, compliance with applicable laws, damage to
+or loss of data, programs or equipment, and unavailability or interruption of
+operations.
+
+6. DISCLAIMER OF LIABILITY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
+CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
+LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE
+EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY
+OF SUCH DAMAGES.
+
+7. GENERAL
+
+If any provision of this Agreement is invalid or unenforceable under
+applicable law, it shall not affect the validity or enforceability of the
+remainder of the terms of this Agreement, and without further action by the
+parties hereto, such provision shall be reformed to the minimum extent
+necessary to make such provision valid and enforceable.
+
+If Recipient institutes patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Program itself
+(excluding combinations of the Program with other software or hardware)
+infringes such Recipient's patent(s), then such Recipient's rights granted
+under Section 2(b) shall terminate as of the date such litigation is filed.
+
+All Recipient's rights under this Agreement shall terminate if it fails to
+comply with any of the material terms or conditions of this Agreement and does
+not cure such failure in a reasonable period of time after becoming aware of
+such noncompliance. If all Recipient's rights under this Agreement terminate,
+Recipient agrees to cease use and distribution of the Program as soon as
+reasonably practicable. However, Recipient's obligations under this Agreement
+and any licenses granted by Recipient relating to the Program shall continue
+and survive.
+
+Everyone is permitted to copy and distribute copies of this Agreement, but in
+order to avoid inconsistency the Agreement is copyrighted and may only be
+modified in the following manner. The Agreement Steward reserves the right to
+publish new versions (including revisions) of this Agreement from time to
+time. No one other than the Agreement Steward has the right to modify this
+Agreement. The Eclipse Foundation is the initial Agreement Steward. The
+Eclipse Foundation may assign the responsibility to serve as the Agreement
+Steward to a suitable separate entity. Each new version of the Agreement will
+be given a distinguishing version number. The Program (including
+Contributions) may always be distributed subject to the version of the
+Agreement under which it was received. In addition, after a new version of the
+Agreement is published, Contributor may elect to distribute the Program
+(including its Contributions) under the new version. Except as expressly
+stated in Sections 2(a) and 2(b) above, Recipient receives no rights or
+licenses to the intellectual property of any Contributor under this Agreement,
+whether expressly, by implication, estoppel or otherwise. All rights in the
+Program not expressly granted under this Agreement are reserved.
+
+This Agreement is governed by the laws of the State of New York and the
+intellectual property laws of the United States of America. No party to this
+Agreement will bring a legal action under this Agreement more than one year
+after the cause of action arose. Each party waives its rights to a jury trial in
+any resulting litigation.
+
+
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-server-9.4.58.v20250814.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-server-9.4.58.v20250814.LICENSE.txt
new file mode 100644
index 00000000000..46f4f252464
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/jetty-server-9.4.58.v20250814.LICENSE.txt
@@ -0,0 +1,414 @@
+This program and the accompanying materials are made available under the
+terms of the Eclipse Public License 2.0 which is available at
+http://www.eclipse.org/legal/epl-2.0, or the Apache Software License
+2.0 which is available at https://www.apache.org/licenses/LICENSE-2.0.
+
+
+
+Eclipse Public License - v 1.0
+
+THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
+LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
+CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
+
+1. DEFINITIONS
+
+"Contribution" means:
+
+a) in the case of the initial Contributor, the initial code and documentation
+   distributed under this Agreement, and
+b) in the case of each subsequent Contributor:
+    i) changes to the Program, and
+   ii) additions to the Program;
+
+   where such changes and/or additions to the Program originate from and are
+   distributed by that particular Contributor. A Contribution 'originates'
+   from a Contributor if it was added to the Program by such Contributor
+   itself or anyone acting on such Contributor's behalf. Contributions do not
+   include additions to the Program which: (i) are separate modules of
+   software distributed in conjunction with the Program under their own
+   license agreement, and (ii) are not derivative works of the Program.
+
+"Contributor" means any person or entity that distributes the Program.
+
+"Licensed Patents" mean patent claims licensable by a Contributor which are
+necessarily infringed by the use or sale of its Contribution alone or when
+combined with the Program.
+
+"Program" means the Contributions distributed in accordance with this
+Agreement.
+
+"Recipient" means anyone who receives the Program under this Agreement,
+including all Contributors.
+
+2. GRANT OF RIGHTS
+  a) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free copyright license to
+     reproduce, prepare derivative works of, publicly display, publicly
+     perform, distribute and sublicense the Contribution of such Contributor,
+     if any, and such derivative works, in source code and object code form.
+  b) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free patent license under
+     Licensed Patents to make, use, sell, offer to sell, import and otherwise
+     transfer the Contribution of such Contributor, if any, in source code and
+     object code form. This patent license shall apply to the combination of
+     the Contribution and the Program if, at the time the Contribution is
+     added by the Contributor, such addition of the Contribution causes such
+     combination to be covered by the Licensed Patents. The patent license
+     shall not apply to any other combinations which include the Contribution.
+     No hardware per se is licensed hereunder.
+  c) Recipient understands that although each Contributor grants the licenses
+     to its Contributions set forth herein, no assurances are provided by any
+     Contributor that the Program does not infringe the patent or other
+     intellectual property rights of any other entity. Each Contributor
+     disclaims any liability to Recipient for claims brought by any other
+     entity based on infringement of intellectual property rights or
+     otherwise. As a condition to exercising the rights and licenses granted
+     hereunder, each Recipient hereby assumes sole responsibility to secure
+     any other intellectual property rights needed, if any. For example, if a
+     third party patent license is required to allow Recipient to distribute
+     the Program, it is Recipient's responsibility to acquire that license
+     before distributing the Program.
+  d) Each Contributor represents that to its knowledge it has sufficient
+     copyright rights in its Contribution, if any, to grant the copyright
+     license set forth in this Agreement.
+
+3. REQUIREMENTS
+
+A Contributor may choose to distribute the Program in object code form under
+its own license agreement, provided that:
+
+  a) it complies with the terms and conditions of this Agreement; and
+  b) its license agreement:
+      i) effectively disclaims on behalf of all Contributors all warranties
+         and conditions, express and implied, including warranties or
+         conditions of title and non-infringement, and implied warranties or
+         conditions of merchantability and fitness for a particular purpose;
+     ii) effectively excludes on behalf of all Contributors all liability for
+         damages, including direct, indirect, special, incidental and
+         consequential damages, such as lost profits;
+    iii) states that any provisions which differ from this Agreement are
+         offered by that Contributor alone and not by any other party; and
+     iv) states that source code for the Program is available from such
+         Contributor, and informs licensees how to obtain it in a reasonable
+         manner on or through a medium customarily used for software exchange.
+
+When the Program is made available in source code form:
+
+  a) it must be made available under this Agreement; and
+  b) a copy of this Agreement must be included with each copy of the Program.
+     Contributors may not remove or alter any copyright notices contained
+     within the Program.
+
+Each Contributor must identify itself as the originator of its Contribution,
+if
+any, in a manner that reasonably allows subsequent Recipients to identify the
+originator of the Contribution.
+
+4. COMMERCIAL DISTRIBUTION
+
+Commercial distributors of software may accept certain responsibilities with
+respect to end users, business partners and the like. While this license is
+intended to facilitate the commercial use of the Program, the Contributor who
+includes the Program in a commercial product offering should do so in a manner
+which does not create potential liability for other Contributors. Therefore,
+if a Contributor includes the Program in a commercial product offering, such
+Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
+every other Contributor ("Indemnified Contributor") against any losses,
+damages and costs (collectively "Losses") arising from claims, lawsuits and
+other legal actions brought by a third party against the Indemnified
+Contributor to the extent caused by the acts or omissions of such Commercial
+Contributor in connection with its distribution of the Program in a commercial
+product offering. The obligations in this section do not apply to any claims
+or Losses relating to any actual or alleged intellectual property
+infringement. In order to qualify, an Indemnified Contributor must:
+a) promptly notify the Commercial Contributor in writing of such claim, and
+b) allow the Commercial Contributor to control, and cooperate with the
+Commercial Contributor in, the defense and any related settlement
+negotiations. The Indemnified Contributor may participate in any such claim at
+its own expense.
+
+For example, a Contributor might include the Program in a commercial product
+offering, Product X. That Contributor is then a Commercial Contributor. If
+that Commercial Contributor then makes performance claims, or offers
+warranties related to Product X, those performance claims and warranties are
+such Commercial Contributor's responsibility alone. Under this section, the
+Commercial Contributor would have to defend claims against the other
+Contributors related to those performance claims and warranties, and if a
+court requires any other Contributor to pay any damages as a result, the
+Commercial Contributor must pay those damages.
+
+5. NO WARRANTY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
+IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
+NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each
+Recipient is solely responsible for determining the appropriateness of using
+and distributing the Program and assumes all risks associated with its
+exercise of rights under this Agreement , including but not limited to the
+risks and costs of program errors, compliance with applicable laws, damage to
+or loss of data, programs or equipment, and unavailability or interruption of
+operations.
+
+6. DISCLAIMER OF LIABILITY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
+CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
+LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE
+EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY
+OF SUCH DAMAGES.
+
+7. GENERAL
+
+If any provision of this Agreement is invalid or unenforceable under
+applicable law, it shall not affect the validity or enforceability of the
+remainder of the terms of this Agreement, and without further action by the
+parties hereto, such provision shall be reformed to the minimum extent
+necessary to make such provision valid and enforceable.
+
+If Recipient institutes patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Program itself
+(excluding combinations of the Program with other software or hardware)
+infringes such Recipient's patent(s), then such Recipient's rights granted
+under Section 2(b) shall terminate as of the date such litigation is filed.
+
+All Recipient's rights under this Agreement shall terminate if it fails to
+comply with any of the material terms or conditions of this Agreement and does
+not cure such failure in a reasonable period of time after becoming aware of
+such noncompliance. If all Recipient's rights under this Agreement terminate,
+Recipient agrees to cease use and distribution of the Program as soon as
+reasonably practicable. However, Recipient's obligations under this Agreement
+and any licenses granted by Recipient relating to the Program shall continue
+and survive.
+
+Everyone is permitted to copy and distribute copies of this Agreement, but in
+order to avoid inconsistency the Agreement is copyrighted and may only be
+modified in the following manner. The Agreement Steward reserves the right to
+publish new versions (including revisions) of this Agreement from time to
+time. No one other than the Agreement Steward has the right to modify this
+Agreement. The Eclipse Foundation is the initial Agreement Steward. The
+Eclipse Foundation may assign the responsibility to serve as the Agreement
+Steward to a suitable separate entity. Each new version of the Agreement will
+be given a distinguishing version number. The Program (including
+Contributions) may always be distributed subject to the version of the
+Agreement under which it was received. In addition, after a new version of the
+Agreement is published, Contributor may elect to distribute the Program
+(including its Contributions) under the new version. Except as expressly
+stated in Sections 2(a) and 2(b) above, Recipient receives no rights or
+licenses to the intellectual property of any Contributor under this Agreement,
+whether expressly, by implication, estoppel or otherwise. All rights in the
+Program not expressly granted under this Agreement are reserved.
+
+This Agreement is governed by the laws of the State of New York and the
+intellectual property laws of the United States of America. No party to this
+Agreement will bring a legal action under this Agreement more than one year
+after the cause of action arose. Each party waives its rights to a jury trial in
+any resulting litigation.
+
+
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.58.v20250814.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.58.v20250814.LICENSE.txt
new file mode 100644
index 00000000000..46f4f252464
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.58.v20250814.LICENSE.txt
@@ -0,0 +1,414 @@
+This program and the accompanying materials are made available under the
+terms of the Eclipse Public License 2.0 which is available at
+http://www.eclipse.org/legal/epl-2.0, or the Apache Software License
+2.0 which is available at https://www.apache.org/licenses/LICENSE-2.0.
+
+
+
+Eclipse Public License - v 1.0
+
+THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
+LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
+CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
+
+1. DEFINITIONS
+
+"Contribution" means:
+
+a) in the case of the initial Contributor, the initial code and documentation
+   distributed under this Agreement, and
+b) in the case of each subsequent Contributor:
+    i) changes to the Program, and
+   ii) additions to the Program;
+
+   where such changes and/or additions to the Program originate from and are
+   distributed by that particular Contributor. A Contribution 'originates'
+   from a Contributor if it was added to the Program by such Contributor
+   itself or anyone acting on such Contributor's behalf. Contributions do not
+   include additions to the Program which: (i) are separate modules of
+   software distributed in conjunction with the Program under their own
+   license agreement, and (ii) are not derivative works of the Program.
+
+"Contributor" means any person or entity that distributes the Program.
+
+"Licensed Patents" mean patent claims licensable by a Contributor which are
+necessarily infringed by the use or sale of its Contribution alone or when
+combined with the Program.
+
+"Program" means the Contributions distributed in accordance with this
+Agreement.
+
+"Recipient" means anyone who receives the Program under this Agreement,
+including all Contributors.
+
+2. GRANT OF RIGHTS
+  a) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free copyright license to
+     reproduce, prepare derivative works of, publicly display, publicly
+     perform, distribute and sublicense the Contribution of such Contributor,
+     if any, and such derivative works, in source code and object code form.
+  b) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free patent license under
+     Licensed Patents to make, use, sell, offer to sell, import and otherwise
+     transfer the Contribution of such Contributor, if any, in source code and
+     object code form. This patent license shall apply to the combination of
+     the Contribution and the Program if, at the time the Contribution is
+     added by the Contributor, such addition of the Contribution causes such
+     combination to be covered by the Licensed Patents. The patent license
+     shall not apply to any other combinations which include the Contribution.
+     No hardware per se is licensed hereunder.
+  c) Recipient understands that although each Contributor grants the licenses
+     to its Contributions set forth herein, no assurances are provided by any
+     Contributor that the Program does not infringe the patent or other
+     intellectual property rights of any other entity. Each Contributor
+     disclaims any liability to Recipient for claims brought by any other
+     entity based on infringement of intellectual property rights or
+     otherwise. As a condition to exercising the rights and licenses granted
+     hereunder, each Recipient hereby assumes sole responsibility to secure
+     any other intellectual property rights needed, if any. For example, if a
+     third party patent license is required to allow Recipient to distribute
+     the Program, it is Recipient's responsibility to acquire that license
+     before distributing the Program.
+  d) Each Contributor represents that to its knowledge it has sufficient
+     copyright rights in its Contribution, if any, to grant the copyright
+     license set forth in this Agreement.
+
+3. REQUIREMENTS
+
+A Contributor may choose to distribute the Program in object code form under
+its own license agreement, provided that:
+
+  a) it complies with the terms and conditions of this Agreement; and
+  b) its license agreement:
+      i) effectively disclaims on behalf of all Contributors all warranties
+         and conditions, express and implied, including warranties or
+         conditions of title and non-infringement, and implied warranties or
+         conditions of merchantability and fitness for a particular purpose;
+     ii) effectively excludes on behalf of all Contributors all liability for
+         damages, including direct, indirect, special, incidental and
+         consequential damages, such as lost profits;
+    iii) states that any provisions which differ from this Agreement are
+         offered by that Contributor alone and not by any other party; and
+     iv) states that source code for the Program is available from such
+         Contributor, and informs licensees how to obtain it in a reasonable
+         manner on or through a medium customarily used for software exchange.
+
+When the Program is made available in source code form:
+
+  a) it must be made available under this Agreement; and
+  b) a copy of this Agreement must be included with each copy of the Program.
+     Contributors may not remove or alter any copyright notices contained
+     within the Program.
+
+Each Contributor must identify itself as the originator of its Contribution,
+if
+any, in a manner that reasonably allows subsequent Recipients to identify the
+originator of the Contribution.
+
+4. COMMERCIAL DISTRIBUTION
+
+Commercial distributors of software may accept certain responsibilities with
+respect to end users, business partners and the like. While this license is
+intended to facilitate the commercial use of the Program, the Contributor who
+includes the Program in a commercial product offering should do so in a manner
+which does not create potential liability for other Contributors. Therefore,
+if a Contributor includes the Program in a commercial product offering, such
+Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
+every other Contributor ("Indemnified Contributor") against any losses,
+damages and costs (collectively "Losses") arising from claims, lawsuits and
+other legal actions brought by a third party against the Indemnified
+Contributor to the extent caused by the acts or omissions of such Commercial
+Contributor in connection with its distribution of the Program in a commercial
+product offering. The obligations in this section do not apply to any claims
+or Losses relating to any actual or alleged intellectual property
+infringement. In order to qualify, an Indemnified Contributor must:
+a) promptly notify the Commercial Contributor in writing of such claim, and
+b) allow the Commercial Contributor to control, and cooperate with the
+Commercial Contributor in, the defense and any related settlement
+negotiations. The Indemnified Contributor may participate in any such claim at
+its own expense.
+
+For example, a Contributor might include the Program in a commercial product
+offering, Product X. That Contributor is then a Commercial Contributor. If
+that Commercial Contributor then makes performance claims, or offers
+warranties related to Product X, those performance claims and warranties are
+such Commercial Contributor's responsibility alone. Under this section, the
+Commercial Contributor would have to defend claims against the other
+Contributors related to those performance claims and warranties, and if a
+court requires any other Contributor to pay any damages as a result, the
+Commercial Contributor must pay those damages.
+
+5. NO WARRANTY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
+IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
+NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each
+Recipient is solely responsible for determining the appropriateness of using
+and distributing the Program and assumes all risks associated with its
+exercise of rights under this Agreement , including but not limited to the
+risks and costs of program errors, compliance with applicable laws, damage to
+or loss of data, programs or equipment, and unavailability or interruption of
+operations.
+
+6. DISCLAIMER OF LIABILITY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
+CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
+LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE
+EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY
+OF SUCH DAMAGES.
+
+7. GENERAL
+
+If any provision of this Agreement is invalid or unenforceable under
+applicable law, it shall not affect the validity or enforceability of the
+remainder of the terms of this Agreement, and without further action by the
+parties hereto, such provision shall be reformed to the minimum extent
+necessary to make such provision valid and enforceable.
+
+If Recipient institutes patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Program itself
+(excluding combinations of the Program with other software or hardware)
+infringes such Recipient's patent(s), then such Recipient's rights granted
+under Section 2(b) shall terminate as of the date such litigation is filed.
+
+All Recipient's rights under this Agreement shall terminate if it fails to
+comply with any of the material terms or conditions of this Agreement and does
+not cure such failure in a reasonable period of time after becoming aware of
+such noncompliance. If all Recipient's rights under this Agreement terminate,
+Recipient agrees to cease use and distribution of the Program as soon as
+reasonably practicable. However, Recipient's obligations under this Agreement
+and any licenses granted by Recipient relating to the Program shall continue
+and survive.
+
+Everyone is permitted to copy and distribute copies of this Agreement, but in
+order to avoid inconsistency the Agreement is copyrighted and may only be
+modified in the following manner. The Agreement Steward reserves the right to
+publish new versions (including revisions) of this Agreement from time to
+time. No one other than the Agreement Steward has the right to modify this
+Agreement. The Eclipse Foundation is the initial Agreement Steward. The
+Eclipse Foundation may assign the responsibility to serve as the Agreement
+Steward to a suitable separate entity. Each new version of the Agreement will
+be given a distinguishing version number. The Program (including
+Contributions) may always be distributed subject to the version of the
+Agreement under which it was received. In addition, after a new version of the
+Agreement is published, Contributor may elect to distribute the Program
+(including its Contributions) under the new version. Except as expressly
+stated in Sections 2(a) and 2(b) above, Recipient receives no rights or
+licenses to the intellectual property of any Contributor under this Agreement,
+whether expressly, by implication, estoppel or otherwise. All rights in the
+Program not expressly granted under this Agreement are reserved.
+
+This Agreement is governed by the laws of the State of New York and the
+intellectual property laws of the United States of America. No party to this
+Agreement will bring a legal action under this Agreement more than one year
+after the cause of action arose. Each party waives its rights to a jury trial in
+any resulting litigation.
+
+
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-util-9.4.58.v20250814.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-util-9.4.58.v20250814.LICENSE.txt
new file mode 100644
index 00000000000..46f4f252464
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/jetty-util-9.4.58.v20250814.LICENSE.txt
@@ -0,0 +1,414 @@
+This program and the accompanying materials are made available under the
+terms of the Eclipse Public License 2.0 which is available at
+http://www.eclipse.org/legal/epl-2.0, or the Apache Software License
+2.0 which is available at https://www.apache.org/licenses/LICENSE-2.0.
+
+
+
+Eclipse Public License - v 1.0
+
+THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
+LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
+CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
+
+1. DEFINITIONS
+
+"Contribution" means:
+
+a) in the case of the initial Contributor, the initial code and documentation
+   distributed under this Agreement, and
+b) in the case of each subsequent Contributor:
+    i) changes to the Program, and
+   ii) additions to the Program;
+
+   where such changes and/or additions to the Program originate from and are
+   distributed by that particular Contributor. A Contribution 'originates'
+   from a Contributor if it was added to the Program by such Contributor
+   itself or anyone acting on such Contributor's behalf. Contributions do not
+   include additions to the Program which: (i) are separate modules of
+   software distributed in conjunction with the Program under their own
+   license agreement, and (ii) are not derivative works of the Program.
+
+"Contributor" means any person or entity that distributes the Program.
+
+"Licensed Patents" mean patent claims licensable by a Contributor which are
+necessarily infringed by the use or sale of its Contribution alone or when
+combined with the Program.
+
+"Program" means the Contributions distributed in accordance with this
+Agreement.
+
+"Recipient" means anyone who receives the Program under this Agreement,
+including all Contributors.
+
+2. GRANT OF RIGHTS
+  a) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free copyright license to
+     reproduce, prepare derivative works of, publicly display, publicly
+     perform, distribute and sublicense the Contribution of such Contributor,
+     if any, and such derivative works, in source code and object code form.
+  b) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free patent license under
+     Licensed Patents to make, use, sell, offer to sell, import and otherwise
+     transfer the Contribution of such Contributor, if any, in source code and
+     object code form. This patent license shall apply to the combination of
+     the Contribution and the Program if, at the time the Contribution is
+     added by the Contributor, such addition of the Contribution causes such
+     combination to be covered by the Licensed Patents. The patent license
+     shall not apply to any other combinations which include the Contribution.
+     No hardware per se is licensed hereunder.
+  c) Recipient understands that although each Contributor grants the licenses
+     to its Contributions set forth herein, no assurances are provided by any
+     Contributor that the Program does not infringe the patent or other
+     intellectual property rights of any other entity. Each Contributor
+     disclaims any liability to Recipient for claims brought by any other
+     entity based on infringement of intellectual property rights or
+     otherwise. As a condition to exercising the rights and licenses granted
+     hereunder, each Recipient hereby assumes sole responsibility to secure
+     any other intellectual property rights needed, if any. For example, if a
+     third party patent license is required to allow Recipient to distribute
+     the Program, it is Recipient's responsibility to acquire that license
+     before distributing the Program.
+  d) Each Contributor represents that to its knowledge it has sufficient
+     copyright rights in its Contribution, if any, to grant the copyright
+     license set forth in this Agreement.
+
+3. REQUIREMENTS
+
+A Contributor may choose to distribute the Program in object code form under
+its own license agreement, provided that:
+
+  a) it complies with the terms and conditions of this Agreement; and
+  b) its license agreement:
+      i) effectively disclaims on behalf of all Contributors all warranties
+         and conditions, express and implied, including warranties or
+         conditions of title and non-infringement, and implied warranties or
+         conditions of merchantability and fitness for a particular purpose;
+     ii) effectively excludes on behalf of all Contributors all liability for
+         damages, including direct, indirect, special, incidental and
+         consequential damages, such as lost profits;
+    iii) states that any provisions which differ from this Agreement are
+         offered by that Contributor alone and not by any other party; and
+     iv) states that source code for the Program is available from such
+         Contributor, and informs licensees how to obtain it in a reasonable
+         manner on or through a medium customarily used for software exchange.
+
+When the Program is made available in source code form:
+
+  a) it must be made available under this Agreement; and
+  b) a copy of this Agreement must be included with each copy of the Program.
+     Contributors may not remove or alter any copyright notices contained
+     within the Program.
+
+Each Contributor must identify itself as the originator of its Contribution,
+if
+any, in a manner that reasonably allows subsequent Recipients to identify the
+originator of the Contribution.
+
+4. COMMERCIAL DISTRIBUTION
+
+Commercial distributors of software may accept certain responsibilities with
+respect to end users, business partners and the like. While this license is
+intended to facilitate the commercial use of the Program, the Contributor who
+includes the Program in a commercial product offering should do so in a manner
+which does not create potential liability for other Contributors. Therefore,
+if a Contributor includes the Program in a commercial product offering, such
+Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
+every other Contributor ("Indemnified Contributor") against any losses,
+damages and costs (collectively "Losses") arising from claims, lawsuits and
+other legal actions brought by a third party against the Indemnified
+Contributor to the extent caused by the acts or omissions of such Commercial
+Contributor in connection with its distribution of the Program in a commercial
+product offering. The obligations in this section do not apply to any claims
+or Losses relating to any actual or alleged intellectual property
+infringement. In order to qualify, an Indemnified Contributor must:
+a) promptly notify the Commercial Contributor in writing of such claim, and
+b) allow the Commercial Contributor to control, and cooperate with the
+Commercial Contributor in, the defense and any related settlement
+negotiations. The Indemnified Contributor may participate in any such claim at
+its own expense.
+
+For example, a Contributor might include the Program in a commercial product
+offering, Product X. That Contributor is then a Commercial Contributor. If
+that Commercial Contributor then makes performance claims, or offers
+warranties related to Product X, those performance claims and warranties are
+such Commercial Contributor's responsibility alone. Under this section, the
+Commercial Contributor would have to defend claims against the other
+Contributors related to those performance claims and warranties, and if a
+court requires any other Contributor to pay any damages as a result, the
+Commercial Contributor must pay those damages.
+
+5. NO WARRANTY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
+IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
+NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each
+Recipient is solely responsible for determining the appropriateness of using
+and distributing the Program and assumes all risks associated with its
+exercise of rights under this Agreement , including but not limited to the
+risks and costs of program errors, compliance with applicable laws, damage to
+or loss of data, programs or equipment, and unavailability or interruption of
+operations.
+
+6. DISCLAIMER OF LIABILITY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
+CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
+LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE
+EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY
+OF SUCH DAMAGES.
+
+7. GENERAL
+
+If any provision of this Agreement is invalid or unenforceable under
+applicable law, it shall not affect the validity or enforceability of the
+remainder of the terms of this Agreement, and without further action by the
+parties hereto, such provision shall be reformed to the minimum extent
+necessary to make such provision valid and enforceable.
+
+If Recipient institutes patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Program itself
+(excluding combinations of the Program with other software or hardware)
+infringes such Recipient's patent(s), then such Recipient's rights granted
+under Section 2(b) shall terminate as of the date such litigation is filed.
+
+All Recipient's rights under this Agreement shall terminate if it fails to
+comply with any of the material terms or conditions of this Agreement and does
+not cure such failure in a reasonable period of time after becoming aware of
+such noncompliance. If all Recipient's rights under this Agreement terminate,
+Recipient agrees to cease use and distribution of the Program as soon as
+reasonably practicable. However, Recipient's obligations under this Agreement
+and any licenses granted by Recipient relating to the Program shall continue
+and survive.
+
+Everyone is permitted to copy and distribute copies of this Agreement, but in
+order to avoid inconsistency the Agreement is copyrighted and may only be
+modified in the following manner. The Agreement Steward reserves the right to
+publish new versions (including revisions) of this Agreement from time to
+time. No one other than the Agreement Steward has the right to modify this
+Agreement. The Eclipse Foundation is the initial Agreement Steward. The
+Eclipse Foundation may assign the responsibility to serve as the Agreement
+Steward to a suitable separate entity. Each new version of the Agreement will
+be given a distinguishing version number. The Program (including
+Contributions) may always be distributed subject to the version of the
+Agreement under which it was received. In addition, after a new version of the
+Agreement is published, Contributor may elect to distribute the Program
+(including its Contributions) under the new version. Except as expressly
+stated in Sections 2(a) and 2(b) above, Recipient receives no rights or
+licenses to the intellectual property of any Contributor under this Agreement,
+whether expressly, by implication, estoppel or otherwise. All rights in the
+Program not expressly granted under this Agreement are reserved.
+
+This Agreement is governed by the laws of the State of New York and the
+intellectual property laws of the United States of America. No party to this
+Agreement will bring a legal action under this Agreement more than one year
+after the cause of action arose. Each party waives its rights to a jury trial in
+any resulting litigation.
+
+
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.58.v20250814.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.58.v20250814.LICENSE.txt
new file mode 100644
index 00000000000..46f4f252464
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.58.v20250814.LICENSE.txt
@@ -0,0 +1,414 @@
+This program and the accompanying materials are made available under the
+terms of the Eclipse Public License 2.0 which is available at
+http://www.eclipse.org/legal/epl-2.0, or the Apache Software License
+2.0 which is available at https://www.apache.org/licenses/LICENSE-2.0.
+
+
+
+Eclipse Public License - v 1.0
+
+THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
+LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
+CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
+
+1. DEFINITIONS
+
+"Contribution" means:
+
+a) in the case of the initial Contributor, the initial code and documentation
+   distributed under this Agreement, and
+b) in the case of each subsequent Contributor:
+    i) changes to the Program, and
+   ii) additions to the Program;
+
+   where such changes and/or additions to the Program originate from and are
+   distributed by that particular Contributor. A Contribution 'originates'
+   from a Contributor if it was added to the Program by such Contributor
+   itself or anyone acting on such Contributor's behalf. Contributions do not
+   include additions to the Program which: (i) are separate modules of
+   software distributed in conjunction with the Program under their own
+   license agreement, and (ii) are not derivative works of the Program.
+
+"Contributor" means any person or entity that distributes the Program.
+
+"Licensed Patents" mean patent claims licensable by a Contributor which are
+necessarily infringed by the use or sale of its Contribution alone or when
+combined with the Program.
+
+"Program" means the Contributions distributed in accordance with this
+Agreement.
+
+"Recipient" means anyone who receives the Program under this Agreement,
+including all Contributors.
+
+2. GRANT OF RIGHTS
+  a) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free copyright license to
+     reproduce, prepare derivative works of, publicly display, publicly
+     perform, distribute and sublicense the Contribution of such Contributor,
+     if any, and such derivative works, in source code and object code form.
+  b) Subject to the terms of this Agreement, each Contributor hereby grants
+     Recipient a non-exclusive, worldwide, royalty-free patent license under
+     Licensed Patents to make, use, sell, offer to sell, import and otherwise
+     transfer the Contribution of such Contributor, if any, in source code and
+     object code form. This patent license shall apply to the combination of
+     the Contribution and the Program if, at the time the Contribution is
+     added by the Contributor, such addition of the Contribution causes such
+     combination to be covered by the Licensed Patents. The patent license
+     shall not apply to any other combinations which include the Contribution.
+     No hardware per se is licensed hereunder.
+  c) Recipient understands that although each Contributor grants the licenses
+     to its Contributions set forth herein, no assurances are provided by any
+     Contributor that the Program does not infringe the patent or other
+     intellectual property rights of any other entity. Each Contributor
+     disclaims any liability to Recipient for claims brought by any other
+     entity based on infringement of intellectual property rights or
+     otherwise. As a condition to exercising the rights and licenses granted
+     hereunder, each Recipient hereby assumes sole responsibility to secure
+     any other intellectual property rights needed, if any. For example, if a
+     third party patent license is required to allow Recipient to distribute
+     the Program, it is Recipient's responsibility to acquire that license
+     before distributing the Program.
+  d) Each Contributor represents that to its knowledge it has sufficient
+     copyright rights in its Contribution, if any, to grant the copyright
+     license set forth in this Agreement.
+
+3. REQUIREMENTS
+
+A Contributor may choose to distribute the Program in object code form under
+its own license agreement, provided that:
+
+  a) it complies with the terms and conditions of this Agreement; and
+  b) its license agreement:
+      i) effectively disclaims on behalf of all Contributors all warranties
+         and conditions, express and implied, including warranties or
+         conditions of title and non-infringement, and implied warranties or
+         conditions of merchantability and fitness for a particular purpose;
+     ii) effectively excludes on behalf of all Contributors all liability for
+         damages, including direct, indirect, special, incidental and
+         consequential damages, such as lost profits;
+    iii) states that any provisions which differ from this Agreement are
+         offered by that Contributor alone and not by any other party; and
+     iv) states that source code for the Program is available from such
+         Contributor, and informs licensees how to obtain it in a reasonable
+         manner on or through a medium customarily used for software exchange.
+
+When the Program is made available in source code form:
+
+  a) it must be made available under this Agreement; and
+  b) a copy of this Agreement must be included with each copy of the Program.
+     Contributors may not remove or alter any copyright notices contained
+     within the Program.
+
+Each Contributor must identify itself as the originator of its Contribution,
+if
+any, in a manner that reasonably allows subsequent Recipients to identify the
+originator of the Contribution.
+
+4. COMMERCIAL DISTRIBUTION
+
+Commercial distributors of software may accept certain responsibilities with
+respect to end users, business partners and the like. While this license is
+intended to facilitate the commercial use of the Program, the Contributor who
+includes the Program in a commercial product offering should do so in a manner
+which does not create potential liability for other Contributors. Therefore,
+if a Contributor includes the Program in a commercial product offering, such
+Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
+every other Contributor ("Indemnified Contributor") against any losses,
+damages and costs (collectively "Losses") arising from claims, lawsuits and
+other legal actions brought by a third party against the Indemnified
+Contributor to the extent caused by the acts or omissions of such Commercial
+Contributor in connection with its distribution of the Program in a commercial
+product offering. The obligations in this section do not apply to any claims
+or Losses relating to any actual or alleged intellectual property
+infringement. In order to qualify, an Indemnified Contributor must:
+a) promptly notify the Commercial Contributor in writing of such claim, and
+b) allow the Commercial Contributor to control, and cooperate with the
+Commercial Contributor in, the defense and any related settlement
+negotiations. The Indemnified Contributor may participate in any such claim at
+its own expense.
+
+For example, a Contributor might include the Program in a commercial product
+offering, Product X. That Contributor is then a Commercial Contributor. If
+that Commercial Contributor then makes performance claims, or offers
+warranties related to Product X, those performance claims and warranties are
+such Commercial Contributor's responsibility alone. Under this section, the
+Commercial Contributor would have to defend claims against the other
+Contributors related to those performance claims and warranties, and if a
+court requires any other Contributor to pay any damages as a result, the
+Commercial Contributor must pay those damages.
+
+5. NO WARRANTY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
+IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
+NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each
+Recipient is solely responsible for determining the appropriateness of using
+and distributing the Program and assumes all risks associated with its
+exercise of rights under this Agreement , including but not limited to the
+risks and costs of program errors, compliance with applicable laws, damage to
+or loss of data, programs or equipment, and unavailability or interruption of
+operations.
+
+6. DISCLAIMER OF LIABILITY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
+CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
+LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE
+EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY
+OF SUCH DAMAGES.
+
+7. GENERAL
+
+If any provision of this Agreement is invalid or unenforceable under
+applicable law, it shall not affect the validity or enforceability of the
+remainder of the terms of this Agreement, and without further action by the
+parties hereto, such provision shall be reformed to the minimum extent
+necessary to make such provision valid and enforceable.
+
+If Recipient institutes patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Program itself
+(excluding combinations of the Program with other software or hardware)
+infringes such Recipient's patent(s), then such Recipient's rights granted
+under Section 2(b) shall terminate as of the date such litigation is filed.
+
+All Recipient's rights under this Agreement shall terminate if it fails to
+comply with any of the material terms or conditions of this Agreement and does
+not cure such failure in a reasonable period of time after becoming aware of
+such noncompliance. If all Recipient's rights under this Agreement terminate,
+Recipient agrees to cease use and distribution of the Program as soon as
+reasonably practicable. However, Recipient's obligations under this Agreement
+and any licenses granted by Recipient relating to the Program shall continue
+and survive.
+
+Everyone is permitted to copy and distribute copies of this Agreement, but in
+order to avoid inconsistency the Agreement is copyrighted and may only be
+modified in the following manner. The Agreement Steward reserves the right to
+publish new versions (including revisions) of this Agreement from time to
+time. No one other than the Agreement Steward has the right to modify this
+Agreement. The Eclipse Foundation is the initial Agreement Steward. The
+Eclipse Foundation may assign the responsibility to serve as the Agreement
+Steward to a suitable separate entity. Each new version of the Agreement will
+be given a distinguishing version number. The Program (including
+Contributions) may always be distributed subject to the version of the
+Agreement under which it was received. In addition, after a new version of the
+Agreement is published, Contributor may elect to distribute the Program
+(including its Contributions) under the new version. Except as expressly
+stated in Sections 2(a) and 2(b) above, Recipient receives no rights or
+licenses to the intellectual property of any Contributor under this Agreement,
+whether expressly, by implication, estoppel or otherwise. All rights in the
+Program not expressly granted under this Agreement are reserved.
+
+This Agreement is governed by the laws of the State of New York and the
+intellectual property laws of the United States of America. No party to this
+Agreement will bring a legal action under this Agreement more than one year
+after the cause of action arose. Each party waives its rights to a jury trial in
+any resulting litigation.
+
+
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/jline-2.11.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jline-3.25.1.LICENSE.txt
similarity index 90%
rename from zookeeper-server/src/main/resources/lib/jline-2.11.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/jline-3.25.1.LICENSE.txt
index 4ac9522bd8c..ed9503f23c2 100644
--- a/zookeeper-server/src/main/resources/lib/jline-2.11.LICENSE.txt
+++ b/zookeeper-server/src/main/resources/lib/jline-3.25.1.LICENSE.txt
@@ -1,7 +1,7 @@
-Copyright (c) 2002-2012, the original author or authors.
+Copyright (c) 2002-2023, the original author or authors.
 All rights reserved.
 
-http://www.opensource.org/licenses/bsd-license.php
+https://opensource.org/licenses/BSD-3-Clause
 
 Redistribution and use in source and binary forms, with or
 without modification, are permitted provided that the following
@@ -31,5 +31,4 @@ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
 AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
 IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
-OF THE POSSIBILITY OF SUCH DAMAGE.
-
+OF THE POSSIBILITY OF SUCH DAMAGE.
\ No newline at end of file
diff --git a/zookeeper-server/src/main/resources/lib/logback-classic-1.3.15.LICENSE.txt b/zookeeper-server/src/main/resources/lib/logback-classic-1.3.15.LICENSE.txt
new file mode 100644
index 00000000000..7e7bfbfc96e
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/logback-classic-1.3.15.LICENSE.txt
@@ -0,0 +1,688 @@
+Logback LICENSE
+---------------
+
+Logback: the reliable, generic, fast and flexible logging framework.
+Copyright (C) 1999-2015, QOS.ch. All rights reserved.
+
+This program and the accompanying materials are dual-licensed under
+either the terms of the Eclipse Public License v1.0 as published by
+the Eclipse Foundation
+ 
+  or (per the licensee's choosing)
+ 
+under the terms of the GNU Lesser General Public License version 2.1
+as published by the Free Software Foundation.
+
+
+
+Eclipse Public License - v 1.0
+
+THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
+LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
+CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
+
+   1. DEFINITIONS
+
+   "Contribution" means:
+
+a) in the case of the initial Contributor, the initial code and documentation
+distributed under this Agreement, and
+
+      b) in the case of each subsequent Contributor:
+
+         i) changes to the Program, and
+
+         ii) additions to the Program;
+
+where such changes and/or additions to the Program originate from and are
+distributed by that particular Contributor. A Contribution 'originates' from
+a Contributor if it was added to the Program by such Contributor itself or
+anyone acting on such Contributor's behalf. Contributions do not include additions
+to the Program which: (i) are separate modules of software distributed in
+conjunction with the Program under their own license agreement, and (ii) are
+not derivative works of the Program.
+
+   "Contributor" means any person or entity that distributes the Program.
+
+"Licensed Patents" mean patent claims licensable by a Contributor which are
+necessarily infringed by the use or sale of its Contribution alone or when
+combined with the Program.
+
+"Program" means the Contributions distributed in accordance with this Agreement.
+
+"Recipient" means anyone who receives the Program under this Agreement, including
+all Contributors.
+
+   2. GRANT OF RIGHTS
+
+a) Subject to the terms of this Agreement, each Contributor hereby grants
+Recipient a non-exclusive, worldwide, royalty-free copyright license to reproduce,
+prepare derivative works of, publicly display, publicly perform, distribute
+and sublicense the Contribution of such Contributor, if any, and such derivative
+works, in source code and object code form.
+
+b) Subject to the terms of this Agreement, each Contributor hereby grants
+Recipient a non-exclusive, worldwide, royalty-free patent license under Licensed
+Patents to make, use, sell, offer to sell, import and otherwise transfer the
+Contribution of such Contributor, if any, in source code and object code form.
+This patent license shall apply to the combination of the Contribution and
+the Program if, at the time the Contribution is added by the Contributor,
+such addition of the Contribution causes such combination to be covered by
+the Licensed Patents. The patent license shall not apply to any other combinations
+which include the Contribution. No hardware per se is licensed hereunder.
+
+c) Recipient understands that although each Contributor grants the licenses
+to its Contributions set forth herein, no assurances are provided by any Contributor
+that the Program does not infringe the patent or other intellectual property
+rights of any other entity. Each Contributor disclaims any liability to Recipient
+for claims brought by any other entity based on infringement of intellectual
+property rights or otherwise. As a condition to exercising the rights and
+licenses granted hereunder, each Recipient hereby assumes sole responsibility
+to secure any other intellectual property rights needed, if any. For example,
+if a third party patent license is required to allow Recipient to distribute
+the Program, it is Recipient's responsibility to acquire that license before
+distributing the Program.
+
+d) Each Contributor represents that to its knowledge it has sufficient copyright
+rights in its Contribution, if any, to grant the copyright license set forth
+in this Agreement.
+
+   3. REQUIREMENTS
+
+A Contributor may choose to distribute the Program in object code form under
+its own license agreement, provided that:
+
+      a) it complies with the terms and conditions of this Agreement; and
+
+      b) its license agreement:
+
+i) effectively disclaims on behalf of all Contributors all warranties and
+conditions, express and implied, including warranties or conditions of title
+and non-infringement, and implied warranties or conditions of merchantability
+and fitness for a particular purpose;
+
+ii) effectively excludes on behalf of all Contributors all liability for damages,
+including direct, indirect, special, incidental and consequential damages,
+such as lost profits;
+
+iii) states that any provisions which differ from this Agreement are offered
+by that Contributor alone and not by any other party; and
+
+iv) states that source code for the Program is available from such Contributor,
+and informs licensees how to obtain it in a reasonable manner on or through
+a medium customarily used for software exchange.
+
+   When the Program is made available in source code form:
+
+      a) it must be made available under this Agreement; and
+
+b) a copy of this Agreement must be included with each copy of the Program.
+
+Contributors may not remove or alter any copyright notices contained within
+the Program.
+
+Each Contributor must identify itself as the originator of its Contribution,
+if any, in a manner that reasonably allows subsequent Recipients to identify
+the originator of the Contribution.
+
+   4. COMMERCIAL DISTRIBUTION
+
+Commercial distributors of software may accept certain responsibilities with
+respect to end users, business partners and the like. While this license is
+intended to facilitate the commercial use of the Program, the Contributor
+who includes the Program in a commercial product offering should do so in
+a manner which does not create potential liability for other Contributors.
+Therefore, if a Contributor includes the Program in a commercial product offering,
+such Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
+every other Contributor ("Indemnified Contributor") against any losses, damages
+and costs (collectively "Losses") arising from claims, lawsuits and other
+legal actions brought by a third party against the Indemnified Contributor
+to the extent caused by the acts or omissions of such Commercial Contributor
+in connection with its distribution of the Program in a commercial product
+offering. The obligations in this section do not apply to any claims or Losses
+relating to any actual or alleged intellectual property infringement. In order
+to qualify, an Indemnified Contributor must: a) promptly notify the Commercial
+Contributor in writing of such claim, and b) allow the Commercial Contributor
+to control, and cooperate with the Commercial Contributor in, the defense
+and any related settlement negotiations. The Indemnified Contributor may participate
+in any such claim at its own expense.
+
+For example, a Contributor might include the Program in a commercial product
+offering, Product X. That Contributor is then a Commercial Contributor. If
+that Commercial Contributor then makes performance claims, or offers warranties
+related to Product X, those performance claims and warranties are such Commercial
+Contributor's responsibility alone. Under this section, the Commercial Contributor
+would have to defend claims against the other Contributors related to those
+performance claims and warranties, and if a court requires any other Contributor
+to pay any damages as a result, the Commercial Contributor must pay those
+damages.
+
+   5. NO WARRANTY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON
+AN "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS
+OR IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF
+TITLE, NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
+Each Recipient is solely responsible for determining the appropriateness of
+using and distributing the Program and assumes all risks associated with its
+exercise of rights under this Agreement, including but not limited to the
+risks and costs of program errors, compliance with applicable laws, damage
+to or loss of data, programs or equipment, and unavailability or interruption
+of operations.
+
+   6. DISCLAIMER OF LIABILITY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
+CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
+LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY
+WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS
+GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+   7. GENERAL
+
+If any provision of this Agreement is invalid or unenforceable under applicable
+law, it shall not affect the validity or enforceability of the remainder of
+the terms of this Agreement, and without further action by the parties hereto,
+such provision shall be reformed to the minimum extent necessary to make such
+provision valid and enforceable.
+
+If Recipient institutes patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Program itself
+(excluding combinations of the Program with other software or hardware) infringes
+such Recipient's patent(s), then such Recipient's rights granted under Section
+2(b) shall terminate as of the date such litigation is filed.
+
+All Recipient's rights under this Agreement shall terminate if it fails to
+comply with any of the material terms or conditions of this Agreement and
+does not cure such failure in a reasonable period of time after becoming aware
+of such noncompliance. If all Recipient's rights under this Agreement terminate,
+Recipient agrees to cease use and distribution of the Program as soon as reasonably
+practicable. However, Recipient's obligations under this Agreement and any
+licenses granted by Recipient relating to the Program shall continue and survive.
+
+Everyone is permitted to copy and distribute copies of this Agreement, but
+in order to avoid inconsistency the Agreement is copyrighted and may only
+be modified in the following manner. The Agreement Steward reserves the right
+to publish new versions (including revisions) of this Agreement from time
+to time. No one other than the Agreement Steward has the right to modify this
+Agreement. The Eclipse Foundation is the initial Agreement Steward. The Eclipse
+Foundation may assign the responsibility to serve as the Agreement Steward
+to a suitable separate entity. Each new version of the Agreement will be given
+a distinguishing version number. The Program (including Contributions) may
+always be distributed subject to the version of the Agreement under which
+it was received. In addition, after a new version of the Agreement is published,
+Contributor may elect to distribute the Program (including its Contributions)
+under the new version. Except as expressly stated in Sections 2(a) and 2(b)
+above, Recipient receives no rights or licenses to the intellectual property
+of any Contributor under this Agreement, whether expressly, by implication,
+estoppel or otherwise. All rights in the Program not expressly granted under
+this Agreement are reserved.
+
+This Agreement is governed by the laws of the State of New York and the intellectual
+property laws of the United States of America. No party to this Agreement
+will bring a legal action under this Agreement more than one year after the
+cause of action arose. Each party waives its rights to a jury trial in any
+resulting litigation.
+
+
+
+                  GNU LESSER GENERAL PUBLIC LICENSE
+                       Version 2.1, February 1999
+
+ Copyright (C) 1991, 1999 Free Software Foundation, Inc.
+ 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+[This is the first released version of the Lesser GPL.  It also counts
+ as the successor of the GNU Library Public License, version 2, hence
+ the version number 2.1.]
+
+                            Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+Licenses are intended to guarantee your freedom to share and change
+free software--to make sure the software is free for all its users.
+
+  This license, the Lesser General Public License, applies to some
+specially designated software packages--typically libraries--of the
+Free Software Foundation and other authors who decide to use it.  You
+can use it too, but we suggest you first think carefully about whether
+this license or the ordinary General Public License is the better
+strategy to use in any particular case, based on the explanations below.
+
+  When we speak of free software, we are referring to freedom of use,
+not price.  Our General Public Licenses are designed to make sure that
+you have the freedom to distribute copies of free software (and charge
+for this service if you wish); that you receive source code or can get
+it if you want it; that you can change the software and use pieces of
+it in new free programs; and that you are informed that you can do
+these things.
+
+  To protect your rights, we need to make restrictions that forbid
+distributors to deny you these rights or to ask you to surrender these
+rights.  These restrictions translate to certain responsibilities for
+you if you distribute copies of the library or if you modify it.
+
+  For example, if you distribute copies of the library, whether gratis
+or for a fee, you must give the recipients all the rights that we gave
+you.  You must make sure that they, too, receive or can get the source
+code.  If you link other code with the library, you must provide
+complete object files to the recipients, so that they can relink them
+with the library after making changes to the library and recompiling
+it.  And you must show them these terms so they know their rights.
+
+  We protect your rights with a two-step method: (1) we copyright the
+library, and (2) we offer you this license, which gives you legal
+permission to copy, distribute and/or modify the library.
+
+  To protect each distributor, we want to make it very clear that
+there is no warranty for the free library.  Also, if the library is
+modified by someone else and passed on, the recipients should know
+that what they have is not the original version, so that the original
+author's reputation will not be affected by problems that might be
+introduced by others.
+
+  Finally, software patents pose a constant threat to the existence of
+any free program.  We wish to make sure that a company cannot
+effectively restrict the users of a free program by obtaining a
+restrictive license from a patent holder.  Therefore, we insist that
+any patent license obtained for a version of the library must be
+consistent with the full freedom of use specified in this license.
+
+  Most GNU software, including some libraries, is covered by the
+ordinary GNU General Public License.  This license, the GNU Lesser
+General Public License, applies to certain designated libraries, and
+is quite different from the ordinary General Public License.  We use
+this license for certain libraries in order to permit linking those
+libraries into non-free programs.
+
+  When a program is linked with a library, whether statically or using
+a shared library, the combination of the two is legally speaking a
+combined work, a derivative of the original library.  The ordinary
+General Public License therefore permits such linking only if the
+entire combination fits its criteria of freedom.  The Lesser General
+Public License permits more lax criteria for linking other code with
+the library.
+
+  We call this license the "Lesser" General Public License because it
+does Less to protect the user's freedom than the ordinary General
+Public License.  It also provides other free software developers Less
+of an advantage over competing non-free programs.  These disadvantages
+are the reason we use the ordinary General Public License for many
+libraries.  However, the Lesser license provides advantages in certain
+special circumstances.
+
+  For example, on rare occasions, there may be a special need to
+encourage the widest possible use of a certain library, so that it becomes
+a de-facto standard.  To achieve this, non-free programs must be
+allowed to use the library.  A more frequent case is that a free
+library does the same job as widely used non-free libraries.  In this
+case, there is little to gain by limiting the free library to free
+software only, so we use the Lesser General Public License.
+
+  In other cases, permission to use a particular library in non-free
+programs enables a greater number of people to use a large body of
+free software.  For example, permission to use the GNU C Library in
+non-free programs enables many more people to use the whole GNU
+operating system, as well as its variant, the GNU/Linux operating
+system.
+
+  Although the Lesser General Public License is Less protective of the
+users' freedom, it does ensure that the user of a program that is
+linked with the Library has the freedom and the wherewithal to run
+that program using a modified version of the Library.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.  Pay close attention to the difference between a
+"work based on the library" and a "work that uses the library".  The
+former contains code derived from the library, whereas the latter must
+be combined with the library in order to run.
+
+                  GNU LESSER GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License Agreement applies to any software library or other
+program which contains a notice placed by the copyright holder or
+other authorized party saying it may be distributed under the terms of
+this Lesser General Public License (also called "this License").
+Each licensee is addressed as "you".
+
+  A "library" means a collection of software functions and/or data
+prepared so as to be conveniently linked with application programs
+(which use some of those functions and data) to form executables.
+
+  The "Library", below, refers to any such software library or work
+which has been distributed under these terms.  A "work based on the
+Library" means either the Library or any derivative work under
+copyright law: that is to say, a work containing the Library or a
+portion of it, either verbatim or with modifications and/or translated
+straightforwardly into another language.  (Hereinafter, translation is
+included without limitation in the term "modification".)
+
+  "Source code" for a work means the preferred form of the work for
+making modifications to it.  For a library, complete source code means
+all the source code for all modules it contains, plus any associated
+interface definition files, plus the scripts used to control compilation
+and installation of the library.
+
+  Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running a program using the Library is not restricted, and output from
+such a program is covered only if its contents constitute a work based
+on the Library (independent of the use of the Library in a tool for
+writing it).  Whether that is true depends on what the Library does
+and what the program that uses the Library does.
+
+  1. You may copy and distribute verbatim copies of the Library's
+complete source code as you receive it, in any medium, provided that
+you conspicuously and appropriately publish on each copy an
+appropriate copyright notice and disclaimer of warranty; keep intact
+all the notices that refer to this License and to the absence of any
+warranty; and distribute a copy of this License along with the
+Library.
+
+  You may charge a fee for the physical act of transferring a copy,
+and you may at your option offer warranty protection in exchange for a
+fee.
+
+  2. You may modify your copy or copies of the Library or any portion
+of it, thus forming a work based on the Library, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) The modified work must itself be a software library.
+
+    b) You must cause the files modified to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    c) You must cause the whole of the work to be licensed at no
+    charge to all third parties under the terms of this License.
+
+    d) If a facility in the modified Library refers to a function or a
+    table of data to be supplied by an application program that uses
+    the facility, other than as an argument passed when the facility
+    is invoked, then you must make a good faith effort to ensure that,
+    in the event an application does not supply such function or
+    table, the facility still operates, and performs whatever part of
+    its purpose remains meaningful.
+
+    (For example, a function in a library to compute square roots has
+    a purpose that is entirely well-defined independent of the
+    application.  Therefore, Subsection 2d requires that any
+    application-supplied function or table used by this function must
+    be optional: if the application does not supply it, the square
+    root function must still compute square roots.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Library,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Library, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote
+it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Library.
+
+In addition, mere aggregation of another work not based on the Library
+with the Library (or with a work based on the Library) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may opt to apply the terms of the ordinary GNU General Public
+License instead of this License to a given copy of the Library.  To do
+this, you must alter all the notices that refer to this License, so
+that they refer to the ordinary GNU General Public License, version 2,
+instead of to this License.  (If a newer version than version 2 of the
+ordinary GNU General Public License has appeared, then you can specify
+that version instead if you wish.)  Do not make any other change in
+these notices.
+
+  Once this change is made in a given copy, it is irreversible for
+that copy, so the ordinary GNU General Public License applies to all
+subsequent copies and derivative works made from that copy.
+
+  This option is useful when you wish to copy part of the code of
+the Library into a program that is not a library.
+
+  4. You may copy and distribute the Library (or a portion or
+derivative of it, under Section 2) in object code or executable form
+under the terms of Sections 1 and 2 above provided that you accompany
+it with the complete corresponding machine-readable source code, which
+must be distributed under the terms of Sections 1 and 2 above on a
+medium customarily used for software interchange.
+
+  If distribution of object code is made by offering access to copy
+from a designated place, then offering equivalent access to copy the
+source code from the same place satisfies the requirement to
+distribute the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  5. A program that contains no derivative of any portion of the
+Library, but is designed to work with the Library by being compiled or
+linked with it, is called a "work that uses the Library".  Such a
+work, in isolation, is not a derivative work of the Library, and
+therefore falls outside the scope of this License.
+
+  However, linking a "work that uses the Library" with the Library
+creates an executable that is a derivative of the Library (because it
+contains portions of the Library), rather than a "work that uses the
+library".  The executable is therefore covered by this License.
+Section 6 states terms for distribution of such executables.
+
+  When a "work that uses the Library" uses material from a header file
+that is part of the Library, the object code for the work may be a
+derivative work of the Library even though the source code is not.
+Whether this is true is especially significant if the work can be
+linked without the Library, or if the work is itself a library.  The
+threshold for this to be true is not precisely defined by law.
+
+  If such an object file uses only numerical parameters, data
+structure layouts and accessors, and small macros and small inline
+functions (ten lines or less in length), then the use of the object
+file is unrestricted, regardless of whether it is legally a derivative
+work.  (Executables containing this object code plus portions of the
+Library will still fall under Section 6.)
+
+  Otherwise, if the work is a derivative of the Library, you may
+distribute the object code for the work under the terms of Section 6.
+Any executables containing that work also fall under Section 6,
+whether or not they are linked directly with the Library itself.
+
+  6. As an exception to the Sections above, you may also combine or
+link a "work that uses the Library" with the Library to produce a
+work containing portions of the Library, and distribute that work
+under terms of your choice, provided that the terms permit
+modification of the work for the customer's own use and reverse
+engineering for debugging such modifications.
+
+  You must give prominent notice with each copy of the work that the
+Library is used in it and that the Library and its use are covered by
+this License.  You must supply a copy of this License.  If the work
+during execution displays copyright notices, you must include the
+copyright notice for the Library among them, as well as a reference
+directing the user to the copy of this License.  Also, you must do one
+of these things:
+
+    a) Accompany the work with the complete corresponding
+    machine-readable source code for the Library including whatever
+    changes were used in the work (which must be distributed under
+    Sections 1 and 2 above); and, if the work is an executable linked
+    with the Library, with the complete machine-readable "work that
+    uses the Library", as object code and/or source code, so that the
+    user can modify the Library and then relink to produce a modified
+    executable containing the modified Library.  (It is understood
+    that the user who changes the contents of definitions files in the
+    Library will not necessarily be able to recompile the application
+    to use the modified definitions.)
+
+    b) Use a suitable shared library mechanism for linking with the
+    Library.  A suitable mechanism is one that (1) uses at run time a
+    copy of the library already present on the user's computer system,
+    rather than copying library functions into the executable, and (2)
+    will operate properly with a modified version of the library, if
+    the user installs one, as long as the modified version is
+    interface-compatible with the version that the work was made with.
+
+    c) Accompany the work with a written offer, valid for at
+    least three years, to give the same user the materials
+    specified in Subsection 6a, above, for a charge no more
+    than the cost of performing this distribution.
+
+    d) If distribution of the work is made by offering access to copy
+    from a designated place, offer equivalent access to copy the above
+    specified materials from the same place.
+
+    e) Verify that the user has already received a copy of these
+    materials or that you have already sent this user a copy.
+
+  For an executable, the required form of the "work that uses the
+Library" must include any data and utility programs needed for
+reproducing the executable from it.  However, as a special exception,
+the materials to be distributed need not include anything that is
+normally distributed (in either source or binary form) with the major
+components (compiler, kernel, and so on) of the operating system on
+which the executable runs, unless that component itself accompanies
+the executable.
+
+  It may happen that this requirement contradicts the license
+restrictions of other proprietary libraries that do not normally
+accompany the operating system.  Such a contradiction means you cannot
+use both them and the Library together in an executable that you
+distribute.
+
+  7. You may place library facilities that are a work based on the
+Library side-by-side in a single library together with other library
+facilities not covered by this License, and distribute such a combined
+library, provided that the separate distribution of the work based on
+the Library and of the other library facilities is otherwise
+permitted, and provided that you do these two things:
+
+    a) Accompany the combined library with a copy of the same work
+    based on the Library, uncombined with any other library
+    facilities.  This must be distributed under the terms of the
+    Sections above.
+
+    b) Give prominent notice with the combined library of the fact
+    that part of it is a work based on the Library, and explaining
+    where to find the accompanying uncombined form of the same work.
+
+  8. You may not copy, modify, sublicense, link with, or distribute
+the Library except as expressly provided under this License.  Any
+attempt otherwise to copy, modify, sublicense, link with, or
+distribute the Library is void, and will automatically terminate your
+rights under this License.  However, parties who have received copies,
+or rights, from you under this License will not have their licenses
+terminated so long as such parties remain in full compliance.
+
+  9. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Library or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Library (or any work based on the
+Library), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Library or works based on it.
+
+  10. Each time you redistribute the Library (or any work based on the
+Library), the recipient automatically receives a license from the
+original licensor to copy, distribute, link with or modify the Library
+subject to these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties with
+this License.
+
+  11. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Library at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Library by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Library.
+
+If any portion of this section is held invalid or unenforceable under any
+particular circumstance, the balance of the section is intended to apply,
+and the section as a whole is intended to apply in other circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  12. If the distribution and/or use of the Library is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Library under this License may add
+an explicit geographical distribution limitation excluding those countries,
+so that distribution is permitted only in or among countries not thus
+excluded.  In such case, this License incorporates the limitation as if
+written in the body of this License.
+
+  13. The Free Software Foundation may publish revised and/or new
+versions of the Lesser General Public License from time to time.
+Such new versions will be similar in spirit to the present version,
+but may differ in detail to address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Library
+specifies a version number of this License which applies to it and
+"any later version", you have the option of following the terms and
+conditions either of that version or of any later version published by
+the Free Software Foundation.  If the Library does not specify a
+license version number, you may choose any version ever published by
+the Free Software Foundation.
+
+  14. If you wish to incorporate parts of the Library into other free
+programs whose distribution conditions are incompatible with these,
+write to the author to ask for permission.  For software which is
+copyrighted by the Free Software Foundation, write to the Free
+Software Foundation; we sometimes make exceptions for this.  Our
+decision will be guided by the two goals of preserving the free status
+of all derivatives of our free software and of promoting the sharing
+and reuse of software generally.
+
+                            NO WARRANTY
+
+  15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
+WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
+EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
+OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
+KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
+LIBRARY IS WITH YOU.  SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
+THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
+WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
+AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
+FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
+CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
+LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
+RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
+FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
+SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
+DAMAGES.
+
+                     END OF TERMS AND CONDITIONS
diff --git a/zookeeper-server/src/main/resources/lib/logback-core-1.3.15.LICENSE.txt b/zookeeper-server/src/main/resources/lib/logback-core-1.3.15.LICENSE.txt
new file mode 100644
index 00000000000..7e7bfbfc96e
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/logback-core-1.3.15.LICENSE.txt
@@ -0,0 +1,688 @@
+Logback LICENSE
+---------------
+
+Logback: the reliable, generic, fast and flexible logging framework.
+Copyright (C) 1999-2015, QOS.ch. All rights reserved.
+
+This program and the accompanying materials are dual-licensed under
+either the terms of the Eclipse Public License v1.0 as published by
+the Eclipse Foundation
+ 
+  or (per the licensee's choosing)
+ 
+under the terms of the GNU Lesser General Public License version 2.1
+as published by the Free Software Foundation.
+
+
+
+Eclipse Public License - v 1.0
+
+THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC
+LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM
+CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
+
+   1. DEFINITIONS
+
+   "Contribution" means:
+
+a) in the case of the initial Contributor, the initial code and documentation
+distributed under this Agreement, and
+
+      b) in the case of each subsequent Contributor:
+
+         i) changes to the Program, and
+
+         ii) additions to the Program;
+
+where such changes and/or additions to the Program originate from and are
+distributed by that particular Contributor. A Contribution 'originates' from
+a Contributor if it was added to the Program by such Contributor itself or
+anyone acting on such Contributor's behalf. Contributions do not include additions
+to the Program which: (i) are separate modules of software distributed in
+conjunction with the Program under their own license agreement, and (ii) are
+not derivative works of the Program.
+
+   "Contributor" means any person or entity that distributes the Program.
+
+"Licensed Patents" mean patent claims licensable by a Contributor which are
+necessarily infringed by the use or sale of its Contribution alone or when
+combined with the Program.
+
+"Program" means the Contributions distributed in accordance with this Agreement.
+
+"Recipient" means anyone who receives the Program under this Agreement, including
+all Contributors.
+
+   2. GRANT OF RIGHTS
+
+a) Subject to the terms of this Agreement, each Contributor hereby grants
+Recipient a non-exclusive, worldwide, royalty-free copyright license to reproduce,
+prepare derivative works of, publicly display, publicly perform, distribute
+and sublicense the Contribution of such Contributor, if any, and such derivative
+works, in source code and object code form.
+
+b) Subject to the terms of this Agreement, each Contributor hereby grants
+Recipient a non-exclusive, worldwide, royalty-free patent license under Licensed
+Patents to make, use, sell, offer to sell, import and otherwise transfer the
+Contribution of such Contributor, if any, in source code and object code form.
+This patent license shall apply to the combination of the Contribution and
+the Program if, at the time the Contribution is added by the Contributor,
+such addition of the Contribution causes such combination to be covered by
+the Licensed Patents. The patent license shall not apply to any other combinations
+which include the Contribution. No hardware per se is licensed hereunder.
+
+c) Recipient understands that although each Contributor grants the licenses
+to its Contributions set forth herein, no assurances are provided by any Contributor
+that the Program does not infringe the patent or other intellectual property
+rights of any other entity. Each Contributor disclaims any liability to Recipient
+for claims brought by any other entity based on infringement of intellectual
+property rights or otherwise. As a condition to exercising the rights and
+licenses granted hereunder, each Recipient hereby assumes sole responsibility
+to secure any other intellectual property rights needed, if any. For example,
+if a third party patent license is required to allow Recipient to distribute
+the Program, it is Recipient's responsibility to acquire that license before
+distributing the Program.
+
+d) Each Contributor represents that to its knowledge it has sufficient copyright
+rights in its Contribution, if any, to grant the copyright license set forth
+in this Agreement.
+
+   3. REQUIREMENTS
+
+A Contributor may choose to distribute the Program in object code form under
+its own license agreement, provided that:
+
+      a) it complies with the terms and conditions of this Agreement; and
+
+      b) its license agreement:
+
+i) effectively disclaims on behalf of all Contributors all warranties and
+conditions, express and implied, including warranties or conditions of title
+and non-infringement, and implied warranties or conditions of merchantability
+and fitness for a particular purpose;
+
+ii) effectively excludes on behalf of all Contributors all liability for damages,
+including direct, indirect, special, incidental and consequential damages,
+such as lost profits;
+
+iii) states that any provisions which differ from this Agreement are offered
+by that Contributor alone and not by any other party; and
+
+iv) states that source code for the Program is available from such Contributor,
+and informs licensees how to obtain it in a reasonable manner on or through
+a medium customarily used for software exchange.
+
+   When the Program is made available in source code form:
+
+      a) it must be made available under this Agreement; and
+
+b) a copy of this Agreement must be included with each copy of the Program.
+
+Contributors may not remove or alter any copyright notices contained within
+the Program.
+
+Each Contributor must identify itself as the originator of its Contribution,
+if any, in a manner that reasonably allows subsequent Recipients to identify
+the originator of the Contribution.
+
+   4. COMMERCIAL DISTRIBUTION
+
+Commercial distributors of software may accept certain responsibilities with
+respect to end users, business partners and the like. While this license is
+intended to facilitate the commercial use of the Program, the Contributor
+who includes the Program in a commercial product offering should do so in
+a manner which does not create potential liability for other Contributors.
+Therefore, if a Contributor includes the Program in a commercial product offering,
+such Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
+every other Contributor ("Indemnified Contributor") against any losses, damages
+and costs (collectively "Losses") arising from claims, lawsuits and other
+legal actions brought by a third party against the Indemnified Contributor
+to the extent caused by the acts or omissions of such Commercial Contributor
+in connection with its distribution of the Program in a commercial product
+offering. The obligations in this section do not apply to any claims or Losses
+relating to any actual or alleged intellectual property infringement. In order
+to qualify, an Indemnified Contributor must: a) promptly notify the Commercial
+Contributor in writing of such claim, and b) allow the Commercial Contributor
+to control, and cooperate with the Commercial Contributor in, the defense
+and any related settlement negotiations. The Indemnified Contributor may participate
+in any such claim at its own expense.
+
+For example, a Contributor might include the Program in a commercial product
+offering, Product X. That Contributor is then a Commercial Contributor. If
+that Commercial Contributor then makes performance claims, or offers warranties
+related to Product X, those performance claims and warranties are such Commercial
+Contributor's responsibility alone. Under this section, the Commercial Contributor
+would have to defend claims against the other Contributors related to those
+performance claims and warranties, and if a court requires any other Contributor
+to pay any damages as a result, the Commercial Contributor must pay those
+damages.
+
+   5. NO WARRANTY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON
+AN "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS
+OR IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF
+TITLE, NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
+Each Recipient is solely responsible for determining the appropriateness of
+using and distributing the Program and assumes all risks associated with its
+exercise of rights under this Agreement, including but not limited to the
+risks and costs of program errors, compliance with applicable laws, damage
+to or loss of data, programs or equipment, and unavailability or interruption
+of operations.
+
+   6. DISCLAIMER OF LIABILITY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY
+CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
+LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY
+WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS
+GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+   7. GENERAL
+
+If any provision of this Agreement is invalid or unenforceable under applicable
+law, it shall not affect the validity or enforceability of the remainder of
+the terms of this Agreement, and without further action by the parties hereto,
+such provision shall be reformed to the minimum extent necessary to make such
+provision valid and enforceable.
+
+If Recipient institutes patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Program itself
+(excluding combinations of the Program with other software or hardware) infringes
+such Recipient's patent(s), then such Recipient's rights granted under Section
+2(b) shall terminate as of the date such litigation is filed.
+
+All Recipient's rights under this Agreement shall terminate if it fails to
+comply with any of the material terms or conditions of this Agreement and
+does not cure such failure in a reasonable period of time after becoming aware
+of such noncompliance. If all Recipient's rights under this Agreement terminate,
+Recipient agrees to cease use and distribution of the Program as soon as reasonably
+practicable. However, Recipient's obligations under this Agreement and any
+licenses granted by Recipient relating to the Program shall continue and survive.
+
+Everyone is permitted to copy and distribute copies of this Agreement, but
+in order to avoid inconsistency the Agreement is copyrighted and may only
+be modified in the following manner. The Agreement Steward reserves the right
+to publish new versions (including revisions) of this Agreement from time
+to time. No one other than the Agreement Steward has the right to modify this
+Agreement. The Eclipse Foundation is the initial Agreement Steward. The Eclipse
+Foundation may assign the responsibility to serve as the Agreement Steward
+to a suitable separate entity. Each new version of the Agreement will be given
+a distinguishing version number. The Program (including Contributions) may
+always be distributed subject to the version of the Agreement under which
+it was received. In addition, after a new version of the Agreement is published,
+Contributor may elect to distribute the Program (including its Contributions)
+under the new version. Except as expressly stated in Sections 2(a) and 2(b)
+above, Recipient receives no rights or licenses to the intellectual property
+of any Contributor under this Agreement, whether expressly, by implication,
+estoppel or otherwise. All rights in the Program not expressly granted under
+this Agreement are reserved.
+
+This Agreement is governed by the laws of the State of New York and the intellectual
+property laws of the United States of America. No party to this Agreement
+will bring a legal action under this Agreement more than one year after the
+cause of action arose. Each party waives its rights to a jury trial in any
+resulting litigation.
+
+
+
+                  GNU LESSER GENERAL PUBLIC LICENSE
+                       Version 2.1, February 1999
+
+ Copyright (C) 1991, 1999 Free Software Foundation, Inc.
+ 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+[This is the first released version of the Lesser GPL.  It also counts
+ as the successor of the GNU Library Public License, version 2, hence
+ the version number 2.1.]
+
+                            Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+Licenses are intended to guarantee your freedom to share and change
+free software--to make sure the software is free for all its users.
+
+  This license, the Lesser General Public License, applies to some
+specially designated software packages--typically libraries--of the
+Free Software Foundation and other authors who decide to use it.  You
+can use it too, but we suggest you first think carefully about whether
+this license or the ordinary General Public License is the better
+strategy to use in any particular case, based on the explanations below.
+
+  When we speak of free software, we are referring to freedom of use,
+not price.  Our General Public Licenses are designed to make sure that
+you have the freedom to distribute copies of free software (and charge
+for this service if you wish); that you receive source code or can get
+it if you want it; that you can change the software and use pieces of
+it in new free programs; and that you are informed that you can do
+these things.
+
+  To protect your rights, we need to make restrictions that forbid
+distributors to deny you these rights or to ask you to surrender these
+rights.  These restrictions translate to certain responsibilities for
+you if you distribute copies of the library or if you modify it.
+
+  For example, if you distribute copies of the library, whether gratis
+or for a fee, you must give the recipients all the rights that we gave
+you.  You must make sure that they, too, receive or can get the source
+code.  If you link other code with the library, you must provide
+complete object files to the recipients, so that they can relink them
+with the library after making changes to the library and recompiling
+it.  And you must show them these terms so they know their rights.
+
+  We protect your rights with a two-step method: (1) we copyright the
+library, and (2) we offer you this license, which gives you legal
+permission to copy, distribute and/or modify the library.
+
+  To protect each distributor, we want to make it very clear that
+there is no warranty for the free library.  Also, if the library is
+modified by someone else and passed on, the recipients should know
+that what they have is not the original version, so that the original
+author's reputation will not be affected by problems that might be
+introduced by others.
+
+  Finally, software patents pose a constant threat to the existence of
+any free program.  We wish to make sure that a company cannot
+effectively restrict the users of a free program by obtaining a
+restrictive license from a patent holder.  Therefore, we insist that
+any patent license obtained for a version of the library must be
+consistent with the full freedom of use specified in this license.
+
+  Most GNU software, including some libraries, is covered by the
+ordinary GNU General Public License.  This license, the GNU Lesser
+General Public License, applies to certain designated libraries, and
+is quite different from the ordinary General Public License.  We use
+this license for certain libraries in order to permit linking those
+libraries into non-free programs.
+
+  When a program is linked with a library, whether statically or using
+a shared library, the combination of the two is legally speaking a
+combined work, a derivative of the original library.  The ordinary
+General Public License therefore permits such linking only if the
+entire combination fits its criteria of freedom.  The Lesser General
+Public License permits more lax criteria for linking other code with
+the library.
+
+  We call this license the "Lesser" General Public License because it
+does Less to protect the user's freedom than the ordinary General
+Public License.  It also provides other free software developers Less
+of an advantage over competing non-free programs.  These disadvantages
+are the reason we use the ordinary General Public License for many
+libraries.  However, the Lesser license provides advantages in certain
+special circumstances.
+
+  For example, on rare occasions, there may be a special need to
+encourage the widest possible use of a certain library, so that it becomes
+a de-facto standard.  To achieve this, non-free programs must be
+allowed to use the library.  A more frequent case is that a free
+library does the same job as widely used non-free libraries.  In this
+case, there is little to gain by limiting the free library to free
+software only, so we use the Lesser General Public License.
+
+  In other cases, permission to use a particular library in non-free
+programs enables a greater number of people to use a large body of
+free software.  For example, permission to use the GNU C Library in
+non-free programs enables many more people to use the whole GNU
+operating system, as well as its variant, the GNU/Linux operating
+system.
+
+  Although the Lesser General Public License is Less protective of the
+users' freedom, it does ensure that the user of a program that is
+linked with the Library has the freedom and the wherewithal to run
+that program using a modified version of the Library.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.  Pay close attention to the difference between a
+"work based on the library" and a "work that uses the library".  The
+former contains code derived from the library, whereas the latter must
+be combined with the library in order to run.
+
+                  GNU LESSER GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License Agreement applies to any software library or other
+program which contains a notice placed by the copyright holder or
+other authorized party saying it may be distributed under the terms of
+this Lesser General Public License (also called "this License").
+Each licensee is addressed as "you".
+
+  A "library" means a collection of software functions and/or data
+prepared so as to be conveniently linked with application programs
+(which use some of those functions and data) to form executables.
+
+  The "Library", below, refers to any such software library or work
+which has been distributed under these terms.  A "work based on the
+Library" means either the Library or any derivative work under
+copyright law: that is to say, a work containing the Library or a
+portion of it, either verbatim or with modifications and/or translated
+straightforwardly into another language.  (Hereinafter, translation is
+included without limitation in the term "modification".)
+
+  "Source code" for a work means the preferred form of the work for
+making modifications to it.  For a library, complete source code means
+all the source code for all modules it contains, plus any associated
+interface definition files, plus the scripts used to control compilation
+and installation of the library.
+
+  Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running a program using the Library is not restricted, and output from
+such a program is covered only if its contents constitute a work based
+on the Library (independent of the use of the Library in a tool for
+writing it).  Whether that is true depends on what the Library does
+and what the program that uses the Library does.
+
+  1. You may copy and distribute verbatim copies of the Library's
+complete source code as you receive it, in any medium, provided that
+you conspicuously and appropriately publish on each copy an
+appropriate copyright notice and disclaimer of warranty; keep intact
+all the notices that refer to this License and to the absence of any
+warranty; and distribute a copy of this License along with the
+Library.
+
+  You may charge a fee for the physical act of transferring a copy,
+and you may at your option offer warranty protection in exchange for a
+fee.
+
+  2. You may modify your copy or copies of the Library or any portion
+of it, thus forming a work based on the Library, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) The modified work must itself be a software library.
+
+    b) You must cause the files modified to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    c) You must cause the whole of the work to be licensed at no
+    charge to all third parties under the terms of this License.
+
+    d) If a facility in the modified Library refers to a function or a
+    table of data to be supplied by an application program that uses
+    the facility, other than as an argument passed when the facility
+    is invoked, then you must make a good faith effort to ensure that,
+    in the event an application does not supply such function or
+    table, the facility still operates, and performs whatever part of
+    its purpose remains meaningful.
+
+    (For example, a function in a library to compute square roots has
+    a purpose that is entirely well-defined independent of the
+    application.  Therefore, Subsection 2d requires that any
+    application-supplied function or table used by this function must
+    be optional: if the application does not supply it, the square
+    root function must still compute square roots.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Library,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Library, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote
+it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Library.
+
+In addition, mere aggregation of another work not based on the Library
+with the Library (or with a work based on the Library) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may opt to apply the terms of the ordinary GNU General Public
+License instead of this License to a given copy of the Library.  To do
+this, you must alter all the notices that refer to this License, so
+that they refer to the ordinary GNU General Public License, version 2,
+instead of to this License.  (If a newer version than version 2 of the
+ordinary GNU General Public License has appeared, then you can specify
+that version instead if you wish.)  Do not make any other change in
+these notices.
+
+  Once this change is made in a given copy, it is irreversible for
+that copy, so the ordinary GNU General Public License applies to all
+subsequent copies and derivative works made from that copy.
+
+  This option is useful when you wish to copy part of the code of
+the Library into a program that is not a library.
+
+  4. You may copy and distribute the Library (or a portion or
+derivative of it, under Section 2) in object code or executable form
+under the terms of Sections 1 and 2 above provided that you accompany
+it with the complete corresponding machine-readable source code, which
+must be distributed under the terms of Sections 1 and 2 above on a
+medium customarily used for software interchange.
+
+  If distribution of object code is made by offering access to copy
+from a designated place, then offering equivalent access to copy the
+source code from the same place satisfies the requirement to
+distribute the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  5. A program that contains no derivative of any portion of the
+Library, but is designed to work with the Library by being compiled or
+linked with it, is called a "work that uses the Library".  Such a
+work, in isolation, is not a derivative work of the Library, and
+therefore falls outside the scope of this License.
+
+  However, linking a "work that uses the Library" with the Library
+creates an executable that is a derivative of the Library (because it
+contains portions of the Library), rather than a "work that uses the
+library".  The executable is therefore covered by this License.
+Section 6 states terms for distribution of such executables.
+
+  When a "work that uses the Library" uses material from a header file
+that is part of the Library, the object code for the work may be a
+derivative work of the Library even though the source code is not.
+Whether this is true is especially significant if the work can be
+linked without the Library, or if the work is itself a library.  The
+threshold for this to be true is not precisely defined by law.
+
+  If such an object file uses only numerical parameters, data
+structure layouts and accessors, and small macros and small inline
+functions (ten lines or less in length), then the use of the object
+file is unrestricted, regardless of whether it is legally a derivative
+work.  (Executables containing this object code plus portions of the
+Library will still fall under Section 6.)
+
+  Otherwise, if the work is a derivative of the Library, you may
+distribute the object code for the work under the terms of Section 6.
+Any executables containing that work also fall under Section 6,
+whether or not they are linked directly with the Library itself.
+
+  6. As an exception to the Sections above, you may also combine or
+link a "work that uses the Library" with the Library to produce a
+work containing portions of the Library, and distribute that work
+under terms of your choice, provided that the terms permit
+modification of the work for the customer's own use and reverse
+engineering for debugging such modifications.
+
+  You must give prominent notice with each copy of the work that the
+Library is used in it and that the Library and its use are covered by
+this License.  You must supply a copy of this License.  If the work
+during execution displays copyright notices, you must include the
+copyright notice for the Library among them, as well as a reference
+directing the user to the copy of this License.  Also, you must do one
+of these things:
+
+    a) Accompany the work with the complete corresponding
+    machine-readable source code for the Library including whatever
+    changes were used in the work (which must be distributed under
+    Sections 1 and 2 above); and, if the work is an executable linked
+    with the Library, with the complete machine-readable "work that
+    uses the Library", as object code and/or source code, so that the
+    user can modify the Library and then relink to produce a modified
+    executable containing the modified Library.  (It is understood
+    that the user who changes the contents of definitions files in the
+    Library will not necessarily be able to recompile the application
+    to use the modified definitions.)
+
+    b) Use a suitable shared library mechanism for linking with the
+    Library.  A suitable mechanism is one that (1) uses at run time a
+    copy of the library already present on the user's computer system,
+    rather than copying library functions into the executable, and (2)
+    will operate properly with a modified version of the library, if
+    the user installs one, as long as the modified version is
+    interface-compatible with the version that the work was made with.
+
+    c) Accompany the work with a written offer, valid for at
+    least three years, to give the same user the materials
+    specified in Subsection 6a, above, for a charge no more
+    than the cost of performing this distribution.
+
+    d) If distribution of the work is made by offering access to copy
+    from a designated place, offer equivalent access to copy the above
+    specified materials from the same place.
+
+    e) Verify that the user has already received a copy of these
+    materials or that you have already sent this user a copy.
+
+  For an executable, the required form of the "work that uses the
+Library" must include any data and utility programs needed for
+reproducing the executable from it.  However, as a special exception,
+the materials to be distributed need not include anything that is
+normally distributed (in either source or binary form) with the major
+components (compiler, kernel, and so on) of the operating system on
+which the executable runs, unless that component itself accompanies
+the executable.
+
+  It may happen that this requirement contradicts the license
+restrictions of other proprietary libraries that do not normally
+accompany the operating system.  Such a contradiction means you cannot
+use both them and the Library together in an executable that you
+distribute.
+
+  7. You may place library facilities that are a work based on the
+Library side-by-side in a single library together with other library
+facilities not covered by this License, and distribute such a combined
+library, provided that the separate distribution of the work based on
+the Library and of the other library facilities is otherwise
+permitted, and provided that you do these two things:
+
+    a) Accompany the combined library with a copy of the same work
+    based on the Library, uncombined with any other library
+    facilities.  This must be distributed under the terms of the
+    Sections above.
+
+    b) Give prominent notice with the combined library of the fact
+    that part of it is a work based on the Library, and explaining
+    where to find the accompanying uncombined form of the same work.
+
+  8. You may not copy, modify, sublicense, link with, or distribute
+the Library except as expressly provided under this License.  Any
+attempt otherwise to copy, modify, sublicense, link with, or
+distribute the Library is void, and will automatically terminate your
+rights under this License.  However, parties who have received copies,
+or rights, from you under this License will not have their licenses
+terminated so long as such parties remain in full compliance.
+
+  9. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Library or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Library (or any work based on the
+Library), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Library or works based on it.
+
+  10. Each time you redistribute the Library (or any work based on the
+Library), the recipient automatically receives a license from the
+original licensor to copy, distribute, link with or modify the Library
+subject to these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties with
+this License.
+
+  11. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Library at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Library by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Library.
+
+If any portion of this section is held invalid or unenforceable under any
+particular circumstance, the balance of the section is intended to apply,
+and the section as a whole is intended to apply in other circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  12. If the distribution and/or use of the Library is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Library under this License may add
+an explicit geographical distribution limitation excluding those countries,
+so that distribution is permitted only in or among countries not thus
+excluded.  In such case, this License incorporates the limitation as if
+written in the body of this License.
+
+  13. The Free Software Foundation may publish revised and/or new
+versions of the Lesser General Public License from time to time.
+Such new versions will be similar in spirit to the present version,
+but may differ in detail to address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Library
+specifies a version number of this License which applies to it and
+"any later version", you have the option of following the terms and
+conditions either of that version or of any later version published by
+the Free Software Foundation.  If the Library does not specify a
+license version number, you may choose any version ever published by
+the Free Software Foundation.
+
+  14. If you wish to incorporate parts of the Library into other free
+programs whose distribution conditions are incompatible with these,
+write to the author to ask for permission.  For software which is
+copyrighted by the Free Software Foundation, write to the Free
+Software Foundation; we sometimes make exceptions for this.  Our
+decision will be guided by the two goals of preserving the free status
+of all derivatives of our free software and of promoting the sharing
+and reuse of software generally.
+
+                            NO WARRANTY
+
+  15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
+WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
+EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
+OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
+KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
+LIBRARY IS WITH YOU.  SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
+THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
+WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
+AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
+FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
+CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
+LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
+RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
+FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
+SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
+DAMAGES.
+
+                     END OF TERMS AND CONDITIONS
diff --git a/zookeeper-server/src/main/resources/lib/metrics-core-3.2.5.jar_LICENSE.txt b/zookeeper-server/src/main/resources/lib/metrics-core-4.1.12.1.jar_LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/metrics-core-3.2.5.jar_LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/metrics-core-4.1.12.1.jar_LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.45.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.130.Final.LICENSE.txt
similarity index 99%
rename from zookeeper-server/src/main/resources/lib/netty-resolver-4.1.45.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-buffer-4.1.130.Final.LICENSE.txt
index 6279e5206de..2e16f8158c9 100644
--- a/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.45.Final.LICENSE.txt
+++ b/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.130.Final.LICENSE.txt
@@ -1,7 +1,7 @@
 
                                  Apache License
                            Version 2.0, January 2004
-                        http://www.apache.org/licenses/
+                        https://www.apache.org/licenses/
 
    TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
 
@@ -193,7 +193,7 @@
    you may not use this file except in compliance with the License.
    You may obtain a copy of the License at
 
-       http://www.apache.org/licenses/LICENSE-2.0
+       https://www.apache.org/licenses/LICENSE-2.0
 
    Unless required by applicable law or agreed to in writing, software
    distributed under the License is distributed on an "AS IS" BASIS,
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-4.1.45.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-codec-4.1.130.Final.LICENSE.txt
similarity index 99%
rename from zookeeper-server/src/main/resources/lib/netty-transport-4.1.45.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/netty-codec-4.1.130.Final.LICENSE.txt
index 6279e5206de..2e16f8158c9 100644
--- a/zookeeper-server/src/main/resources/lib/netty-transport-4.1.45.Final.LICENSE.txt
+++ b/zookeeper-server/src/main/resources/lib/netty-codec-4.1.130.Final.LICENSE.txt
@@ -1,7 +1,7 @@
 
                                  Apache License
                            Version 2.0, January 2004
-                        http://www.apache.org/licenses/
+                        https://www.apache.org/licenses/
 
    TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
 
@@ -193,7 +193,7 @@
    you may not use this file except in compliance with the License.
    You may obtain a copy of the License at
 
-       http://www.apache.org/licenses/LICENSE-2.0
+       https://www.apache.org/licenses/LICENSE-2.0
 
    Unless required by applicable law or agreed to in writing, software
    distributed under the License is distributed on an "AS IS" BASIS,
diff --git a/zookeeper-server/src/main/resources/lib/netty-common-4.1.130.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-common-4.1.130.Final.LICENSE.txt
new file mode 100644
index 00000000000..2e16f8158c9
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/netty-common-4.1.130.Final.LICENSE.txt
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        https://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 1999-2005 The Apache Software Foundation
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       https://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/netty-handler-4.1.130.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-handler-4.1.130.Final.LICENSE.txt
new file mode 100644
index 00000000000..2e16f8158c9
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/netty-handler-4.1.130.Final.LICENSE.txt
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        https://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 1999-2005 The Apache Software Foundation
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       https://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.130.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.130.Final.LICENSE.txt
new file mode 100644
index 00000000000..2e16f8158c9
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/netty-resolver-4.1.130.Final.LICENSE.txt
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        https://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 1999-2005 The Apache Software Foundation
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       https://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-4.1.130.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-4.1.130.Final.LICENSE.txt
new file mode 100644
index 00000000000..2e16f8158c9
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/netty-transport-4.1.130.Final.LICENSE.txt
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        https://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 1999-2005 The Apache Software Foundation
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       https://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-classes-epoll-4.1.130.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-classes-epoll-4.1.130.Final.LICENSE.txt
new file mode 100644
index 00000000000..2e16f8158c9
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/netty-transport-classes-epoll-4.1.130.Final.LICENSE.txt
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        https://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 1999-2005 The Apache Software Foundation
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       https://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.45.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.45.Final.LICENSE.txt
deleted file mode 100644
index 6279e5206de..00000000000
--- a/zookeeper-server/src/main/resources/lib/netty-transport-native-epoll-4.1.45.Final.LICENSE.txt
+++ /dev/null
@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 1999-2005 The Apache Software Foundation
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.130.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.130.Final.LICENSE.txt
new file mode 100644
index 00000000000..2e16f8158c9
--- /dev/null
+++ b/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.130.Final.LICENSE.txt
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        https://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 1999-2005 The Apache Software Foundation
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       https://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.45.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.45.Final.LICENSE.txt
deleted file mode 100644
index 6279e5206de..00000000000
--- a/zookeeper-server/src/main/resources/lib/netty-transport-native-unix-common-4.1.45.Final.LICENSE.txt
+++ /dev/null
@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 1999-2005 The Apache Software Foundation
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/simpleclient-0.6.0.LICENSE.txt b/zookeeper-server/src/main/resources/lib/simpleclient-0.6.0.LICENSE.txt
deleted file mode 100644
index 6279e5206de..00000000000
--- a/zookeeper-server/src/main/resources/lib/simpleclient-0.6.0.LICENSE.txt
+++ /dev/null
@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 1999-2005 The Apache Software Foundation
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/json-simple-1.1.1.LICENSE.txt b/zookeeper-server/src/main/resources/lib/simpleclient-0.9.0.LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/json-simple-1.1.1.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/simpleclient-0.9.0.LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/simpleclient_common-0.6.0_LICENSE.txt b/zookeeper-server/src/main/resources/lib/simpleclient_common-0.6.0_LICENSE.txt
deleted file mode 100644
index 6279e5206de..00000000000
--- a/zookeeper-server/src/main/resources/lib/simpleclient_common-0.6.0_LICENSE.txt
+++ /dev/null
@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 1999-2005 The Apache Software Foundation
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/log4j-1.2.17.LICENSE.txt b/zookeeper-server/src/main/resources/lib/simpleclient_common-0.9.0_LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/log4j-1.2.17.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/simpleclient_common-0.9.0_LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/simpleclient_hotspot-0.6.0_LICENSE.txt b/zookeeper-server/src/main/resources/lib/simpleclient_hotspot-0.6.0_LICENSE.txt
deleted file mode 100644
index 6279e5206de..00000000000
--- a/zookeeper-server/src/main/resources/lib/simpleclient_hotspot-0.6.0_LICENSE.txt
+++ /dev/null
@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 1999-2005 The Apache Software Foundation
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/netty-buffer-4.1.45.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/simpleclient_hotspot-0.9.0_LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-buffer-4.1.45.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/simpleclient_hotspot-0.9.0_LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/simpleclient_servlet-0.6.0_LICENSE.txt b/zookeeper-server/src/main/resources/lib/simpleclient_servlet-0.6.0_LICENSE.txt
deleted file mode 100644
index 6279e5206de..00000000000
--- a/zookeeper-server/src/main/resources/lib/simpleclient_servlet-0.6.0_LICENSE.txt
+++ /dev/null
@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 1999-2005 The Apache Software Foundation
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/zookeeper-server/src/main/resources/lib/netty-codec-4.1.45.Final.LICENSE.txt b/zookeeper-server/src/main/resources/lib/simpleclient_servlet-0.9.0_LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/netty-codec-4.1.45.Final.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/simpleclient_servlet-0.9.0_LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/lib/slf4j-1.7.25.LICENSE.txt b/zookeeper-server/src/main/resources/lib/slf4j-2.0.13.LICENSE.txt
similarity index 97%
rename from zookeeper-server/src/main/resources/lib/slf4j-1.7.25.LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/slf4j-2.0.13.LICENSE.txt
index a502dd93a86..b5b7c9e665d 100644
--- a/zookeeper-server/src/main/resources/lib/slf4j-1.7.25.LICENSE.txt
+++ b/zookeeper-server/src/main/resources/lib/slf4j-2.0.13.LICENSE.txt
@@ -1,4 +1,4 @@
-Copyright (c) 2004-2017 QOS.ch
+Copyright (c) 2004-2025 QOS.ch
 All rights reserved.
 
 Permission is hereby granted, free  of charge, to any person obtaining
diff --git a/zookeeper-server/src/main/resources/lib/snappy-java-1.1.7.jar_LICENSE.txt b/zookeeper-server/src/main/resources/lib/snappy-java-1.1.10.5.jar_LICENSE.txt
similarity index 100%
rename from zookeeper-server/src/main/resources/lib/snappy-java-1.1.7.jar_LICENSE.txt
rename to zookeeper-server/src/main/resources/lib/snappy-java-1.1.10.5.jar_LICENSE.txt
diff --git a/zookeeper-server/src/main/resources/pom.template b/zookeeper-server/src/main/resources/pom.template
deleted file mode 100644
index a02c0b3d235..00000000000
--- a/zookeeper-server/src/main/resources/pom.template
+++ /dev/null
@@ -1,41 +0,0 @@
-SKIP_LINE  ***************************************************************
-SKIP_LINE  * Licensed to the Apache Software Foundation (ASF) under one
-SKIP_LINE  * or more contributor license agreements.  See the NOTICE file
-SKIP_LINE  * distributed with this work for additional information
-SKIP_LINE  * regarding copyright ownership.  The ASF licenses this file
-SKIP_LINE  * to you under the Apache License, Version 2.0 (the
-SKIP_LINE  * "License"); you may not use this file except in compliance
-SKIP_LINE  * with the License.  You may obtain a copy of the License at
-SKIP_LINE  * 
-SKIP_LINE  *   http://www.apache.org/licenses/LICENSE-2.0
-SKIP_LINE  * 
-SKIP_LINE  * Unless required by applicable law or agreed to in writing,
-SKIP_LINE  * software distributed under the License is distributed on an
-SKIP_LINE  * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-SKIP_LINE  * KIND, either express or implied.  See the License for the
-SKIP_LINE  * specific language governing permissions and limitations
-SKIP_LINE  * under the License.
-SKIP_LINE  ***************************************************************
-<?xml version="1.0" encoding="UTF-8"?>
-${ivy.pom.license}
-${ivy.pom.header}
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
-
-  <modelVersion>4.0.0</modelVersion>
-  <groupId>${ivy.pom.groupId}</groupId>
-  <artifactId>${ivy.pom.artifactId}</artifactId>
-  <packaging>${ivy.pom.packaging}</packaging>
-  <version>${ivy.pom.version}</version>
-  <name>${ivy.pom.name}</name>
-  <description>${ivy.pom.description}</description>
-  <url>${ivy.pom.url}</url>
-
-  <licenses>
-    <license>
-      <name>The Apache Software License, Version 2.0</name>
-      <url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
-      <distribution>repo</distribution>
-   </license>
-  </licenses>
-</project>
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/BlockingQueueWatcher.java b/zookeeper-server/src/test/java/org/apache/zookeeper/BlockingQueueWatcher.java
new file mode 100644
index 00000000000..caafb06eb48
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/BlockingQueueWatcher.java
@@ -0,0 +1,69 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper;
+
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.time.Duration;
+import java.util.concurrent.BlockingQueue;
+import java.util.concurrent.LinkedBlockingQueue;
+import java.util.concurrent.TimeUnit;
+import java.util.function.Supplier;
+
+public class BlockingQueueWatcher implements Watcher {
+    private final BlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<>();
+
+    @Override
+    public void process(WatchedEvent event) {
+        assertTrue(events.add(event));
+    }
+
+    public WatchedEvent pollEvent(Duration timeout) throws InterruptedException {
+        return events.poll(timeout.toMillis(), TimeUnit.MILLISECONDS);
+    }
+
+    /**
+     * Format {@link Duration} with suffix "ms" or "s".
+     *
+     * <p>I guess {@link Duration#toString()} is verbose and not intuitive.
+     */
+    private String formatTimeout(Duration timeout) {
+        long millis = timeout.toMillis();
+        if (millis < TimeUnit.SECONDS.toMillis(1)) {
+            return millis + "ms";
+        }
+        long secs = millis / TimeUnit.SECONDS.toMillis(1);
+        millis %= TimeUnit.SECONDS.toMillis(1);
+        // We are test code, second unit is large enough.
+        if (millis == 0) {
+            return secs + "s";
+        }
+        return secs + "s" + millis + "ms";
+    }
+
+    private Supplier<String> noEventMessage(Duration timeout) {
+        return () -> String.format("no event after %s", formatTimeout(timeout));
+    }
+
+    public WatchedEvent takeEvent(Duration timeout) throws InterruptedException {
+        WatchedEvent event = pollEvent(timeout);
+        assertNotNull(event, noEventMessage(timeout));
+        return event;
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCanonicalizeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCanonicalizeTest.java
index 796cb6b998c..d94b7e62233 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCanonicalizeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCanonicalizeTest.java
@@ -18,13 +18,15 @@
 
 package org.apache.zookeeper;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.doThrow;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 import java.io.IOException;
 import java.net.InetSocketAddress;
 import org.apache.zookeeper.client.ZKClientConfig;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class ClientCanonicalizeTest extends ZKTestCase {
 
@@ -40,7 +42,7 @@ public void testClientCanonicalization() throws IOException, InterruptedExceptio
 
         ZKClientConfig conf = new ZKClientConfig();
         String principal = SaslServerPrincipal.getServerPrincipal(addr, conf);
-        assertEquals("The computed principal does not appear to have been canonicalized", "zookeeper/zk1.apache.org", principal);
+        assertEquals("zookeeper/zk1.apache.org", principal, "The computed principal does not appear to have been canonicalized");
     }
 
     @Test
@@ -56,7 +58,7 @@ public void testClientNoCanonicalization() throws IOException, InterruptedExcept
         ZKClientConfig conf = new ZKClientConfig();
         conf.setProperty(ZKClientConfig.ZK_SASL_CLIENT_CANONICALIZE_HOSTNAME, "false");
         String principal = SaslServerPrincipal.getServerPrincipal(addr, conf);
-        assertEquals("The computed principal does appears to have been canonicalized incorrectly", "zookeeper/zookeeper.apache.org", principal);
+        assertEquals("zookeeper/zookeeper.apache.org", principal, "The computed principal does appears to have been canonicalized incorrectly");
     }
 
     @Test
@@ -71,7 +73,7 @@ public void testClientCanonicalizationToIp() throws IOException, InterruptedExce
 
         ZKClientConfig conf = new ZKClientConfig();
         String principal = SaslServerPrincipal.getServerPrincipal(addr, conf);
-        assertEquals("The computed principal does appear to have falled back to the original host name", "zookeeper/zookeeper.apache.org", principal);
+        assertEquals("zookeeper/zookeeper.apache.org", principal, "The computed principal does appear to have falled back to the original host name");
     }
 
     @Test
@@ -85,4 +87,39 @@ public void testGetServerPrincipalReturnConfiguredPrincipalName() {
         assertEquals(configuredPrincipal, serverPrincipal);
     }
 
+    @Test
+    public void testAllowReverseDnsLookupDisabled() {
+        // Arrange
+        ZKClientConfig config = new ZKClientConfig();
+        config.setProperty(ZKClientConfig.ZK_SASL_CLIENT_ALLOW_REVERSE_DNS, "false");
+        InetSocketAddress addr = mock(InetSocketAddress.class);
+        SaslServerPrincipal.WrapperInetSocketAddress ia = new SaslServerPrincipal.WrapperInetSocketAddress(addr, config);
+        doReturn("this-is-the-right-hostname").when(addr).getHostString();
+        doThrow(new UnsupportedOperationException("getHostName() should not be called when reverse DNS is disabled"))
+            .when(addr).getHostName();
+
+        // Act
+        String hostname = ia.getHostName();
+
+        // Assert
+        assertEquals("this-is-the-right-hostname", hostname);
+    }
+
+    @Test
+    public void testAllowReverseDnsLookupEnabled() {
+        // Arrange
+        ZKClientConfig config = new ZKClientConfig();
+        config.setProperty(ZKClientConfig.ZK_SASL_CLIENT_ALLOW_REVERSE_DNS, "true");
+        InetSocketAddress addr = mock(InetSocketAddress.class);
+        SaslServerPrincipal.WrapperInetSocketAddress ia = new SaslServerPrincipal.WrapperInetSocketAddress(addr, config);
+        doReturn("this-is-the-right-hostname").when(addr).getHostName();
+        doThrow(new UnsupportedOperationException("getHostString() should not be called when reverse DNS is enabled"))
+            .when(addr).getHostString();
+
+        // Act
+        String hostname = ia.getHostName();
+
+        // Assert
+        assertEquals("this-is-the-right-hostname", hostname);
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java
index 2c7f6bd0547..27c07fe905b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketFragilityTest.java
@@ -18,22 +18,36 @@
 
 package org.apache.zookeeper;
 
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.lessThanOrEqualTo;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.doAnswer;
+import static org.mockito.Mockito.doThrow;
+import static org.mockito.Mockito.spy;
 import java.io.IOException;
 import java.net.InetSocketAddress;
+import java.net.SocketException;
+import java.nio.channels.Selector;
+import java.nio.channels.SocketChannel;
+import java.time.Duration;
 import java.util.Queue;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.Executors;
 import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicReference;
 import org.apache.zookeeper.ClientCnxn.Packet;
 import org.apache.zookeeper.Watcher.Event.KeeperState;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.client.HostProvider;
 import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.common.BusyServer;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Assert;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class ClientCnxnSocketFragilityTest extends QuorumPeerTestBase {
 
@@ -73,6 +87,40 @@ private void closeZookeeper(ZooKeeper zk) {
         });
     }
 
+    @Test
+    public void testSocketClosedAfterFailure() throws Exception {
+        Duration sessionTimeout = Duration.ofMillis(1000);
+        final AtomicReference<Selector> nioSelector = new AtomicReference<>();
+        try (
+                // given: busy server
+                BusyServer server = new BusyServer();
+                ZooKeeper zk = new ZooKeeper(server.getHostPort(), (int) sessionTimeout.toMillis(), null) {
+                @Override
+                ClientCnxn createConnection(HostProvider hostProvider, int sessionTimeout, long newSessionTimeout, ZKClientConfig clientConfig, Watcher defaultWatcher, ClientCnxnSocket clientCnxnSocket, long sessionId, byte[] sessionPasswd, boolean canBeReadOnly) throws IOException {
+                    ClientCnxnSocketNIO socket = spy((ClientCnxnSocketNIO) clientCnxnSocket);
+
+                    doAnswer(mock -> {
+                        SocketChannel spy = spy((SocketChannel) mock.callRealMethod());
+                        // when: connect get exception
+                        //
+                        // this could happen if system's network service is unavailable,
+                        // for examples, "ifdown eth0" or "service network stop" and so on.
+                        doThrow(new SocketException("Network is unreachable")).when(spy).connect(any());
+                        return spy;
+                    }).when(socket).createSock();
+
+                    nioSelector.set(socket.getSelector());
+                    return super.createConnection(hostProvider, sessionTimeout, newSessionTimeout, clientConfig, defaultWatcher, socket, sessionId, sessionPasswd, canBeReadOnly);
+                }
+            }) {
+
+            Thread.sleep(sessionTimeout.toMillis() * 5);
+
+            // then: sockets of failed connections are closed, so at most one registered socket
+            assertThat(nioSelector.get().keys().size(), lessThanOrEqualTo(1));
+        }
+    }
+
     @Test
     public void testClientCnxnSocketFragility() throws Exception {
         System.setProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET,
@@ -98,8 +146,8 @@ public void testClientCnxnSocketFragility() throws Exception {
 
         // Ensure server started
         for (int i = 0; i < SERVER_COUNT; i++) {
-            Assert.assertTrue("waiting for server " + i + " being up",
-                    ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                    "waiting for server " + i + " being up");
         }
         String path = "/testClientCnxnSocketFragility";
         String data = "balabala";
@@ -109,8 +157,8 @@ public void testClientCnxnSocketFragility() throws Exception {
 
         // Let's see some successful operations
         zk.create(path, data.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        Assert.assertEquals(new String(zk.getData(path, false, new Stat())), data);
-        Assert.assertTrue(!watcher.isSessionExpired());
+        assertEquals(new String(zk.getData(path, false, new Stat())), data);
+        assertTrue(!watcher.isSessionExpired());
 
         // Let's make a broken operation
         socket.mute();
@@ -119,11 +167,11 @@ public void testClientCnxnSocketFragility() throws Exception {
             zk.getData(path, false, new Stat());
         } catch (KeeperException e) {
             catchKeeperException = true;
-            Assert.assertFalse(e instanceof KeeperException.SessionExpiredException);
+            assertFalse(e instanceof KeeperException.SessionExpiredException);
         }
         socket.unmute();
-        Assert.assertTrue(catchKeeperException);
-        Assert.assertTrue(!watcher.isSessionExpired());
+        assertTrue(catchKeeperException);
+        assertTrue(!watcher.isSessionExpired());
 
         GetDataRetryForeverBackgroundTask retryForeverGetData =
                 new GetDataRetryForeverBackgroundTask(zk, path);
@@ -143,8 +191,8 @@ public void testClientCnxnSocketFragility() throws Exception {
         TimeUnit.MILLISECONDS.sleep(3000);
 
         // Since we already close zookeeper, we expect that the zk should not be alive.
-        Assert.assertTrue(!zk.isAlive());
-        Assert.assertTrue(!watcher.isSessionExpired());
+        assertTrue(!zk.isAlive());
+        assertTrue(!watcher.isSessionExpired());
 
         retryForeverGetData.syncCloseTask();
         for (int i = 0; i < SERVER_COUNT; i++) {
@@ -278,14 +326,26 @@ class CustomClientCnxn extends ClientCnxn {
         private volatile boolean hitUnsafeRegion = false;
 
         public CustomClientCnxn(
-            String chrootPath,
             HostProvider hostProvider,
             int sessionTimeout,
-            ZooKeeper zooKeeper,
-            ClientWatchManager watcher,
+            long newSessionTimeout,
+            ZKClientConfig zkClientConfig,
+            Watcher defaultWatcher,
             ClientCnxnSocket clientCnxnSocket,
-            boolean canBeReadOnly) throws IOException {
-            super(chrootPath, hostProvider, sessionTimeout, zooKeeper, watcher, clientCnxnSocket, canBeReadOnly);
+            long sessionId,
+            byte[] sessionPasswd,
+            boolean canBeReadOnly
+        ) throws IOException {
+            super(
+                hostProvider,
+                sessionTimeout,
+                newSessionTimeout,
+                zkClientConfig,
+                defaultWatcher,
+                clientCnxnSocket,
+                sessionId,
+                sessionPasswd,
+                canBeReadOnly);
         }
 
         void attemptClose() {
@@ -304,7 +364,7 @@ void waitUntilHitUnsafeRegion() {
         @Override
         protected void onConnecting(InetSocketAddress addr) {
             if (closing) {
-                LOG.info("Attempt to connnecting {} {} {}", addr, closing, state);
+                LOG.info("Attempt to connecting {} {} {}", addr, closing, state);
                 ///////// Unsafe Region ////////
                 // Slow down and zoom out the unsafe point to make risk
                 // The unsafe point is that startConnect happens after sendThread.close
@@ -316,7 +376,7 @@ protected void onConnecting(InetSocketAddress addr) {
 
         @Override
         public void disconnect() {
-            Assert.assertTrue(closing);
+            assertTrue(closing);
             LOG.info("Attempt to disconnecting client for session: 0x{} {} {}", Long.toHexString(getSessionId()), closing, state);
             sendThread.close();
             ///////// Unsafe Region ////////
@@ -328,9 +388,6 @@ public void disconnect() {
                 LOG.warn("Got interrupted while waiting for the sender thread to close", ex);
             }
             eventThread.queueEventOfDeath();
-            if (zooKeeperSaslClient != null) {
-                zooKeeperSaslClient.shutdown();
-            }
         }
     }
 
@@ -345,18 +402,30 @@ public boolean isAlive() {
         }
 
         @Override
-        protected ClientCnxn createConnection(
-            String chrootPath,
+        ClientCnxn createConnection(
             HostProvider hostProvider,
             int sessionTimeout,
-            ZooKeeper zooKeeper,
-            ClientWatchManager watcher,
+            long newSessionTimeout,
+            ZKClientConfig clientConfig,
+            Watcher defaultWatcher,
             ClientCnxnSocket clientCnxnSocket,
-            boolean canBeReadOnly) throws IOException {
-            Assert.assertTrue(clientCnxnSocket instanceof FragileClientCnxnSocketNIO);
+            long sessionId,
+            byte[] sessionPasswd,
+            boolean canBeReadOnly
+        ) throws IOException {
+            assertTrue(clientCnxnSocket instanceof FragileClientCnxnSocketNIO);
             socket = (FragileClientCnxnSocketNIO) clientCnxnSocket;
-            ClientCnxnSocketFragilityTest.this.cnxn = new CustomClientCnxn(chrootPath, hostProvider, sessionTimeout, zooKeeper, watcher, clientCnxnSocket, canBeReadOnly);
+            ClientCnxnSocketFragilityTest.this.cnxn = new CustomClientCnxn(
+                hostProvider,
+                sessionTimeout,
+                newSessionTimeout,
+                clientConfig,
+                defaultWatcher,
+                clientCnxnSocket,
+                sessionId,
+                sessionPasswd,
+                canBeReadOnly);
             return ClientCnxnSocketFragilityTest.this.cnxn;
         }
     }
-}
\ No newline at end of file
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketTest.java
index 310d34fce5c..a6e4c135d9d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientCnxnSocketTest.java
@@ -18,24 +18,25 @@
 
 package org.apache.zookeeper;
 
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.common.ZKConfig;
 import org.apache.zookeeper.test.TestByteBufAllocator;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class ClientCnxnSocketTest {
 
-    @Before
+    @BeforeEach
     public void setUp() {
         ClientCnxnSocketNetty.setTestAllocator(TestByteBufAllocator.getInstance());
     }
 
-    @After
+    @AfterEach
     public void tearDown() {
         ClientCnxnSocketNetty.clearTestAllocator();
         TestByteBufAllocator.checkForLeaks();
@@ -63,4 +64,40 @@ public void testWhenInvalidJuteMaxBufferIsConfiguredIOExceptionIsThrown() {
 
     }
 
+    /*
+     * Tests readLength():
+     * 1. successfully read packet if length == jute.maxbuffer;
+     * 2. IOException is thrown if packet length is greater than jute.maxbuffer.
+     */
+    @Test
+    public void testIOExceptionIsThrownWhenPacketLenExceedsJuteMaxBuffer() throws IOException {
+        ClientCnxnSocket clientCnxnSocket = new ClientCnxnSocketNIO(new ZKClientConfig());
+
+        // Should successfully read packet length == jute.maxbuffer
+        int length = ZKClientConfig.CLIENT_MAX_PACKET_LENGTH_DEFAULT;
+        clientCnxnSocket.incomingBuffer.putInt(length);
+        clientCnxnSocket.incomingBuffer.rewind();
+        clientCnxnSocket.readLength();
+
+        // Failed to read packet length > jute.maxbuffer
+        length = ZKClientConfig.CLIENT_MAX_PACKET_LENGTH_DEFAULT + 1;
+        clientCnxnSocket.incomingBuffer.putInt(length);
+        clientCnxnSocket.incomingBuffer.rewind();
+        try {
+            clientCnxnSocket.readLength();
+            fail("IOException is expected.");
+        } catch (IOException e) {
+            assertEquals("Packet len " + length + " is out of range!", e.getMessage());
+        }
+    }
+
+    @Test
+    public void testClientCanBeClosedWhenNotInitialized() throws IOException {
+        ZKClientConfig clientConfig = new ZKClientConfig();
+        final ClientCnxnSocketNetty clientCnxnSocket = new ClientCnxnSocketNetty(clientConfig);
+        // Should not throw
+        clientCnxnSocket.close();
+        // Call onClosing explicitly since it otherwise won't be invoked without more setup.
+        clientCnxnSocket.onClosing();
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientReconnectTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientReconnectTest.java
index e77283c84e5..b7d6af387e7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientReconnectTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientReconnectTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper;
 
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.ArgumentMatchers.anyLong;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
@@ -29,7 +29,7 @@
 import java.util.concurrent.TimeUnit;
 import org.apache.zookeeper.client.HostProvider;
 import org.apache.zookeeper.client.ZKClientConfig;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class ClientReconnectTest extends ZKTestCase {
 
@@ -66,8 +66,13 @@ public void testClientReconnect() throws IOException, InterruptedException {
         sc = SocketChannel.open();
 
         ClientCnxnSocketNIO nioCnxn = new MockCnxn();
-        ClientWatchManager watcher = mock(ClientWatchManager.class);
-        ClientCnxn clientCnxn = new ClientCnxn("tmp", hostProvider, 5000, zk, watcher, nioCnxn, false);
+        ClientCnxn clientCnxn = new ClientCnxn(
+            hostProvider,
+            5000,
+            zk.getClientConfig(),
+            DummyWatcher.INSTANCE,
+            nioCnxn,
+            false);
         clientCnxn.start();
         countDownLatch.await(5000, TimeUnit.MILLISECONDS);
         assertTrue(countDownLatch.getCount() == 0);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientRequestTimeoutTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientRequestTimeoutTest.java
index 7c3bf5198f4..a05825ce2de 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ClientRequestTimeoutTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ClientRequestTimeoutTest.java
@@ -19,24 +19,38 @@
 package org.apache.zookeeper;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.greaterThanOrEqualTo;
+import static org.hamcrest.Matchers.lessThan;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
+import java.util.concurrent.TimeUnit;
+import org.apache.jute.Record;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.client.HostProvider;
+import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.common.Time;
+import org.apache.zookeeper.proto.ReplyHeader;
+import org.apache.zookeeper.proto.RequestHeader;
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 public class ClientRequestTimeoutTest extends QuorumPeerTestBase {
 
     private static final int SERVER_COUNT = 3;
     private boolean dropPacket = false;
     private int dropPacketType = ZooDefs.OpCode.create;
+    private boolean capturePacket = false;
+    private int capturePacketType = ZooDefs.OpCode.create;
+    private ClientCnxn.Packet capturedPacket = null;
 
-    @Test(timeout = 120000)
+    @Test
+    @Timeout(value = 120)
     public void testClientRequestTimeout() throws Exception {
         int requestTimeOut = 15000;
         System.setProperty("zookeeper.request.timeout", Integer.toString(requestTimeOut));
@@ -60,9 +74,8 @@ public void testClientRequestTimeout() throws Exception {
 
         // ensure server started
         for (int i = 0; i < SERVER_COUNT; i++) {
-            assertTrue(
-                "waiting for server " + i + " being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                "waiting for server " + i + " being up");
         }
 
         CountdownWatcher watch1 = new CountdownWatcher();
@@ -92,6 +105,105 @@ public void testClientRequestTimeout() throws Exception {
         }
     }
 
+    @Test
+    void testClientRequestTimeoutTime() throws Exception {
+        long requestTimeout = TimeUnit.SECONDS.toMillis(5);
+        System.setProperty("zookeeper.request.timeout", Long.toString(requestTimeout));
+
+        CustomZooKeeper zk = null;
+        int clientPort = PortAssignment.unique();
+        MainThread mainThread = new MainThread(0, clientPort, "", false);
+        mainThread.start();
+        try {
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPort, CONNECTION_TIMEOUT),
+                    "waiting for server 0 being up");
+
+            CountdownWatcher watch = new CountdownWatcher();
+            zk = new CustomZooKeeper(getCxnString(new int[]{clientPort}), ClientBase.CONNECTION_TIMEOUT, watch);
+            watch.waitForConnected(ClientBase.CONNECTION_TIMEOUT);
+
+            dropPacket = true;
+            dropPacketType = ZooDefs.OpCode.create;
+
+            String data = "originalData";
+            long startTime = Time.currentElapsedTime();
+            try {
+                zk.create("/testClientRequestTimeout", data.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_SEQUENTIAL);
+                fail("KeeperException is expected.");
+            } catch (KeeperException exception) {
+                long cost = Time.currentElapsedTime() - startTime;
+                assertEquals(KeeperException.Code.REQUESTTIMEOUT, exception.code());
+                LOG.info("testClientRequestTimeoutTime cost:{}", cost);
+                assertThat(cost, greaterThanOrEqualTo(requestTimeout));
+                assertThat(cost, lessThan(requestTimeout + 500));
+            }
+        } finally {
+            mainThread.shutdown();
+            if (zk != null) {
+                zk.close();
+            }
+        }
+    }
+
+
+    @Test
+    void testClientRequestTimeoutTimeSimulatingSpuriousWakeup() throws Exception {
+        long requestTimeout = TimeUnit.SECONDS.toMillis(5);
+        System.setProperty("zookeeper.request.timeout", Long.toString(requestTimeout));
+
+        CustomZooKeeper zk = null;
+        int clientPort = PortAssignment.unique();
+        MainThread mainThread = new MainThread(0, clientPort, "", false);
+        mainThread.start();
+        try {
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPort, CONNECTION_TIMEOUT),
+                    "waiting for server 0 being up");
+
+            CountdownWatcher watch = new CountdownWatcher();
+            zk = new CustomZooKeeper(getCxnString(new int[]{clientPort}), ClientBase.CONNECTION_TIMEOUT, watch);
+            watch.waitForConnected(ClientBase.CONNECTION_TIMEOUT);
+
+            dropPacket = true;
+            dropPacketType = ZooDefs.OpCode.create;
+            capturePacket = true;
+            capturePacketType = ZooDefs.OpCode.create;
+
+            // Simulating spurious wakeup
+            new Thread(() -> {
+                try {
+                    TimeUnit.MILLISECONDS.sleep(requestTimeout / 2);
+                    if (capturedPacket != null) {
+                        synchronized (capturedPacket) {
+                            capturedPacket.notifyAll();
+                        }
+                    }
+                } catch (InterruptedException e) {
+                    throw new RuntimeException(e);
+                }
+            }).start();
+
+            String data = "originalData";
+            long startTime = Time.currentElapsedTime();
+            try {
+                zk.create("/testClientRequestTimeout", data.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_SEQUENTIAL);
+                fail("KeeperException is expected.");
+            } catch (KeeperException exception) {
+                long cost = Time.currentElapsedTime() - startTime;
+                assertEquals(KeeperException.Code.REQUESTTIMEOUT, exception.code());
+                LOG.info("testClientRequestTimeoutTimeSimulatingSpuriousWakeup cost:{}", cost);
+                assertThat(cost, greaterThanOrEqualTo(requestTimeout));
+                assertThat(cost, lessThan(requestTimeout + 500));
+            }
+        } finally {
+            capturePacket = false;
+            capturedPacket = null;
+            mainThread.shutdown();
+            if (zk != null) {
+                zk.close();
+            }
+        }
+    }
+
     /**
      * @return connection string in the form of
      *         127.0.0.1:port1,127.0.0.1:port2,127.0.0.1:port3
@@ -110,15 +222,27 @@ private String getCxnString(int[] clientPorts) {
 
     class CustomClientCnxn extends ClientCnxn {
 
-        public CustomClientCnxn(
-            String chrootPath,
+        CustomClientCnxn(
             HostProvider hostProvider,
             int sessionTimeout,
-            ZooKeeper zooKeeper,
-            ClientWatchManager watcher,
+            long newSessionTimeout,
+            ZKClientConfig clientConfig,
+            Watcher defaultWatcher,
             ClientCnxnSocket clientCnxnSocket,
-            boolean canBeReadOnly) throws IOException {
-            super(chrootPath, hostProvider, sessionTimeout, zooKeeper, watcher, clientCnxnSocket, canBeReadOnly);
+            long sessionId,
+            byte[] sessionPasswd,
+            boolean canBeReadOnly
+        ) throws IOException {
+            super(
+                hostProvider,
+                sessionTimeout,
+                newSessionTimeout,
+                clientConfig,
+                defaultWatcher,
+                clientCnxnSocket,
+                sessionId,
+                sessionPasswd,
+                canBeReadOnly);
         }
 
         @Override
@@ -131,6 +255,27 @@ public void finishPacket(Packet p) {
             super.finishPacket(p);
         }
 
+        @Override
+        public Packet queuePacket(
+                RequestHeader h,
+                ReplyHeader r,
+                Record request,
+                Record response,
+                AsyncCallback cb,
+                String clientPath,
+                String serverPath,
+                Object ctx,
+                ZooKeeper.WatchRegistration watchRegistration,
+                WatchDeregistration watchDeregistration) {
+            Packet packet = super.queuePacket(h, r, request, response, cb, clientPath, serverPath,
+                    ctx, watchRegistration, watchDeregistration);
+
+            if (capturePacket && h != null && h.getType() == capturePacketType) {
+                capturedPacket = packet;
+            }
+            return packet;
+        }
+
     }
 
     class CustomZooKeeper extends ZooKeeper {
@@ -140,15 +285,27 @@ public CustomZooKeeper(String connectString, int sessionTimeout, Watcher watcher
         }
 
         @Override
-        protected ClientCnxn createConnection(
-            String chrootPath,
+        ClientCnxn createConnection(
             HostProvider hostProvider,
             int sessionTimeout,
-            ZooKeeper zooKeeper,
-            ClientWatchManager watcher,
+            long newSessionTimeout,
+            ZKClientConfig clientConfig,
+            Watcher defaultWatcher,
             ClientCnxnSocket clientCnxnSocket,
-            boolean canBeReadOnly) throws IOException {
-            return new CustomClientCnxn(chrootPath, hostProvider, sessionTimeout, zooKeeper, watcher, clientCnxnSocket, canBeReadOnly);
+            long sessionId,
+            byte[] sessionPasswd,
+            boolean canBeReadOnly
+        ) throws IOException {
+            return new CustomClientCnxn(
+                hostProvider,
+                sessionTimeout,
+                newSessionTimeout,
+                clientConfig,
+                defaultWatcher,
+                clientCnxnSocket,
+                sessionId,
+                sessionPasswd,
+                canBeReadOnly);
         }
 
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ConfigWatcherPathTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ConfigWatcherPathTest.java
new file mode 100644
index 00000000000..db56ad47407
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ConfigWatcherPathTest.java
@@ -0,0 +1,231 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper;
+
+import static org.hamcrest.CoreMatchers.hasItem;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.time.Duration;
+import java.util.HashSet;
+import java.util.Set;
+import java.util.concurrent.CompletableFuture;
+import java.util.function.Consumer;
+import org.apache.zookeeper.common.PathUtils;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.Test;
+
+public class ConfigWatcherPathTest extends ClientBase {
+    private void join(Consumer<CompletableFuture<Void>> task) {
+        CompletableFuture<Void> future = new CompletableFuture<>();
+        task.accept(future);
+        future.join();
+    }
+
+    private AsyncCallback.DataCallback complete(CompletableFuture<Void> future) {
+        return (rc, path, ctx, data, stat) -> {
+            if (rc == 0) {
+                future.complete(null);
+            } else {
+                future.completeExceptionally(KeeperException.create(KeeperException.Code.get(rc), path));
+            }
+        };
+    }
+
+    private void testConfigWatcherPathWithChroot(String chroot) throws Exception {
+        ZooKeeper zk1 = createClient(hostPort + chroot);
+
+        BlockingQueueWatcher configWatcher = new BlockingQueueWatcher();
+
+        // given|>config watcher: attach to config node multiple times
+        byte[] configData = zk1.getConfig(configWatcher, null);
+        join(future -> zk1.getConfig(configWatcher, complete(future), null));
+
+        // given|>default watcher: attach to config node multiple times
+        BlockingQueueWatcher defaultWatcher = new BlockingQueueWatcher();
+        zk1.getWatchManager().setDefaultWatcher(defaultWatcher);
+        zk1.getConfig(true, null);
+        zk1.getConfig(defaultWatcher, null);
+
+        // when: make change to config node
+        ZooKeeper zk2 = createClient();
+        zk2.addAuthInfo("digest", "super:test".getBytes());
+        zk2.setData(ZooDefs.CONFIG_NODE, configData, -1);
+
+        // then|>config watcher: only one event with path "/zookeeper/config"
+        WatchedEvent configEvent = configWatcher.takeEvent(Duration.ofSeconds(10));
+        assertEquals("/zookeeper/config", configEvent.getPath());
+        assertNull(configWatcher.pollEvent(Duration.ofMillis(10)));
+
+        // then|>default watcher: only one event with path "/zookeeper/config"
+        WatchedEvent defaultWatcherEvent = defaultWatcher.takeEvent(Duration.ofSeconds(10));
+        assertEquals("/zookeeper/config", defaultWatcherEvent.getPath());
+        assertNull(defaultWatcher.pollEvent(Duration.ofMillis(10)));
+
+        // given: all watchers fired
+        // when: make change to config node
+        zk2.setData(ZooDefs.CONFIG_NODE, configData, -1);
+
+        // then: no more events
+        assertNull(configWatcher.pollEvent(Duration.ofMillis(10)));
+        assertNull(defaultWatcher.pollEvent(Duration.ofMillis(10)));
+    }
+
+    @Test
+    public void testConfigWatcherPathWithNoChroot() throws Exception {
+        testConfigWatcherPathWithChroot("");
+    }
+
+    @Test
+    public void testConfigWatcherPathWithShortChroot() throws Exception {
+        testConfigWatcherPathWithChroot("/short");
+    }
+
+    @Test
+    public void testConfigWatcherPathWithLongChroot() throws Exception {
+        testConfigWatcherPathWithChroot("/pretty-long-chroot-path");
+    }
+
+    @Test
+    public void testConfigWatcherPathWithChrootZooKeeperTree() throws Exception {
+        testConfigWatcherPathWithChroot("/zookeeper");
+        testConfigWatcherPathWithChroot("/zookeeper/a");
+        testConfigWatcherPathWithChroot("/zookeeper/config");
+        testConfigWatcherPathWithChroot("/zookeeper/config/a");
+    }
+
+    @Test
+    public void testConfigWatcherPathWithChrootZoo() throws Exception {
+        // "/zoo" is prefix of "/zookeeper/config"
+        testConfigWatcherPathWithChroot("/zoo");
+    }
+
+    private void testDataWatcherPathWithChroot(String chroot) throws Exception {
+        assertTrue("/zookeeper/config".startsWith(chroot));
+        String leafPath = "/zookeeper/config".substring(chroot.length());
+        String dataPath = leafPath.isEmpty() ? "/" : leafPath;
+        PathUtils.validatePath(dataPath);
+
+        ZooKeeper zk1 = createClient(hostPort + chroot);
+
+        BlockingQueueWatcher dataWatcher = new BlockingQueueWatcher();
+        BlockingQueueWatcher configWatcher = new BlockingQueueWatcher();
+
+        // given|>config watcher: attach to config node multiple times
+        byte[] configData = zk1.getConfig(configWatcher, null);
+        zk1.getConfig(configWatcher, null);
+
+        // given|>data watcher: attach to config node through getData multiple times
+        zk1.getData(dataPath, dataWatcher, null);
+        join(future -> zk1.getData(dataPath, dataWatcher, complete(future), null));
+
+        // given|>default watcher: attach to config node through getData and getConfig multiple times
+        BlockingQueueWatcher defaultWatcher = new BlockingQueueWatcher();
+        zk1.getWatchManager().setDefaultWatcher(defaultWatcher);
+        zk1.getData(dataPath, true, null);
+        zk1.getData(dataPath, defaultWatcher, null);
+        zk1.getConfig(true, null);
+        zk1.getConfig(defaultWatcher, null);
+
+        // when: make change to config node
+        ZooKeeper zk2 = createClient();
+        zk2.addAuthInfo("digest", "super:test".getBytes());
+        zk2.setData(ZooDefs.CONFIG_NODE, configData, -1);
+
+        // then|>data watcher: only one event with path dataPath
+        WatchedEvent dataEvent = dataWatcher.takeEvent(Duration.ofSeconds(10));
+        assertEquals(dataPath, dataEvent.getPath());
+        assertNull(dataWatcher.pollEvent(Duration.ofMillis(10)));
+
+        // then|>config watcher: only one event with path "/zookeeper/config"
+        WatchedEvent configEvent = configWatcher.takeEvent(Duration.ofSeconds(10));
+        assertEquals("/zookeeper/config", configEvent.getPath());
+        assertNull(configWatcher.pollEvent(Duration.ofMillis(10)));
+
+        if (dataPath.equals("/zookeeper/config")) {
+            // then|>default watcher: only one event with path "/zookeeper/config"
+            WatchedEvent defaultWatcherEvent = defaultWatcher.takeEvent(Duration.ofSeconds(10));
+            assertEquals("/zookeeper/config", defaultWatcherEvent.getPath());
+        } else {
+            // then|>default watcher: two events with path dataPath and "/zookeeper/config"
+            Set<String> defaultWatcherPaths = new HashSet<>();
+            defaultWatcherPaths.add(dataPath);
+            defaultWatcherPaths.add("/zookeeper/config");
+
+            WatchedEvent defaultWatcherEvent1 = defaultWatcher.takeEvent(Duration.ofSeconds(10));
+            assertThat(defaultWatcherPaths, hasItem(defaultWatcherEvent1.getPath()));
+            defaultWatcherPaths.remove(defaultWatcherEvent1.getPath());
+
+            WatchedEvent defaultWatcherEvent2 = defaultWatcher.takeEvent(Duration.ofSeconds(10));
+            assertNotNull(defaultWatcherEvent2);
+            assertThat(defaultWatcherPaths, hasItem(defaultWatcherEvent2.getPath()));
+        }
+        assertNull(defaultWatcher.pollEvent(Duration.ofMillis(10)));
+
+        // given: all watchers fired
+        // when: make change to config node
+        zk2.setData(ZooDefs.CONFIG_NODE, configData, -1);
+
+        // then: no more events
+        assertNull(dataWatcher.pollEvent(Duration.ofMillis(10)));
+        assertNull(configWatcher.pollEvent(Duration.ofMillis(10)));
+        assertNull(defaultWatcher.pollEvent(Duration.ofMillis(10)));
+    }
+
+    @Test
+    public void testDataWatcherPathWithNoChroot() throws Exception {
+        testDataWatcherPathWithChroot("");
+    }
+
+    @Test
+    public void testDataWatcherPathWithChrootZooKeeper() throws Exception {
+        testDataWatcherPathWithChroot("/zookeeper");
+    }
+
+    @Test
+    public void testDataWatcherPathWithChrootZooKeeperConfig() throws Exception {
+        testDataWatcherPathWithChroot("/zookeeper/config");
+    }
+
+    @Test
+    public void testDataWatcherPathWithChrootAndConfigPath() throws Exception {
+        try (ZooKeeper zk1 = createClient(hostPort + "/root1"); ZooKeeper zk2 = createClient()) {
+            // given: watcher client path "/zookeeper/config" in chroot "/root1"
+            BlockingQueueWatcher dataWatcher = new BlockingQueueWatcher();
+            zk1.addWatch("/zookeeper/config", dataWatcher, AddWatchMode.PERSISTENT);
+
+            // and: watch for "/zookeeper/config" in server
+            BlockingQueueWatcher configWatcher = new BlockingQueueWatcher();
+            byte[] configData = zk1.getConfig(configWatcher, null);
+
+            // when: make change to config node
+            zk2.addAuthInfo("digest", "super:test".getBytes());
+            zk2.setData(ZooDefs.CONFIG_NODE, configData, -1);
+
+            // then: config watcher works normally
+            WatchedEvent configEvent = configWatcher.takeEvent(Duration.ofSeconds(10));
+            assertEquals("/zookeeper/config", configEvent.getPath());
+
+            // and: no data watcher for "/zookeeper/config" in chroot "/root1"
+            assertNull(dataWatcher.pollEvent(Duration.ofSeconds(1)));
+        }
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/CustomHostProviderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/CustomHostProviderTest.java
index 29ce9ef0c24..9a78b3428e5 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/CustomHostProviderTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/CustomHostProviderTest.java
@@ -18,14 +18,14 @@
 
 package org.apache.zookeeper;
 
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
 import java.net.InetSocketAddress;
 import java.util.Collection;
 import java.util.concurrent.atomic.AtomicInteger;
 import org.apache.zookeeper.client.HostProvider;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class CustomHostProviderTest extends ZKTestCase {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/EnforceAuthenticationTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/EnforceAuthenticationTest.java
new file mode 100644
index 00000000000..ef665621ac7
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/EnforceAuthenticationTest.java
@@ -0,0 +1,266 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper;
+
+import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.fail;
+import java.io.File;
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.concurrent.CountDownLatch;
+import org.apache.zookeeper.ZooDefs.Ids;
+import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.server.AuthenticationHelper;
+import org.apache.zookeeper.server.ServerConfig;
+import org.apache.zookeeper.server.ZooKeeperServerMain;
+import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class EnforceAuthenticationTest extends QuorumPeerTestBase {
+    protected static final Logger LOG = LoggerFactory.getLogger(EnforceAuthenticationTest.class);
+    private Servers servers;
+    private int clientPort;
+
+    @Before
+    public void setUp() {
+        System.setProperty("zookeeper.admin.enableServer", "false");
+        System.setProperty("zookeeper.4lw.commands.whitelist", "*");
+        System.clearProperty(AuthenticationHelper.ENFORCE_AUTH_ENABLED);
+        System.clearProperty(AuthenticationHelper.ENFORCE_AUTH_SCHEMES);
+    }
+
+    @After
+    public void tearDown() throws InterruptedException {
+        if (servers != null) {
+            servers.shutDownAllServers();
+        }
+        System.clearProperty(AuthenticationHelper.ENFORCE_AUTH_ENABLED);
+        System.clearProperty(AuthenticationHelper.ENFORCE_AUTH_SCHEMES);
+    }
+
+    /**
+     * When AuthenticationHelper.ENFORCE_AUTH_ENABLED is not set or set to false, behaviour should
+     * be same as the old ie. clients without authentication are allowed to do operations
+     */
+    @Test
+    public void testEnforceAuthenticationOldBehaviour() throws Exception {
+        Map<String, String> prop = new HashMap<>();
+        startServer(prop);
+        testEnforceAuthOldBehaviour(false);
+    }
+
+    @Test
+    public void testEnforceAuthenticationOldBehaviourWithNetty() throws Exception {
+        Map<String, String> prop = new HashMap<>();
+        //setting property false should give the same behaviour as when property is not set
+        prop.put(removeZooKeeper(AuthenticationHelper.ENFORCE_AUTH_ENABLED), "false");
+        prop.put("serverCnxnFactory", "org.apache.zookeeper.server.NettyServerCnxnFactory");
+        startServer(prop);
+        testEnforceAuthOldBehaviour(true);
+    }
+
+    private void testEnforceAuthOldBehaviour(boolean netty) throws Exception {
+        ZKClientConfig config = new ZKClientConfig();
+        if (netty) {
+            config.setProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET,
+                "org.apache.zookeeper.ClientCnxnSocketNetty");
+        }
+        ZooKeeper client = ClientBase
+            .createZKClient("127.0.0.1:" + clientPort, CONNECTION_TIMEOUT, CONNECTION_TIMEOUT,
+                config);
+        String path = "/defaultAuth" + System.currentTimeMillis();
+        String data = "someData";
+        client.create(path, data.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        byte[] data1 = client.getData(path, false, null);
+        assertEquals(data, new String(data1));
+        client.close();
+    }
+
+    /**
+     * Server start should fail when ZooKeeperServer.ENFORCE_AUTH_ENABLED is set to true  but
+     * AuthenticationHelper.ENFORCE_AUTH_SCHEME is not configured
+     */
+    @Test
+    public void testServerStartShouldFailWhenEnforceAuthSchemeIsNotConfigured() throws Exception {
+        Map<String, String> prop = new HashMap<>();
+        prop.put(removeZooKeeper(AuthenticationHelper.ENFORCE_AUTH_ENABLED), "true");
+        testServerCannotStart(prop);
+    }
+
+    /**
+     * Server start should fail when AuthenticationHelper.ENFORCE_AUTH_ENABLED is set to true,
+     * AuthenticationHelper.ENFORCE_AUTH_SCHEME is configured but authentication provider is not
+     * configured.
+     */
+    @Test
+    public void testServerStartShouldFailWhenAuthProviderIsNotConfigured() throws Exception {
+        Map<String, String> prop = new HashMap<>();
+        prop.put(removeZooKeeper(AuthenticationHelper.ENFORCE_AUTH_ENABLED), "true");
+        prop.put(removeZooKeeper(AuthenticationHelper.ENFORCE_AUTH_SCHEMES), "sasl");
+        testServerCannotStart(prop);
+    }
+
+    private void testServerCannotStart(Map<String, String> prop)
+        throws Exception {
+        File confFile = getConfFile(prop);
+        ServerConfig config = new ServerConfig();
+        config.parse(confFile.toString());
+        ZooKeeperServerMain serverMain = new ZooKeeperServerMain();
+        try {
+            serverMain.runFromConfig(config);
+            fail("IllegalArgumentException is expected.");
+        } catch (IllegalArgumentException e) {
+            //do nothing
+        }
+    }
+
+    @Test
+    public void testEnforceAuthenticationNewBehaviour() throws Exception {
+        Map<String, String> prop = new HashMap<>();
+        prop.put(removeZooKeeper(AuthenticationHelper.ENFORCE_AUTH_ENABLED), "true");
+        prop.put(removeZooKeeper(AuthenticationHelper.ENFORCE_AUTH_SCHEMES), "digest");
+        //digest auth provider is started by default, so no need to
+        //prop.put("authProvider.1", DigestAuthenticationProvider.class.getName());
+        startServer(prop);
+        testEnforceAuthNewBehaviour(false);
+    }
+
+    @Test
+    public void testEnforceAuthenticationNewBehaviourWithNetty() throws Exception {
+        Map<String, String> prop = new HashMap<>();
+        prop.put(removeZooKeeper(AuthenticationHelper.ENFORCE_AUTH_ENABLED), "true");
+        prop.put(removeZooKeeper(AuthenticationHelper.ENFORCE_AUTH_SCHEMES), "digest");
+        prop.put("serverCnxnFactory", "org.apache.zookeeper.server.NettyServerCnxnFactory");
+        startServer(prop);
+        testEnforceAuthNewBehaviour(true);
+    }
+
+    /**
+     * Client operations are allowed only after the authentication is done
+     */
+    private void testEnforceAuthNewBehaviour(boolean netty) throws Exception {
+        ZKClientConfig config = new ZKClientConfig();
+        if (netty) {
+            config.setProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET,
+                "org.apache.zookeeper.ClientCnxnSocketNetty");
+        }
+        CountDownLatch countDownLatch = new CountDownLatch(1);
+        ZooKeeper client =
+            new ZooKeeper("127.0.0.1:" + clientPort, CONNECTION_TIMEOUT, getWatcher(countDownLatch),
+                config);
+        countDownLatch.await();
+        String path = "/newAuth" + System.currentTimeMillis();
+        String data = "someData";
+
+        //try without authentication
+        try {
+            client.create(path, data.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            fail("SessionClosedRequireAuthException is expected.");
+        } catch (KeeperException.SessionClosedRequireAuthException e) {
+            //do nothing
+        }
+        client.close();
+        countDownLatch = new CountDownLatch(1);
+        client =
+            new ZooKeeper("127.0.0.1:" + clientPort, CONNECTION_TIMEOUT, getWatcher(countDownLatch),
+                config);
+        countDownLatch.await();
+
+        // try operations after authentication
+        String idPassword = "user1:pass1";
+        client.addAuthInfo("digest", idPassword.getBytes());
+        client.create(path, data.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        byte[] data1 = client.getData(path, false, null);
+        assertEquals(data, new String(data1));
+        client.close();
+    }
+
+    @Test
+    public void testEnforceAuthenticationWithMultipleAuthSchemes() throws Exception {
+        Map<String, String> prop = new HashMap<>();
+        prop.put(removeZooKeeper(AuthenticationHelper.ENFORCE_AUTH_ENABLED), "true");
+        prop.put(removeZooKeeper(AuthenticationHelper.ENFORCE_AUTH_SCHEMES), "digest,ip");
+        startServer(prop);
+        ZKClientConfig config = new ZKClientConfig();
+        CountDownLatch countDownLatch = new CountDownLatch(1);
+        ZooKeeper client =
+            new ZooKeeper("127.0.0.1:" + clientPort, CONNECTION_TIMEOUT, getWatcher(countDownLatch),
+                config);
+        countDownLatch.await();
+        // try operation without adding auth info, it should be success as ip auth info is
+        // added automatically by server
+        String path = "/newAuth" + System.currentTimeMillis();
+        String data = "someData";
+        client.create(path, data.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        byte[] data1 = client.getData(path, false, null);
+        assertEquals(data, new String(data1));
+        client.close();
+    }
+
+    private String removeZooKeeper(String prop) {
+        return prop.replace("zookeeper.", "");
+    }
+
+    private File getConfFile(Map<String, String> additionalProp) throws IOException {
+        clientPort = PortAssignment.unique();
+        StringBuilder sb = new StringBuilder();
+        sb.append("standaloneEnabled=true" + "\n");
+        if (null != additionalProp) {
+            for (Map.Entry<String, String> entry : additionalProp.entrySet()) {
+                sb.append(entry.getKey());
+                sb.append("=");
+                sb.append(entry.getValue());
+                sb.append("\n");
+            }
+        }
+        String currentQuorumCfgSection = sb.toString();
+        return new MainThread(1, clientPort, currentQuorumCfgSection, false).getConfFile();
+    }
+
+    private void startServer(Map<String, String> additionalProp) throws Exception {
+        additionalProp.put("standaloneEnabled", "true");
+        servers = LaunchServers(1, additionalProp);
+        clientPort = servers.clientPorts[0];
+    }
+
+    private Watcher getWatcher(CountDownLatch countDownLatch) {
+        return event -> {
+            Event.EventType type = event.getType();
+            if (type == Event.EventType.None) {
+                Event.KeeperState state = event.getState();
+                if (state == Event.KeeperState.SyncConnected) {
+                    LOG.info("Event.KeeperState.SyncConnected");
+                    countDownLatch.countDown();
+                } else if (state == Event.KeeperState.Expired) {
+                    LOG.info("Event.KeeperState.Expired");
+                } else if (state == Event.KeeperState.Disconnected) {
+                    LOG.info("Event.KeeperState.Disconnected");
+                } else if (state == Event.KeeperState.AuthFailed) {
+                    LOG.info("Event.KeeperState.AuthFailed");
+                }
+            }
+        };
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/GetAllChildrenNumberTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/GetAllChildrenNumberTest.java
index db692520d21..39b0c5c348b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/GetAllChildrenNumberTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/GetAllChildrenNumberTest.java
@@ -18,14 +18,16 @@
 
 package org.apache.zookeeper;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class GetAllChildrenNumberTest extends ClientBase {
 
@@ -36,6 +38,7 @@ public class GetAllChildrenNumberTest extends ClientBase {
 
     private ZooKeeper zk;
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         super.setUp();
@@ -44,6 +47,7 @@ public void setUp() throws Exception {
         generatePaths(PERSISTENT_CNT, EPHEMERAL_CNT);
     }
 
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         super.tearDown();
@@ -87,12 +91,12 @@ public void testGetAllChildrenNumberAsync() throws IOException, KeeperException,
         }
     }
 
-    private void generatePaths(int persistantCnt, int ephemeralCnt) throws KeeperException, InterruptedException {
+    private void generatePaths(int persistentCnt, int ephemeralCnt) throws KeeperException, InterruptedException {
 
         zk.create(BASE, BASE.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         zk.create(BASE_EXT, BASE_EXT.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
-        for (int p = 0; p < persistantCnt; p++) {
+        for (int p = 0; p < persistentCnt; p++) {
             String base = BASE + "/" + p;
             zk.create(base, base.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
             for (int e = 0; e < ephemeralCnt; e++) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/GetEphemeralsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/GetEphemeralsTest.java
index efc66ffd850..aefa0bba55b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/GetEphemeralsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/GetEphemeralsTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.List;
@@ -28,7 +28,9 @@
 import java.util.concurrent.TimeUnit;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class GetEphemeralsTest extends ClientBase {
 
@@ -39,6 +41,7 @@ public class GetEphemeralsTest extends ClientBase {
     private String[] expected;
     private ZooKeeper zk;
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         super.setUp();
@@ -47,6 +50,7 @@ public void setUp() throws Exception {
         expected = generatePaths(PERSISTENT_CNT, EPHEMERAL_CNT);
     }
 
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         super.tearDown();
@@ -57,10 +61,10 @@ public void tearDown() throws Exception {
     @Test
     public void testGetEphemeralsSync() throws KeeperException, InterruptedException {
         List<String> actual = zk.getEphemerals();
-        assertEquals("Expected ephemeral count for allPaths", actual.size(), expected.length);
+        assertEquals(actual.size(), expected.length, "Expected ephemeral count for allPaths");
         for (int i = 0; i < expected.length; i++) {
             String path = expected[i];
-            assertTrue(String.format("Path=%s exists in get All Ephemerals list ", path), actual.contains(path));
+            assertTrue(actual.contains(path), String.format("Path=%s exists in get All Ephemerals list ", path));
         }
     }
 
@@ -68,10 +72,10 @@ public void testGetEphemeralsSync() throws KeeperException, InterruptedException
     public void testGetEphemeralsSyncByPath() throws KeeperException, InterruptedException {
         final String prefixPath = BASE + 0;
         List<String> actual = zk.getEphemerals(prefixPath);
-        assertEquals("Expected ephemeral count for allPaths", actual.size(), EPHEMERAL_CNT);
+        assertEquals(actual.size(), EPHEMERAL_CNT, "Expected ephemeral count for allPaths");
         for (int i = 0; i < EPHEMERAL_CNT; i++) {
             String path = expected[i];
-            assertTrue(String.format("Path=%s exists in getEphemerals(%s) list ", path, prefixPath), actual.contains(path));
+            assertTrue(actual.contains(path), String.format("Path=%s exists in getEphemerals(%s) list ", path, prefixPath));
         }
     }
 
@@ -79,7 +83,7 @@ public void testGetEphemeralsSyncByPath() throws KeeperException, InterruptedExc
     public void testGetEphemerals() throws IOException, KeeperException, InterruptedException {
 
         final CountDownLatch doneProcessing = new CountDownLatch(1);
-        final List<String> unexpectedBehavior = new ArrayList<String>();
+        final List<String> unexpectedBehavior = new ArrayList<>();
         zk.getEphemerals((rc, ctx, paths) -> {
             if (paths == null) {
                 unexpectedBehavior.add(String.format("Expected ephemeral count for"
@@ -108,7 +112,7 @@ public void testGetEphemeralsByPath() throws IOException, KeeperException, Inter
 
         final CountDownLatch doneProcessing = new CountDownLatch(1);
         final String checkPath = BASE + "0";
-        final List<String> unexpectedBehavior = new ArrayList<String>();
+        final List<String> unexpectedBehavior = new ArrayList<>();
         zk.getEphemerals(checkPath, (rc, ctx, paths) -> {
             if (paths == null) {
                 unexpectedBehavior.add(String.format("Expected ephemeral count for %s to be %d but was null", checkPath, expected.length));
@@ -137,7 +141,7 @@ public void testGetEphemeralsEmpty() throws IOException, KeeperException, Interr
         final CountDownLatch doneProcessing = new CountDownLatch(1);
         final String checkPath = "/unknownPath";
         final int expectedSize = 0;
-        final List<String> unexpectedBehavior = new ArrayList<String>();
+        final List<String> unexpectedBehavior = new ArrayList<>();
         zk.getEphemerals(checkPath, (rc, ctx, paths) -> {
             if (paths == null) {
                 unexpectedBehavior.add(String.format("Expected ephemeral count for %s to be %d but was null", checkPath, expectedSize));
@@ -170,10 +174,10 @@ public void testGetEphemeralsErrors() throws KeeperException {
         }
     }
 
-    private String[] generatePaths(int persistantCnt, int ephemeralCnt) throws KeeperException, InterruptedException {
+    private String[] generatePaths(int persistentCnt, int ephemeralCnt) throws KeeperException, InterruptedException {
 
-        final String[] expected = new String[persistantCnt * ephemeralCnt];
-        for (int p = 0; p < persistantCnt; p++) {
+        final String[] expected = new String[persistentCnt * ephemeralCnt];
+        for (int p = 0; p < persistentCnt; p++) {
             String base = BASE + p;
             zk.create(base, base.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
             for (int e = 0; e < ephemeralCnt; e++) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/HostProviderSelectionTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/HostProviderSelectionTest.java
new file mode 100644
index 00000000000..386cb9d5a11
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/HostProviderSelectionTest.java
@@ -0,0 +1,95 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper;
+
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.Test;
+
+public class HostProviderSelectionTest extends ZKTestCase {
+    @Test
+    public void testStaticHostProviderSelection() throws Exception {
+        final String[] staticFormats = {
+                "localhost:2181",
+                "zk1:2181,zk2:2181,zk3:2181",
+                "zk1:2181,zk2:2181/myapp",
+                "[::1]:2181,[2001:db8::1]:2181"
+        };
+
+        for (final String connectString : staticFormats) {
+            // Test without config
+            try (final ZooKeeper zk = new ZooKeeper(connectString,
+                    ClientBase.CONNECTION_TIMEOUT, DummyWatcher.INSTANCE)) {
+                assertNotNull(zk);
+            }
+
+            // Test with config
+            final ZKClientConfig config = new ZKClientConfig();
+            try (final ZooKeeper zk = new ZooKeeper(connectString,
+                    ClientBase.CONNECTION_TIMEOUT, DummyWatcher.INSTANCE, config)) {
+                assertNotNull(zk);
+            }
+        }
+    }
+
+    @Test
+    public void testDnsSrvHostProviderSelection() {
+        final String[] dnsSrvFormats = {
+                "dns-srv://nonexistent.test.local",
+                "dns-srv://nonexistent.test.local/myapp"
+        };
+
+        for (final String connectString : dnsSrvFormats) {
+            // Test without config
+            final IllegalArgumentException exception1 = assertThrows(IllegalArgumentException.class, () ->
+                    new ZooKeeper(connectString, ClientBase.CONNECTION_TIMEOUT, DummyWatcher.INSTANCE));
+            validateDnsSrvError(exception1);
+
+            // Test with config
+            final ZKClientConfig config = new ZKClientConfig();
+            final IllegalArgumentException exception2 = assertThrows(IllegalArgumentException.class, () ->
+                    new ZooKeeper(connectString, ClientBase.CONNECTION_TIMEOUT, DummyWatcher.INSTANCE, config));
+            validateDnsSrvError(exception2);
+        }
+    }
+
+    @Test
+    public void testInvalidFormats() {
+        final String[] invalidFormats = {
+                "",
+                "dns-srv://"
+        };
+
+        for (final String connectString : invalidFormats) {
+            final IllegalArgumentException exception = assertThrows(IllegalArgumentException.class, () ->
+                    new ZooKeeper(connectString, ClientBase.CONNECTION_TIMEOUT, DummyWatcher.INSTANCE));
+            final String message = exception.getMessage();
+            assertTrue(message.contains("Connect string cannot be null or empty")
+                || message.contains("DNS name cannot be null or empty"));
+        }
+    }
+
+    private void validateDnsSrvError(final IllegalArgumentException exception) {
+        final String message = exception.getMessage();
+        assertTrue(message.contains("Failed to initialize DnsSrvHostProvider for DNS name:"));
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/JaasConfiguration.java b/zookeeper-server/src/test/java/org/apache/zookeeper/JaasConfiguration.java
index aecc7ede144..199a83150da 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/JaasConfiguration.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/JaasConfiguration.java
@@ -31,11 +31,11 @@
  * Example:
  *   jaas = new JaasConfiguration();
  *   jaas.addSection("Server", "org.apache.zookeeper.server.auth.DigestLoginModule",
- *                   "username", "passowrd");
+ *                   "username", "password");
  */
 public class JaasConfiguration extends javax.security.auth.login.Configuration {
 
-    private final Map<String, AppConfigurationEntry[]> sections = new HashMap<String, AppConfigurationEntry[]>();
+    private final Map<String, AppConfigurationEntry[]> sections = new HashMap<>();
 
     public JaasConfiguration() {
     }
@@ -47,7 +47,7 @@ public JaasConfiguration() {
      * @param args login key/value args
      */
     public void addSection(String name, String loginModuleName, String... args) {
-        Map<String, String> conf = new HashMap<String, String>();
+        Map<String, String> conf = new HashMap<>();
         // loop through the args (must be key/value sequence)
         for (int i = 0; i < args.length - 1; i += 2) {
             conf.put(args[i], args[i + 1]);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/KerberosTicketRenewalTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/KerberosTicketRenewalTest.java
new file mode 100644
index 00000000000..d0f52b152af
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/KerberosTicketRenewalTest.java
@@ -0,0 +1,280 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper;
+
+import static org.apache.zookeeper.server.quorum.auth.MiniKdc.MAX_TICKET_LIFETIME;
+import static org.apache.zookeeper.server.quorum.auth.MiniKdc.MIN_TICKET_LIFETIME;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTimeout;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.io.File;
+import java.io.FileWriter;
+import java.io.IOException;
+import java.security.Principal;
+import java.time.Duration;
+import java.util.Properties;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.function.Supplier;
+import javax.security.auth.login.Configuration;
+import javax.security.auth.login.LoginException;
+import org.apache.commons.io.FileUtils;
+import org.apache.commons.io.FilenameUtils;
+import org.apache.zookeeper.common.ZKConfig;
+import org.apache.zookeeper.server.quorum.auth.KerberosTestUtils;
+import org.apache.zookeeper.server.quorum.auth.MiniKdc;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * This test class is mainly testing the TGT renewal logic implemented
+ * in the org.apache.zookeeper.Login class.
+ */
+public class KerberosTicketRenewalTest {
+
+
+  private static final Logger LOG = LoggerFactory.getLogger(KerberosTicketRenewalTest.class);
+  private static final String JAAS_CONFIG_SECTION = "ClientUsingKerberos";
+  private static final String TICKET_LIFETIME = "5000";
+  private static File testTempDir;
+  private static MiniKdc kdc;
+  private static File kdcWorkDir;
+  private static String PRINCIPAL = KerberosTestUtils.getClientPrincipal();
+
+  TestableKerberosLogin login;
+
+  @BeforeAll
+  public static void setupClass() throws Exception {
+    // by default, we should wait at least 1 minute between subsequent TGT renewals.
+    // changing it to 500ms.
+    System.setProperty(Login.MIN_TIME_BEFORE_RELOGIN_CONFIG_KEY, "500");
+
+    testTempDir = ClientBase.createTmpDir();
+    startMiniKdcAndAddPrincipal();
+
+    String keytabFilePath = FilenameUtils.normalize(KerberosTestUtils.getKeytabFile(), true);
+
+    // note: we use "refreshKrb5Config=true" to refresh the kerberos config in the JVM,
+    // making sure that we use the latest config even if other tests already have been executed
+    // and initialized the kerberos client configs before)
+    String jaasEntries = ""
+      + "ClientUsingKerberos {\n"
+      + "  com.sun.security.auth.module.Krb5LoginModule required\n"
+      + "  storeKey=\"false\"\n"
+      + "  useTicketCache=\"false\"\n"
+      + "  useKeyTab=\"true\"\n"
+      + "  doNotPrompt=\"true\"\n"
+      + "  debug=\"true\"\n"
+      + "  refreshKrb5Config=\"true\"\n"
+      + "  keyTab=\"" + keytabFilePath + "\"\n"
+      + "  principal=\"" + PRINCIPAL + "\";\n"
+      + "};\n";
+    setupJaasConfig(jaasEntries);
+  }
+
+  @AfterAll
+  public static void tearDownClass() {
+    System.clearProperty(Login.MIN_TIME_BEFORE_RELOGIN_CONFIG_KEY);
+    System.clearProperty("java.security.auth.login.config");
+    stopMiniKdc();
+    if (testTempDir != null) {
+      // the testTempDir contains the jaas config file and also the
+      // working folder of the currently running KDC server
+      FileUtils.deleteQuietly(testTempDir);
+    }
+  }
+
+  @AfterEach
+  public void tearDownTest() throws Exception {
+    if (login != null) {
+      login.shutdown();
+      login.logout();
+    }
+  }
+
+
+  /**
+   * We extend the regular Login class to be able to properly control the
+   * "sleeping" between the retry attempts of ticket refresh actions.
+   */
+  private static class TestableKerberosLogin extends Login {
+
+    private AtomicBoolean refreshFailed = new AtomicBoolean(false);
+    private CountDownLatch continueRefreshThread = new CountDownLatch(1);
+
+    public TestableKerberosLogin() throws LoginException {
+      super(JAAS_CONFIG_SECTION, () -> {
+        return (callbacks) -> {};
+      }, new ZKConfig());
+    }
+
+    @Override
+    protected void sleepBeforeRetryFailedRefresh() throws InterruptedException {
+      LOG.info("sleep started due to failed refresh");
+      refreshFailed.set(true);
+      continueRefreshThread.await(20, TimeUnit.SECONDS);
+      LOG.info("sleep due to failed refresh finished");
+    }
+
+    public void assertRefreshFailsEventually(Duration timeout) {
+      assertEventually(timeout, () -> refreshFailed.get());
+    }
+
+    public void continueWithRetryAfterFailedRefresh() {
+      LOG.info("continue refresh thread");
+      continueRefreshThread.countDown();
+    }
+  }
+
+
+  @Test
+  public void shouldLoginUsingKerberos() throws Exception {
+    login = new TestableKerberosLogin();
+    login.startThreadIfNeeded();
+
+    assertPrincipalLoggedIn();
+  }
+
+
+  @Test
+  public void shouldRenewTicketUsingKerberos() throws Exception {
+    login = new TestableKerberosLogin();
+    login.startThreadIfNeeded();
+
+    long initialLoginTime = login.getLastLogin();
+
+    // ticket lifetime is 5sec, so we will trigger ticket renewal in each ~2-3 sec
+    assertTicketRefreshHappenedUntil(Duration.ofSeconds(15));
+
+    assertPrincipalLoggedIn();
+    assertTrue(initialLoginTime < login.getLastLogin());
+  }
+
+
+  @Test
+  public void shouldRecoverIfKerberosNotAvailableForSomeTime() throws Exception {
+    login = new TestableKerberosLogin();
+    login.startThreadIfNeeded();
+
+    assertTicketRefreshHappenedUntil(Duration.ofSeconds(15));
+
+    stopMiniKdc();
+
+    // ticket lifetime is 5sec, so we will trigger ticket renewal in each ~2-3 sec
+    // the very next ticket renewal should fail (as KDC is offline)
+    login.assertRefreshFailsEventually(Duration.ofSeconds(15));
+
+    // now the ticket thread is "sleeping", it will retry the refresh later
+
+    // we restart KDC, then terminate the "sleeping" and expecting
+    // that the next retry should succeed
+    startMiniKdcAndAddPrincipal();
+    login.continueWithRetryAfterFailedRefresh();
+    assertTicketRefreshHappenedUntil(Duration.ofSeconds(15));
+
+    assertPrincipalLoggedIn();
+  }
+
+
+  private void assertPrincipalLoggedIn() {
+    assertEquals(PRINCIPAL, login.getUserName());
+    assertNotNull(login.getSubject());
+    assertEquals(1, login.getSubject().getPrincipals().size());
+    Principal actualPrincipal = login.getSubject().getPrincipals().iterator().next();
+    assertEquals(PRINCIPAL, actualPrincipal.getName());
+  }
+
+  private void assertTicketRefreshHappenedUntil(Duration timeout) {
+    long lastLoginTime = login.getLastLogin();
+    assertEventually(timeout, () -> login.getLastLogin() != lastLoginTime
+      && login.getSubject() != null && !login.getSubject().getPrincipals().isEmpty());
+  }
+
+  private static void assertEventually(Duration timeout, Supplier<Boolean> test) {
+    assertTimeout(timeout, () -> {
+      while (true) {
+        if (test.get()) {
+          return;
+        }
+        Thread.sleep(100);
+      }
+    });
+  }
+
+  public static void startMiniKdcAndAddPrincipal() throws Exception {
+    kdcWorkDir = createTmpDirInside(testTempDir);
+
+    Properties conf = MiniKdc.createConf();
+    conf.setProperty(MAX_TICKET_LIFETIME, TICKET_LIFETIME);
+    conf.setProperty(MIN_TICKET_LIFETIME, TICKET_LIFETIME);
+
+    kdc = new MiniKdc(conf, kdcWorkDir);
+    kdc.start();
+
+    String principalName = PRINCIPAL.substring(0, PRINCIPAL.lastIndexOf("@"));
+    kdc.createPrincipal(new File(KerberosTestUtils.getKeytabFile()), principalName);
+  }
+
+  private static void stopMiniKdc() {
+    if (kdc != null) {
+      kdc.stop();
+      kdc = null;
+    }
+    if (kdcWorkDir != null) {
+      FileUtils.deleteQuietly(kdcWorkDir);
+      kdcWorkDir = null;
+    }
+  }
+
+  private static File createTmpDirInside(File parentDir) throws IOException {
+    File tmpFile = File.createTempFile("test", ".junit", parentDir);
+    // don't delete tmpFile - this ensures we don't attempt to create
+    // a tmpDir with a duplicate name
+    File tmpDir = new File(tmpFile + ".dir");
+    // never true if tmpfile does it's job
+    assertFalse(tmpDir.exists());
+    assertTrue(tmpDir.mkdirs());
+    return tmpDir;
+  }
+
+  private static void setupJaasConfig(String jaasEntries) {
+    try {
+      File saslConfFile = new File(testTempDir, "jaas.conf");
+      FileWriter fwriter = new FileWriter(saslConfFile);
+      fwriter.write(jaasEntries);
+      fwriter.close();
+      System.setProperty("java.security.auth.login.config", saslConfFile.getAbsolutePath());
+    } catch (IOException ioe) {
+      LOG.error("Failed to initialize JAAS conf file", ioe);
+    }
+
+    // refresh the SASL configuration in this JVM (making sure that we use the latest config
+    // even if other tests already have been executed and initialized the SASL configs before)
+    Configuration.getConfiguration().refresh();
+  }
+
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/MockPacket.java b/zookeeper-server/src/test/java/org/apache/zookeeper/MockPacket.java
index 9d880fd39b0..e4e6548ea23 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/MockPacket.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/MockPacket.java
@@ -35,16 +35,6 @@ public MockPacket(
         super(requestHeader, replyHeader, request, response, watchRegistration);
     }
 
-    public MockPacket(
-        RequestHeader requestHeader,
-        ReplyHeader replyHeader,
-        Record request,
-        Record response,
-        WatchRegistration watchRegistration,
-        boolean readOnly) {
-        super(requestHeader, replyHeader, request, response, watchRegistration, readOnly);
-    }
-
     public ByteBuffer createAndReturnBB() {
         createBB();
         return this.bb;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/MultiOperationRecordTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/MultiOperationRecordTest.java
index 75da5df3160..df8d8b91642 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/MultiOperationRecordTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/MultiOperationRecordTest.java
@@ -18,14 +18,14 @@
 
 package org.apache.zookeeper;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.nio.ByteBuffer;
 import org.apache.jute.BinaryInputArchive;
 import org.apache.jute.BinaryOutputArchive;
 import org.apache.zookeeper.server.ByteBufferInputStream;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class MultiOperationRecordTest extends ZKTestCase {
 
@@ -33,7 +33,7 @@ public class MultiOperationRecordTest extends ZKTestCase {
     public void testRoundTrip() throws IOException {
         MultiOperationRecord request = new MultiOperationRecord();
         request.add(Op.check("check", 1));
-        request.add(Op.create("create", "create data".getBytes(), ZooDefs.Ids.CREATOR_ALL_ACL, ZooDefs.Perms.ALL));
+        request.add(Op.create("create", "create data".getBytes(), ZooDefs.Ids.CREATOR_ALL_ACL, CreateMode.EPHEMERAL.toFlag()));
         request.add(Op.delete("delete", 17));
         request.add(Op.setData("setData", "set data".getBytes(), 19));
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/MultiResponseTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/MultiResponseTest.java
index 7993d04c338..cab1d5d1ec7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/MultiResponseTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/MultiResponseTest.java
@@ -17,7 +17,7 @@
 
 package org.apache.zookeeper;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.nio.ByteBuffer;
@@ -25,7 +25,7 @@
 import org.apache.jute.BinaryOutputArchive;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.server.ByteBufferInputStream;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class MultiResponseTest extends ZKTestCase {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/PortAssignment.java b/zookeeper-server/src/test/java/org/apache/zookeeper/PortAssignment.java
index 87c0562d5c7..fb28344c1d5 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/PortAssignment.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/PortAssignment.java
@@ -107,7 +107,7 @@ public static synchronized int unique() {
      * uses these 2 pieces of information to split the available ports into
      * disjoint ranges.  Each JUnit process only assigns ports from its own range
      * in order to prevent bind errors during concurrent test runs.  If any of
-     * this information is unavailable or unparseable, then the default behavior
+     * this information is unavailable or unparsable, then the default behavior
      * is for this process to use the entire available port range.  This is
      * expected when running tests outside of Ant.
      *
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/PortAssignmentTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/PortAssignmentTest.java
index 234adb1b715..20b9362beb2 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/PortAssignmentTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/PortAssignmentTest.java
@@ -18,56 +18,40 @@
 
 package org.apache.zookeeper;
 
-import static org.junit.Assert.assertEquals;
-import java.util.Arrays;
-import java.util.Collection;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
-import org.junit.runners.Parameterized.Parameters;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import java.util.stream.Stream;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
 
-@RunWith(Parameterized.class)
-@Parameterized.UseParametersRunnerFactory(ZKParameterized.RunnerFactory.class)
 public class PortAssignmentTest {
 
-    private final String strProcessCount;
-    private final String cmdLine;
-    private final int expectedMinimumPort;
-    private final int expectedMaximumPort;
-
-    @Parameters
-    public static Collection<Object[]> data() {
-        return Arrays.asList(
-            new Object[]{"8", "threadid=1", 11221, 13913},
-            new Object[]{"8", "threadid=2", 13914, 16606},
-            new Object[]{"8", "threadid=3", 16607, 19299},
-            new Object[]{"8", "threadid=4", 19300, 21992},
-            new Object[]{"8", "threadid=5", 21993, 24685},
-            new Object[]{"8", "threadid=6", 24686, 27378},
-            new Object[]{"8", "threadid=7", 27379, 30071},
-            new Object[]{"8", "threadid=8", 30072, 32764},
-            new Object[]{"1", "threadid=1", 11221, 32767},
-            new Object[]{"2", "threadid=1", 11221, 21993},
-            new Object[]{"2", "threadid=2", 21994, 32766},
-            new Object[]{null, null, 11221, 32767},
-            new Object[]{"", "", 11221, 32767});
-    }
-
-    public PortAssignmentTest(String strProcessCount, String cmdLine, int expectedMinimumPort, int expectedMaximumPort) {
-        this.strProcessCount = strProcessCount;
-        this.cmdLine = cmdLine;
-        this.expectedMinimumPort = expectedMinimumPort;
-        this.expectedMaximumPort = expectedMaximumPort;
+    public static Stream<Arguments> data() throws Exception {
+        return Stream.of(
+                Arguments.of("8", "threadid=1", 11221, 13913),
+                Arguments.of("8", "threadid=2", 13914, 16606),
+                Arguments.of("8", "threadid=3", 16607, 19299),
+                Arguments.of("8", "threadid=4", 19300, 21992),
+                Arguments.of("8", "threadid=5", 21993, 24685),
+                Arguments.of("8", "threadid=6", 24686, 27378),
+                Arguments.of("8", "threadid=7", 27379, 30071),
+                Arguments.of("8", "threadid=8", 30072, 32764),
+                Arguments.of("1", "threadid=1", 11221, 32767),
+                Arguments.of("2", "threadid=1", 11221, 21993),
+                Arguments.of("2", "threadid=2", 21994, 32766),
+                Arguments.of(null, null, 11221, 32767),
+                Arguments.of("", "", 11221, 32767));
     }
 
-    @Test
-    public void testSetupPortRange() {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testSetupPortRange(String strProcessCount, String cmdLine, int expectedMinimumPort, int expectedMaximumPort) {
         PortAssignment.PortRange portRange = PortAssignment.setupPortRange(strProcessCount, cmdLine);
-        assertEquals(buildAssertionMessage("minimum"), expectedMinimumPort, portRange.getMinimum());
-        assertEquals(buildAssertionMessage("maximum"), expectedMaximumPort, portRange.getMaximum());
+        assertEquals(expectedMinimumPort, portRange.getMinimum(), buildAssertionMessage("minimum", strProcessCount, cmdLine));
+        assertEquals(expectedMaximumPort, portRange.getMaximum(), buildAssertionMessage("maximum", strProcessCount, cmdLine));
     }
 
-    private String buildAssertionMessage(String checkType) {
+    private String buildAssertionMessage(String checkType, String strProcessCount, String cmdLine) {
         return String.format("strProcessCount = %s, cmdLine = %s, checking %s", strProcessCount, cmdLine, checkType);
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesCmdTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesCmdTest.java
index c92f72a27bc..5f859d2823e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesCmdTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesCmdTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.List;
@@ -29,7 +29,10 @@
 import org.apache.zookeeper.Watcher.Event.EventType;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -42,6 +45,7 @@ public class RemoveWatchesCmdTest extends ClientBase {
     private ZooKeeper zk;
     private ZooKeeperMain zkMain;
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         super.setUp();
@@ -49,6 +53,7 @@ public void setUp() throws Exception {
         zkMain = new ZooKeeperMain(zk);
     }
 
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         if (zk != null) {
@@ -62,7 +67,8 @@ public void tearDown() throws Exception {
      * removewatches command will use default options - WatcherType.ANY and
      * local=false
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testRemoveWatchesWithNoPassedOptions() throws Exception {
         List<EventType> expectedEvents = new ArrayList<>();
         expectedEvents.add(EventType.ChildWatchRemoved);
@@ -83,19 +89,20 @@ public void testRemoveWatchesWithNoPassedOptions() throws Exception {
         String cmdstring = "removewatches /testnode1";
         LOG.info("Remove watchers using shell command : {}", cmdstring);
         zkMain.cl.parseCommand(cmdstring);
-        assertTrue("Removewatches cmd fails to remove child watches", zkMain.processZKCmd(zkMain.cl));
+        assertTrue(zkMain.processZKCmd(zkMain.cl), "Removewatches cmd fails to remove child watches");
         LOG.info("Waiting for the DataWatchRemoved event");
         myWatcher.matches();
 
         // verifying that other path child watches are not affected
-        assertTrue("Failed to find child watches for the path testnode2", zk.getChildWatches().contains("/testnode2"));
-        assertTrue("Failed to find data watches for the path testnode2", zk.getDataWatches().contains("/testnode2"));
+        assertTrue(zk.getChildWatches().contains("/testnode2"), "Failed to find child watches for the path testnode2");
+        assertTrue(zk.getDataWatches().contains("/testnode2"), "Failed to find data watches for the path testnode2");
     }
 
     /**
      * Test verifies deletion of NodeDataChanged watches
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testRemoveNodeDataChangedWatches() throws Exception {
         LOG.info("Adding data watcher using getData()");
         List<EventType> expectedEvents = new ArrayList<>();
@@ -108,19 +115,20 @@ public void testRemoveNodeDataChangedWatches() throws Exception {
         String cmdstring = "removewatches /testnode1 -d";
         LOG.info("Remove watchers using shell command : {}", cmdstring);
         zkMain.cl.parseCommand(cmdstring);
-        assertTrue("Removewatches cmd fails to remove data watches", zkMain.processZKCmd(zkMain.cl));
+        assertTrue(zkMain.processZKCmd(zkMain.cl), "Removewatches cmd fails to remove data watches");
 
         LOG.info("Waiting for the DataWatchRemoved event");
         myWatcher.matches();
 
         // verifying that other path data watches are removed
-        assertEquals("Data watches are not removed : " + zk.getDataWatches(), 0, zk.getDataWatches().size());
+        assertEquals(0, zk.getDataWatches().size(), "Data watches are not removed : " + zk.getDataWatches());
     }
 
     /**
      * Test verifies deletion of NodeCreated data watches
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testRemoveNodeCreatedWatches() throws Exception {
         List<EventType> expectedEvents = new ArrayList<>();
         expectedEvents.add(EventType.DataWatchRemoved);
@@ -134,27 +142,25 @@ public void testRemoveNodeCreatedWatches() throws Exception {
         String cmdstring1 = "removewatches /testnode1 -d";
         LOG.info("Remove watchers using shell command : {}", cmdstring1);
         zkMain.cl.parseCommand(cmdstring1);
-        assertTrue("Removewatches cmd fails to remove pre-create watches", zkMain.processZKCmd(zkMain.cl));
+        assertTrue(zkMain.processZKCmd(zkMain.cl), "Removewatches cmd fails to remove pre-create watches");
         myWatcher1.matches();
-        assertEquals("Failed to remove pre-create watches :"
-                                    + zk.getExistWatches(), 1, zk.getExistWatches().size());
-        assertTrue("Failed to remove pre-create watches :"
-                                  + zk.getExistWatches(), zk.getExistWatches().contains("/testnode1/testnode2"));
+        assertEquals(1, zk.getExistWatches().size(), "Failed to remove pre-create watches :" + zk.getExistWatches());
+        assertTrue(zk.getExistWatches().contains("/testnode1/testnode2"), "Failed to remove pre-create watches :" + zk.getExistWatches());
 
         String cmdstring2 = "removewatches /testnode1/testnode2 -d";
         LOG.info("Remove watchers using shell command : {}", cmdstring2);
         zkMain.cl.parseCommand(cmdstring2);
-        assertTrue("Removewatches cmd fails to remove data watches", zkMain.processZKCmd(zkMain.cl));
+        assertTrue(zkMain.processZKCmd(zkMain.cl), "Removewatches cmd fails to remove data watches");
 
         myWatcher2.matches();
-        assertEquals("Failed to remove pre-create watches : "
-                                    + zk.getExistWatches(), 0, zk.getExistWatches().size());
+        assertEquals(0, zk.getExistWatches().size(), "Failed to remove pre-create watches : " + zk.getExistWatches());
     }
 
     /**
      * Test verifies deletion of NodeChildrenChanged watches
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testRemoveNodeChildrenChangedWatches() throws Exception {
         List<EventType> expectedEvents = new ArrayList<>();
         expectedEvents.add(EventType.ChildWatchRemoved);
@@ -167,15 +173,16 @@ public void testRemoveNodeChildrenChangedWatches() throws Exception {
         String cmdstring = "removewatches /testnode1 -c";
         LOG.info("Remove watchers using shell command : {}", cmdstring);
         zkMain.cl.parseCommand(cmdstring);
-        assertTrue("Removewatches cmd fails to remove child watches", zkMain.processZKCmd(zkMain.cl));
+        assertTrue(zkMain.processZKCmd(zkMain.cl), "Removewatches cmd fails to remove child watches");
         myWatcher.matches();
-        assertEquals("Failed to remove child watches : " + zk.getChildWatches(), 0, zk.getChildWatches().size());
+        assertEquals(0, zk.getChildWatches().size(), "Failed to remove child watches : " + zk.getChildWatches());
     }
 
     /**
      * Test verifies deletion of NodeDeleted watches
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testRemoveNodeDeletedWatches() throws Exception {
         LOG.info("Adding NodeDeleted watcher");
         List<EventType> expectedEvents = new ArrayList<>();
@@ -191,13 +198,12 @@ public void testRemoveNodeDeletedWatches() throws Exception {
         String cmdstring = "removewatches /testnode1 -c";
         LOG.info("Remove watchers using shell command : {}", cmdstring);
         zkMain.cl.parseCommand(cmdstring);
-        assertTrue("Removewatches cmd fails to remove child watches", zkMain.processZKCmd(zkMain.cl));
+        assertTrue(zkMain.processZKCmd(zkMain.cl), "Removewatches cmd fails to remove child watches");
         LOG.info("Waiting for the ChildWatchRemoved event");
         myWatcher.matches();
-        assertEquals("Failed to remove child watches : " + zk.getChildWatches(), 1, zk.getChildWatches().size());
+        assertEquals(1, zk.getChildWatches().size(), "Failed to remove child watches : " + zk.getChildWatches());
 
-        assertTrue("Failed to remove child watches :"
-                                  + zk.getChildWatches(), zk.getChildWatches().contains("/testnode1/testnode2"));
+        assertTrue(zk.getChildWatches().contains("/testnode1/testnode2"), "Failed to remove child watches :" + zk.getChildWatches());
 
         // verify node delete watcher
         zk.delete("/testnode1/testnode2", -1);
@@ -207,7 +213,8 @@ public void testRemoveNodeDeletedWatches() throws Exception {
     /**
      * Test verifies deletion of any watches
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testRemoveAnyWatches() throws Exception {
         verifyRemoveAnyWatches(false);
     }
@@ -216,7 +223,8 @@ public void testRemoveAnyWatches() throws Exception {
      * Test verifies deletion of watches locally when there is no server
      * connection
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testRemoveWatchesLocallyWhenNoServerConnection() throws Exception {
         verifyRemoveAnyWatches(true);
     }
@@ -259,12 +267,12 @@ private void addWatchNotifications(Map<String, List<EventType>> pathVsEvent, Wat
 
         LOG.info("Remove watchers using shell command : {}", cmdstring);
         zkMain.cl.parseCommand(cmdstring);
-        assertTrue("Removewatches cmd fails to remove child/data watches", zkMain.processZKCmd(zkMain.cl));
+        assertTrue(zkMain.processZKCmd(zkMain.cl), "Removewatches cmd fails to remove child/data watches");
         LOG.info("Waiting for the WatchRemoved events");
         watcherLatch.await(10, TimeUnit.SECONDS);
-        assertEquals("Didn't receives WatchRemoved events!", 1, pathVsEvent.size());
-        assertTrue("Didn't receives DataWatchRemoved!", pathVsEvent.get("/testnode1").contains(EventType.DataWatchRemoved));
-        assertTrue("Didn't receives ChildWatchRemoved!", pathVsEvent.get("/testnode1").contains(EventType.ChildWatchRemoved));
+        assertEquals(1, pathVsEvent.size(), "Didn't receives WatchRemoved events!");
+        assertTrue(pathVsEvent.get("/testnode1").contains(EventType.DataWatchRemoved), "Didn't receives DataWatchRemoved!");
+        assertTrue(pathVsEvent.get("/testnode1").contains(EventType.ChildWatchRemoved), "Didn't receives ChildWatchRemoved!");
     }
 
     private static class MyWatcher implements Watcher {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesTest.java
index 30f1558fd01..5f3cf9b1ded 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/RemoveWatchesTest.java
@@ -18,50 +18,55 @@
 
 package org.apache.zookeeper;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.hamcrest.CoreMatchers.is;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.spy;
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Arrays;
-import java.util.Collection;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
+import java.util.concurrent.BlockingDeque;
+import java.util.concurrent.BlockingQueue;
 import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.LinkedBlockingDeque;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.TimeoutException;
-import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.collections4.CollectionUtils;
 import org.apache.zookeeper.KeeperException.Code;
-import org.apache.zookeeper.KeeperException.NoWatcherException;
 import org.apache.zookeeper.Watcher.Event.EventType;
 import org.apache.zookeeper.Watcher.WatcherType;
 import org.apache.zookeeper.ZooDefs.Ids;
-import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.ZooDefs.OpCode;
 import org.apache.zookeeper.server.ServerCnxn;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
-import org.junit.runners.Parameterized.Parameters;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Timeout;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 /**
  * Verifies removing watches using ZooKeeper client apis
  */
-@RunWith(Parameterized.class)
-@Parameterized.UseParametersRunnerFactory(ZKParameterized.RunnerFactory.class)
 public class RemoveWatchesTest extends ClientBase {
 
     private static final Logger LOG = LoggerFactory.getLogger(RemoveWatchesTest.class);
     private ZooKeeper zk1 = null;
     private ZooKeeper zk2 = null;
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         super.setUp();
@@ -69,6 +74,7 @@ public void setUp() throws Exception {
         zk2 = createClient();
     }
 
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         if (zk1 != null) {
@@ -80,32 +86,29 @@ public void tearDown() throws Exception {
         super.tearDown();
     }
 
-    private final boolean useAsync;
-
-    public RemoveWatchesTest(boolean useAsync) {
-        this.useAsync = useAsync;
-    }
-
-    @Parameters
-    public static Collection<Object[]> configs() {
-        return Arrays.asList(new Object[][]{{false}, {true}});
-    }
-
     private void removeWatches(
         ZooKeeper zk,
         String path,
         Watcher watcher,
         WatcherType watcherType,
         boolean local,
-        KeeperException.Code rc) throws InterruptedException, KeeperException {
+        KeeperException.Code rc,
+        boolean useAsync) throws InterruptedException, KeeperException {
         LOG.info("Sending removeWatches req using zk {} path: {} type: {} watcher: {} ", zk, path, watcherType, watcher);
         if (useAsync) {
             MyCallback c1 = new MyCallback(rc.intValue(), path);
             zk.removeWatches(path, watcher, watcherType, local, c1, null);
-            assertTrue("Didn't succeeds removeWatch operation", c1.matches());
-            if (KeeperException.Code.OK.intValue() != c1.rc) {
-                KeeperException ke = KeeperException.create(KeeperException.Code.get(c1.rc));
-                throw ke;
+            assertTrue(c1.matches(), "Didn't succeeds removeWatch operation");
+            if (rc.intValue() != c1.rc) {
+                throw KeeperException.create(KeeperException.Code.get(c1.rc));
+            }
+        } else if (rc != Code.OK) {
+            try {
+                zk.removeWatches(path, watcher, watcherType, local);
+                fail("expect exception code " + rc);
+            } catch (KeeperException ex) {
+                assertEquals(rc, ex.code());
+                assertEquals(path, ex.getPath());
             }
         } else {
             zk.removeWatches(path, watcher, watcherType, local);
@@ -117,39 +120,77 @@ private void removeAllWatches(
         String path,
         WatcherType watcherType,
         boolean local,
-        KeeperException.Code rc) throws InterruptedException, KeeperException {
+        KeeperException.Code rc,
+        boolean useAsync) throws InterruptedException, KeeperException {
         LOG.info("Sending removeWatches req using zk {} path: {} type: {} ", zk, path, watcherType);
         if (useAsync) {
             MyCallback c1 = new MyCallback(rc.intValue(), path);
             zk.removeAllWatches(path, watcherType, local, c1, null);
-            assertTrue("Didn't succeeds removeWatch operation", c1.matches());
-            if (KeeperException.Code.OK.intValue() != c1.rc) {
-                KeeperException ke = KeeperException.create(KeeperException.Code.get(c1.rc));
-                throw ke;
+            assertTrue(c1.matches(), "Didn't succeeds removeWatch operation");
+            if (rc.intValue() != c1.rc) {
+                throw KeeperException.create(KeeperException.Code.get(c1.rc));
+            }
+        } else if (rc != Code.OK) {
+            try {
+                zk.removeAllWatches(path, watcherType, local);
+                fail("expect exception code " + rc);
+            } catch (KeeperException ex) {
+                assertEquals(rc, ex.code());
+                assertEquals(path, ex.getPath());
             }
         } else {
             zk.removeAllWatches(path, watcherType, local);
         }
     }
 
+    private void assertWatchers(ZooKeeper zk, String path, WatcherType... watcherTypes) {
+        for (WatcherType watcherType : watcherTypes) {
+            String msg = String.format("expect watcher for path %s and type %s", path, watcherType);
+            assertTrue(isServerSessionWatcher(zk.getSessionId(), path, watcherType), msg);
+        }
+    }
+
+    private void assertNoWatchers(ZooKeeper zk, String path, WatcherType... watcherTypes) {
+        for (WatcherType watcherType : watcherTypes) {
+            String msg = String.format("expect no watcher for path %s and type %s", path, watcherType);
+            assertFalse(isServerSessionWatcher(zk.getSessionId(), path, watcherType), msg);
+        }
+    }
+
+    private void assertWatchersExcept(ZooKeeper zk, String path, WatcherType... watcherTypes) {
+        List<WatcherType> excludes = Arrays.asList(watcherTypes);
+        for (WatcherType watcherType : WatcherType.values()) {
+            if (watcherType == WatcherType.Any) {
+                continue;
+            }
+            if (excludes.contains(watcherType)) {
+                assertNoWatchers(zk, path, watcherType);
+            } else {
+                assertWatchers(zk, path, watcherType);
+            }
+        }
+    }
+
     /**
      * Test verifies removal of single watcher when there is server connection
      */
-    @Test(timeout = 90000)
-    public void testRemoveSingleWatcher() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveSingleWatcher(boolean useAsync) throws Exception {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL);
         zk1.create("/node2", null, Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL);
         MyWatcher w1 = new MyWatcher("/node1", 1);
         LOG.info("Adding data watcher {} on path {}", w1, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w1));
+        assertNotNull(zk2.exists("/node1", w1), "Didn't set data watches");
         MyWatcher w2 = new MyWatcher("/node2", 1);
         LOG.info("Adding data watcher {} on path {}", w2, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node2", w2));
-        removeWatches(zk2, "/node1", w1, WatcherType.Data, false, Code.OK);
-        assertEquals("Didn't find data watcher", 1, zk2.getDataWatches().size());
-        assertEquals("Didn't find data watcher", "/node2", zk2.getDataWatches().get(0));
-        removeWatches(zk2, "/node2", w2, WatcherType.Any, false, Code.OK);
-        assertTrue("Didn't remove data watcher", w2.matches());
+        assertNotNull(zk2.exists("/node2", w2), "Didn't set data watches");
+        removeWatches(zk2, "/node1", w1, WatcherType.Data, false, Code.OK, useAsync);
+        assertEquals(1, zk2.getDataWatches().size(), "Didn't find data watcher");
+        assertEquals("/node2", zk2.getDataWatches().get(0), "Didn't find data watcher");
+        removeWatches(zk2, "/node2", w2, WatcherType.Any, false, Code.OK, useAsync);
+        assertTrue(w2.matches(), "Didn't remove data watcher");
         // closing session should remove ephemeral nodes and trigger data
         // watches if any
         if (zk1 != null) {
@@ -158,28 +199,30 @@ public void testRemoveSingleWatcher() throws Exception {
         }
 
         List<EventType> events = w1.getEventsAfterWatchRemoval();
-        assertFalse("Shouldn't get NodeDeletedEvent after watch removal", events.contains(EventType.NodeDeleted));
-        assertEquals("Shouldn't get NodeDeletedEvent after watch removal", 0, events.size());
+        assertFalse(events.contains(EventType.NodeDeleted), "Shouldn't get NodeDeletedEvent after watch removal");
+        assertEquals(0, events.size(), "Shouldn't get NodeDeletedEvent after watch removal");
     }
 
     /**
      * Test verifies removal of multiple data watchers when there is server
      * connection
      */
-    @Test(timeout = 90000)
-    public void testMultipleDataWatchers() throws IOException, InterruptedException, KeeperException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testMultipleDataWatchers(boolean useAsync) throws IOException, InterruptedException, KeeperException {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL);
         MyWatcher w1 = new MyWatcher("/node1", 1);
         LOG.info("Adding data watcher {} on path {}", w1, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w1));
+        assertNotNull(zk2.exists("/node1", w1), "Didn't set data watches");
         MyWatcher w2 = new MyWatcher("/node1", 1);
         LOG.info("Adding data watcher {} on path {}", w2, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w2));
-        removeWatches(zk2, "/node1", w2, WatcherType.Data, false, Code.OK);
-        assertEquals("Didn't find data watcher", 1, zk2.getDataWatches().size());
-        assertEquals("Didn't find data watcher", "/node1", zk2.getDataWatches().get(0));
-        removeWatches(zk2, "/node1", w1, WatcherType.Any, false, Code.OK);
-        assertTrue("Didn't remove data watcher", w2.matches());
+        assertNotNull(zk2.exists("/node1", w2), "Didn't set data watches");
+        removeWatches(zk2, "/node1", w2, WatcherType.Data, false, Code.OK, useAsync);
+        assertEquals(1, zk2.getDataWatches().size(), "Didn't find data watcher");
+        assertEquals("/node1", zk2.getDataWatches().get(0), "Didn't find data watcher");
+        removeWatches(zk2, "/node1", w1, WatcherType.Any, false, Code.OK, useAsync);
+        assertTrue(w2.matches(), "Didn't remove data watcher");
         // closing session should remove ephemeral nodes and trigger data
         // watches if any
         if (zk1 != null) {
@@ -188,15 +231,17 @@ public void testMultipleDataWatchers() throws IOException, InterruptedException,
         }
 
         List<EventType> events = w2.getEventsAfterWatchRemoval();
-        assertEquals("Shouldn't get NodeDeletedEvent after watch removal", 0, events.size());
+        assertEquals(0, events.size(), "Shouldn't get NodeDeletedEvent after watch removal");
     }
 
     /**
      * Test verifies removal of multiple child watchers when there is server
      * connection
      */
-    @Test(timeout = 90000)
-    public void testMultipleChildWatchers() throws IOException, InterruptedException, KeeperException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testMultipleChildWatchers(boolean useAsync) throws IOException, InterruptedException, KeeperException {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         MyWatcher w1 = new MyWatcher("/node1", 1);
         LOG.info("Adding child watcher {} on path {}", w1, "/node1");
@@ -204,11 +249,11 @@ public void testMultipleChildWatchers() throws IOException, InterruptedException
         MyWatcher w2 = new MyWatcher("/node1", 1);
         LOG.info("Adding child watcher {} on path {}", w2, "/node1");
         zk2.getChildren("/node1", w2);
-        removeWatches(zk2, "/node1", w2, WatcherType.Children, false, Code.OK);
-        assertTrue("Didn't remove child watcher", w2.matches());
-        assertEquals("Didn't find child watcher", 1, zk2.getChildWatches().size());
-        removeWatches(zk2, "/node1", w1, WatcherType.Any, false, Code.OK);
-        assertTrue("Didn't remove child watcher", w1.matches());
+        removeWatches(zk2, "/node1", w2, WatcherType.Children, false, Code.OK, useAsync);
+        assertTrue(w2.matches(), "Didn't remove child watcher");
+        assertEquals(1, zk2.getChildWatches().size(), "Didn't find child watcher");
+        removeWatches(zk2, "/node1", w1, WatcherType.Any, false, Code.OK, useAsync);
+        assertTrue(w1.matches(), "Didn't remove child watcher");
         // create child to see NodeChildren notification
         zk1.create("/node1/node2", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         // waiting for child watchers to be notified
@@ -222,55 +267,59 @@ public void testMultipleChildWatchers() throws IOException, InterruptedException
         }
         // watcher2
         List<EventType> events = w2.getEventsAfterWatchRemoval();
-        assertEquals("Shouldn't get NodeChildrenChanged event", 0, events.size());
+        assertEquals(0, events.size(), "Shouldn't get NodeChildrenChanged event");
     }
 
     /**
      * Test verifies null watcher with WatcherType.Any - remove all the watchers
      * data, child, exists
      */
-    @Test(timeout = 90000)
-    public void testRemoveAllWatchers() throws IOException, InterruptedException, KeeperException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveAllWatchers(boolean useAsync) throws IOException, InterruptedException, KeeperException {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         MyWatcher w1 = new MyWatcher("/node1", 2);
         MyWatcher w2 = new MyWatcher("/node1", 2);
         LOG.info("Adding data watcher {} on path {}", w1, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w1));
+        assertNotNull(zk2.exists("/node1", w1), "Didn't set data watches");
         LOG.info("Adding data watcher {} on path {}", w2, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w2));
+        assertNotNull(zk2.exists("/node1", w2), "Didn't set data watches");
         LOG.info("Adding child watcher {} on path {}", w1, "/node1");
         zk2.getChildren("/node1", w1);
         LOG.info("Adding child watcher {} on path {}", w2, "/node1");
         zk2.getChildren("/node1", w2);
-        removeWatches(zk2, "/node1", w1, WatcherType.Any, false, Code.OK);
-        removeWatches(zk2, "/node1", w2, WatcherType.Any, false, Code.OK);
+        removeWatches(zk2, "/node1", w1, WatcherType.Any, false, Code.OK, useAsync);
+        removeWatches(zk2, "/node1", w2, WatcherType.Any, false, Code.OK, useAsync);
         zk1.create("/node1/child", null, Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL);
-        assertTrue("Didn't remove data watcher", w1.matches());
-        assertTrue("Didn't remove child watcher", w2.matches());
+        assertTrue(w1.matches(), "Didn't remove data watcher");
+        assertTrue(w2.matches(), "Didn't remove child watcher");
     }
 
     /**
      * Test verifies null watcher with WatcherType.Data - remove all data
      * watchers. Child watchers shouldn't be removed
      */
-    @Test(timeout = 90000)
-    public void testRemoveAllDataWatchers() throws IOException, InterruptedException, KeeperException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveAllDataWatchers(boolean useAsync) throws IOException, InterruptedException, KeeperException {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         MyWatcher w1 = new MyWatcher("/node1", 1);
         MyWatcher w2 = new MyWatcher("/node1", 1);
         LOG.info("Adding data watcher {} on path {}", w1, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w1));
+        assertNotNull(zk2.exists("/node1", w1), "Didn't set data watches");
         LOG.info("Adding data watcher {} on path {}", w2, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w2));
+        assertNotNull(zk2.exists("/node1", w2), "Didn't set data watches");
         LOG.info("Adding child watcher {} on path {}", w1, "/node1");
         zk2.getChildren("/node1", w1);
         LOG.info("Adding child watcher {} on path {}", w2, "/node1");
         zk2.getChildren("/node1", w2);
-        removeWatches(zk2, "/node1", w1, WatcherType.Data, false, Code.OK);
-        removeWatches(zk2, "/node1", w2, WatcherType.Data, false, Code.OK);
+        removeWatches(zk2, "/node1", w1, WatcherType.Data, false, Code.OK, useAsync);
+        removeWatches(zk2, "/node1", w2, WatcherType.Data, false, Code.OK, useAsync);
         zk1.create("/node1/child", null, Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL);
-        assertTrue("Didn't remove data watcher", w1.matches());
-        assertTrue("Didn't remove data watcher", w2.matches());
+        assertTrue(w1.matches(), "Didn't remove data watcher");
+        assertTrue(w2.matches(), "Didn't remove data watcher");
         // waiting for child watchers to be notified
         int count = 10;
         while (count > 0) {
@@ -282,36 +331,38 @@ public void testRemoveAllDataWatchers() throws IOException, InterruptedException
         }
         // watcher1
         List<EventType> events = w1.getEventsAfterWatchRemoval();
-        assertEquals("Didn't get NodeChildrenChanged event", 1, events.size());
-        assertTrue("Didn't get NodeChildrenChanged event", events.contains(EventType.NodeChildrenChanged));
+        assertEquals(1, events.size(), "Didn't get NodeChildrenChanged event");
+        assertTrue(events.contains(EventType.NodeChildrenChanged), "Didn't get NodeChildrenChanged event");
         // watcher2
         events = w2.getEventsAfterWatchRemoval();
-        assertEquals("Didn't get NodeChildrenChanged event", 1, events.size());
-        assertTrue("Didn't get NodeChildrenChanged event", events.contains(EventType.NodeChildrenChanged));
+        assertEquals(1, events.size(), "Didn't get NodeChildrenChanged event");
+        assertTrue(events.contains(EventType.NodeChildrenChanged), "Didn't get NodeChildrenChanged event");
     }
 
     /**
      * Test verifies null watcher with WatcherType.Children - remove all child
      * watchers. Data watchers shouldn't be removed
      */
-    @Test(timeout = 90000)
-    public void testRemoveAllChildWatchers() throws IOException, InterruptedException, KeeperException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveAllChildWatchers(boolean useAsync) throws IOException, InterruptedException, KeeperException {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         MyWatcher w1 = new MyWatcher("/node1", 1);
         MyWatcher w2 = new MyWatcher("/node1", 1);
         LOG.info("Adding data watcher {} on path {}", w1, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w1));
+        assertNotNull(zk2.exists("/node1", w1), "Didn't set data watches");
         LOG.info("Adding data watcher {} on path {}", w2, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w2));
+        assertNotNull(zk2.exists("/node1", w2), "Didn't set data watches");
         LOG.info("Adding child watcher {} on path {}", w1, "/node1");
         zk2.getChildren("/node1", w1);
         LOG.info("Adding child watcher {} on path {}", w2, "/node1");
         zk2.getChildren("/node1", w2);
-        removeWatches(zk2, "/node1", w1, WatcherType.Children, false, Code.OK);
-        removeWatches(zk2, "/node1", w2, WatcherType.Children, false, Code.OK);
+        removeWatches(zk2, "/node1", w1, WatcherType.Children, false, Code.OK, useAsync);
+        removeWatches(zk2, "/node1", w2, WatcherType.Children, false, Code.OK, useAsync);
         zk1.setData("/node1", "test".getBytes(), -1);
-        assertTrue("Didn't remove child watcher", w1.matches());
-        assertTrue("Didn't remove child watcher", w2.matches());
+        assertTrue(w1.matches(), "Didn't remove child watcher");
+        assertTrue(w2.matches(), "Didn't remove child watcher");
         // waiting for child watchers to be notified
         int count = 10;
         while (count > 0) {
@@ -323,26 +374,118 @@ public void testRemoveAllChildWatchers() throws IOException, InterruptedExceptio
         }
         // watcher1
         List<EventType> events = w1.getEventsAfterWatchRemoval();
-        assertEquals("Didn't get NodeDataChanged event", 1, events.size());
-        assertTrue("Didn't get NodeDataChanged event", events.contains(EventType.NodeDataChanged));
+        assertEquals(1, events.size(), "Didn't get NodeDataChanged event");
+        assertTrue(events.contains(EventType.NodeDataChanged), "Didn't get NodeDataChanged event");
         // watcher2
         events = w2.getEventsAfterWatchRemoval();
-        assertEquals("Didn't get NodeDataChanged event", 1, events.size());
-        assertTrue("Didn't get NodeDataChanged event", events.contains(EventType.NodeDataChanged));
+        assertEquals(1, events.size(), "Didn't get NodeDataChanged event");
+        assertTrue(events.contains(EventType.NodeDataChanged), "Didn't get NodeDataChanged event");
+    }
+
+    /**
+     * Test verifies removing all watcher with WatcherType.Persistent.
+     *
+     * <p>All other watchers shouldn't be removed.
+     */
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveAllPersistentWatchers(boolean useAsync) throws InterruptedException, KeeperException {
+        zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        BlockingDeque<WatchedEvent> persistentEvents1 = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> persistentEvents2 = new LinkedBlockingDeque<>();
+
+        Watcher persistentWatcher1 = persistentEvents1::add;
+        Watcher persistentWatcher2 = persistentEvents2::add;
+        zk2.addWatch("/node1", persistentWatcher1, AddWatchMode.PERSISTENT);
+        zk2.addWatch("/node1", persistentWatcher2, AddWatchMode.PERSISTENT);
+
+        BlockingDeque<WatchedEvent> dataEvents = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> childrenEvents = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> recursiveEvents = new LinkedBlockingDeque<>();
+        zk2.getData("/node1", dataEvents::add, null);
+        zk2.getChildren("/node1", childrenEvents::add);
+        zk2.addWatch("/node1", recursiveEvents::add, AddWatchMode.PERSISTENT_RECURSIVE);
+
+        removeWatches(zk2, "/node1", persistentWatcher1, WatcherType.Persistent, false, Code.OK, useAsync);
+        removeWatches(zk2, "/node1", persistentWatcher2, WatcherType.Persistent, false, Code.OK, useAsync);
+        removeWatches(zk2, "/node1", persistentWatcher1, WatcherType.Data, false, Code.NOWATCHER, useAsync);
+        removeWatches(zk2, "/node1", persistentWatcher2, WatcherType.Data, false, Code.NOWATCHER, useAsync);
+        removeWatches(zk2, "/node1", persistentWatcher1, WatcherType.Children, false, Code.NOWATCHER, useAsync);
+        removeWatches(zk2, "/node1", persistentWatcher2, WatcherType.Children, false, Code.NOWATCHER, useAsync);
+        removeWatches(zk2, "/node1", persistentWatcher1, WatcherType.PersistentRecursive, false, Code.NOWATCHER, useAsync);
+        removeWatches(zk2, "/node1", persistentWatcher2, WatcherType.PersistentRecursive, false, Code.NOWATCHER, useAsync);
+
+        zk1.create("/node1/node2", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk1.setData("/node1", null, -1);
+
+        assertEvent(persistentEvents1, EventType.PersistentWatchRemoved, "/node1");
+        assertEvent(persistentEvents2, EventType.PersistentWatchRemoved, "/node1");
+        assertEvent(dataEvents, EventType.NodeDataChanged, "/node1");
+        assertEvent(childrenEvents, EventType.NodeChildrenChanged, "/node1");
+        assertEvent(recursiveEvents, EventType.NodeCreated, "/node1/node2");
+        assertEvent(recursiveEvents, EventType.NodeDataChanged, "/node1");
     }
 
+    /**
+     * Test verifies removing all watcher with WatcherType.PersistentRecursive.
+     *
+     * <p>All other watchers shouldn't be removed
+     */
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveAllPersistentRecursiveWatchers(boolean useAsync) throws InterruptedException, KeeperException {
+        zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        BlockingDeque<WatchedEvent> recursiveEvents1 = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> recursiveEvents2 = new LinkedBlockingDeque<>();
+
+        Watcher recursiveWatcher1 = recursiveEvents1::add;
+        Watcher recursiveWatcher2 = recursiveEvents2::add;
+        zk2.addWatch("/node1", recursiveWatcher1, AddWatchMode.PERSISTENT_RECURSIVE);
+        zk2.addWatch("/node1", recursiveWatcher2, AddWatchMode.PERSISTENT_RECURSIVE);
+
+        BlockingDeque<WatchedEvent> dataEvents = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> childrenEvents = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> persistentEvents = new LinkedBlockingDeque<>();
+        zk2.getData("/node1", dataEvents::add, null);
+        zk2.getChildren("/node1", childrenEvents::add);
+        zk2.addWatch("/node1", persistentEvents::add, AddWatchMode.PERSISTENT);
+
+        removeWatches(zk2, "/node1", recursiveWatcher1, WatcherType.PersistentRecursive, false, Code.OK, useAsync);
+        removeWatches(zk2, "/node1", recursiveWatcher2, WatcherType.PersistentRecursive, false, Code.OK, useAsync);
+        removeWatches(zk2, "/node1", recursiveWatcher1, WatcherType.Data, false, Code.NOWATCHER, useAsync);
+        removeWatches(zk2, "/node1", recursiveWatcher2, WatcherType.Data, false, Code.NOWATCHER, useAsync);
+        removeWatches(zk2, "/node1", recursiveWatcher1, WatcherType.Children, false, Code.NOWATCHER, useAsync);
+        removeWatches(zk2, "/node1", recursiveWatcher2, WatcherType.Children, false, Code.NOWATCHER, useAsync);
+        removeWatches(zk2, "/node1", recursiveWatcher1, WatcherType.Persistent, false, Code.NOWATCHER, useAsync);
+        removeWatches(zk2, "/node1", recursiveWatcher2, WatcherType.Persistent, false, Code.NOWATCHER, useAsync);
+
+        assertEvent(recursiveEvents1, EventType.PersistentWatchRemoved, "/node1");
+        assertEvent(recursiveEvents2, EventType.PersistentWatchRemoved, "/node1");
+
+        zk1.create("/node1/child1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk1.setData("/node1", "test".getBytes(), -1);
+
+        assertEvent(dataEvents, EventType.NodeDataChanged, "/node1");
+        assertEvent(childrenEvents, EventType.NodeChildrenChanged, "/node1");
+        assertEvent(persistentEvents, EventType.NodeChildrenChanged, "/node1");
+        assertEvent(persistentEvents, EventType.NodeDataChanged, "/node1");
+    }
     /**
      * Test verifies given watcher doesn't exists!
      */
-    @Test(timeout = 90000)
-    public void testNoWatcherException() throws IOException, InterruptedException, KeeperException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testNoWatcherException(boolean useAsync) throws IOException, InterruptedException, KeeperException {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         MyWatcher w1 = new MyWatcher("/node1", 2);
         MyWatcher w2 = new MyWatcher("/node1", 2);
         LOG.info("Adding data watcher {} on path {}", w1, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w1));
+        assertNotNull(zk2.exists("/node1", w1), "Didn't set data watches");
         LOG.info("Adding data watcher {} on path {}", w2, "/node1");
-        assertNull("Didn't set data watches", zk2.exists("/node2", w2));
+        assertNull(zk2.exists("/node2", w2), "Didn't set data watches");
         LOG.info("Adding child watcher {} on path {}", w1, "/node1");
         zk2.getChildren("/node1", w1);
         LOG.info("Adding child watcher {} on path {}", w2, "/node1");
@@ -351,123 +494,106 @@ public void testNoWatcherException() throws IOException, InterruptedException, K
         // New Watcher which will be used for removal
         MyWatcher w3 = new MyWatcher("/node1", 2);
 
-        try {
-            removeWatches(zk2, "/node1", w3, WatcherType.Any, false, Code.NOWATCHER);
-            fail("Should throw exception as given watcher doesn't exists");
-        } catch (KeeperException.NoWatcherException nwe) {
-            // expected
-        }
-        try {
-            removeWatches(zk2, "/node1", w3, WatcherType.Children, false, Code.NOWATCHER);
-            fail("Should throw exception as given watcher doesn't exists");
-        } catch (KeeperException.NoWatcherException nwe) {
-            // expected
-        }
-        try {
-            removeWatches(zk2, "/node1", w3, WatcherType.Data, false, Code.NOWATCHER);
-            fail("Should throw exception as given watcher doesn't exists");
-        } catch (KeeperException.NoWatcherException nwe) {
-            // expected
-        }
-        try {
-            removeWatches(zk2, "/nonexists", w3, WatcherType.Data, false, Code.NOWATCHER);
-            fail("Should throw exception as given watcher doesn't exists");
-        } catch (KeeperException.NoWatcherException nwe) {
-            // expected
-        }
+        removeWatches(zk2, "/node1", w3, WatcherType.Any, false, Code.NOWATCHER, useAsync);
+        removeWatches(zk2, "/node1", w3, WatcherType.Children, false, Code.NOWATCHER, useAsync);
+        removeWatches(zk2, "/node1", w3, WatcherType.Data, false, Code.NOWATCHER, useAsync);
+        removeWatches(zk2, "/nonexists", w3, WatcherType.Data, false, Code.NOWATCHER, useAsync);
     }
 
     /**
      * Test verifies WatcherType.Any - removes only the configured data watcher
      * function
      */
-    @Test(timeout = 90000)
-    public void testRemoveAnyDataWatcher() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveAnyDataWatcher(boolean useAsync) throws Exception {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         MyWatcher w1 = new MyWatcher("/node1", 1);
         MyWatcher w2 = new MyWatcher("/node1", 2);
         // Add multiple data watches
         LOG.info("Adding data watcher {} on path {}", w1, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w1));
+        assertNotNull(zk2.exists("/node1", w1), "Didn't set data watches");
         LOG.info("Adding data watcher {} on path {}", w2, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w2));
+        assertNotNull(zk2.exists("/node1", w2), "Didn't set data watches");
         // Add child watch
         LOG.info("Adding child watcher {} on path {}", w2, "/node1");
         zk2.getChildren("/node1", w2);
-        removeWatches(zk2, "/node1", w1, WatcherType.Any, false, Code.OK);
-        assertTrue("Didn't remove data watcher", w1.matches());
-        assertEquals("Didn't find child watcher", 1, zk2.getChildWatches().size());
-        assertEquals("Didn't find data watcher", 1, zk2.getDataWatches().size());
-        removeWatches(zk2, "/node1", w2, WatcherType.Any, false, Code.OK);
-        assertTrue("Didn't remove child watcher", w2.matches());
+        removeWatches(zk2, "/node1", w1, WatcherType.Any, false, Code.OK, useAsync);
+        assertTrue(w1.matches(), "Didn't remove data watcher");
+        assertEquals(1, zk2.getChildWatches().size(), "Didn't find child watcher");
+        assertEquals(1, zk2.getDataWatches().size(), "Didn't find data watcher");
+        removeWatches(zk2, "/node1", w2, WatcherType.Any, false, Code.OK, useAsync);
+        assertTrue(w2.matches(), "Didn't remove child watcher");
     }
 
     /**
      * Test verifies WatcherType.Any - removes only the configured child watcher
      * function
      */
-    @Test(timeout = 90000)
-    public void testRemoveAnyChildWatcher() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveAnyChildWatcher(boolean useAsync) throws Exception {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         MyWatcher w1 = new MyWatcher("/node1", 2);
         MyWatcher w2 = new MyWatcher("/node1", 1);
         LOG.info("Adding data watcher {} on path {}", w1, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w1));
+        assertNotNull(zk2.exists("/node1", w1), "Didn't set data watches");
         // Add multiple child watches
         LOG.info("Adding child watcher {} on path {}", w1, "/node1");
         zk2.getChildren("/node1", w2);
         LOG.info("Adding child watcher {} on path {}", w2, "/node1");
         zk2.getChildren("/node1", w1);
-        removeWatches(zk2, "/node1", w2, WatcherType.Any, false, Code.OK);
-        assertTrue("Didn't remove child watcher", w2.matches());
-        assertEquals("Didn't find child watcher", 1, zk2.getChildWatches().size());
-        assertEquals("Didn't find data watcher", 1, zk2.getDataWatches().size());
-        removeWatches(zk2, "/node1", w1, WatcherType.Any, false, Code.OK);
-        assertTrue("Didn't remove watchers", w1.matches());
+        removeWatches(zk2, "/node1", w2, WatcherType.Any, false, Code.OK, useAsync);
+        assertTrue(w2.matches(), "Didn't remove child watcher");
+        assertEquals(1, zk2.getChildWatches().size(), "Didn't find child watcher");
+        assertEquals(1, zk2.getDataWatches().size(), "Didn't find data watcher");
+        removeWatches(zk2, "/node1", w1, WatcherType.Any, false, Code.OK, useAsync);
+        assertTrue(w1.matches(), "Didn't remove watchers");
     }
 
     /**
      * Test verifies when there is no server connection. Remove watches when
      * local=true, otw should retain it
      */
-    @Test(timeout = 90000)
-    public void testRemoveWatcherWhenNoConnection() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveWatcherWhenNoConnection(boolean useAsync) throws Exception {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         MyWatcher w1 = new MyWatcher("/node1", 2);
         MyWatcher w2 = new MyWatcher("/node1", 1);
         LOG.info("Adding data watcher {} on path {}", w1, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w1));
+        assertNotNull(zk2.exists("/node1", w1), "Didn't set data watches");
         // Add multiple child watches
         LOG.info("Adding child watcher {} on path {}", w1, "/node1");
         zk2.getChildren("/node1", w1);
         LOG.info("Adding child watcher {} on path {}", w1, "/node1");
         zk2.getChildren("/node1", w2);
         stopServer();
-        removeWatches(zk2, "/node1", w2, WatcherType.Any, true, Code.OK);
-        assertTrue("Didn't remove child watcher", w2.matches());
-        assertFalse("Shouldn't remove data watcher", w1.matches());
-        try {
-            removeWatches(zk2, "/node1", w1, WatcherType.Any, false, Code.CONNECTIONLOSS);
-            fail("Should throw exception as last watch removal requires server connection");
-        } catch (KeeperException.ConnectionLossException nwe) {
-            // expected
-        }
-        assertFalse("Shouldn't remove data watcher", w1.matches());
+        removeWatches(zk2, "/node1", w2, WatcherType.Any, true, Code.OK, useAsync);
+        assertTrue(w2.matches(), "Didn't remove child watcher");
+        assertFalse(w1.matches(), "Shouldn't remove data watcher");
+        removeWatches(zk2, "/node1", w1, WatcherType.Any, false, Code.CONNECTIONLOSS, useAsync);
+        assertFalse(w1.matches(), "Shouldn't remove data watcher");
 
         // when local=true, here if connection not available, simply removes
         // from local session
-        removeWatches(zk2, "/node1", w1, WatcherType.Any, true, Code.OK);
-        assertTrue("Didn't remove data watcher", w1.matches());
+        removeWatches(zk2, "/node1", w1, WatcherType.Any, true, Code.OK, useAsync);
+        assertTrue(w1.matches(), "Didn't remove data watcher");
     }
 
     /**
      * Test verifies many pre-node watchers. Also, verifies internal
      * datastructure 'watchManager.existWatches'
      */
-    @Test(timeout = 90000)
-    public void testManyPreNodeWatchers() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testManyPreNodeWatchers(boolean useAsync) throws Exception {
         int count = 50;
-        List<MyWatcher> wList = new ArrayList<MyWatcher>(count);
+        List<MyWatcher> wList = new ArrayList<>(count);
         MyWatcher w;
         String path = "/node";
         // Exists watcher
@@ -478,23 +604,25 @@ public void testManyPreNodeWatchers() throws Exception {
             LOG.info("Adding pre node watcher {} on path {}", w, nodePath);
             zk1.exists(nodePath, w);
         }
-        assertEquals("Failed to add watchers!", count, zk1.getExistWatches().size());
+        assertEquals(count, zk1.getExistWatches().size(), "Failed to add watchers!");
         for (int i = 0; i < count; i++) {
             final MyWatcher watcher = wList.get(i);
-            removeWatches(zk1, path + i, watcher, WatcherType.Data, false, Code.OK);
-            assertTrue("Didn't remove data watcher", watcher.matches());
+            removeWatches(zk1, path + i, watcher, WatcherType.Data, false, Code.OK, useAsync);
+            assertTrue(watcher.matches(), "Didn't remove data watcher");
         }
-        assertEquals("Didn't remove watch references!", 0, zk1.getExistWatches().size());
+        assertEquals(0, zk1.getExistWatches().size(), "Didn't remove watch references!");
     }
 
     /**
      * Test verifies many child watchers. Also, verifies internal datastructure
      * 'watchManager.childWatches'
      */
-    @Test(timeout = 90000)
-    public void testManyChildWatchers() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testManyChildWatchers(boolean useAsync) throws Exception {
         int count = 50;
-        List<MyWatcher> wList = new ArrayList<MyWatcher>(count);
+        List<MyWatcher> wList = new ArrayList<>(count);
         MyWatcher w;
         String path = "/node";
 
@@ -512,23 +640,25 @@ public void testManyChildWatchers() throws Exception {
             zk1.getChildren(nodePath, w);
             nodePath += "/";
         }
-        assertEquals("Failed to add watchers!", count, zk1.getChildWatches().size());
+        assertEquals(count, zk1.getChildWatches().size(), "Failed to add watchers!");
         for (int i = 0; i < count; i++) {
             final MyWatcher watcher = wList.get(i);
-            removeWatches(zk1, path + i, watcher, WatcherType.Children, false, Code.OK);
-            assertTrue("Didn't remove child watcher", watcher.matches());
+            removeWatches(zk1, path + i, watcher, WatcherType.Children, false, Code.OK, useAsync);
+            assertTrue(watcher.matches(), "Didn't remove child watcher");
         }
-        assertEquals("Didn't remove watch references!", 0, zk1.getChildWatches().size());
+        assertEquals(0, zk1.getChildWatches().size(), "Didn't remove watch references!");
     }
 
     /**
      * Test verifies many data watchers. Also, verifies internal datastructure
      * 'watchManager.dataWatches'
      */
-    @Test(timeout = 90000)
-    public void testManyDataWatchers() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testManyDataWatchers(boolean useAsync) throws Exception {
         int count = 50;
-        List<MyWatcher> wList = new ArrayList<MyWatcher>(count);
+        List<MyWatcher> wList = new ArrayList<>(count);
         MyWatcher w;
         String path = "/node";
 
@@ -542,23 +672,25 @@ public void testManyDataWatchers() throws Exception {
             zk1.getData(nodePath, w, null);
             nodePath += "/";
         }
-        assertEquals("Failed to add watchers!", count, zk1.getDataWatches().size());
+        assertEquals(count, zk1.getDataWatches().size(), "Failed to add watchers!");
         for (int i = 0; i < count; i++) {
             final MyWatcher watcher = wList.get(i);
-            removeWatches(zk1, path + i, watcher, WatcherType.Data, false, Code.OK);
-            assertTrue("Didn't remove data watcher", watcher.matches());
+            removeWatches(zk1, path + i, watcher, WatcherType.Data, false, Code.OK, useAsync);
+            assertTrue(watcher.matches(), "Didn't remove data watcher");
         }
-        assertEquals("Didn't remove watch references!", 0, zk1.getDataWatches().size());
+        assertEquals(0, zk1.getDataWatches().size(), "Didn't remove watch references!");
     }
 
     /**
      * Test verifies removal of many watchers locally when no connection and
      * WatcherType#Any. Also, verifies internal watchManager datastructures
      */
-    @Test(timeout = 90000)
-    public void testManyWatchersWhenNoConnection() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testManyWatchersWhenNoConnection(boolean useAsync) throws Exception {
         int count = 3;
-        List<MyWatcher> wList = new ArrayList<MyWatcher>(count);
+        List<MyWatcher> wList = new ArrayList<>(count);
         MyWatcher w;
         String path = "/node";
 
@@ -576,7 +708,7 @@ public void testManyWatchersWhenNoConnection() throws Exception {
             zk1.getChildren(nodePath, w);
             nodePath += "/";
         }
-        assertEquals("Failed to add watchers!", count, zk1.getChildWatches().size());
+        assertEquals(count, zk1.getChildWatches().size(), "Failed to add watchers!");
 
         // Data watcher
         for (int i = 0; i < count; i++) {
@@ -586,22 +718,24 @@ public void testManyWatchersWhenNoConnection() throws Exception {
             zk1.getData(nodePath, w, null);
             nodePath += "/";
         }
-        assertEquals("Failed to add watchers!", count, zk1.getDataWatches().size());
+        assertEquals(count, zk1.getDataWatches().size(), "Failed to add watchers!");
         stopServer();
         for (int i = 0; i < count; i++) {
             final MyWatcher watcher = wList.get(i);
-            removeWatches(zk1, path + i, watcher, WatcherType.Any, true, Code.OK);
-            assertTrue("Didn't remove watcher", watcher.matches());
+            removeWatches(zk1, path + i, watcher, WatcherType.Any, true, Code.OK, useAsync);
+            assertTrue(watcher.matches(), "Didn't remove watcher");
         }
-        assertEquals("Didn't remove watch references!", 0, zk1.getChildWatches().size());
-        assertEquals("Didn't remove watch references!", 0, zk1.getDataWatches().size());
+        assertEquals(0, zk1.getChildWatches().size(), "Didn't remove watch references!");
+        assertEquals(0, zk1.getDataWatches().size(), "Didn't remove watch references!");
     }
 
     /**
      * Test verifies removing watcher having namespace
      */
-    @Test(timeout = 90000)
-    public void testChRootRemoveWatcher() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testChRootRemoveWatcher(boolean useAsync) throws Exception {
         // creating the subtree for chRoot clients.
         String chRoot = "/appsX";
         zk1.create("/appsX", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
@@ -620,17 +754,17 @@ public void testChRootRemoveWatcher() throws Exception {
         MyWatcher w1 = new MyWatcher("/node1", 2);
         MyWatcher w2 = new MyWatcher("/node1", 1);
         LOG.info("Adding data watcher {} on path {}", w1, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w1));
+        assertNotNull(zk2.exists("/node1", w1), "Didn't set data watches");
         // Add multiple child watches
         LOG.info("Adding child watcher {} on path {}", w1, "/node1");
         zk2.getChildren("/node1", w2);
         LOG.info("Adding child watcher {} on path {}", w2, "/node1");
         zk2.getChildren("/node1", w1);
-        removeWatches(zk2, "/node1", w1, WatcherType.Any, false, Code.OK);
-        assertTrue("Didn't remove child watcher", w1.matches());
-        assertEquals("Didn't find child watcher", 1, zk2.getChildWatches().size());
-        removeWatches(zk2, "/node1", w2, WatcherType.Any, false, Code.OK);
-        assertTrue("Didn't remove child watcher", w2.matches());
+        removeWatches(zk2, "/node1", w1, WatcherType.Any, false, Code.OK, useAsync);
+        assertTrue(w1.matches(), "Didn't remove child watcher");
+        assertEquals(1, zk2.getChildWatches().size(), "Didn't find child watcher");
+        removeWatches(zk2, "/node1", w2, WatcherType.Any, false, Code.OK, useAsync);
+        assertTrue(w2.matches(), "Didn't remove child watcher");
     }
 
     /**
@@ -654,45 +788,40 @@ public void testChRootRemoveWatcher() throws Exception {
      * we would just return ZOK even if no watch was removed.
      *
      */
-    @Test(timeout = 90000)
-    public void testNoWatcherServerException() throws InterruptedException, IOException, TimeoutException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testNoWatcherServerException(boolean useAsync) throws KeeperException, InterruptedException, IOException, TimeoutException {
         CountdownWatcher watcher = new CountdownWatcher();
-        MyZooKeeper zk = new MyZooKeeper(hostPort, CONNECTION_TIMEOUT, watcher);
-        boolean nw = false;
+        ZooKeeper zk = spy(new ZooKeeper(hostPort, CONNECTION_TIMEOUT, watcher));
+        MyWatchManager watchManager = new MyWatchManager(false, watcher);
+        doReturn(watchManager).when(zk).getWatchManager();
 
         watcher.waitForConnected(CONNECTION_TIMEOUT);
 
-        try {
-            zk.removeWatches("/nowatchhere", watcher, WatcherType.Data, false);
-        } catch (KeeperException nwe) {
-            if (nwe.code().intValue() == Code.NOWATCHER.intValue()) {
-                nw = true;
-            }
-        }
+        removeWatches(zk, "/nowatchhere", watcher, WatcherType.Data, false, Code.NOWATCHER, useAsync);
 
-        assertTrue("Server didn't return NOWATCHER", zk.getRemoveWatchesRC() == Code.NOWATCHER.intValue());
-        assertTrue("NoWatcherException didn't happen", nw);
+        assertThat("Server didn't return NOWATCHER", watchManager.lastReturnCode, is(Code.NOWATCHER.intValue()));
     }
 
     /**
      * Test verifies given watcher doesn't exists!
      */
-    @Test(timeout = 90000)
-    public void testRemoveAllNoWatcherException() throws IOException, InterruptedException, KeeperException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveAllNoWatcherException(boolean useAsync) throws IOException, InterruptedException, KeeperException {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        try {
-            removeAllWatches(zk2, "/node1", WatcherType.Any, false, Code.NOWATCHER);
-            fail("Should throw exception as given watcher doesn't exists");
-        } catch (KeeperException.NoWatcherException nwe) {
-            // expected
-        }
+        removeAllWatches(zk2, "/node1", WatcherType.Any, false, Code.NOWATCHER, useAsync);
     }
 
     /**
      * Test verifies null watcher
      */
-    @Test(timeout = 30000)
-    public void testNullWatcherReference() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 30)
+    public void testNullWatcherReference(boolean useAsync) throws Exception {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         try {
             if (useAsync) {
@@ -710,8 +839,10 @@ public void testNullWatcherReference() throws Exception {
      * Test verifies WatcherType.Data - removes only the configured data watcher
      * function
      */
-    @Test(timeout = 90000)
-    public void testRemoveWhenMultipleDataWatchesOnAPath() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveWhenMultipleDataWatchesOnAPath(boolean useAsync) throws Exception {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         final CountDownLatch dataWatchCount = new CountDownLatch(1);
         final CountDownLatch rmWatchCount = new CountDownLatch(1);
@@ -727,24 +858,26 @@ public void testRemoveWhenMultipleDataWatchesOnAPath() throws Exception {
         };
         // Add multiple data watches
         LOG.info("Adding data watcher {} on path {}", w1, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w1));
+        assertNotNull(zk2.exists("/node1", w1), "Didn't set data watches");
         LOG.info("Adding data watcher {} on path {}", w2, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w2));
+        assertNotNull(zk2.exists("/node1", w2), "Didn't set data watches");
 
-        removeWatches(zk2, "/node1", w1, WatcherType.Data, false, Code.OK);
-        assertTrue("Didn't remove data watcher", rmWatchCount.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS));
+        removeWatches(zk2, "/node1", w1, WatcherType.Data, false, Code.OK, useAsync);
+        assertTrue(rmWatchCount.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS), "Didn't remove data watcher");
 
         zk1.setData("/node1", "test".getBytes(), -1);
         LOG.info("Waiting for data watchers to be notified");
-        assertTrue("Didn't get data watch notification!", dataWatchCount.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS));
+        assertTrue(dataWatchCount.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS), "Didn't get data watch notification!");
     }
 
     /**
      * Test verifies WatcherType.Children - removes only the configured child
      * watcher function
      */
-    @Test(timeout = 90000)
-    public void testRemoveWhenMultipleChildWatchesOnAPath() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveWhenMultipleChildWatchesOnAPath(boolean useAsync) throws Exception {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         final CountDownLatch childWatchCount = new CountDownLatch(1);
         final CountDownLatch rmWatchCount = new CountDownLatch(1);
@@ -760,219 +893,388 @@ public void testRemoveWhenMultipleChildWatchesOnAPath() throws Exception {
         };
         // Add multiple child watches
         LOG.info("Adding child watcher {} on path {}", w1, "/node1");
-        assertEquals("Didn't set child watches", 0, zk2.getChildren("/node1", w1).size());
+        assertEquals(0, zk2.getChildren("/node1", w1).size(), "Didn't set child watches");
         LOG.info("Adding child watcher {} on path {}", w2, "/node1");
-        assertEquals("Didn't set child watches", 0, zk2.getChildren("/node1", w2).size());
+        assertEquals(0, zk2.getChildren("/node1", w2).size(), "Didn't set child watches");
 
-        removeWatches(zk2, "/node1", w1, WatcherType.Children, false, Code.OK);
-        assertTrue("Didn't remove child watcher", rmWatchCount.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS));
+        removeWatches(zk2, "/node1", w1, WatcherType.Children, false, Code.OK, useAsync);
+        assertTrue(rmWatchCount.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS), "Didn't remove child watcher");
 
         zk1.create("/node1/node2", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         LOG.info("Waiting for child watchers to be notified");
-        assertTrue("Didn't get child watch notification!", childWatchCount.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS));
+        assertTrue(childWatchCount.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS), "Didn't get child watch notification!");
     }
 
     /**
-     * Test verifies WatcherType.Data - removes only the configured data watcher
-     * function
+     * Test verifies {@link WatcherType#Persistent} - removes only the configured watcher function
      */
-    @Test(timeout = 90000)
-    public void testRemoveAllDataWatchesOnAPath() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveWhenMultiplePersistentWatchesOnAPath(boolean useAsync) throws Exception {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        final CountDownLatch dWatchCount = new CountDownLatch(2);
-        final CountDownLatch rmWatchCount = new CountDownLatch(2);
-        Watcher w1 = event -> {
-            switch (event.getType()) {
-            case DataWatchRemoved:
-                rmWatchCount.countDown();
-                break;
-            case NodeDataChanged:
-                dWatchCount.countDown();
-                break;
-            default:
-                break;
-            }
-        };
-        Watcher w2 = event -> {
-            switch (event.getType()) {
-            case DataWatchRemoved:
-                rmWatchCount.countDown();
-                break;
-            case NodeDataChanged:
-                dWatchCount.countDown();
-                break;
-            default:
-                break;
-            }
-        };
-        // Add multiple data watches
-        LOG.info("Adding data watcher {} on path {}", w1, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w1));
-        LOG.info("Adding data watcher {} on path {}", w2, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w2));
 
-        assertTrue("Server session is not a watcher", isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Data));
-        removeAllWatches(zk2, "/node1", WatcherType.Data, false, Code.OK);
-        assertTrue("Didn't remove data watcher", rmWatchCount.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS));
+        BlockingDeque<WatchedEvent> persistentEvents1 = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> persistentEvents2 = new LinkedBlockingDeque<>();
+        Watcher w1 = persistentEvents1::add;
+        // Add multiple persistent watches
+        zk2.addWatch("/node1", w1, AddWatchMode.PERSISTENT);
+        zk2.addWatch("/node1", persistentEvents2::add, AddWatchMode.PERSISTENT);
+
+        removeWatches(zk2, "/node1", w1, WatcherType.Persistent, false, Code.OK, useAsync);
+        assertEvent(persistentEvents1, EventType.PersistentWatchRemoved, "/node1");
 
-        assertFalse("Server session is still a watcher after removal", isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Data));
+        zk1.create("/node1/node2", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        assertEvent(persistentEvents2, EventType.NodeChildrenChanged, "/node1");
+        assertNoEvent(persistentEvents1);
     }
 
     /**
-     * Test verifies WatcherType.Children - removes only the configured child
-     * watcher function
+     * Test verifies {@link WatcherType#PersistentRecursive} - removes only the configured watcher function
      */
-    @Test(timeout = 90000)
-    public void testRemoveAllChildWatchesOnAPath() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveWhenMultiplePersistentRecursiveWatchesOnAPath(boolean useAsync) throws Exception {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        final CountDownLatch cWatchCount = new CountDownLatch(2);
-        final CountDownLatch rmWatchCount = new CountDownLatch(2);
-        Watcher w1 = event -> {
-            switch (event.getType()) {
-            case ChildWatchRemoved:
-                rmWatchCount.countDown();
-                break;
-            case NodeChildrenChanged:
-                cWatchCount.countDown();
-                break;
-            default:
-                break;
-            }
-        };
-        Watcher w2 = event -> {
-            switch (event.getType()) {
-            case ChildWatchRemoved:
-                rmWatchCount.countDown();
-                break;
-            case NodeChildrenChanged:
-                cWatchCount.countDown();
-                break;
-            default:
-                break;
-            }
-        };
-        // Add multiple child watches
-        LOG.info("Adding child watcher {} on path {}", w1, "/node1");
-        assertEquals("Didn't set child watches", 0, zk2.getChildren("/node1", w1).size());
-        LOG.info("Adding child watcher {} on path {}", w2, "/node1");
-        assertEquals("Didn't set child watches", 0, zk2.getChildren("/node1", w2).size());
 
-        assertTrue("Server session is not a watcher", isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Children));
-        removeAllWatches(zk2, "/node1", WatcherType.Children, false, Code.OK);
-        assertTrue("Didn't remove child watcher", rmWatchCount.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS));
+        BlockingDeque<WatchedEvent> recursiveEvents1 = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> recursiveEvents2 = new LinkedBlockingDeque<>();
+        Watcher w1 = recursiveEvents1::add;
+        // Add multiple persistent recursive watches
+        zk2.addWatch("/node1", w1, AddWatchMode.PERSISTENT_RECURSIVE);
+        zk2.addWatch("/node1", recursiveEvents2::add, AddWatchMode.PERSISTENT_RECURSIVE);
 
-        assertFalse("Server session is still a watcher after removal", isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Children));
+        removeWatches(zk2, "/node1", w1, WatcherType.PersistentRecursive, false, Code.OK, useAsync);
+        assertEvent(recursiveEvents1, EventType.PersistentWatchRemoved, "/node1");
+
+        zk1.create("/node1/node2", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        assertEvent(recursiveEvents2, EventType.NodeCreated, "/node1/node2");
+        assertNoEvent(recursiveEvents1);
     }
 
     /**
-     * Test verifies WatcherType.Any - removes all the configured child,data
-     * watcher functions
+     * Test verifies {@link OpCode#checkWatches} {@link WatcherType#Persistent} using {@link WatcherType#Data}.
      */
-    @Test(timeout = 90000)
-    public void testRemoveAllWatchesOnAPath() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemovePersistentWatchesOnAPathPartially(boolean useAsync) throws Exception {
         zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        final CountDownLatch watchCount = new CountDownLatch(2);
-        final CountDownLatch rmWatchCount = new CountDownLatch(4);
-        Watcher w1 = event -> {
-            switch (event.getType()) {
-            case ChildWatchRemoved:
-            case DataWatchRemoved:
-                rmWatchCount.countDown();
-                break;
-            case NodeChildrenChanged:
-            case NodeDataChanged:
-                watchCount.countDown();
-                break;
-            default:
-                break;
-            }
-        };
-        Watcher w2 = event -> {
-            switch (event.getType()) {
-            case ChildWatchRemoved:
-            case DataWatchRemoved:
-                rmWatchCount.countDown();
-                break;
-            case NodeChildrenChanged:
-            case NodeDataChanged:
-                watchCount.countDown();
-                break;
-            default:
-                break;
-            }
-        };
-        // Add multiple child watches
-        LOG.info("Adding child watcher {} on path {}", w1, "/node1");
-        assertEquals("Didn't set child watches", 0, zk2.getChildren("/node1", w1).size());
-        LOG.info("Adding child watcher {} on path {}", w2, "/node1");
-        assertEquals("Didn't set child watches", 0, zk2.getChildren("/node1", w2).size());
 
+        BlockingDeque<WatchedEvent> persistentEvents = new LinkedBlockingDeque<>();
+        Watcher persistentWatcher = persistentEvents::add;
+        zk2.addWatch("/node1", persistentWatcher, AddWatchMode.PERSISTENT);
+
+        assertWatchers(zk2, "/node1", WatcherType.Persistent);
+        assertNoWatchers(zk2, "/node1", WatcherType.Data);
+        removeWatches(zk2, "/node1", persistentWatcher, WatcherType.Data, false, Code.NOWATCHER, useAsync);
+        assertWatchers(zk2, "/node1", WatcherType.Persistent);
+        assertNoWatchers(zk2, "/node1", WatcherType.Data);
+
+        zk1.create("/node1/child1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk1.setData("/node1", null, -1);
+
+        assertEvent(persistentEvents, EventType.NodeChildrenChanged, "/node1");
+        assertEvent(persistentEvents, EventType.NodeDataChanged, "/node1");
+
+        assertNull(persistentEvents.poll(10, TimeUnit.MILLISECONDS));
+    }
+
+    /**
+     * Test verifies {@link OpCode#removeWatches} {@link WatcherType#Data}.
+     *
+     * <p>All other watcher types shouldn't be removed.
+     */
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveAllDataWatchesOnAPath(boolean useAsync) throws Exception {
+        zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+        BlockingDeque<WatchedEvent> dataEvents1 = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> dataEvents2 = new LinkedBlockingDeque<>();
         // Add multiple data watches
-        LOG.info("Adding data watcher {} on path {}", w1, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w1));
-        LOG.info("Adding data watcher {} on path {}", w2, "/node1");
-        assertNotNull("Didn't set data watches", zk2.exists("/node1", w2));
+        zk2.getData("/node1", dataEvents1::add, null);
+        zk2.getData("/node1", dataEvents2::add, null);
 
-        assertTrue("Server session is not a watcher", isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Data));
-        removeAllWatches(zk2, "/node1", WatcherType.Any, false, Code.OK);
-        assertTrue("Didn't remove data watcher", rmWatchCount.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS));
-        assertFalse("Server session is still a watcher after removal", isServerSessionWatcher(zk2.getSessionId(), "/node1", WatcherType.Data));
-        assertEquals("Received watch notification after removal!", 2, watchCount.getCount());
+        BlockingDeque<WatchedEvent> childrenEvents = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> persistentEvents = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> recursiveEvents = new LinkedBlockingDeque<>();
+        zk2.getChildren("/node1", childrenEvents::add);
+        zk2.addWatch("/node1", persistentEvents::add, AddWatchMode.PERSISTENT);
+        zk2.addWatch("/node1", recursiveEvents::add, AddWatchMode.PERSISTENT_RECURSIVE);
+
+        assertWatchers(zk2, "/node1", WatcherType.values());
+        removeAllWatches(zk2, "/node1", WatcherType.Data, false, Code.OK, useAsync);
+        assertEvent(dataEvents1, EventType.DataWatchRemoved, "/node1");
+        assertEvent(dataEvents2, EventType.DataWatchRemoved, "/node1");
+        assertWatchersExcept(zk2, "/node1", WatcherType.Data);
+
+        zk1.create("/node1/child", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk1.setData("/node1", null, -1);
+
+        assertEvent(childrenEvents, EventType.NodeChildrenChanged, "/node1");
+
+        assertEvent(persistentEvents, EventType.NodeChildrenChanged, "/node1");
+        assertEvent(persistentEvents, EventType.NodeDataChanged, "/node1");
+
+        assertEvent(recursiveEvents, EventType.NodeCreated, "/node1/child");
+        assertEvent(recursiveEvents, EventType.NodeDataChanged, "/node1");
+
+        assertNoEvent(dataEvents1);
+        assertNoEvent(dataEvents2);
     }
 
-    /* a mocked ZK class that doesn't do client-side verification
-     * before/after calling removeWatches */
-    private class MyZooKeeper extends ZooKeeper {
+    /**
+     * Test verifies {@link OpCode#removeWatches} {@link WatcherType#Children}.
+     *
+     * <p>All other watcher types shouldn't be removed.
+     */
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveAllChildWatchesOnAPath(boolean useAsync) throws Exception {
+        zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
-        class MyWatchManager extends ZKWatchManager {
+        BlockingDeque<WatchedEvent> childrenEvents1 = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> childrenEvents2 = new LinkedBlockingDeque<>();
+        // Add multiple child watches
+        zk2.getChildren("/node1", childrenEvents1::add);
+        zk2.getChildren("/node1", childrenEvents2::add);
+
+        BlockingDeque<WatchedEvent> dataEvents = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> persistentEvents = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> recursiveEvents = new LinkedBlockingDeque<>();
+        zk2.getData("/node1", dataEvents::add, null);
+        zk2.addWatch("/node1", persistentEvents::add, AddWatchMode.PERSISTENT);
+        zk2.addWatch("/node1", recursiveEvents::add, AddWatchMode.PERSISTENT_RECURSIVE);
+
+        assertWatchers(zk2, "/node1", WatcherType.values());
+        removeAllWatches(zk2, "/node1", WatcherType.Children, false, Code.OK, useAsync);
+        assertEvent(childrenEvents1, EventType.ChildWatchRemoved, "/node1");
+        assertEvent(childrenEvents2, EventType.ChildWatchRemoved, "/node1");
+        assertWatchersExcept(zk2, "/node1", WatcherType.Children);
+
+        zk1.create("/node1/child", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk1.setData("/node1", null, -1);
+
+        assertEvent(dataEvents, EventType.NodeDataChanged, "/node1");
+        assertEvent(persistentEvents, EventType.NodeChildrenChanged, "/node1");
+        assertEvent(persistentEvents, EventType.NodeDataChanged, "/node1");
+        assertEvent(recursiveEvents, EventType.NodeCreated, "/node1/child");
+        assertEvent(recursiveEvents, EventType.NodeDataChanged, "/node1");
+
+        assertNull(childrenEvents1.poll(10, TimeUnit.MILLISECONDS));
+        assertNull(childrenEvents2.poll(10, TimeUnit.MILLISECONDS));
+    }
 
-            public MyWatchManager(boolean disableAutoWatchReset) {
-                super(disableAutoWatchReset);
-            }
+    /**
+     * Test verifies {@link OpCode#removeWatches} {@link WatcherType#Persistent}.
+     *
+     * <p>All other watcher types shouldn't be removed.
+     */
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveAllPersistentWatchesOnAPath(boolean useAsync) throws Exception {
+        zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
-            public int lastrc;
+        BlockingDeque<WatchedEvent> persistentEvents1 = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> persistentEvents2 = new LinkedBlockingDeque<>();
+        // Add multiple persistent watches
+        zk2.addWatch("/node1", persistentEvents1::add, AddWatchMode.PERSISTENT);
+        zk2.addWatch("/node1", persistentEvents2::add, AddWatchMode.PERSISTENT);
+
+        BlockingDeque<WatchedEvent> dataEvents = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> childrenEvents = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> recursiveEvents = new LinkedBlockingDeque<>();
+        zk2.getData("/node1", dataEvents::add, null);
+        zk2.getChildren("/node1", childrenEvents::add, null);
+        zk2.addWatch("/node1", recursiveEvents::add, AddWatchMode.PERSISTENT_RECURSIVE);
+
+        assertWatchers(zk2, "/node1", WatcherType.values());
+        removeAllWatches(zk2, "/node1", WatcherType.Persistent, false, Code.OK, useAsync);
+        assertEvent(persistentEvents1, EventType.PersistentWatchRemoved, "/node1");
+        assertEvent(persistentEvents2, EventType.PersistentWatchRemoved, "/node1");
+        assertWatchersExcept(zk2, "/node1", WatcherType.Persistent);
+
+        zk1.create("/node1/child1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk1.setData("/node1", null, -1);
+
+        assertEvent(dataEvents, EventType.NodeDataChanged, "/node1");
+        assertEvent(childrenEvents, EventType.NodeChildrenChanged, "/node1");
+        assertEvent(recursiveEvents, EventType.NodeCreated, "/node1/child1");
+        assertEvent(recursiveEvents, EventType.NodeDataChanged, "/node1");
+
+        assertNull(persistentEvents1.poll(10, TimeUnit.MILLISECONDS));
+        assertNull(persistentEvents2.poll(10, TimeUnit.MILLISECONDS));
+    }
 
-            /* Pretend that any watcher exists */
-            void containsWatcher(String path, Watcher watcher, WatcherType watcherType) throws NoWatcherException {
-            }
+    /**
+     * Test verifies {@link OpCode#removeWatches} {@link WatcherType#Persistent} using {@link WatcherType#Data}.
+     */
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveAllPersistentWatchesOnAPathPartially(boolean useAsync) throws Exception {
+        zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
-            /* save the return error code by the server */
-            protected boolean removeWatches(
-                Map<String, Set<Watcher>> pathVsWatcher,
-                Watcher watcher,
-                String path,
-                boolean local,
-                int rc,
-                Set<Watcher> removedWatchers) throws KeeperException {
-                lastrc = rc;
-                return false;
-            }
+        BlockingDeque<WatchedEvent> persistentEvents = new LinkedBlockingDeque<>();
+        zk2.addWatch("/node1", persistentEvents::add, AddWatchMode.PERSISTENT);
 
-        }
+        assertWatchers(zk2, "/node1", WatcherType.Persistent);
+        assertNoWatchers(zk2, "/node1", WatcherType.Data);
+        removeAllWatches(zk2, "/node1", WatcherType.Data, false, Code.NOWATCHER, useAsync);
+        assertWatchers(zk2, "/node1", WatcherType.Persistent);
+        assertNoWatchers(zk2, "/node1", WatcherType.Data);
 
-        public MyZooKeeper(String hp, int timeout, Watcher watcher) throws IOException {
-            super(hp, timeout, watcher, false);
-        }
+        zk1.create("/node1/child1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk1.setData("/node1", null, -1);
 
-        private MyWatchManager myWatchManager;
+        assertEvent(persistentEvents, EventType.NodeChildrenChanged, "/node1");
+        assertEvent(persistentEvents, EventType.NodeDataChanged, "/node1");
 
-        protected ZKWatchManager defaultWatchManager() {
-            myWatchManager = new MyWatchManager(getClientConfig().getBoolean(ZKClientConfig.DISABLE_AUTO_WATCH_RESET));
-            return myWatchManager;
+        assertNull(persistentEvents.poll(10, TimeUnit.MILLISECONDS));
+    }
+
+    /**
+     * Test verifies {@link OpCode#removeWatches} {@link WatcherType#PersistentRecursive}.
+     *
+     * <p>All other watcher types shouldn't be removed.
+     */
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveAllPersistentRecursiveWatchesOnAPath(boolean useAsync) throws Exception {
+        zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+        BlockingDeque<WatchedEvent> recursiveEvents1 = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> recursiveEvents2 = new LinkedBlockingDeque<>();
+        // Add multiple persistent recursive watches
+        zk2.addWatch("/node1", recursiveEvents1::add, AddWatchMode.PERSISTENT_RECURSIVE);
+        zk2.addWatch("/node1", recursiveEvents2::add, AddWatchMode.PERSISTENT_RECURSIVE);
+
+        BlockingDeque<WatchedEvent> dataEvents = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> childrenEvents = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> persistentEvents = new LinkedBlockingDeque<>();
+        zk2.getData("/node1", dataEvents::add, null);
+        zk2.getChildren("/node1", childrenEvents::add, null);
+        zk2.addWatch("/node1", persistentEvents::add, AddWatchMode.PERSISTENT);
+
+        assertWatchers(zk2, "/node1", WatcherType.values());
+        removeAllWatches(zk2, "/node1", WatcherType.PersistentRecursive, false, Code.OK, useAsync);
+        assertEvent(recursiveEvents1, EventType.PersistentWatchRemoved, "/node1");
+        assertEvent(recursiveEvents2, EventType.PersistentWatchRemoved, "/node1");
+        assertWatchersExcept(zk2, "/node1", WatcherType.PersistentRecursive);
+
+        zk1.create("/node1/child1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk1.setData("/node1", null, -1);
+
+        assertEvent(dataEvents, EventType.NodeDataChanged, "/node1");
+        assertEvent(childrenEvents, EventType.NodeChildrenChanged, "/node1");
+        assertEvent(persistentEvents, EventType.NodeChildrenChanged, "/node1");
+        assertEvent(persistentEvents, EventType.NodeDataChanged, "/node1");
+
+        assertNull(recursiveEvents1.poll(10, TimeUnit.MILLISECONDS));
+        assertNull(recursiveEvents2.poll(10, TimeUnit.MILLISECONDS));
+    }
+
+    /**
+     * Test verifies {@link OpCode#removeWatches} {@link WatcherType#Any}.
+     *
+     * <p>All watcher types should be removed.
+     */
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testRemoveAllWatchesOnAPath(boolean useAsync) throws Exception {
+        zk1.create("/node1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+        // Add multiple child watches
+        BlockingDeque<WatchedEvent> childEvents1 = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> childEvents2 = new LinkedBlockingDeque<>();
+        zk2.getChildren("/node1", childEvents1::add);
+        zk2.getChildren("/node1", childEvents2::add);
+
+        // Add multiple data watches
+        BlockingDeque<WatchedEvent> dataEvents1 = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> dataEvents2 = new LinkedBlockingDeque<>();
+        zk2.getData("/node1", dataEvents1::add, null);
+        zk2.exists("/node1", dataEvents2::add);
+
+        // Add multiple persistent watches
+        BlockingDeque<WatchedEvent> persistentEvents1 = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> persistentEvents2 = new LinkedBlockingDeque<>();
+        zk2.addWatch("/node1", persistentEvents1::add, AddWatchMode.PERSISTENT);
+        zk2.addWatch("/node1", persistentEvents2::add, AddWatchMode.PERSISTENT);
+
+        // Add multiple recursive watches
+        BlockingDeque<WatchedEvent> recursiveEvents1 = new LinkedBlockingDeque<>();
+        BlockingDeque<WatchedEvent> recursiveEvents2 = new LinkedBlockingDeque<>();
+        zk2.addWatch("/node1", recursiveEvents1::add, AddWatchMode.PERSISTENT_RECURSIVE);
+        zk2.addWatch("/node1", recursiveEvents2::add, AddWatchMode.PERSISTENT_RECURSIVE);
+
+        assertWatchers(zk2, "/node1", WatcherType.values());
+        removeAllWatches(zk2, "/node1", WatcherType.Any, false, Code.OK, useAsync);
+
+        assertEvent(childEvents1, EventType.ChildWatchRemoved, "/node1");
+        assertEvent(childEvents2, EventType.ChildWatchRemoved, "/node1");
+
+        assertEvent(dataEvents1, EventType.DataWatchRemoved, "/node1");
+        assertEvent(dataEvents2, EventType.DataWatchRemoved, "/node1");
+
+        assertEvent(persistentEvents1, EventType.PersistentWatchRemoved, "/node1");
+        assertEvent(persistentEvents2, EventType.PersistentWatchRemoved, "/node1");
+
+        assertEvent(recursiveEvents1, EventType.PersistentWatchRemoved, "/node1");
+        assertEvent(recursiveEvents2, EventType.PersistentWatchRemoved, "/node1");
+        assertNoWatchers(zk2, "/node1", WatcherType.values());
+
+        zk1.create("/node1/child1", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk1.setData("/node1", null, -1);
+
+        assertNoEvent(childEvents1);
+        assertNoEvent(childEvents2);
+        assertNoEvent(dataEvents1);
+        assertNoEvent(dataEvents2);
+        assertNoEvent(persistentEvents1);
+        assertNoEvent(persistentEvents2);
+        assertNoEvent(recursiveEvents1);
+        assertNoEvent(recursiveEvents2);
+    }
+
+    private static class MyWatchManager extends ZKWatchManager {
+
+        int lastReturnCode;
+
+        MyWatchManager(boolean disableAutoWatchReset, Watcher defaultWatcher) {
+            super(disableAutoWatchReset, defaultWatcher);
         }
 
-        public int getRemoveWatchesRC() {
-            return myWatchManager.lastrc;
+        void containsWatcher(String path, Watcher watcher, WatcherType watcherType) {
+            // prevent contains watcher
         }
 
+        @Override
+        protected boolean removeWatches(
+            Map<String, Set<Watcher>> pathVsWatcher,
+            Watcher watcher,
+            String path,
+            boolean local,
+            int rc,
+            Set<Watcher> removedWatchers) {
+            lastReturnCode = rc;
+            return false;
+        }
     }
 
-    private class MyWatcher implements Watcher {
+    private static class MyWatcher implements Watcher {
 
         private final String path;
         private String eventPath;
         private CountDownLatch latch;
-        private List<EventType> eventsAfterWatchRemoval = new ArrayList<EventType>();
+        private List<EventType> eventsAfterWatchRemoval = new ArrayList<>();
         MyWatcher(String path, int count) {
             this.path = path;
             latch = new CountDownLatch(count);
@@ -1072,4 +1374,22 @@ private boolean isServerSessionWatcher(long sessionId, String path, WatcherType
         return false;
     }
 
+    /**
+     * Asserts next event from queue has given event type and path.
+     */
+    private void assertEvent(BlockingQueue<WatchedEvent> events, Watcher.Event.EventType eventType, String path)
+            throws InterruptedException {
+        WatchedEvent event = events.poll(5, TimeUnit.SECONDS);
+        assertNotNull(event);
+        assertEquals(eventType, event.getType());
+        assertEquals(path, event.getPath());
+    }
+
+    /**
+     * Asserts no event from queue in a short period.
+     */
+    private void assertNoEvent(BlockingQueue<WatchedEvent> events) throws InterruptedException {
+        // Short timeout so we don't hurt CI too much. It will fail finally given enough run if there are bugs.
+        assertNull(events.poll(10, TimeUnit.MILLISECONDS));
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/SaslAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/SaslAuthTest.java
index a63ab10145a..fe9b41dc625 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/SaslAuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/SaslAuthTest.java
@@ -18,9 +18,12 @@
 
 package org.apache.zookeeper;
 
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertSame;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.FileWriter;
 import java.io.IOException;
@@ -33,16 +36,17 @@
 import org.apache.zookeeper.ClientCnxn.SendThread;
 import org.apache.zookeeper.Watcher.Event.KeeperState;
 import org.apache.zookeeper.ZooDefs.Ids;
+import org.apache.zookeeper.client.ZooKeeperSaslClient;
 import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Id;
-import org.apache.zookeeper.test.ClientBase;
-import org.junit.AfterClass;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.apache.zookeeper.test.SaslAuthDigestTestBase;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
 
-public class SaslAuthTest extends ClientBase {
+public class SaslAuthTest extends SaslAuthDigestTestBase {
 
-    @BeforeClass
+    @BeforeAll
     public static void init() {
         System.setProperty("zookeeper.authProvider.1", "org.apache.zookeeper.server.auth.SASLAuthenticationProvider");
         try {
@@ -83,7 +87,7 @@ private static String getJaasFileContent() {
         return jaasContent.toString();
     }
 
-    @AfterClass
+    @AfterAll
     public static void clean() {
         System.clearProperty("zookeeper.authProvider.1");
         System.clearProperty("java.security.auth.login.config");
@@ -125,7 +129,7 @@ public void testAuth() throws Exception {
     public void testValidSaslIds() throws Exception {
         ZooKeeper zk = createClient();
 
-        List<String> validIds = new ArrayList<String>();
+        List<String> validIds = new ArrayList<>();
         validIds.add("user");
         validIds.add("service/host.name.com");
         validIds.add("user@KERB.REALM");
@@ -133,7 +137,7 @@ public void testValidSaslIds() throws Exception {
 
         int i = 0;
         for (String validId : validIds) {
-            List<ACL> aclList = new ArrayList<ACL>();
+            List<ACL> aclList = new ArrayList<>();
             ACL acl = new ACL(0, new Id("sasl", validId));
             aclList.add(acl);
             zk.create("/valid" + i, null, aclList, CreateMode.PERSISTENT);
@@ -145,13 +149,13 @@ public void testValidSaslIds() throws Exception {
     public void testInvalidSaslIds() throws Exception {
         ZooKeeper zk = createClient();
 
-        List<String> invalidIds = new ArrayList<String>();
+        List<String> invalidIds = new ArrayList<>();
         invalidIds.add("user@KERB.REALM/server.com");
         invalidIds.add("user@KERB.REALM1@KERB.REALM2");
 
         int i = 0;
         for (String invalidId : invalidIds) {
-            List<ACL> aclList = new ArrayList<ACL>();
+            List<ACL> aclList = new ArrayList<>();
             try {
                 ACL acl = new ACL(0, new Id("sasl", invalidId));
                 aclList.add(acl);
@@ -187,7 +191,7 @@ public void testZKOperationsAfterClientSaslAuthFailure() throws Exception {
                     // do nothing
                 }
             }
-            assertTrue("ZNode creation is failing continuously after Sasl auth failure.", success);
+            assertTrue(success, "ZNode creation is failing continuously after Sasl auth failure.");
 
         } finally {
             zk.close();
@@ -232,10 +236,15 @@ public void testThreadsShutdownOnAuthFailed() throws Exception {
             Field eventThreadField = clientCnxn.getClass().getDeclaredField("eventThread");
             eventThreadField.setAccessible(true);
             EventThread eventThread = (EventThread) eventThreadField.get(clientCnxn);
+            ZooKeeperSaslClient zooKeeperSaslClient = clientCnxn.getZooKeeperSaslClient();
+            assertNotNull(zooKeeperSaslClient);
             sendThread.join(CONNECTION_TIMEOUT);
             eventThread.join(CONNECTION_TIMEOUT);
-            assertFalse("SendThread did not shutdown after authFail", sendThread.isAlive());
-            assertFalse("EventThread did not shutdown after authFail", eventThread.isAlive());
+            // If login is null, this means ZooKeeperSaslClient#shutdown method has been called which in turns
+            // means that Login#shutdown has been called.
+            assertNull(sendThread.getLogin());
+            assertFalse(sendThread.isAlive(), "SendThread did not shutdown after authFail");
+            assertFalse(eventThread.isAlive(), "EventThread did not shutdown after authFail");
         } finally {
             if (zk != null) {
                 zk.close();
@@ -243,4 +252,36 @@ public void testThreadsShutdownOnAuthFailed() throws Exception {
         }
     }
 
+    @Test
+    public void testDisconnectNotCreatingLoginThread() throws Exception {
+        MyWatcher watcher = new MyWatcher();
+        ZooKeeper zk = null;
+        try {
+            zk = new ZooKeeper(hostPort, CONNECTION_TIMEOUT, watcher);
+            watcher.waitForConnected(CONNECTION_TIMEOUT);
+            zk.getData("/", false, null);
+
+            Field cnxnField = zk.getClass().getDeclaredField("cnxn");
+            cnxnField.setAccessible(true);
+            ClientCnxn clientCnxn = (ClientCnxn) cnxnField.get(zk);
+            Field sendThreadField = clientCnxn.getClass().getDeclaredField("sendThread");
+            sendThreadField.setAccessible(true);
+            SendThread sendThread = (SendThread) sendThreadField.get(clientCnxn);
+
+            Login l1 = sendThread.getLogin();
+            assertNotNull(l1);
+
+            stopServer();
+            watcher.waitForDisconnected(CONNECTION_TIMEOUT);
+            startServer();
+            watcher.waitForConnected(CONNECTION_TIMEOUT);
+            zk.getData("/", false, null);
+
+            assertSame("Login thread should not been recreated on disconnect", l1, sendThread.getLogin());
+        } finally {
+            if (zk != null) {
+                zk.close();
+            }
+        }
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ServerConfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ServerConfigTest.java
index a2b4371843c..4989bd1b369 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ServerConfigTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ServerConfigTest.java
@@ -18,30 +18,33 @@
 
 package org.apache.zookeeper;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 import java.io.File;
 import org.apache.zookeeper.server.ServerConfig;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class ServerConfigTest {
 
     private ServerConfig serverConfig;
 
-    @Before
+    @BeforeEach
     public void setUp() {
         serverConfig = new ServerConfig();
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testFewArguments() {
-        String[] args = {"2181"};
-        serverConfig.parse(args);
+        assertThrows(IllegalArgumentException.class, () -> {
+            String[] args = {"2181"};
+            serverConfig.parse(args);
+        });
     }
 
     @Test
@@ -55,10 +58,12 @@ public void testValidArguments() {
         assertEquals(10000, serverConfig.getMaxClientCnxns());
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testTooManyArguments() {
-        String[] args = {"2181", "/data/dir", "60000", "10000", "9999"};
-        serverConfig.parse(args);
+        assertThrows(IllegalArgumentException.class, () -> {
+            String[] args = {"2181", "/data/dir", "60000", "10000", "9999"};
+            serverConfig.parse(args);
+        });
     }
 
     @Test
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/TestableZooKeeper.java b/zookeeper-server/src/test/java/org/apache/zookeeper/TestableZooKeeper.java
index a02127aae07..7f9e41e3380 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/TestableZooKeeper.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/TestableZooKeeper.java
@@ -20,12 +20,10 @@
 
 import java.io.IOException;
 import java.net.SocketAddress;
-import java.util.List;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
 import org.apache.jute.Record;
 import org.apache.zookeeper.admin.ZooKeeperAdmin;
-import org.apache.zookeeper.client.HostProvider;
 import org.apache.zookeeper.proto.ReplyHeader;
 import org.apache.zookeeper.proto.RequestHeader;
 
@@ -35,76 +33,12 @@ public TestableZooKeeper(String host, int sessionTimeout, Watcher watcher) throw
         super(host, sessionTimeout, watcher);
     }
 
-    class TestableClientCnxn extends ClientCnxn {
-
-        TestableClientCnxn(
-            String chrootPath,
-            HostProvider hostProvider,
-            int sessionTimeout,
-            ZooKeeper zooKeeper,
-            ClientWatchManager watcher,
-            ClientCnxnSocket clientCnxnSocket,
-            boolean canBeReadOnly) throws IOException {
-            super(chrootPath,
-                  hostProvider,
-                  sessionTimeout,
-                  zooKeeper,
-                  watcher,
-                  clientCnxnSocket,
-                  0,
-                  new byte[16],
-                  canBeReadOnly);
-        }
-
-        void setXid(int newXid) {
-            xid = newXid;
-        }
-
-        int checkXid() {
-            return xid;
-        }
-
-    }
-
-    protected ClientCnxn createConnection(
-        String chrootPath,
-        HostProvider hostProvider,
-        int sessionTimeout,
-        ZooKeeper zooKeeper,
-        ClientWatchManager watcher,
-        ClientCnxnSocket clientCnxnSocket,
-        boolean canBeReadOnly) throws IOException {
-        return new TestableClientCnxn(
-            chrootPath,
-            hostProvider,
-            sessionTimeout,
-            this,
-            watcher,
-            clientCnxnSocket,
-            canBeReadOnly);
-    }
-
     public void setXid(int xid) {
-        ((TestableClientCnxn) cnxn).setXid(xid);
+        cnxn.xid = xid;
     }
 
     public int checkXid() {
-        return ((TestableClientCnxn) cnxn).checkXid();
-    }
-
-    @Override
-    public List<String> getChildWatches() {
-        return super.getChildWatches();
-    }
-
-    @Override
-    public List<String> getDataWatches() {
-        return super.getDataWatches();
-    }
-
-    @Override
-    public List<String> getExistWatches() {
-        return super.getExistWatches();
+        return cnxn.xid;
     }
 
     /**
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/VerGenTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/VerGenTest.java
deleted file mode 100644
index 1542df0caa5..00000000000
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/VerGenTest.java
+++ /dev/null
@@ -1,71 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.apache.zookeeper;
-
-import static org.junit.Assert.assertEquals;
-import java.io.File;
-import java.util.Arrays;
-import java.util.Collection;
-import org.apache.zookeeper.test.ClientBase;
-import org.apache.zookeeper.version.util.VerGen;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
-import org.junit.runners.Parameterized.Parameters;
-
-/**
- * Test VerGen, used during the build.
- *
- */
-@RunWith(Parameterized.class)
-@Parameterized.UseParametersRunnerFactory(ZKParameterized.RunnerFactory.class)
-public class VerGenTest extends ZKTestCase {
-
-    @Parameters
-    public static Collection<Object[]> data() {
-        return Arrays.asList(new Object[][]{{"1.2.3", new Object[]{1, 2, 3, null}}, {"1.2.3-dev", new Object[]{1, 2, 3, "dev"}}, {"1.2.3-SNAPSHOT", new Object[]{1, 2, 3, "SNAPSHOT"}}, {"1.2.3-SNAPSHOT", new Object[]{1, 2, 3, "SNAPSHOT"}}, {"1.2.3-foo-bar+123", new Object[]{1, 2, 3, "foo-bar+123"}}, {"1.2.3.4.5-SNAPSHOT", new Object[]{1, 2, 3, "SNAPSHOT"}}, {"1.2.3.4.5-foo-bar+123", new Object[]{1, 2, 3, "foo-bar+123"}}});
-    }
-
-    private String input;
-
-    private Object[] expected;
-
-    public VerGenTest(String input, Object[] expected) {
-        this.input = input;
-        this.expected = expected;
-    }
-
-    @Test
-    public void testParser() {
-        VerGen.Version v = VerGen.parseVersionString(input);
-        assertEquals(expected[0], v.maj);
-        assertEquals(expected[1], v.min);
-        assertEquals(expected[2], v.micro);
-        assertEquals(expected[3], v.qualifier);
-    }
-
-    @Test
-    public void testGenFile() throws Exception {
-        VerGen.Version v = VerGen.parseVersionString(input);
-        File outputDir = ClientBase.createTmpDir();
-        VerGen.generateFile(outputDir, v, "1", "Nov1");
-        ClientBase.recursiveDelete(outputDir);
-    }
-
-}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ZKParameterized.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ZKParameterized.java
deleted file mode 100644
index 6b5359096b0..00000000000
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ZKParameterized.java
+++ /dev/null
@@ -1,62 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.apache.zookeeper;
-
-import java.util.List;
-import org.junit.runners.model.FrameworkMethod;
-import org.junit.runners.model.InitializationError;
-import org.junit.runners.model.Statement;
-import org.junit.runners.parameterized.BlockJUnit4ClassRunnerWithParameters;
-import org.junit.runners.parameterized.BlockJUnit4ClassRunnerWithParametersFactory;
-import org.junit.runners.parameterized.TestWithParameters;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-public class ZKParameterized {
-
-    private static final Logger LOG = LoggerFactory.getLogger(ZKParameterized.class);
-
-    public static class RunnerFactory extends BlockJUnit4ClassRunnerWithParametersFactory {
-
-        @Override
-        public org.junit.runner.Runner createRunnerForTestWithParameters(TestWithParameters test) throws InitializationError {
-            return new ZKParameterized.Runner(test);
-        }
-
-    }
-
-    public static class Runner extends BlockJUnit4ClassRunnerWithParameters {
-
-        public Runner(TestWithParameters test) throws InitializationError {
-            super(test);
-        }
-
-        @Override
-        protected List<FrameworkMethod> computeTestMethods() {
-            return JUnit4ZKTestRunner.computeTestMethodsForClass(getTestClass().getJavaClass(), super.computeTestMethods());
-        }
-
-        @Override
-        protected Statement methodInvoker(FrameworkMethod method, Object test) {
-            return new JUnit4ZKTestRunner.LoggedInvokeMethod(method, test);
-        }
-
-    }
-
-}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ZKTestCase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ZKTestCase.java
index 78e3cd79e82..db24797180b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ZKTestCase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ZKTestCase.java
@@ -18,16 +18,21 @@
 
 package org.apache.zookeeper;
 
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
-import java.time.LocalDateTime;
+import java.time.Instant;
+import java.util.concurrent.CompletableFuture;
+import org.apache.zookeeper.metrics.MetricsUtils;
 import org.apache.zookeeper.util.ServiceUtils;
-import org.junit.BeforeClass;
-import org.junit.Rule;
-import org.junit.rules.TestWatcher;
-import org.junit.runner.Description;
-import org.junit.runner.RunWith;
+import org.hamcrest.CustomMatcher;
+import org.hamcrest.Description;
+import org.hamcrest.Matcher;
+import org.hamcrest.StringDescription;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.TestInfo;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -37,11 +42,11 @@
  * Basic utilities shared by all tests. Also logging of various events during
  * the test execution (start/stop/success/failure/etc...)
  */
-@RunWith(JUnit4ZKTestRunner.class)
 public class ZKTestCase {
 
     protected static final File testBaseDir = new File(System.getProperty("build.test.dir", "build"));
     private static final Logger LOG = LoggerFactory.getLogger(ZKTestCase.class);
+    public static final int DEFAULT_METRIC_TIMEOUT = 30;
 
     static {
         // Disable System.exit in tests.
@@ -54,54 +59,58 @@ protected String getTestName() {
         return testName;
     }
 
-    @BeforeClass
+    public void syncClient(ZooKeeper zk, boolean synchronous) throws KeeperException {
+        if (synchronous) {
+            try {
+                zk.sync("/");
+            } catch (InterruptedException ex) {
+                throw new RuntimeException(ex);
+            }
+            return;
+        }
+        final CompletableFuture<KeeperException.Code> synced = new CompletableFuture<>();
+        zk.sync("/", (rc, path, ctx) -> {
+            synced.complete(KeeperException.Code.get(rc));
+        }, null);
+        KeeperException.Code code = synced.join();
+        if (code != KeeperException.Code.OK) {
+            throw KeeperException.create(code);
+        }
+    }
+
+    @BeforeAll
     public static void before() {
         if (!testBaseDir.exists()) {
-            assertTrue(
-                "Cannot properly create test base directory " + testBaseDir.getAbsolutePath(),
-                testBaseDir.mkdirs());
+            assertTrue(testBaseDir.mkdirs(),
+                "Cannot properly create test base directory " + testBaseDir.getAbsolutePath());
         } else if (!testBaseDir.isDirectory()) {
-            assertTrue(
-                "Cannot properly delete file with duplicate name of test base directory " + testBaseDir.getAbsolutePath(),
-                testBaseDir.delete());
-            assertTrue(
-                "Cannot properly create test base directory " + testBaseDir.getAbsolutePath(),
-                testBaseDir.mkdirs());
+            assertTrue(testBaseDir.delete(),
+                "Cannot properly delete file with duplicate name of test base directory " + testBaseDir.getAbsolutePath());
+            assertTrue(testBaseDir.mkdirs(),
+                "Cannot properly create test base directory " + testBaseDir.getAbsolutePath());
         }
     }
 
-    @Rule
-    public TestWatcher watchman = new TestWatcher() {
-
-        @Override
-        public void starting(Description method) {
-            // By default, disable starting a JettyAdminServer in tests to avoid
-            // accidentally attempting to start multiple admin servers on the
-            // same port.
-            System.setProperty("zookeeper.admin.enableServer", "false");
-            // ZOOKEEPER-2693 disables all 4lw by default.
-            // Here we enable the 4lw which ZooKeeper tests depends.
-            System.setProperty("zookeeper.4lw.commands.whitelist", "*");
-            testName = method.getMethodName();
-            LOG.info("STARTING {}", testName);
-        }
+    @BeforeEach
+    public void starting(TestInfo testInfo) {
+        // By default, disable starting a JettyAdminServer in tests to avoid
+        // accidentally attempting to start multiple admin servers on the
+        // same port.
+        System.setProperty("zookeeper.admin.enableServer", "false");
 
-        @Override
-        public void finished(Description method) {
-            LOG.info("FINISHED {}", testName);
-        }
-
-        @Override
-        public void succeeded(Description method) {
-            LOG.info("SUCCEEDED {}", testName);
-        }
+        // disable rate limiting
+        System.setProperty("zookeeper.admin.rateLimiterIntervalInMS", "0");
 
-        @Override
-        public void failed(Throwable e, Description method) {
-            LOG.error("FAILED {}", testName, e);
-        }
+        // ZOOKEEPER-2693 disables all 4lw by default.
+        // Here we enable the 4lw which ZooKeeper tests depends.
+        System.setProperty("zookeeper.4lw.commands.whitelist", "*");
+        LOG.info("STARTING {}", testInfo.getTestMethod());
+    }
 
-    };
+    @AfterEach
+    public void finished(TestInfo testInfo) {
+        LOG.info("FINISHED {}", testInfo.getTestMethod());
+    }
 
     public interface WaitForCondition {
 
@@ -120,9 +129,9 @@ public interface WaitForCondition {
      * @param timeout   timeout in seconds
      * @throws InterruptedException
      */
-    public void waitFor(String msg, WaitForCondition condition, int timeout) throws InterruptedException {
-        final LocalDateTime deadline = LocalDateTime.now().plusSeconds(timeout);
-        while (LocalDateTime.now().isBefore(deadline)) {
+    public static void waitFor(String msg, WaitForCondition condition, int timeout) throws InterruptedException {
+        final Instant deadline = Instant.now().plusSeconds(timeout);
+        while (Instant.now().isBefore(deadline)) {
             if (condition.evaluate()) {
                 return;
             }
@@ -131,4 +140,36 @@ public void waitFor(String msg, WaitForCondition condition, int timeout) throws
         fail(msg);
     }
 
-}
+    public static <T> void waitForMetric(String metricKey, Matcher<T> matcher) throws InterruptedException {
+        waitForMetric(metricKey, matcher, DEFAULT_METRIC_TIMEOUT);
+    }
+
+    public static <T> void waitForMetric(String metricKey, Matcher<T> matcher, int timeoutInSeconds) throws InterruptedException {
+        String errorMessage = String.format("metric \"%s\" failed to match after %d seconds",
+            metricKey, timeoutInSeconds);
+        waitFor(errorMessage, () -> {
+            @SuppressWarnings("unchecked")
+            T actual = (T) MetricsUtils.currentServerMetrics().get(metricKey);
+            if (!matcher.matches(actual)) {
+                Description description = new StringDescription();
+                matcher.describeMismatch(actual, description);
+                LOG.info("match failed for metric {}: {}", metricKey, description);
+                return false;
+            }
+            return true;
+        }, timeoutInSeconds);
+    }
+
+    /**
+     * Functionally identical to {@link org.hamcrest.Matchers#closeTo} except that it accepts all numerical types
+     * instead of failing if the value is not a {@link Double}.
+     */
+    public static Matcher<Number> closeTo(double operand, double error) {
+        return new CustomMatcher<Number>(String.format("A number within %s of %s", error, operand)) {
+            @Override
+            public boolean matches(Object actual) {
+                return Math.abs(operand - ((Number) actual).doubleValue()) <= error;
+            }
+        };
+    }
+}
\ No newline at end of file
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ZKUtilTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ZKUtilTest.java
index 43e986978d0..21dad4c50b4 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ZKUtilTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ZKUtilTest.java
@@ -18,21 +18,28 @@
 
 package org.apache.zookeeper;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
 import static org.junit.Assume.assumeTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertIterableEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
 import java.io.File;
 import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
 import java.util.UUID;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.apache.zookeeper.data.Stat;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
 
-public class ZKUtilTest {
+public class ZKUtilTest extends ClientBase {
 
     private static final File testData = new File(System.getProperty("test.data.dir", "build/test/data"));
 
-    @BeforeClass
+    @BeforeAll
     public static void init() {
         testData.mkdirs();
     }
@@ -67,14 +74,15 @@ public void testValidateFileInputDirectory() throws Exception {
         String absolutePath = file.getAbsolutePath();
         String error = ZKUtil.validateFileInput(absolutePath);
         assertNotNull(error);
-        String expectedMessage = "'" + absolutePath + "' is a direcory. it must be a file.";
+        String expectedMessage = "'" + absolutePath + "' is a directory. it must be a file.";
         assertEquals(expectedMessage, error);
     }
 
     @Test
     public void testUnreadableFileInput() throws Exception {
-        //skip this test on Windows, coverage on Linux
-        assumeTrue(!org.apache.zookeeper.Shell.WINDOWS);
+        //skip this test on Windows and WSL, coverage on Linux
+        assumeTrue("Skipping this test on Windows and WSL",
+                !(org.apache.zookeeper.Shell.WINDOWS || org.apache.zookeeper.Shell.isWsl()));
         File file = File.createTempFile("test", ".junit", testData);
         file.setReadable(false, false);
         file.deleteOnExit();
@@ -85,4 +93,81 @@ public void testUnreadableFileInput() throws Exception {
         assertEquals(expectedMessage, error);
     }
 
+    @Test
+    public void testListRootPathSuccess() throws IOException, InterruptedException, KeeperException {
+        TestableZooKeeper zk = createClient();
+        zk.setData("/", "some".getBytes(), -1);
+        zk.create("/a", "some".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk.create("/a/b", "some".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+        List<String> list = ZKUtil.listSubTreeBFS(zk, "/");
+        list.remove(Quotas.procZookeeper);
+        list.remove(Quotas.quotaZookeeper);
+        list.remove(ZooDefs.CONFIG_NODE);
+        assertEquals(3, list.size());
+        assertIterableEquals(Arrays.asList("/", "/a", "/a/b"), list);
+    }
+
+    @Test
+    public void testListNoneRootPathSuccess() throws IOException, InterruptedException, KeeperException {
+        TestableZooKeeper zk = createClient();
+        zk.setData("/", "some".getBytes(), -1);
+        zk.create("/a", "some".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk.create("/a/b", "some".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        List<String> aList = ZKUtil.listSubTreeBFS(zk, "/a");
+        assertEquals(2, aList.size());
+        assertIterableEquals(Arrays.asList("/a", "/a/b"), aList);
+
+        List<String> bList = ZKUtil.listSubTreeBFS(zk, "/a/b");
+        assertEquals(1, bList.size());
+        assertIterableEquals(Collections.singletonList("/a/b"), bList);
+    }
+
+    @Test
+    public void testDeleteRecursiveInAsyncMode() throws Exception {
+        int batchSize = 10;
+        testDeleteRecursiveInSyncAsyncMode(batchSize);
+    }
+
+    @Test
+    public void testDeleteRecursiveInSyncMode() throws Exception {
+        int batchSize = 0;
+        testDeleteRecursiveInSyncAsyncMode(batchSize);
+    }
+
+    // batchSize>0 is async mode otherwise it is sync mode
+    private void testDeleteRecursiveInSyncAsyncMode(int batchSize)
+        throws IOException, InterruptedException, KeeperException {
+        TestableZooKeeper zk = createClient();
+        String parentPath = "/a";
+        zk.create(parentPath, "".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        int numberOfNodes = 50;
+        List<Op> ops = new ArrayList<>();
+        for (int i = 0; i < numberOfNodes; i++) {
+            ops.add(Op.create(parentPath + "/a" + i, "".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE,
+                CreateMode.PERSISTENT));
+        }
+        zk.multi(ops);
+        ops.clear();
+
+        // check nodes create successfully
+        List<String> children = zk.getChildren(parentPath, false);
+        assertEquals(numberOfNodes, children.size());
+
+        // create one more level of z nodes
+        String subNode = "/a/a0";
+        for (int i = 0; i < numberOfNodes; i++) {
+            ops.add(Op.create(subNode + "/b" + i, "".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE,
+                CreateMode.PERSISTENT));
+        }
+        zk.multi(ops);
+
+        // check sub nodes created successfully
+        children = zk.getChildren(subNode, false);
+        assertEquals(numberOfNodes, children.size());
+
+        ZKUtil.deleteRecursive(zk, parentPath, batchSize);
+        Stat exists = zk.exists(parentPath, false);
+        assertNull(exists, "ZKUtil.deleteRecursive() could not delete all the z nodes");
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
index 4467a1ac471..973e8b75f03 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/ZooKeeperTest.java
@@ -18,11 +18,13 @@
 
 package org.apache.zookeeper;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.apache.zookeeper.KeeperException.Code.NOAUTH;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.PrintStream;
@@ -31,6 +33,7 @@
 import java.util.List;
 import java.util.concurrent.atomic.AtomicInteger;
 import org.apache.zookeeper.AsyncCallback.VoidCallback;
+import org.apache.zookeeper.KeeperException.Code;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.cli.CliCommand;
 import org.apache.zookeeper.cli.CliException;
@@ -39,16 +42,18 @@
 import org.apache.zookeeper.cli.MalformedCommandException;
 import org.apache.zookeeper.cli.MalformedPathException;
 import org.apache.zookeeper.cli.SyncCommand;
+import org.apache.zookeeper.cli.WhoAmICommand;
 import org.apache.zookeeper.client.ConnectStringParser;
 import org.apache.zookeeper.client.HostProvider;
 import org.apache.zookeeper.client.StaticHostProvider;
 import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.common.StringUtils;
 import org.apache.zookeeper.data.ACL;
+import org.apache.zookeeper.data.ClientInfo;
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 /**
  *
@@ -66,7 +71,7 @@ public void testDeleteRecursive() throws IOException, InterruptedException, Keep
 
         assertTrue(ZKUtil.deleteRecursive(zk, "/a/c", 1000));
         List<String> children = zk.getChildren("/a", false);
-        assertEquals("1 children - c should be deleted ", 1, children.size());
+        assertEquals(1, children.size(), "1 children - c should be deleted ");
         assertTrue(children.contains("b"));
 
         assertTrue(ZKUtil.deleteRecursive(zk, "/a", 1000));
@@ -89,12 +94,12 @@ public void testDeleteRecursiveFail() throws IOException, InterruptedException,
 
         assertFalse(ZKUtil.deleteRecursive(zk, "/a/c", 1000));
         List<String> children = zk.getChildren("/a", false);
-        assertEquals("2 children - c should fail to be deleted ", 2, children.size());
+        assertEquals(2, children.size(), "2 children - c should fail to be deleted ");
         assertTrue(children.contains("b"));
 
         assertTrue(ZKUtil.deleteRecursive(zk, "/a/b", 1000));
         children = zk.getChildren("/a", false);
-        assertEquals("1 children - b should be deleted ", 1, children.size());
+        assertEquals(1, children.size(), "1 children - b should be deleted ");
 
         // acquire immunity to poison
         zk.addAuthInfo(deleteProtection.getId().getScheme(), "user:test".getBytes());
@@ -125,7 +130,7 @@ private void setupDataTree(ZooKeeper zk) throws KeeperException, InterruptedExce
         }
         List<String> children = zk.getChildren("/a", false);
 
-        assertEquals("2 children - b & c should be present ", 2, children.size());
+        assertEquals(2, children.size(), "2 children - b & c should be present ");
         assertTrue(children.contains("b"));
         assertTrue(children.contains("c"));
     }
@@ -149,7 +154,7 @@ public void testDeleteRecursiveCli() throws IOException, InterruptedException, C
 
         List<String> children = zk.getChildren("/a", false);
 
-        assertEquals("2 children - b & c should be present ", children.size(), 2);
+        assertEquals(children.size(), 2, "2 children - b & c should be present ");
         assertTrue(children.contains("b"));
         assertTrue(children.contains("c"));
 
@@ -182,7 +187,7 @@ public void testDeleteRecursiveAsync() throws IOException, InterruptedException,
         }
         List<String> children = zk.getChildren("/a", false);
 
-        assertEquals("2 children - b & c should be present ", children.size(), 2);
+        assertEquals(children.size(), 2, "2 children - b & c should be present ");
         assertTrue(children.contains("b"));
         assertTrue(children.contains("c"));
 
@@ -225,9 +230,9 @@ public void testParseWithExtraSpaces() throws Exception {
         ZooKeeperMain zkMain = new ZooKeeperMain(zk);
         String cmdstring = "      ls       /  ";
         zkMain.cl.parseCommand(cmdstring);
-        assertEquals("Spaces also considered as characters", zkMain.cl.getNumArguments(), 2);
-        assertEquals("ls is not taken as first argument", zkMain.cl.getCmdArgument(0), "ls");
-        assertEquals("/ is not taken as second argument", zkMain.cl.getCmdArgument(1), "/");
+        assertEquals(zkMain.cl.getNumArguments(), 2, "Spaces also considered as characters");
+        assertEquals(zkMain.cl.getCmdArgument(0), "ls", "ls is not taken as first argument");
+        assertEquals(zkMain.cl.getCmdArgument(1), "/", "/ is not taken as second argument");
     }
 
     @Test
@@ -237,10 +242,10 @@ public void testParseWithQuotes() throws Exception {
         for (String quoteChar : new String[]{"'", "\""}) {
             String cmdstring = String.format("create /node %1$squoted data%1$s", quoteChar);
             zkMain.cl.parseCommand(cmdstring);
-            assertEquals("quotes combine arguments", zkMain.cl.getNumArguments(), 3);
-            assertEquals("create is not taken as first argument", zkMain.cl.getCmdArgument(0), "create");
-            assertEquals("/node is not taken as second argument", zkMain.cl.getCmdArgument(1), "/node");
-            assertEquals("quoted data is not taken as third argument", zkMain.cl.getCmdArgument(2), "quoted data");
+            assertEquals(zkMain.cl.getNumArguments(), 3, "quotes combine arguments");
+            assertEquals(zkMain.cl.getCmdArgument(0), "create", "create is not taken as first argument");
+            assertEquals(zkMain.cl.getCmdArgument(1), "/node", "/node is not taken as second argument");
+            assertEquals(zkMain.cl.getCmdArgument(2), "quoted data", "quoted data is not taken as third argument");
         }
     }
 
@@ -253,13 +258,11 @@ public void testParseWithMixedQuotes() throws Exception {
             String innerQuotes = quoteChars[1];
             String cmdstring = String.format("create /node %1$s%2$squoted data%2$s%1$s", outerQuotes, innerQuotes);
             zkMain.cl.parseCommand(cmdstring);
-            assertEquals("quotes combine arguments", zkMain.cl.getNumArguments(), 3);
-            assertEquals("create is not taken as first argument", zkMain.cl.getCmdArgument(0), "create");
-            assertEquals("/node is not taken as second argument", zkMain.cl.getCmdArgument(1), "/node");
-            assertEquals(
-                "quoted data is not taken as third argument",
-                zkMain.cl.getCmdArgument(2),
-                innerQuotes + "quoted data" + innerQuotes);
+            assertEquals(zkMain.cl.getNumArguments(), 3, "quotes combine arguments");
+            assertEquals(zkMain.cl.getCmdArgument(0), "create", "create is not taken as first argument");
+            assertEquals(zkMain.cl.getCmdArgument(1), "/node", "/node is not taken as second argument");
+            assertEquals(zkMain.cl.getCmdArgument(2), innerQuotes + "quoted data" + innerQuotes,
+                    "quoted data is not taken as third argument");
         }
     }
 
@@ -269,10 +272,10 @@ public void testParseWithEmptyQuotes() throws Exception {
         ZooKeeperMain zkMain = new ZooKeeperMain(zk);
         String cmdstring = "create /node ''";
         zkMain.cl.parseCommand(cmdstring);
-        assertEquals("empty quotes should produce arguments", zkMain.cl.getNumArguments(), 3);
-        assertEquals("create is not taken as first argument", zkMain.cl.getCmdArgument(0), "create");
-        assertEquals("/node is not taken as second argument", zkMain.cl.getCmdArgument(1), "/node");
-        assertEquals("empty string is not taken as third argument", zkMain.cl.getCmdArgument(2), "");
+        assertEquals(zkMain.cl.getNumArguments(), 3, "empty quotes should produce arguments");
+        assertEquals(zkMain.cl.getCmdArgument(0), "create", "create is not taken as first argument");
+        assertEquals(zkMain.cl.getCmdArgument(1), "/node", "/node is not taken as second argument");
+        assertEquals(zkMain.cl.getCmdArgument(2), "", "empty string is not taken as third argument");
     }
 
     @Test
@@ -281,15 +284,15 @@ public void testParseWithMultipleQuotes() throws Exception {
         ZooKeeperMain zkMain = new ZooKeeperMain(zk);
         String cmdstring = "create /node '' ''";
         zkMain.cl.parseCommand(cmdstring);
-        assertEquals("expected 5 arguments", zkMain.cl.getNumArguments(), 4);
-        assertEquals("create is not taken as first argument", zkMain.cl.getCmdArgument(0), "create");
-        assertEquals("/node is not taken as second argument", zkMain.cl.getCmdArgument(1), "/node");
-        assertEquals("empty string is not taken as third argument", zkMain.cl.getCmdArgument(2), "");
-        assertEquals("empty string is not taken as fourth argument", zkMain.cl.getCmdArgument(3), "");
+        assertEquals(zkMain.cl.getNumArguments(), 4, "expected 5 arguments");
+        assertEquals(zkMain.cl.getCmdArgument(0), "create", "create is not taken as first argument");
+        assertEquals(zkMain.cl.getCmdArgument(1), "/node", "/node is not taken as second argument");
+        assertEquals(zkMain.cl.getCmdArgument(2), "", "empty string is not taken as third argument");
+        assertEquals(zkMain.cl.getCmdArgument(3), "", "empty string is not taken as fourth argument");
     }
 
     @Test
-    public void testNonexistantCommand() throws Exception {
+    public void testNonexistentCommand() throws Exception {
         testInvalidCommand("cret -s /node1", 127);
     }
 
@@ -339,20 +342,20 @@ public void testCreateNodeWithoutData() throws Exception {
         // create persistent sequential node
         String cmdstring = "create -s /node ";
         zkMain.cl.parseCommand(cmdstring);
-        assertTrue("Doesn't create node without data", zkMain.processZKCmd(zkMain.cl));
+        assertTrue(zkMain.processZKCmd(zkMain.cl), "Doesn't create node without data");
         // create ephemeral node
         cmdstring = "create  -e /node ";
         zkMain.cl.parseCommand(cmdstring);
-        assertTrue("Doesn't create node without data", zkMain.processZKCmd(zkMain.cl));
+        assertTrue(zkMain.processZKCmd(zkMain.cl), "Doesn't create node without data");
         // create ephemeral sequential node
         cmdstring = "create -s -e /node ";
         zkMain.cl.parseCommand(cmdstring);
-        assertTrue("Doesn't create node without data", zkMain.processZKCmd(zkMain.cl));
+        assertTrue(zkMain.processZKCmd(zkMain.cl), "Doesn't create node without data");
         // creating ephemeral with wrong option.
         cmdstring = "create -s y /node";
         zkMain.cl.parseCommand(cmdstring);
         try {
-            assertTrue("Created node with wrong option", zkMain.processZKCmd(zkMain.cl));
+            assertTrue(zkMain.processZKCmd(zkMain.cl), "Created node with wrong option");
             fail("Created the node with wrong option should " + "throw Exception.");
         } catch (MalformedPathException e) {
             assertEquals("Path must start with / character", e.getMessage());
@@ -360,13 +363,13 @@ public void testCreateNodeWithoutData() throws Exception {
     }
 
     @Test
-    public void testACLWithExtraAgruments() throws Exception {
+    public void testACLWithExtraArguments() throws Exception {
         final ZooKeeper zk = createClient();
         ZooKeeperMain zkMain = new ZooKeeperMain(zk);
         // create persistent sequential node
         String cmdstring = "create -s /l data ip:10.18.52.144:cdrwa f g h";
         zkMain.cl.parseCommand(cmdstring);
-        assertTrue("Not considering the extra arguments after the acls.", zkMain.processZKCmd(zkMain.cl));
+        assertTrue(zkMain.processZKCmd(zkMain.cl), "Not considering the extra arguments after the acls.");
     }
 
     @Test
@@ -375,7 +378,7 @@ public void testCreatePersistentNode() throws Exception {
         ZooKeeperMain zkMain = new ZooKeeperMain(zk);
         String cmdstring = "create /node2";
         zkMain.cl.parseCommand(cmdstring);
-        assertTrue("Not creating Persistent node.", zkMain.processZKCmd(zkMain.cl));
+        assertTrue(zkMain.processZKCmd(zkMain.cl), "Not creating Persistent node.");
     }
 
     @Test
@@ -390,11 +393,11 @@ public void testDelete() throws Exception {
         zkMain.cl.parseCommand(cmdstring2);
         assertFalse(zkMain.processZKCmd(zkMain.cl));
         zkMain.cl.parseCommand(cmdstring3);
-        assertFalse("", zkMain.processCmd(zkMain.cl));
+        assertFalse(zkMain.processCmd(zkMain.cl), "");
     }
 
     @Test
-    public void testDeleteNonexistantNode() throws Exception {
+    public void testDeleteNonexistentNode() throws Exception {
         testInvalidCommand("delete /blahblahblah", 1);
     }
 
@@ -498,15 +501,20 @@ public void testRedoWithNegativeCmdNumber() throws Exception {
         final ZooKeeper zk = createClient();
         ZooKeeperMain zkMain = new ZooKeeperMain(zk);
         String cmd1 = "redo -1";
+        String result = executeLine(zkMain, cmd1);
+        assertEquals("Command index out of range", result);
+    }
 
+    private String executeLine(ZooKeeperMain zkMain, String cmd)
+        throws InterruptedException, IOException {
         // setup redirect out/err streams to get System.in/err, use this
         // judiciously!
         final PrintStream systemErr = System.err; // get current err
         final ByteArrayOutputStream errContent = new ByteArrayOutputStream();
         System.setErr(new PrintStream(errContent));
         try {
-            zkMain.executeLine(cmd1);
-            assertEquals("Command index out of range", errContent.toString().trim());
+            zkMain.executeLine(cmd);
+            return errContent.toString().trim();
         } finally {
             // revert redirect of out/err streams - important step!
             System.setErr(systemErr);
@@ -514,14 +522,18 @@ public void testRedoWithNegativeCmdNumber() throws Exception {
     }
 
     private static void runCommandExpect(CliCommand command, List<String> expectedResults) throws Exception {
+        String result = runCommandExpect(command);
+        assertTrue(result.contains(StringUtils.joinStrings(expectedResults, LINE_SEPARATOR)), result);
+    }
+
+    private static String runCommandExpect(CliCommand command) throws CliException {
         // call command and put result in byteStream
         ByteArrayOutputStream byteStream = new ByteArrayOutputStream();
         PrintStream out = new PrintStream(byteStream);
         command.setOut(out);
         command.exec();
 
-        String result = byteStream.toString();
-        assertTrue(result, result.contains(StringUtils.joinStrings(expectedResults, LINE_SEPARATOR)));
+        return byteStream.toString();
     }
 
     @Test
@@ -538,7 +550,7 @@ public void testSortedLs() throws Exception {
         LsCommand cmd = new LsCommand();
         cmd.setZk(zk);
         cmd.parse("ls /".split(" "));
-        List<String> expected = new ArrayList<String>();
+        List<String> expected = new ArrayList<>();
         expected.add("[aa1, aa2, aa3, test1, zk1, zookeeper]");
         runCommandExpect(cmd, expected);
     }
@@ -559,7 +571,7 @@ public void testLsrCommand() throws Exception {
         cmd.setZk(zk);
         cmd.parse("ls -R /a".split(" "));
 
-        List<String> expected = new ArrayList<String>();
+        List<String> expected = new ArrayList<>();
         expected.add("/a");
         expected.add("/a/b");
         expected.add("/a/c");
@@ -578,7 +590,7 @@ public void testLsrRootCommand() throws Exception {
         cmd.setZk(zk);
         cmd.parse("ls -R /".split(" "));
 
-        List<String> expected = new ArrayList<String>();
+        List<String> expected = new ArrayList<>();
         expected.add("/");
         expected.add("/zookeeper");
         runCommandExpect(cmd, expected);
@@ -596,13 +608,13 @@ public void testLsrLeafCommand() throws Exception {
         cmd.setZk(zk);
         cmd.parse("ls -R /b/c".split(" "));
 
-        List<String> expected = new ArrayList<String>();
+        List<String> expected = new ArrayList<>();
         expected.add("/b/c");
         runCommandExpect(cmd, expected);
     }
 
     @Test
-    public void testLsrNonexistantZnodeCommand() throws Exception {
+    public void testLsrNonexistentZnodeCommand() throws Exception {
         final ZooKeeper zk = createClient();
         ZooKeeperMain zkMain = new ZooKeeperMain(zk);
 
@@ -614,7 +626,7 @@ public void testLsrNonexistantZnodeCommand() throws Exception {
         cmd.parse("ls -R /b/c/d".split(" "));
 
         try {
-            runCommandExpect(cmd, new ArrayList<String>());
+            runCommandExpect(cmd, new ArrayList<>());
             fail("Path doesn't exists so, command should fail.");
         } catch (CliWrapperException e) {
             assertEquals(KeeperException.Code.NONODE, ((KeeperException) e.getCause()).code());
@@ -666,7 +678,7 @@ public void testClientReconnectWithZKClientConfig() throws Exception {
                 aHostProvider,
                 clientConfig);
             watcher.waitForConnected(CONNECTION_TIMEOUT);
-            assertEquals("Old client session id and new clinet session id must be same", zk.getSessionId(), newZKClient.getSessionId());
+            assertEquals(zk.getSessionId(), newZKClient.getSessionId(), "Old client session id and new client session id must be same");
         } finally {
             zk.close();
             newZKClient.close();
@@ -679,10 +691,128 @@ public void testSyncCommand() throws Exception {
         SyncCommand cmd = new SyncCommand();
         cmd.setZk(zk);
         cmd.parse("sync /".split(" "));
-        List<String> expected = new ArrayList<String>();
+        List<String> expected = new ArrayList<>();
         expected.add("Sync is OK");
 
         runCommandExpect(cmd, expected);
     }
 
+    @Test
+    public void testInsufficientPermission() throws Exception {
+        final ZooKeeper zk = createClient();
+        zk.create("/permZNode", "".getBytes(), Ids.READ_ACL_UNSAFE, CreateMode.PERSISTENT);
+        ZooKeeperMain zkMain = new ZooKeeperMain(zk);
+        String zNodeToBeCreated = "/permZNode/child1";
+        String errorMessage = executeLine(zkMain, "create " + zNodeToBeCreated);
+        assertEquals("Insufficient permission : " + zNodeToBeCreated, errorMessage);
+
+        // Test Get command error message when there is not read access
+        List<ACL> writeAcl = Arrays.asList(new ACL(ZooDefs.Perms.WRITE, Ids.ANYONE_ID_UNSAFE));
+        String noReadPermZNodePath = "/noReadPermZNode";
+        zk.create(noReadPermZNodePath, "newData".getBytes(), writeAcl, CreateMode.PERSISTENT);
+        errorMessage = executeLine(zkMain, "get " + noReadPermZNodePath);
+        assertEquals("Insufficient permission : " + noReadPermZNodePath, errorMessage);
+    }
+
+    @Test
+    public void testWhoAmIAPI() throws Exception {
+        final ZooKeeper zk = createClient();
+
+        // Check who ami without authentication/without any user into the session
+        List<ClientInfo> clientInfos = zk.whoAmI();
+        // By default server adds ip as the authentication info
+        assertEquals(1, clientInfos.size());
+        assertEquals("ip", clientInfos.get(0).getAuthScheme());
+
+        // Add one user into the session
+        zk.addAuthInfo("digest", "user1:abcXYZ".getBytes());
+        clientInfos = zk.whoAmI();
+        assertEquals(2, clientInfos.size());
+        ClientInfo user1 = getClientInfos(clientInfos, "user1");
+        assertEquals("digest", user1.getAuthScheme());
+
+        // Add one more user into the session
+        zk.addAuthInfo("digest", "user2:xyzABC".getBytes());
+        clientInfos = zk.whoAmI();
+        assertEquals(3, clientInfos.size());
+        user1 = getClientInfos(clientInfos, "user1");
+        assertEquals("digest", user1.getAuthScheme());
+        ClientInfo user2 = getClientInfos(clientInfos, "user2");
+        assertEquals("digest", user2.getAuthScheme());
+    }
+
+    private ClientInfo getClientInfos(List<ClientInfo> clientInfos, String user) {
+        for (ClientInfo clientInfo : clientInfos) {
+            if (clientInfo.getUser().equals(user)) {
+                return clientInfo;
+            }
+        }
+        throw new AssertionError("User +" + user + " not found");
+    }
+
+    @Test
+    public void testWhoAmICLICommand() throws Exception {
+        final ZooKeeper zk = createClient();
+        WhoAmICommand cmd = new WhoAmICommand();
+        cmd.setZk(zk);
+        List<String> expectedResults = new ArrayList<>();
+        expectedResults.add("Auth scheme: User");
+        expectedResults.add("ip: 127.0.0.1");
+
+        // Check who ami without authentication/without any user into the session
+        cmd.parse(new String[] { "whoami" });
+        String actualResult = runCommandExpect(cmd);
+        assertClientAuthInfo(expectedResults, actualResult);
+
+        // Add one user into the session
+        zk.addAuthInfo("digest", "user1:abcXYZ".getBytes());
+        expectedResults.add("digest: user1");
+        actualResult = runCommandExpect(cmd);
+        assertClientAuthInfo(expectedResults, actualResult);
+
+        // Add one more user into the session
+        zk.addAuthInfo("digest", "user2:xyzABC".getBytes());
+        expectedResults.add("digest: user2");
+        actualResult = runCommandExpect(cmd);
+        assertClientAuthInfo(expectedResults, actualResult);
+    }
+
+    private void assertClientAuthInfo(List<String> expected, String actual) {
+        expected.forEach(s -> {
+            assertTrue(actual.contains(s),
+                "Expected result part '" + s + "' not present in actual result '" + actual + "' ");
+        });
+    }
+
+    @Test
+    public void testWaitForConnection() throws Exception {
+        // get a wrong port number
+        int invalidPort = PortAssignment.unique();
+        long timeout = 3000L; // millisecond
+        String[] args1 = {"-server", "localhost:" + invalidPort, "-timeout",
+                Long.toString(timeout), "-waitforconnection", "ls", "/"};
+        long startTime = System.currentTimeMillis();
+        // try to connect to a non-existing server so as to wait until wait_timeout
+        try {
+            ZooKeeperMain zkMain = new ZooKeeperMain(args1);
+            fail("IOException was expected");
+        } catch (IOException e) {
+            // do nothing
+        }
+        long endTime = System.currentTimeMillis();
+        assertTrue(endTime - startTime >= timeout,
+                "ZooKeeperMain does not wait until the specified timeout");
+
+    }
+
+    @Test
+    public void testKeeperExceptionCreateNPE() {
+        // One existing code
+        KeeperException k1 = KeeperException.create(Code.get(NOAUTH.intValue()));
+        assertTrue(k1 instanceof KeeperException.NoAuthException);
+
+        // One impossible code
+        assertThrows(IllegalArgumentException.class, () -> KeeperException.create(Code.get(Integer.MAX_VALUE)));
+    }
+
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/audit/AuditEventTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/audit/AuditEventTest.java
index 02d9ac0bb85..faa872ae6f0 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/audit/AuditEventTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/audit/AuditEventTest.java
@@ -17,9 +17,9 @@
  */
 package org.apache.zookeeper.audit;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import org.apache.zookeeper.audit.AuditEvent.Result;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class AuditEventTest {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/audit/Log4jAuditLoggerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/audit/Slf4JAuditLoggerTest.java
similarity index 85%
rename from zookeeper-server/src/test/java/org/apache/zookeeper/audit/Log4jAuditLoggerTest.java
rename to zookeeper-server/src/test/java/org/apache/zookeeper/audit/Slf4JAuditLoggerTest.java
index 0c408110a17..caad6ad3bcb 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/audit/Log4jAuditLoggerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/audit/Slf4JAuditLoggerTest.java
@@ -18,7 +18,8 @@
 package org.apache.zookeeper.audit;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.LineNumberReader;
@@ -27,11 +28,6 @@
 import java.net.InetSocketAddress;
 import java.util.ArrayList;
 import java.util.List;
-import org.apache.log4j.Layout;
-import org.apache.log4j.Level;
-import org.apache.log4j.Logger;
-import org.apache.log4j.SimpleLayout;
-import org.apache.log4j.WriterAppender;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.KeeperException.Code;
@@ -43,38 +39,34 @@
 import org.apache.zookeeper.audit.AuditEvent.Result;
 import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Stat;
-import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.ServerCnxn;
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
+import org.apache.zookeeper.server.util.AuthUtil;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.AfterClass;
-import org.junit.Assert;
-import org.junit.Before;
-import org.junit.BeforeClass;
-import org.junit.Test;
-
-
-public class Log4jAuditLoggerTest extends QuorumPeerTestBase {
-    private static final Logger LOG = Logger.getLogger(Log4jAuditLoggerTest.class);
+import org.apache.zookeeper.test.LoggerTestTool;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class Slf4JAuditLoggerTest extends QuorumPeerTestBase {
+    private static final Logger LOG = LoggerFactory.getLogger(Slf4JAuditLoggerTest.class);
     private static int SERVER_COUNT = 3;
     private static MainThread[] mt;
     private static ZooKeeper zk;
-    private static Logger zlogger;
-    private static WriterAppender appender;
     private static ByteArrayOutputStream os;
 
-    @BeforeClass
+    @BeforeAll
     public static void setUpBeforeClass() throws Exception {
         System.setProperty(ZKAuditProvider.AUDIT_ENABLE, "true");
+        System.setProperty("zookeeper.extendedTypesEnabled", "true");
         // setup the logger to capture all logs
-        Layout layout = new SimpleLayout();
-        os = new ByteArrayOutputStream();
-        appender = new WriterAppender(layout, os);
-        appender.setImmediateFlush(true);
-        appender.setThreshold(Level.INFO);
-        zlogger = Logger.getLogger(Log4jAuditLogger.class);
-        zlogger.addAppender(appender);
+        LoggerTestTool loggerTestTool = new LoggerTestTool(Slf4jAuditLogger.class);
+        os = loggerTestTool.getOutputStream();
         mt = startQuorum();
         zk = ClientBase.createZKClient("127.0.0.1:" + mt[0].getQuorumPeer().getClientPort());
         //Verify start audit log here itself
@@ -83,7 +75,7 @@ public static void setUpBeforeClass() throws Exception {
         verifyLogs(expectedAuditLog, logs);
     }
 
-    @Before
+    @BeforeEach
     public void setUp() {
         os.reset();
     }
@@ -112,6 +104,32 @@ public void testCreateAuditLogs()
                         null, createMode), readAuditLog(os));
     }
 
+    @Test
+    public void testCreateWithTtlAuditLogs()
+            throws KeeperException, InterruptedException, IOException {
+        final CreateMode createMode = CreateMode.PERSISTENT_WITH_TTL;
+        final String path = "/createTtlPath";
+        zk.create(path, "".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE,
+                createMode, null, 3600);
+        // success log
+        verifyLog(
+                getAuditLog(AuditConstants.OP_CREATE, path, Result.SUCCESS,
+                        null, createMode.toString().toLowerCase()), readAuditLog(os));
+    }
+
+    @Test
+    public void testCreateSeqWithTtlAuditLogs()
+            throws KeeperException, InterruptedException, IOException {
+        final CreateMode createMode = CreateMode.PERSISTENT_SEQUENTIAL_WITH_TTL;
+        String path = "/createTtlPath";
+        path = zk.create(path, "".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE,
+                createMode, null, 3600);
+        // success log
+        verifyLog(
+                getAuditLog(AuditConstants.OP_CREATE, path, Result.SUCCESS,
+                        null, createMode.toString().toLowerCase()), readAuditLog(os));
+    }
+
     @Test
     public void testDeleteAuditLogs()
             throws InterruptedException, IOException, KeeperException {
@@ -299,9 +317,7 @@ private String getSession() {
 
     private String getUser() {
         ServerCnxn next = getServerCnxn();
-        Request request = new Request(next, -1, -1, -1, null,
-                next.getAuthInfo());
-        return request.getUsers();
+        return AuthUtil.getUsers(next.getAuthInfo());
     }
 
     private String getIp() {
@@ -322,8 +338,7 @@ private static void verifyLog(String expectedLog, String log) {
         String searchString = " - ";
         int logStartIndex = log.indexOf(searchString);
         String auditLog = log.substring(logStartIndex + searchString.length());
-        assertEquals(expectedLog, auditLog);
-
+        assertTrue(auditLog.endsWith(expectedLog));
     }
 
     private static void verifyLogs(String expectedLog, List<String> logs) {
@@ -357,10 +372,9 @@ private static List<String> readAuditLog(ByteArrayOutputStream os,
             logs.add(line);
         }
         os.reset();
-        assertEquals(
+        assertEquals(numberOfLogEntry, logs.size(),
                 "Expected number of log entries are not generated. Logs are "
-                        + logs,
-                numberOfLogEntry, logs.size());
+                        + logs);
         return logs;
 
     }
@@ -393,9 +407,8 @@ private static MainThread[] startQuorum() throws IOException {
 
         // ensure all servers started
         for (int i = 0; i < SERVER_COUNT; i++) {
-            Assert.assertTrue("waiting for server " + i + " being up",
-                    ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i],
-                            CONNECTION_TIMEOUT));
+            Assertions.assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i],
+                    CONNECTION_TIMEOUT), "waiting for server " + i + " being up");
         }
         return mt;
     }
@@ -410,17 +423,17 @@ private void waitForDeletion(ZooKeeper zooKeeper, String path)
             try {
                 Thread.sleep(waitInterval);
             } catch (InterruptedException e) {
-                Assert.fail("CurrentEpoch update failed");
+                Assertions.fail("CurrentEpoch update failed");
             }
             elapsedTime = elapsedTime + waitInterval;
             exists = zooKeeper.exists(path, false);
         }
-        Assert.assertNull("Node " + path + " not deleted in " + timeout + " ms",
-                exists);
+        Assertions.assertNull(exists, "Node " + path + " not deleted in " + timeout + " ms");
     }
 
-    @AfterClass
+    @AfterAll
     public static void tearDownAfterClass() {
+        System.clearProperty("zookeeper.extendedTypesEnabled");
         System.clearProperty(ZKAuditProvider.AUDIT_ENABLE);
         for (int i = 0; i < SERVER_COUNT; i++) {
             try {
@@ -431,12 +444,5 @@ public static void tearDownAfterClass() {
                 e.printStackTrace();
             }
         }
-        try {
-            zlogger.removeAppender(appender);
-            os.close();
-        } catch (IOException e) {
-            e.printStackTrace();
-        }
     }
-
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/audit/StandaloneServerAuditTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/audit/StandaloneServerAuditTest.java
index 7aed4c6ff42..8cadf3e1ee7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/audit/StandaloneServerAuditTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/audit/StandaloneServerAuditTest.java
@@ -18,48 +18,35 @@
 
 package org.apache.zookeeper.audit;
 
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.LineNumberReader;
 import java.io.StringReader;
 import java.util.ArrayList;
 import java.util.List;
-import org.apache.log4j.Layout;
-import org.apache.log4j.Level;
-import org.apache.log4j.Logger;
-import org.apache.log4j.SimpleLayout;
-import org.apache.log4j.WriterAppender;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.AfterClass;
-import org.junit.BeforeClass;
-import org.junit.Test;
-
-
+import org.apache.zookeeper.test.LoggerTestTool;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
 
 public class StandaloneServerAuditTest extends ClientBase {
     private static ByteArrayOutputStream os;
 
-    @BeforeClass
+    @BeforeAll
     public static void setup() {
         System.setProperty(ZKAuditProvider.AUDIT_ENABLE, "true");
-        // setup the logger to capture all the logs
-        Layout layout = new SimpleLayout();
-        os = new ByteArrayOutputStream();
-        WriterAppender appender = new WriterAppender(layout, os);
-        appender.setImmediateFlush(true);
-        appender.setThreshold(Level.INFO);
-        Logger zLogger = Logger.getLogger(Log4jAuditLogger.class);
-        zLogger.addAppender(appender);
+        LoggerTestTool loggerTestTool = new LoggerTestTool(Slf4jAuditLogger.class);
+        os = loggerTestTool.getOutputStream();
     }
 
-    @AfterClass
+    @AfterAll
     public static void teardown() {
         System.clearProperty(ZKAuditProvider.AUDIT_ENABLE);
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/cli/CommandFactoryTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/cli/CommandFactoryTest.java
new file mode 100644
index 00000000000..2173514d368
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/cli/CommandFactoryTest.java
@@ -0,0 +1,38 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.cli;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import org.junit.jupiter.api.Test;
+
+/**
+ * Unit test for {@link CommandFactory}.
+ */
+public class CommandFactoryTest {
+
+    /**
+     * Verify that the {@code CommandFactory} can create a command instance.
+     */
+    @Test
+    public void testCommandCreation() {
+        CliCommand cliCommand =
+                CommandFactory.getInstance(CommandFactory.Command.CREATE);
+        assertTrue(cliCommand instanceof CreateCommand);
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/client/DnsSrvHostProviderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/client/DnsSrvHostProviderTest.java
new file mode 100644
index 00000000000..136b6e47ac4
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/client/DnsSrvHostProviderTest.java
@@ -0,0 +1,214 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.client;
+
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+import java.net.InetSocketAddress;
+import java.util.HashSet;
+import java.util.Set;
+import org.apache.zookeeper.client.DnsSrvHostProvider.DnsSrvResolver;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.xbill.DNS.Name;
+import org.xbill.DNS.SRVRecord;
+
+public class DnsSrvHostProviderTest {
+
+    private static final String TEST_DNS_NAME = "_zookeeper._tcp.example.com.";
+    private static final long TEST_SEED = 12345L;
+
+    private DnsSrvResolver mockDnsSrvResolver;
+
+    @BeforeEach
+    public void setUp() {
+        mockDnsSrvResolver = mock(DnsSrvResolver.class);
+    }
+
+    @AfterEach
+    public void tearDown() {
+        System.clearProperty(ZKClientConfig.DNS_SRV_REFRESH_INTERVAL_SECONDS);
+    }
+
+    @Test
+    public void testBasic() throws Exception {
+        final SRVRecord[] srvRecords = createMockSrvRecords();
+        when(mockDnsSrvResolver.lookupSrvRecords(TEST_DNS_NAME)).thenReturn(srvRecords);
+
+        try (final DnsSrvHostProvider hostProvider = new DnsSrvHostProvider(TEST_DNS_NAME, TEST_SEED, mockDnsSrvResolver, null)) {
+            assertEquals(3, hostProvider.size());
+            assertNotNull(hostProvider.next(0));
+        }
+    }
+
+    @Test
+    public void testServerIteration() throws Exception {
+        final SRVRecord[] srvRecords = createMockSrvRecords();
+        when(mockDnsSrvResolver.lookupSrvRecords(TEST_DNS_NAME)).thenReturn(srvRecords);
+
+        try (final DnsSrvHostProvider hostProvider = new DnsSrvHostProvider(TEST_DNS_NAME, TEST_SEED, mockDnsSrvResolver, null)) {
+            final InetSocketAddress addr1 = hostProvider.next(0);
+            final InetSocketAddress addr2 = hostProvider.next(0);
+            final InetSocketAddress addr3 = hostProvider.next(0);
+
+            final Set<InetSocketAddress> actualAddresses = new HashSet<>();
+            actualAddresses.add(addr1);
+            actualAddresses.add(addr2);
+            actualAddresses.add(addr3);
+
+            final Set<InetSocketAddress> expectedAddresses = new HashSet<>();
+            expectedAddresses.add(new InetSocketAddress("server1.example.com", 2181));
+            expectedAddresses.add(new InetSocketAddress("server2.example.com", 2181));
+            expectedAddresses.add(new InetSocketAddress("server3.example.com", 2181));
+
+            assertEquals(expectedAddresses, actualAddresses);
+
+            // cycle back
+            final InetSocketAddress addr4 = hostProvider.next(0);
+            assertTrue(expectedAddresses.contains(addr4));
+        }
+    }
+
+    @Test
+    public void testEmptyDnsName() {
+        assertThrows(IllegalArgumentException.class,
+            () -> new DnsSrvHostProvider("", TEST_SEED, mockDnsSrvResolver, null));
+
+        assertThrows(IllegalArgumentException.class,
+            () -> new DnsSrvHostProvider(null, TEST_SEED, mockDnsSrvResolver, null));
+
+        assertThrows(IllegalArgumentException.class,
+            () -> new DnsSrvHostProvider("   ", TEST_SEED, mockDnsSrvResolver, null));
+    }
+
+    @Test
+    public void testNoSrvRecords() throws Exception {
+        when(mockDnsSrvResolver.lookupSrvRecords(TEST_DNS_NAME)).thenReturn(new SRVRecord[0]);
+
+        assertThrows(IllegalArgumentException.class,
+            () -> new DnsSrvHostProvider(TEST_DNS_NAME, TEST_SEED, mockDnsSrvResolver, null));
+    }
+
+    @Test
+    public void testDnsLookupFailure() throws Exception {
+        when(mockDnsSrvResolver.lookupSrvRecords(TEST_DNS_NAME))
+                .thenThrow(new java.io.IOException("DNS lookup failed"));
+
+        assertThrows(IllegalArgumentException.class,
+                () -> new DnsSrvHostProvider(TEST_DNS_NAME, TEST_SEED, mockDnsSrvResolver, null));
+    }
+
+    @Test
+    public void testInvalidPortFiltering() throws Exception {
+        // Create SRV record with invalid port (0)
+        final SRVRecord invalidPortRecord = createMockSrvRecord("server1.example.com.", 0);
+        final SRVRecord[] srvRecords = new SRVRecord[]{invalidPortRecord};
+
+        when(mockDnsSrvResolver.lookupSrvRecords(TEST_DNS_NAME)).thenReturn(srvRecords);
+
+        assertThrows(IllegalArgumentException.class,
+            () -> new DnsSrvHostProvider(TEST_DNS_NAME, TEST_SEED, mockDnsSrvResolver, null));
+    }
+
+    @Test
+    public void testTrailingDotRemoval() throws Exception {
+        final SRVRecord recordWithDot = createMockSrvRecord("server1.example.com.", 2181);
+        final SRVRecord[] srvRecords = new SRVRecord[]{recordWithDot};
+
+        when(mockDnsSrvResolver.lookupSrvRecords(TEST_DNS_NAME)).thenReturn(srvRecords);
+
+        try (final DnsSrvHostProvider hostProvider = new DnsSrvHostProvider(TEST_DNS_NAME, TEST_SEED, mockDnsSrvResolver, null)) {
+            assertEquals(1, hostProvider.size());
+            final InetSocketAddress addr = hostProvider.next(0);
+
+            // validate trailing dot is removed
+            assertEquals("server1.example.com", addr.getHostString());
+        }
+    }
+
+    @Test
+    public void testRefreshIntervalZeroDisablesPeriodicRefresh() throws Exception {
+        // Set system property to disable refresh
+        System.setProperty(ZKClientConfig.DNS_SRV_REFRESH_INTERVAL_SECONDS, "0");
+
+        final SRVRecord[] srvRecords = createMockSrvRecords();
+        when(mockDnsSrvResolver.lookupSrvRecords(TEST_DNS_NAME)).thenReturn(srvRecords);
+
+        try (final DnsSrvHostProvider hostProvider = new DnsSrvHostProvider(TEST_DNS_NAME, TEST_SEED, mockDnsSrvResolver, null)) {
+            // Verify initial setup works
+            assertEquals(3, hostProvider.size());
+
+            // Wait to ensure no background refresh occurs
+            Thread.sleep(1000);
+
+            // Verify DNS resolver was only called once during initialization (no periodic refresh)
+            verify(mockDnsSrvResolver, times(1)).lookupSrvRecords(TEST_DNS_NAME);
+
+            // Verify host provider still works normally
+            assertNotNull(hostProvider.next(0));
+
+            // Test multiple next() calls to ensure functionality is not affected
+            for (int i = 0; i < 5; i++) {
+                assertNotNull(hostProvider.next(0));
+            }
+
+            // Verify no additional DNS calls were made
+            verify(mockDnsSrvResolver, times(1)).lookupSrvRecords(TEST_DNS_NAME);
+        }
+    }
+
+    @Test
+    public void testRefreshIntervalNegative() throws Exception {
+        System.setProperty(ZKClientConfig.DNS_SRV_REFRESH_INTERVAL_SECONDS, "-1");
+
+        final SRVRecord[] srvRecords = createMockSrvRecords();
+        when(mockDnsSrvResolver.lookupSrvRecords(TEST_DNS_NAME)).thenReturn(srvRecords);
+
+        final IllegalArgumentException exception = assertThrows(IllegalArgumentException.class,
+                () -> new DnsSrvHostProvider(TEST_DNS_NAME, TEST_SEED, mockDnsSrvResolver, null));
+
+        assertEquals("Invalid DNS SRV refresh interval: -1", exception.getMessage());
+    }
+
+    private SRVRecord[] createMockSrvRecords() {
+        return new SRVRecord[]{
+            createMockSrvRecord("server1.example.com.", 2181),
+            createMockSrvRecord("server2.example.com.", 2181),
+            createMockSrvRecord("server3.example.com.", 2181)
+        };
+    }
+
+    private SRVRecord createMockSrvRecord(final String target, final int port) {
+        try {
+            final Name targetName = Name.fromString(target);
+            final Name serviceName = Name.fromString(TEST_DNS_NAME);
+            return new SRVRecord(serviceName, 1, 300, 1, 1, port, targetName);
+        } catch (final Exception e) {
+            throw new RuntimeException("Failed to create mock SRV record", e);
+        }
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZKClientConfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZKClientConfigTest.java
index 9a9b6223e00..95846b467a3 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZKClientConfigTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZKClientConfigTest.java
@@ -25,39 +25,28 @@
 import static org.apache.zookeeper.client.ZKClientConfig.ZK_SASL_CLIENT_USERNAME;
 import static org.apache.zookeeper.client.ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET;
 import static org.apache.zookeeper.client.ZKClientConfig.ZOOKEEPER_SERVER_REALM;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.OutputStream;
+import java.nio.file.Paths;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Properties;
-import java.util.concurrent.TimeUnit;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.common.ZKConfig;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
-import org.junit.BeforeClass;
-import org.junit.Rule;
-import org.junit.Test;
-import org.junit.rules.Timeout;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
+import org.junit.jupiter.api.io.TempDir;
 
 public class ZKClientConfigTest {
 
-    private static final File testData = new File(System.getProperty("test.data.dir", "src/test/resources/data"));
-    @Rule
-    public Timeout timeout = new Timeout(10, TimeUnit.SECONDS);
-
-    @BeforeClass
-    public static void init() {
-        if (!testData.exists()) {
-            testData.mkdirs();
-        }
-    }
-
     @Test
+    @Timeout(value = 10)
     public void testDefaultConfiguration() {
         Map<String, String> properties = new HashMap<>();
         properties.put(ZK_SASL_CLIENT_USERNAME, "zookeeper1");
@@ -96,6 +85,7 @@ public void testDefaultConfiguration() {
     }
 
     @Test
+    @Timeout(value = 10)
     public void testSystemPropertyValue() {
         String clientName = "zookeeper1";
         System.setProperty(ZK_SASL_CLIENT_USERNAME, clientName);
@@ -110,9 +100,9 @@ public void testSystemPropertyValue() {
     }
 
     @Test
-    public void testReadConfigurationFile() throws IOException, ConfigException {
-        File file = File.createTempFile("clientConfig", ".conf", testData);
-        file.deleteOnExit();
+    @Timeout(value = 10)
+    public void testReadConfigurationFile(@TempDir File testDataDir) throws IOException, ConfigException {
+        File file = File.createTempFile("clientConfig", ".conf", testDataDir);
         Properties clientConfProp = new Properties();
         clientConfProp.setProperty(ENABLE_CLIENT_SASL_KEY, "true");
         clientConfProp.setProperty(ZK_SASL_CLIENT_USERNAME, "ZK");
@@ -127,20 +117,16 @@ public void testReadConfigurationFile() throws IOException, ConfigException {
         }
 
         ZKClientConfig conf = new ZKClientConfig();
-        conf.addConfiguration(file.getAbsolutePath());
+        conf.addConfiguration(Paths.get(file.getAbsolutePath()));
         assertEquals(conf.getProperty(ENABLE_CLIENT_SASL_KEY), "true");
         assertEquals(conf.getProperty(ZK_SASL_CLIENT_USERNAME), "ZK");
         assertEquals(conf.getProperty(LOGIN_CONTEXT_NAME_KEY), "MyClient");
         assertEquals(conf.getProperty(ZOOKEEPER_SERVER_REALM), "HADOOP.COM");
         assertEquals(conf.getProperty("dummyProperty"), "dummyValue");
-
-        // try to delete it now as we have done with the created file, why to
-        // wait for deleteOnExit() deletion
-        file.delete();
-
     }
 
     @Test
+    @Timeout(value = 10)
     public void testSetConfiguration() {
         ZKClientConfig conf = new ZKClientConfig();
         String defaultValue = conf.getProperty(ZKClientConfig.ENABLE_CLIENT_SASL_KEY, ZKClientConfig.ENABLE_CLIENT_SASL_DEFAULT);
@@ -153,6 +139,7 @@ public void testSetConfiguration() {
     }
 
     @Test
+    @Timeout(value = 10)
     public void testIntegerRetrievalFromProperty() {
         ZKClientConfig conf = new ZKClientConfig();
         String prop = "UnSetProperty" + System.currentTimeMillis();
@@ -163,7 +150,7 @@ public void testIntegerRetrievalFromProperty() {
 
         // property is set but can not be parsed to int, we should get the
         // NumberFormatException
-        conf.setProperty(ZKConfig.JUTE_MAXBUFFER, "InvlaidIntValue123");
+        conf.setProperty(ZKConfig.JUTE_MAXBUFFER, "InvalidIntValue123");
         try {
             result = conf.getInt(ZKConfig.JUTE_MAXBUFFER, defaultValue);
             fail("NumberFormatException is expected");
@@ -186,6 +173,7 @@ public void testIntegerRetrievalFromProperty() {
     }
 
     @Test
+    @Timeout(value = 10)
     public void testIntegerRetrievalFromHexadecimalProperty() {
         int hexaValue = 0x3000000;
         String wrongValue = "0xwel";
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZooKeeperBuilderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZooKeeperBuilderTest.java
new file mode 100644
index 00000000000..0a7b4aae50b
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/client/ZooKeeperBuilderTest.java
@@ -0,0 +1,88 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.client;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import java.time.Duration;
+import java.util.concurrent.BlockingQueue;
+import java.util.concurrent.LinkedBlockingQueue;
+import java.util.concurrent.TimeUnit;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.WatchedEvent;
+import org.apache.zookeeper.Watcher;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.admin.ZooKeeperAdmin;
+import org.apache.zookeeper.common.Time;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.Test;
+
+public class ZooKeeperBuilderTest extends ClientBase {
+    private void testClient(BlockingQueue<WatchedEvent> events, ZooKeeper zk) throws Exception {
+        zk.exists("/test", true);
+        zk.create("/test", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        Thread.sleep(100);
+        zk.close();
+
+        WatchedEvent connected = events.poll(10, TimeUnit.SECONDS);
+        assertNotNull(connected);
+        assertEquals(Watcher.Event.EventType.None, connected.getType());
+        assertEquals(Watcher.Event.KeeperState.SyncConnected, connected.getState());
+
+        WatchedEvent created = events.poll(10, TimeUnit.SECONDS);
+        assertNotNull(created);
+        assertEquals(Watcher.Event.EventType.NodeCreated, created.getType());
+        assertEquals("/test", created.getPath());
+
+        // A sleep(100) before disconnect approve that events receiving in closing is indeterminate,
+        // but the last should be closed. See ZOOKEEPER-4702.
+        WatchedEvent closed = null;
+        long timeoutMs = TimeUnit.SECONDS.toMillis(10);
+        long deadlineMs = Time.currentElapsedTime() + timeoutMs;
+        while (timeoutMs > 0 && (closed == null || closed.getState() != Watcher.Event.KeeperState.Closed)) {
+            WatchedEvent event = events.poll(10, TimeUnit.SECONDS);
+            if (event != null) {
+                closed = event;
+            }
+            timeoutMs = deadlineMs - Time.currentElapsedTime();
+        }
+        assertNotNull(closed);
+        assertEquals(Watcher.Event.EventType.None, closed.getType());
+        assertEquals(Watcher.Event.KeeperState.Closed, closed.getState());
+    }
+
+    @Test
+    public void testBuildClient() throws Exception {
+        BlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<>();
+        ZooKeeper zk = ZooKeeper.builder(hostPort, Duration.ofMillis(1000))
+            .withDefaultWatcher(events::offer)
+            .build();
+        testClient(events, zk);
+    }
+
+    @Test
+    public void testBuildAdminClient() throws Exception {
+        BlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<>();
+        ZooKeeperAdmin zk = ZooKeeper.builder(hostPort, Duration.ofMillis(1000))
+            .withDefaultWatcher(events::offer)
+            .buildAdmin();
+        testClient(events, zk);
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/AtomicFileWritingIdiomTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/AtomicFileWritingIdiomTest.java
index d128ecc84b9..3126f005111 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/AtomicFileWritingIdiomTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/AtomicFileWritingIdiomTest.java
@@ -18,34 +18,27 @@
 
 package org.apache.zookeeper.common;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.OutputStream;
 import java.io.Writer;
+import java.nio.charset.Charset;
 import java.nio.charset.StandardCharsets;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.common.AtomicFileWritingIdiom.OutputStreamStatement;
 import org.apache.zookeeper.common.AtomicFileWritingIdiom.WriterStatement;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 
 public class AtomicFileWritingIdiomTest extends ZKTestCase {
 
-    private static File tmpdir;
-
-    @BeforeClass
-    public static void createTmpDir() {
-        tmpdir = new File("build/test/tmp");
-        tmpdir.mkdirs();
-    }
-
     @Test
-    public void testOutputStreamSuccess() throws IOException {
+    public void testOutputStreamSuccess(@TempDir File tmpdir) throws IOException {
         File target = new File(tmpdir, "target.txt");
         final File tmp = new File(tmpdir, "target.txt.tmp");
         createFile(target, "before");
@@ -54,17 +47,16 @@ public void testOutputStreamSuccess() throws IOException {
             @Override
             public void write(OutputStream os) throws IOException {
                 os.write("after".getBytes(StandardCharsets.US_ASCII));
-                assertTrue("implementation of AtomicFileOutputStream has changed, update the test", tmp.exists());
+                assertTrue(tmp.exists(), "implementation of AtomicFileOutputStream has changed, update the test");
             }
         });
-        assertFalse("tmp file should have been deleted", tmp.exists());
+        assertFalse(tmp.exists(), "tmp file should have been deleted");
         // content changed
         assertEquals("after", getContent(target));
-        target.delete();
     }
 
     @Test
-    public void testWriterSuccess() throws IOException {
+    public void testWriterSuccess(@TempDir File tmpdir) throws IOException {
         File target = new File(tmpdir, "target.txt");
         final File tmp = new File(tmpdir, "target.txt.tmp");
         createFile(target, "before");
@@ -73,17 +65,16 @@ public void testWriterSuccess() throws IOException {
             @Override
             public void write(Writer os) throws IOException {
                 os.write("after");
-                assertTrue("implementation of AtomicFileOutputStream has changed, update the test", tmp.exists());
+                assertTrue(tmp.exists(), "implementation of AtomicFileOutputStream has changed, update the test");
             }
         });
-        assertFalse("tmp file should have been deleted", tmp.exists());
+        assertFalse(tmp.exists(), "tmp file should have been deleted");
         // content changed
         assertEquals("after", getContent(target));
-        target.delete();
     }
 
     @Test
-    public void testOutputStreamFailure() throws IOException {
+    public void testOutputStreamFailure(@TempDir File tmpdir) throws IOException {
         File target = new File(tmpdir, "target.txt");
         final File tmp = new File(tmpdir, "target.txt.tmp");
         createFile(target, "before");
@@ -95,22 +86,21 @@ public void testOutputStreamFailure() throws IOException {
                 public void write(OutputStream os) throws IOException {
                     os.write("after".getBytes(StandardCharsets.US_ASCII));
                     os.flush();
-                    assertTrue("implementation of AtomicFileOutputStream has changed, update the test", tmp.exists());
+                    assertTrue(tmp.exists(), "implementation of AtomicFileOutputStream has changed, update the test");
                     throw new RuntimeException();
                 }
             });
         } catch (RuntimeException ex) {
             exception = true;
         }
-        assertFalse("tmp file should have been deleted", tmp.exists());
-        assertTrue("should have raised an exception", exception);
+        assertFalse(tmp.exists(), "tmp file should have been deleted");
+        assertTrue(exception, "should have raised an exception");
         // content preserved
         assertEquals("before", getContent(target));
-        target.delete();
     }
 
     @Test
-    public void testWriterFailure() throws IOException {
+    public void testWriterFailure(@TempDir File tmpdir) throws IOException {
         File target = new File(tmpdir, "target.txt");
         final File tmp = new File(tmpdir, "target.txt.tmp");
         createFile(target, "before");
@@ -122,22 +112,21 @@ public void testWriterFailure() throws IOException {
                 public void write(Writer os) throws IOException {
                     os.write("after");
                     os.flush();
-                    assertTrue("implementation of AtomicFileOutputStream has changed, update the test", tmp.exists());
+                    assertTrue(tmp.exists(), "implementation of AtomicFileOutputStream has changed, update the test");
                     throw new RuntimeException();
                 }
             });
         } catch (RuntimeException ex) {
             exception = true;
         }
-        assertFalse("tmp file should have been deleted", tmp.exists());
-        assertTrue("should have raised an exception", exception);
+        assertFalse(tmp.exists(), "tmp file should have been deleted");
+        assertTrue(exception, "should have raised an exception");
         // content preserved
         assertEquals("before", getContent(target));
-        target.delete();
     }
 
     @Test
-    public void testOutputStreamFailureIOException() throws IOException {
+    public void testOutputStreamFailureIOException(@TempDir File tmpdir) throws IOException {
         File target = new File(tmpdir, "target.txt");
         final File tmp = new File(tmpdir, "target.txt.tmp");
         createFile(target, "before");
@@ -149,22 +138,21 @@ public void testOutputStreamFailureIOException() throws IOException {
                 public void write(OutputStream os) throws IOException {
                     os.write("after".getBytes(StandardCharsets.US_ASCII));
                     os.flush();
-                    assertTrue("implementation of AtomicFileOutputStream has changed, update the test", tmp.exists());
+                    assertTrue(tmp.exists(), "implementation of AtomicFileOutputStream has changed, update the test");
                     throw new IOException();
                 }
             });
         } catch (IOException ex) {
             exception = true;
         }
-        assertFalse("tmp file should have been deleted", tmp.exists());
-        assertTrue("should have raised an exception", exception);
+        assertFalse(tmp.exists(), "tmp file should have been deleted");
+        assertTrue(exception, "should have raised an exception");
         // content preserved
         assertEquals("before", getContent(target));
-        target.delete();
     }
 
     @Test
-    public void testWriterFailureIOException() throws IOException {
+    public void testWriterFailureIOException(@TempDir File tmpdir) throws IOException {
         File target = new File(tmpdir, "target.txt");
         final File tmp = new File(tmpdir, "target.txt.tmp");
         createFile(target, "before");
@@ -176,22 +164,21 @@ public void testWriterFailureIOException() throws IOException {
                 public void write(Writer os) throws IOException {
                     os.write("after");
                     os.flush();
-                    assertTrue("implementation of AtomicFileOutputStream has changed, update the test", tmp.exists());
+                    assertTrue(tmp.exists(), "implementation of AtomicFileOutputStream has changed, update the test");
                     throw new IOException();
                 }
             });
         } catch (IOException ex) {
             exception = true;
         }
-        assertFalse("tmp file should have been deleted", tmp.exists());
-        assertTrue("should have raised an exception", exception);
+        assertFalse(tmp.exists(), "tmp file should have been deleted");
+        assertTrue(exception, "should have raised an exception");
         // content preserved
         assertEquals("before", getContent(target));
-        target.delete();
     }
 
     @Test
-    public void testOutputStreamFailureError() throws IOException {
+    public void testOutputStreamFailureError(@TempDir File tmpdir) throws IOException {
         File target = new File(tmpdir, "target.txt");
         final File tmp = new File(tmpdir, "target.txt.tmp");
         createFile(target, "before");
@@ -203,22 +190,21 @@ public void testOutputStreamFailureError() throws IOException {
                 public void write(OutputStream os) throws IOException {
                     os.write("after".getBytes(StandardCharsets.US_ASCII));
                     os.flush();
-                    assertTrue("implementation of AtomicFileOutputStream has changed, update the test", tmp.exists());
+                    assertTrue(tmp.exists(), "implementation of AtomicFileOutputStream has changed, update the test");
                     throw new Error();
                 }
             });
         } catch (Error ex) {
             exception = true;
         }
-        assertFalse("tmp file should have been deleted", tmp.exists());
-        assertTrue("should have raised an exception", exception);
+        assertFalse(tmp.exists(), "tmp file should have been deleted");
+        assertTrue(exception, "should have raised an exception");
         // content preserved
         assertEquals("before", getContent(target));
-        target.delete();
     }
 
     @Test
-    public void testWriterFailureError() throws IOException {
+    public void testWriterFailureError(@TempDir File tmpdir) throws IOException {
         File target = new File(tmpdir, "target.txt");
         final File tmp = new File(tmpdir, "target.txt.tmp");
         createFile(target, "before");
@@ -230,65 +216,62 @@ public void testWriterFailureError() throws IOException {
                 public void write(Writer os) throws IOException {
                     os.write("after");
                     os.flush();
-                    assertTrue("implementation of AtomicFileOutputStream has changed, update the test", tmp.exists());
+                    assertTrue(tmp.exists(), "implementation of AtomicFileOutputStream has changed, update the test");
                     throw new Error();
                 }
             });
         } catch (Error ex) {
             exception = true;
         }
-        assertFalse("tmp file should have been deleted", tmp.exists());
-        assertTrue("should have raised an exception", exception);
+        assertFalse(tmp.exists(), "tmp file should have been deleted");
+        assertTrue(exception, "should have raised an exception");
         // content preserved
         assertEquals("before", getContent(target));
-        target.delete();
     }
 
     // ************** target file does not exist
 
     @Test
-    public void testOutputStreamSuccessNE() throws IOException {
+    public void testOutputStreamSuccessNE(@TempDir File tmpdir) throws IOException {
         File target = new File(tmpdir, "target.txt");
         final File tmp = new File(tmpdir, "target.txt.tmp");
         target.delete();
-        assertFalse("file should not exist", target.exists());
+        assertFalse(target.exists(), "file should not exist");
         new AtomicFileWritingIdiom(target, new OutputStreamStatement() {
             @Override
             public void write(OutputStream os) throws IOException {
                 os.write("after".getBytes(StandardCharsets.US_ASCII));
-                assertTrue("implementation of AtomicFileOutputStream has changed, update the test", tmp.exists());
+                assertTrue(tmp.exists(), "implementation of AtomicFileOutputStream has changed, update the test");
             }
         });
         // content changed
         assertEquals("after", getContent(target));
-        target.delete();
     }
 
     @Test
-    public void testWriterSuccessNE() throws IOException {
+    public void testWriterSuccessNE(@TempDir File tmpdir) throws IOException {
         File target = new File(tmpdir, "target.txt");
         final File tmp = new File(tmpdir, "target.txt.tmp");
         target.delete();
-        assertFalse("file should not exist", target.exists());
+        assertFalse(target.exists(), "file should not exist");
         new AtomicFileWritingIdiom(target, new WriterStatement() {
             @Override
             public void write(Writer os) throws IOException {
                 os.write("after");
-                assertTrue("implementation of AtomicFileOutputStream has changed, update the test", tmp.exists());
+                assertTrue(tmp.exists(), "implementation of AtomicFileOutputStream has changed, update the test");
             }
         });
-        assertFalse("tmp file should have been deleted", tmp.exists());
+        assertFalse(tmp.exists(), "tmp file should have been deleted");
         // content changed
         assertEquals("after", getContent(target));
-        target.delete();
     }
 
     @Test
-    public void testOutputStreamFailureNE() throws IOException {
+    public void testOutputStreamFailureNE(@TempDir File tmpdir) throws IOException {
         File target = new File(tmpdir, "target.txt");
         final File tmp = new File(tmpdir, "target.txt.tmp");
         target.delete();
-        assertFalse("file should not exist", target.exists());
+        assertFalse(target.exists(), "file should not exist");
         boolean exception = false;
         try {
             new AtomicFileWritingIdiom(target, new OutputStreamStatement() {
@@ -296,25 +279,25 @@ public void testOutputStreamFailureNE() throws IOException {
                 public void write(OutputStream os) throws IOException {
                     os.write("after".getBytes(StandardCharsets.US_ASCII));
                     os.flush();
-                    assertTrue("implementation of AtomicFileOutputStream has changed, update the test", tmp.exists());
+                    assertTrue(tmp.exists(), "implementation of AtomicFileOutputStream has changed, update the test");
                     throw new RuntimeException();
                 }
             });
         } catch (RuntimeException ex) {
             exception = true;
         }
-        assertFalse("tmp file should have been deleted", tmp.exists());
-        assertTrue("should have raised an exception", exception);
+        assertFalse(tmp.exists(), "tmp file should have been deleted");
+        assertTrue(exception, "should have raised an exception");
         // file should not exist
-        assertFalse("file should not exist", target.exists());
+        assertFalse(target.exists(), "file should not exist");
     }
 
     @Test
-    public void testWriterFailureNE() throws IOException {
+    public void testWriterFailureNE(@TempDir File tmpdir) throws IOException {
         File target = new File(tmpdir, "target.txt");
         final File tmp = new File(tmpdir, "target.txt.tmp");
         target.delete();
-        assertFalse("file should not exist", target.exists());
+        assertFalse(target.exists(), "file should not exist");
         boolean exception = false;
         try {
             new AtomicFileWritingIdiom(target, new WriterStatement() {
@@ -322,20 +305,20 @@ public void testWriterFailureNE() throws IOException {
                 public void write(Writer os) throws IOException {
                     os.write("after");
                     os.flush();
-                    assertTrue("implementation of AtomicFileOutputStream has changed, update the test", tmp.exists());
+                    assertTrue(tmp.exists(), "implementation of AtomicFileOutputStream has changed, update the test");
                     throw new RuntimeException();
                 }
             });
         } catch (RuntimeException ex) {
             exception = true;
         }
-        assertFalse("tmp file should have been deleted", tmp.exists());
-        assertTrue("should have raised an exception", exception);
+        assertFalse(tmp.exists(), "tmp file should have been deleted");
+        assertTrue(exception, "should have raised an exception");
         // file should not exist
-        assertFalse("file should not exist", target.exists());
+        assertFalse(target.exists(), "file should not exist");
     }
 
-    private String getContent(File file, String encoding) throws IOException {
+    private String getContent(File file, Charset encoding) throws IOException {
         StringBuilder result = new StringBuilder();
         FileInputStream fis = new FileInputStream(file);
         byte[] b = new byte[20];
@@ -348,7 +331,7 @@ private String getContent(File file, String encoding) throws IOException {
     }
 
     private String getContent(File file) throws IOException {
-        return getContent(file, "ASCII");
+        return getContent(file, StandardCharsets.US_ASCII);
     }
 
     private void createFile(File file, String content) throws IOException {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/BCFKSFileLoaderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/BCFKSFileLoaderTest.java
new file mode 100644
index 00000000000..b3d9e34f32e
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/BCFKSFileLoaderTest.java
@@ -0,0 +1,187 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import java.io.IOException;
+import java.security.KeyStore;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.MethodSource;
+
+public class BCFKSFileLoaderTest extends BaseX509ParameterizedTestCase {
+
+
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStore(
+      X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+      throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.BCFKS).getAbsolutePath();
+        KeyStore ks = new BCFKSFileLoader.Builder()
+          .setKeyStorePath(path)
+          .setKeyStorePassword(x509TestContext.getKeyStorePassword())
+          .build()
+          .loadKeyStore();
+        assertEquals(1, ks.size());
+    }
+
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStoreWithWrongPassword(
+      X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+      throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(Exception.class, () -> {
+            String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.BCFKS).getAbsolutePath();
+            new BCFKSFileLoader.Builder()
+              .setKeyStorePath(path)
+              .setKeyStorePassword("wrong password")
+              .build()
+              .loadKeyStore();
+        });
+    }
+
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStoreWithWrongFilePath(
+      X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+      throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(IOException.class, () -> {
+            String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.BCFKS).getAbsolutePath();
+            new BCFKSFileLoader.Builder()
+              .setKeyStorePath(path + ".does_not_exist")
+              .setKeyStorePassword(x509TestContext.getKeyStorePassword())
+              .build()
+              .loadKeyStore();
+        });
+    }
+
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStoreWithNullFilePath(
+      X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+      throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(NullPointerException.class, () -> {
+            new BCFKSFileLoader.Builder()
+              .setKeyStorePassword(x509TestContext.getKeyStorePassword())
+              .build()
+              .loadKeyStore();
+        });
+    }
+
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStoreWithWrongFileType(
+      X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+      throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(IOException.class, () -> {
+            // Trying to load a PEM file with BCFKS loader should fail
+            String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
+            new BCFKSFileLoader.Builder()
+              .setKeyStorePath(path)
+              .setKeyStorePassword(x509TestContext.getKeyStorePassword())
+              .build()
+              .loadKeyStore();
+        });
+    }
+
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStore(
+      X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+      throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.BCFKS).getAbsolutePath();
+        KeyStore ts = new BCFKSFileLoader.Builder()
+          .setTrustStorePath(path)
+          .setTrustStorePassword(x509TestContext.getTrustStorePassword())
+          .build()
+          .loadTrustStore();
+        assertEquals(1, ts.size());
+    }
+
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStoreWithWrongPassword(
+      X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+      throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(Exception.class, () -> {
+            String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.BCFKS).getAbsolutePath();
+            new BCFKSFileLoader.Builder()
+              .setTrustStorePath(path)
+              .setTrustStorePassword("wrong password")
+              .build()
+              .loadTrustStore();
+        });
+    }
+
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStoreWithWrongFilePath(
+      X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+      throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(IOException.class, () -> {
+            String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.BCFKS).getAbsolutePath();
+            new BCFKSFileLoader.Builder()
+              .setTrustStorePath(path + ".does_not_exist")
+              .setTrustStorePassword(x509TestContext.getTrustStorePassword())
+              .build()
+              .loadTrustStore();
+        });
+    }
+
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStoreWithNullFilePath(
+      X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+      throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(NullPointerException.class, () -> {
+            new BCFKSFileLoader.Builder()
+              .setTrustStorePassword(x509TestContext.getTrustStorePassword())
+              .build()
+              .loadTrustStore();
+        });
+    }
+
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStoreWithWrongFileType(
+      X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+      throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(IOException.class, () -> {
+            // Trying to load a PEM file with BCFKS loader should fail
+            String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
+            new BCFKSFileLoader.Builder()
+              .setTrustStorePath(path)
+              .setTrustStorePassword(x509TestContext.getTrustStorePassword())
+              .build()
+              .loadTrustStore();
+        });
+    }
+
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/BaseX509ParameterizedTestCase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/BaseX509ParameterizedTestCase.java
index b4790cfd9fc..b5ece888505 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/BaseX509ParameterizedTestCase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/BaseX509ParameterizedTestCase.java
@@ -19,18 +19,17 @@
 package org.apache.zookeeper.common;
 
 import java.io.File;
-import java.io.IOException;
 import java.security.Security;
 import java.util.ArrayList;
-import java.util.Collection;
 import java.util.HashMap;
 import java.util.Map;
-import org.apache.commons.io.FileUtils;
+import java.util.stream.Stream;
 import org.apache.zookeeper.ZKTestCase;
-import org.apache.zookeeper.test.ClientBase;
 import org.bouncycastle.jce.provider.BouncyCastleProvider;
-import org.junit.AfterClass;
-import org.junit.BeforeClass;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.io.TempDir;
+import org.junit.jupiter.params.provider.Arguments;
 
 /**
  * Base class for parameterized unit tests that use X509TestContext for testing
@@ -41,23 +40,26 @@
  * and caching the X509TestContext objects used by the tests.
  */
 public abstract class BaseX509ParameterizedTestCase extends ZKTestCase {
+    protected static final String KEY_NON_EMPTY_PASSWORD = "pa$$w0rd";
+    protected static final String KEY_EMPTY_PASSWORD = "";
 
     /**
      * Default parameters suitable for most subclasses. See example usage
      * in {@link X509UtilTest}.
-     * @return an array of parameter combinations to test with.
+     * @return a stream of parameter combinations to test with.
      */
-    public static Collection<Object[]> defaultParams() {
-        ArrayList<Object[]> result = new ArrayList<>();
+    public static Stream<Arguments> data() {
+        ArrayList<Arguments> result = new ArrayList<>();
         int paramIndex = 0;
         for (X509KeyType caKeyType : X509KeyType.values()) {
             for (X509KeyType certKeyType : X509KeyType.values()) {
-                for (String keyPassword : new String[]{"", "pa$$w0rd"}) {
-                    result.add(new Object[]{caKeyType, certKeyType, keyPassword, paramIndex++});
+                for (String keyPassword : new String[]{KEY_EMPTY_PASSWORD, KEY_NON_EMPTY_PASSWORD}) {
+                    result.add(Arguments.of(caKeyType, certKeyType, keyPassword, paramIndex++));
                 }
             }
         }
-        return result;
+
+        return result.stream();
     }
 
     /**
@@ -66,37 +68,32 @@ public static Collection<Object[]> defaultParams() {
      * caching makes all test cases after the first one for a given parameter combination complete almost instantly.
      */
     protected static Map<Integer, X509TestContext> cachedTestContexts;
+    @TempDir
     protected static File tempDir;
 
     protected X509TestContext x509TestContext;
 
-    @BeforeClass
+    @BeforeAll
     public static void setUpBaseClass() throws Exception {
         Security.addProvider(new BouncyCastleProvider());
         cachedTestContexts = new HashMap<>();
-        tempDir = ClientBase.createEmptyTestDir();
     }
 
-    @AfterClass
+    @AfterAll
     public static void cleanUpBaseClass() {
-        Security.removeProvider("BC");
+        Security.removeProvider(BouncyCastleProvider.PROVIDER_NAME);
         cachedTestContexts.clear();
         cachedTestContexts = null;
-        try {
-            FileUtils.deleteDirectory(tempDir);
-        } catch (IOException e) {
-            // ignore
-        }
     }
 
     /**
-     * Constructor. See example usage in {@link X509UtilTest}.
+     * Init method. See example usage in {@link X509UtilTest}.
      *
      * @param paramIndex the index under which the X509TestContext should be cached.
      * @param contextSupplier a function that creates and returns the X509TestContext
      *                        for the current index if one is not already cached.
      */
-    protected BaseX509ParameterizedTestCase(
+    protected void init(
             Integer paramIndex, java.util.function.Supplier<X509TestContext> contextSupplier) {
         if (cachedTestContexts.containsKey(paramIndex)) {
             x509TestContext = cachedTestContexts.get(paramIndex);
@@ -106,4 +103,24 @@ protected BaseX509ParameterizedTestCase(
         }
     }
 
+    protected void init(
+            final X509KeyType caKeyType,
+            final X509KeyType certKeyType,
+            final String keyPassword,
+            final Integer paramIndex)
+            throws Exception {
+        init(paramIndex, () -> {
+            try {
+                return X509TestContext.newBuilder()
+                        .setTempDir(tempDir)
+                        .setKeyStorePassword(keyPassword)
+                        .setKeyStoreKeyType(certKeyType)
+                        .setTrustStorePassword(keyPassword)
+                        .setTrustStoreKeyType(caKeyType)
+                        .build();
+            } catch (Exception e) {
+                throw new RuntimeException(e);
+            }
+        });
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/BusyServer.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/BusyServer.java
new file mode 100644
index 00000000000..c2eece3d242
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/BusyServer.java
@@ -0,0 +1,48 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common;
+
+import java.io.IOException;
+import java.net.InetAddress;
+import java.net.ServerSocket;
+import java.net.Socket;
+
+public class BusyServer implements AutoCloseable {
+    private final ServerSocket server;
+    private final Socket client;
+
+    public BusyServer() throws IOException {
+        this.server = new ServerSocket(0, 1, InetAddress.getByName("127.0.0.1"));
+        this.client = new Socket("127.0.0.1", server.getLocalPort());
+    }
+
+    public int getLocalPort() {
+        return server.getLocalPort();
+    }
+
+    public String getHostPort() {
+        return String.format("127.0.0.1:%d", getLocalPort());
+    }
+
+    @Override
+    public void close() throws Exception {
+        client.close();
+        server.close();
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/CertificatesToPlayWith.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/CertificatesToPlayWith.java
new file mode 100644
index 00000000000..0cd2172a713
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/CertificatesToPlayWith.java
@@ -0,0 +1,539 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common;
+
+/**
+ * Some X509 certificates to test against.
+ * <p>
+ * Note:  some of these certificates have Japanese Kanji in the "subjectAlt"
+ * field (UTF8).  Not sure how realistic that is since international characters
+ * in DNS names usually get translated into ASCII using "xn--" style DNS
+ * entries.  "xn--i8s592g.co.jp" is what FireFox actually uses when trying to
+ * find &#x82b1;&#x5b50;.co.jp.  So would the CN in the certificate contain
+ * "xn--i8s592g.co.jp" in ASCII, or "&#x82b1;&#x5b50;.co.jp" in UTF8?  (Both?)
+ * </p>
+ *
+ * @since 11-Dec-2006
+ */
+public class CertificatesToPlayWith {
+
+    /**
+     * CN=foo.com
+     */
+    public static final byte[] X509_FOO = ("-----BEGIN CERTIFICATE-----\n"
+        + "MIIERjCCAy6gAwIBAgIJAIz+EYMBU6aQMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n"
+        + "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n"
+        + "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n"
+        + "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n"
+        + "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE1MzE0MVoXDTI4MTEwNTE1MzE0MVowgaQx\n"
+        + "CzAJBgNVBAYTAlVTMREwDwYDVQQIEwhNYXJ5bGFuZDEUMBIGA1UEBxMLRm9yZXN0\n"
+        + "IEhpbGwxFzAVBgNVBAoTDmh0dHBjb21wb25lbnRzMRowGAYDVQQLExF0ZXN0IGNl\n"
+        + "cnRpZmljYXRlczEQMA4GA1UEAxMHZm9vLmNvbTElMCMGCSqGSIb3DQEJARYWanVs\n"
+        + "aXVzZGF2aWVzQGdtYWlsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC\n"
+        + "ggEBAMhjr5aCPoyp0R1iroWAfnEyBMGYWoCidH96yGPFjYLowez5aYKY1IOKTY2B\n"
+        + "lYho4O84X244QrZTRl8kQbYtxnGh4gSCD+Z8gjZ/gMvLUlhqOb+WXPAUHMB39GRy\n"
+        + "zerA/ZtrlUqf+lKo0uWcocxeRc771KN8cPH3nHZ0rV0Hx4ZAZy6U4xxObe4rtSVY\n"
+        + "07hNKXAb2odnVqgzcYiDkLV8ilvEmoNWMWrp8UBqkTcpEhYhCYp3cTkgJwMSuqv8\n"
+        + "BqnGd87xQU3FVZI4tbtkB+KzjD9zz8QCDJAfDjZHR03KNQ5mxOgXwxwKw6lGMaiV\n"
+        + "JTxpTKqym93whYk93l3ocEe55c0CAwEAAaN7MHkwCQYDVR0TBAIwADAsBglghkgB\n"
+        + "hvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYE\n"
+        + "FJ8Ud78/OrbKOIJCSBYs2tDLXofYMB8GA1UdIwQYMBaAFHua2o+QmU5S0qzbswNS\n"
+        + "yoemDT4NMA0GCSqGSIb3DQEBBQUAA4IBAQC3jRmEya6sQCkmieULcvx8zz1euCk9\n"
+        + "fSez7BEtki8+dmfMXe3K7sH0lI8f4jJR0rbSCjpmCQLYmzC3NxBKeJOW0RcjNBpO\n"
+        + "c2JlGO9auXv2GDP4IYiXElLJ6VSqc8WvDikv0JmCCWm0Zga+bZbR/EWN5DeEtFdF\n"
+        + "815CLpJZNcYwiYwGy/CVQ7w2TnXlG+mraZOz+owr+cL6J/ZesbdEWfjoS1+cUEhE\n"
+        + "HwlNrAu8jlZ2UqSgskSWlhYdMTAP9CPHiUv9N7FcT58Itv/I4fKREINQYjDpvQcx\n"
+        + "SaTYb9dr5sB4WLNglk7zxDtM80H518VvihTcP7FHL+Gn6g4j5fkI98+S\n"
+        + "-----END CERTIFICATE-----\n").getBytes();
+
+    /**
+     * CN=&#x82b1;&#x5b50;.co.jp
+     */
+    public static final byte[] X509_HANAKO = ("-----BEGIN CERTIFICATE-----\n"
+        + "MIIESzCCAzOgAwIBAgIJAIz+EYMBU6aTMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n"
+        + "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n"
+        + "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n"
+        + "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n"
+        + "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE1NDIxNVoXDTI4MTEwNTE1NDIxNVowgakx\n"
+        + "CzAJBgNVBAYTAlVTMREwDwYDVQQIDAhNYXJ5bGFuZDEUMBIGA1UEBwwLRm9yZXN0\n"
+        + "IEhpbGwxFzAVBgNVBAoMDmh0dHBjb21wb25lbnRzMRowGAYDVQQLDBF0ZXN0IGNl\n"
+        + "cnRpZmljYXRlczEVMBMGA1UEAwwM6Iqx5a2QLmNvLmpwMSUwIwYJKoZIhvcNAQkB\n"
+        + "FhZqdWxpdXNkYXZpZXNAZ21haWwuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A\n"
+        + "MIIBCgKCAQEAyGOvloI+jKnRHWKuhYB+cTIEwZhagKJ0f3rIY8WNgujB7PlpgpjU\n"
+        + "g4pNjYGViGjg7zhfbjhCtlNGXyRBti3GcaHiBIIP5nyCNn+Ay8tSWGo5v5Zc8BQc\n"
+        + "wHf0ZHLN6sD9m2uVSp/6UqjS5ZyhzF5FzvvUo3xw8fecdnStXQfHhkBnLpTjHE5t\n"
+        + "7iu1JVjTuE0pcBvah2dWqDNxiIOQtXyKW8Sag1YxaunxQGqRNykSFiEJindxOSAn\n"
+        + "AxK6q/wGqcZ3zvFBTcVVkji1u2QH4rOMP3PPxAIMkB8ONkdHTco1DmbE6BfDHArD\n"
+        + "qUYxqJUlPGlMqrKb3fCFiT3eXehwR7nlzQIDAQABo3sweTAJBgNVHRMEAjAAMCwG\n"
+        + "CWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNV\n"
+        + "HQ4EFgQUnxR3vz86tso4gkJIFiza0Mteh9gwHwYDVR0jBBgwFoAUe5raj5CZTlLS\n"
+        + "rNuzA1LKh6YNPg0wDQYJKoZIhvcNAQEFBQADggEBALJ27i3okV/KvlDp6KMID3gd\n"
+        + "ITl68PyItzzx+SquF8gahMh016NX73z/oVZoVUNdftla8wPUB1GwIkAnGkhQ9LHK\n"
+        + "spBdbRiCj0gMmLCsX8SrjFvr7cYb2cK6J/fJe92l1tg/7Y4o7V/s4JBe/cy9U9w8\n"
+        + "a0ctuDmEBCgC784JMDtT67klRfr/2LlqWhlOEq7pUFxRLbhpquaAHSOjmIcWnVpw\n"
+        + "9BsO7qe46hidgn39hKh1WjKK2VcL/3YRsC4wUi0PBtFW6ScMCuMhgIRXSPU55Rae\n"
+        + "UIlOdPjjr1SUNWGId1rD7W16Scpwnknn310FNxFMHVI0GTGFkNdkilNCFJcIoRA=\n"
+        + "-----END CERTIFICATE-----\n").getBytes();
+
+    /**
+     * CN=foo.com, subjectAlt=bar.com
+     */
+    public static final byte[] X509_FOO_BAR = ("-----BEGIN CERTIFICATE-----\n"
+        + "MIIEXDCCA0SgAwIBAgIJAIz+EYMBU6aRMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n"
+        + "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n"
+        + "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n"
+        + "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n"
+        + "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE1MzYyOVoXDTI4MTEwNTE1MzYyOVowgaQx\n"
+        + "CzAJBgNVBAYTAlVTMREwDwYDVQQIEwhNYXJ5bGFuZDEUMBIGA1UEBxMLRm9yZXN0\n"
+        + "IEhpbGwxFzAVBgNVBAoTDmh0dHBjb21wb25lbnRzMRowGAYDVQQLExF0ZXN0IGNl\n"
+        + "cnRpZmljYXRlczEQMA4GA1UEAxMHZm9vLmNvbTElMCMGCSqGSIb3DQEJARYWanVs\n"
+        + "aXVzZGF2aWVzQGdtYWlsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC\n"
+        + "ggEBAMhjr5aCPoyp0R1iroWAfnEyBMGYWoCidH96yGPFjYLowez5aYKY1IOKTY2B\n"
+        + "lYho4O84X244QrZTRl8kQbYtxnGh4gSCD+Z8gjZ/gMvLUlhqOb+WXPAUHMB39GRy\n"
+        + "zerA/ZtrlUqf+lKo0uWcocxeRc771KN8cPH3nHZ0rV0Hx4ZAZy6U4xxObe4rtSVY\n"
+        + "07hNKXAb2odnVqgzcYiDkLV8ilvEmoNWMWrp8UBqkTcpEhYhCYp3cTkgJwMSuqv8\n"
+        + "BqnGd87xQU3FVZI4tbtkB+KzjD9zz8QCDJAfDjZHR03KNQ5mxOgXwxwKw6lGMaiV\n"
+        + "JTxpTKqym93whYk93l3ocEe55c0CAwEAAaOBkDCBjTAJBgNVHRMEAjAAMCwGCWCG\n"
+        + "SAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4E\n"
+        + "FgQUnxR3vz86tso4gkJIFiza0Mteh9gwHwYDVR0jBBgwFoAUe5raj5CZTlLSrNuz\n"
+        + "A1LKh6YNPg0wEgYDVR0RBAswCYIHYmFyLmNvbTANBgkqhkiG9w0BAQUFAAOCAQEA\n"
+        + "dQyprNZBmVnvuVWjV42sey/PTfkYShJwy1j0/jcFZR/ypZUovpiHGDO1DgL3Y3IP\n"
+        + "zVQ26uhUsSw6G0gGRiaBDe/0LUclXZoJzXX1qpS55OadxW73brziS0sxRgGrZE/d\n"
+        + "3g5kkio6IED47OP6wYnlmZ7EKP9cqjWwlnvHnnUcZ2SscoLNYs9rN9ccp8tuq2by\n"
+        + "88OyhKwGjJfhOudqfTNZcDzRHx4Fzm7UsVaycVw4uDmhEHJrAsmMPpj/+XRK9/42\n"
+        + "2xq+8bc6HojdtbCyug/fvBZvZqQXSmU8m8IVcMmWMz0ZQO8ee3QkBHMZfCy7P/kr\n"
+        + "VbWx/uETImUu+NZg22ewEw==\n" + "-----END CERTIFICATE-----\n").getBytes();
+
+    /**
+     * CN=foo.com, subjectAlt=bar.com, subjectAlt=&#x82b1;&#x5b50;.co.jp
+     * (hanako.co.jp in kanji)
+     */
+    public static final byte[] X509_FOO_BAR_HANAKO = ("-----BEGIN CERTIFICATE-----\n"
+        + "MIIEajCCA1KgAwIBAgIJAIz+EYMBU6aSMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n"
+        + "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n"
+        + "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n"
+        + "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n"
+        + "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE1MzgxM1oXDTI4MTEwNTE1MzgxM1owgaQx\n"
+        + "CzAJBgNVBAYTAlVTMREwDwYDVQQIEwhNYXJ5bGFuZDEUMBIGA1UEBxMLRm9yZXN0\n"
+        + "IEhpbGwxFzAVBgNVBAoTDmh0dHBjb21wb25lbnRzMRowGAYDVQQLExF0ZXN0IGNl\n"
+        + "cnRpZmljYXRlczEQMA4GA1UEAxMHZm9vLmNvbTElMCMGCSqGSIb3DQEJARYWanVs\n"
+        + "aXVzZGF2aWVzQGdtYWlsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC\n"
+        + "ggEBAMhjr5aCPoyp0R1iroWAfnEyBMGYWoCidH96yGPFjYLowez5aYKY1IOKTY2B\n"
+        + "lYho4O84X244QrZTRl8kQbYtxnGh4gSCD+Z8gjZ/gMvLUlhqOb+WXPAUHMB39GRy\n"
+        + "zerA/ZtrlUqf+lKo0uWcocxeRc771KN8cPH3nHZ0rV0Hx4ZAZy6U4xxObe4rtSVY\n"
+        + "07hNKXAb2odnVqgzcYiDkLV8ilvEmoNWMWrp8UBqkTcpEhYhCYp3cTkgJwMSuqv8\n"
+        + "BqnGd87xQU3FVZI4tbtkB+KzjD9zz8QCDJAfDjZHR03KNQ5mxOgXwxwKw6lGMaiV\n"
+        + "JTxpTKqym93whYk93l3ocEe55c0CAwEAAaOBnjCBmzAJBgNVHRMEAjAAMCwGCWCG\n"
+        + "SAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4E\n"
+        + "FgQUnxR3vz86tso4gkJIFiza0Mteh9gwHwYDVR0jBBgwFoAUe5raj5CZTlLSrNuz\n"
+        + "A1LKh6YNPg0wIAYDVR0RBBkwF4IHYmFyLmNvbYIM6Iqx5a2QLmNvLmpwMA0GCSqG\n"
+        + "SIb3DQEBBQUAA4IBAQBeZs7ZIYyKtdnVxVvdLgwySEPOE4pBSXii7XYv0Q9QUvG/\n"
+        + "++gFGQh89HhABzA1mVUjH5dJTQqSLFvRfqTHqLpxSxSWqMHnvRM4cPBkIRp/XlMK\n"
+        + "PlXadYtJLPTgpbgvulA1ickC9EwlNYWnowZ4uxnfsMghW4HskBqaV+PnQ8Zvy3L0\n"
+        + "12c7Cg4mKKS5pb1HdRuiD2opZ+Hc77gRQLvtWNS8jQvd/iTbh6fuvTKfAOFoXw22\n"
+        + "sWIKHYrmhCIRshUNohGXv50m2o+1w9oWmQ6Dkq7lCjfXfUB4wIbggJjpyEtbNqBt\n"
+        + "j4MC2x5rfsLKKqToKmNE7pFEgqwe8//Aar1b+Qj+\n" + "-----END CERTIFICATE-----\n").getBytes();
+
+    /**
+     * CN=*.foo.com
+     */
+    public static final byte[] X509_WILD_FOO = ("-----BEGIN CERTIFICATE-----\n"
+        + "MIIESDCCAzCgAwIBAgIJAIz+EYMBU6aUMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n"
+        + "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n"
+        + "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n"
+        + "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n"
+        + "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE2MTU1NVoXDTI4MTEwNTE2MTU1NVowgaYx\n"
+        + "CzAJBgNVBAYTAlVTMREwDwYDVQQIEwhNYXJ5bGFuZDEUMBIGA1UEBxMLRm9yZXN0\n"
+        + "IEhpbGwxFzAVBgNVBAoTDmh0dHBjb21wb25lbnRzMRowGAYDVQQLExF0ZXN0IGNl\n"
+        + "cnRpZmljYXRlczESMBAGA1UEAxQJKi5mb28uY29tMSUwIwYJKoZIhvcNAQkBFhZq\n"
+        + "dWxpdXNkYXZpZXNAZ21haWwuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\n"
+        + "CgKCAQEAyGOvloI+jKnRHWKuhYB+cTIEwZhagKJ0f3rIY8WNgujB7PlpgpjUg4pN\n"
+        + "jYGViGjg7zhfbjhCtlNGXyRBti3GcaHiBIIP5nyCNn+Ay8tSWGo5v5Zc8BQcwHf0\n"
+        + "ZHLN6sD9m2uVSp/6UqjS5ZyhzF5FzvvUo3xw8fecdnStXQfHhkBnLpTjHE5t7iu1\n"
+        + "JVjTuE0pcBvah2dWqDNxiIOQtXyKW8Sag1YxaunxQGqRNykSFiEJindxOSAnAxK6\n"
+        + "q/wGqcZ3zvFBTcVVkji1u2QH4rOMP3PPxAIMkB8ONkdHTco1DmbE6BfDHArDqUYx\n"
+        + "qJUlPGlMqrKb3fCFiT3eXehwR7nlzQIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCG\n"
+        + "SAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4E\n"
+        + "FgQUnxR3vz86tso4gkJIFiza0Mteh9gwHwYDVR0jBBgwFoAUe5raj5CZTlLSrNuz\n"
+        + "A1LKh6YNPg0wDQYJKoZIhvcNAQEFBQADggEBAH0ipG6J561UKUfgkeW7GvYwW98B\n"
+        + "N1ZooWX+JEEZK7+Pf/96d3Ij0rw9ACfN4bpfnCq0VUNZVSYB+GthQ2zYuz7tf/UY\n"
+        + "A6nxVgR/IjG69BmsBl92uFO7JTNtHztuiPqBn59pt+vNx4yPvno7zmxsfI7jv0ww\n"
+        + "yfs+0FNm7FwdsC1k47GBSOaGw38kuIVWqXSAbL4EX9GkryGGOKGNh0qvAENCdRSB\n"
+        + "G9Z6tyMbmfRY+dLSh3a9JwoEcBUso6EWYBakLbq4nG/nvYdYvG9ehrnLVwZFL82e\n"
+        + "l3Q/RK95bnA6cuRClGusLad0e6bjkBzx/VQ3VarDEpAkTLUGVAa0CLXtnyc=\n"
+        + "-----END CERTIFICATE-----\n").getBytes();
+
+    /**
+     * CN=*.co.jp
+     */
+    public static final byte[] X509_WILD_CO_JP = ("-----BEGIN CERTIFICATE-----\n"
+        + "MIIERjCCAy6gAwIBAgIJAIz+EYMBU6aVMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n"
+        + "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n"
+        + "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n"
+        + "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n"
+        + "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE2MTYzMFoXDTI4MTEwNTE2MTYzMFowgaQx\n"
+        + "CzAJBgNVBAYTAlVTMREwDwYDVQQIEwhNYXJ5bGFuZDEUMBIGA1UEBxMLRm9yZXN0\n"
+        + "IEhpbGwxFzAVBgNVBAoTDmh0dHBjb21wb25lbnRzMRowGAYDVQQLExF0ZXN0IGNl\n"
+        + "cnRpZmljYXRlczEQMA4GA1UEAxQHKi5jby5qcDElMCMGCSqGSIb3DQEJARYWanVs\n"
+        + "aXVzZGF2aWVzQGdtYWlsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC\n"
+        + "ggEBAMhjr5aCPoyp0R1iroWAfnEyBMGYWoCidH96yGPFjYLowez5aYKY1IOKTY2B\n"
+        + "lYho4O84X244QrZTRl8kQbYtxnGh4gSCD+Z8gjZ/gMvLUlhqOb+WXPAUHMB39GRy\n"
+        + "zerA/ZtrlUqf+lKo0uWcocxeRc771KN8cPH3nHZ0rV0Hx4ZAZy6U4xxObe4rtSVY\n"
+        + "07hNKXAb2odnVqgzcYiDkLV8ilvEmoNWMWrp8UBqkTcpEhYhCYp3cTkgJwMSuqv8\n"
+        + "BqnGd87xQU3FVZI4tbtkB+KzjD9zz8QCDJAfDjZHR03KNQ5mxOgXwxwKw6lGMaiV\n"
+        + "JTxpTKqym93whYk93l3ocEe55c0CAwEAAaN7MHkwCQYDVR0TBAIwADAsBglghkgB\n"
+        + "hvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYE\n"
+        + "FJ8Ud78/OrbKOIJCSBYs2tDLXofYMB8GA1UdIwQYMBaAFHua2o+QmU5S0qzbswNS\n"
+        + "yoemDT4NMA0GCSqGSIb3DQEBBQUAA4IBAQA0sWglVlMx2zNGvUqFC73XtREwii53\n"
+        + "CfMM6mtf2+f3k/d8KXhLNySrg8RRlN11zgmpPaLtbdTLrmG4UdAHHYr8O4y2BBmE\n"
+        + "1cxNfGxxechgF8HX10QV4dkyzp6Z1cfwvCeMrT5G/V1pejago0ayXx+GPLbWlNeZ\n"
+        + "S+Kl0m3p+QplXujtwG5fYcIpaGpiYraBLx3Tadih39QN65CnAh/zRDhLCUzKyt9l\n"
+        + "UGPLEUDzRHMPHLnSqT1n5UU5UDRytbjJPXzF+l/+WZIsanefWLsxnkgAuZe/oMMF\n"
+        + "EJMryEzOjg4Tfuc5qM0EXoPcQ/JlheaxZ40p2IyHqbsWV4MRYuFH4bkM\n"
+        + "-----END CERTIFICATE-----\n").getBytes();
+
+    /**
+     * CN=*.foo.com, subjectAlt=*.bar.com, subjectAlt=*.&#x82b1;&#x5b50;.co.jp
+     * (*.hanako.co.jp in kanji)
+     */
+    public static final byte[] X509_WILD_FOO_BAR_HANAKO = ("-----BEGIN CERTIFICATE-----\n"
+        + "MIIEcDCCA1igAwIBAgIJAIz+EYMBU6aWMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n"
+        + "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n"
+        + "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n"
+        + "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n"
+        + "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE2MTczMVoXDTI4MTEwNTE2MTczMVowgaYx\n"
+        + "CzAJBgNVBAYTAlVTMREwDwYDVQQIEwhNYXJ5bGFuZDEUMBIGA1UEBxMLRm9yZXN0\n"
+        + "IEhpbGwxFzAVBgNVBAoTDmh0dHBjb21wb25lbnRzMRowGAYDVQQLExF0ZXN0IGNl\n"
+        + "cnRpZmljYXRlczESMBAGA1UEAxQJKi5mb28uY29tMSUwIwYJKoZIhvcNAQkBFhZq\n"
+        + "dWxpdXNkYXZpZXNAZ21haWwuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\n"
+        + "CgKCAQEAyGOvloI+jKnRHWKuhYB+cTIEwZhagKJ0f3rIY8WNgujB7PlpgpjUg4pN\n"
+        + "jYGViGjg7zhfbjhCtlNGXyRBti3GcaHiBIIP5nyCNn+Ay8tSWGo5v5Zc8BQcwHf0\n"
+        + "ZHLN6sD9m2uVSp/6UqjS5ZyhzF5FzvvUo3xw8fecdnStXQfHhkBnLpTjHE5t7iu1\n"
+        + "JVjTuE0pcBvah2dWqDNxiIOQtXyKW8Sag1YxaunxQGqRNykSFiEJindxOSAnAxK6\n"
+        + "q/wGqcZ3zvFBTcVVkji1u2QH4rOMP3PPxAIMkB8ONkdHTco1DmbE6BfDHArDqUYx\n"
+        + "qJUlPGlMqrKb3fCFiT3eXehwR7nlzQIDAQABo4GiMIGfMAkGA1UdEwQCMAAwLAYJ\n"
+        + "YIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1Ud\n"
+        + "DgQWBBSfFHe/Pzq2yjiCQkgWLNrQy16H2DAfBgNVHSMEGDAWgBR7mtqPkJlOUtKs\n"
+        + "27MDUsqHpg0+DTAkBgNVHREEHTAbggkqLmJhci5jb22CDiou6Iqx5a2QLmNvLmpw\n"
+        + "MA0GCSqGSIb3DQEBBQUAA4IBAQBobWC+D5/lx6YhX64CwZ26XLjxaE0S415ajbBq\n"
+        + "DK7lz+Rg7zOE3GsTAMi+ldUYnhyz0wDiXB8UwKXl0SDToB2Z4GOgqQjAqoMmrP0u\n"
+        + "WB6Y6dpkfd1qDRUzI120zPYgSdsXjHW9q2H77iV238hqIU7qCvEz+lfqqWEY504z\n"
+        + "hYNlknbUnR525ItosEVwXFBJTkZ3Yw8gg02c19yi8TAh5Li3Ad8XQmmSJMWBV4XK\n"
+        + "qFr0AIZKBlg6NZZFf/0dP9zcKhzSriW27bY0XfzA6GSiRDXrDjgXq6baRT6YwgIg\n"
+        + "pgJsDbJtZfHnV1nd3M6zOtQPm1TIQpNmMMMd/DPrGcUQerD3\n" + "-----END CERTIFICATE-----\n")
+        .getBytes();
+
+    /**
+     * CN=foo.com, CN=bar.com, CN=&#x82b1;&#x5b50;.co.jp
+     */
+    public static final byte[] X509_THREE_CNS_FOO_BAR_HANAKO = ("-----BEGIN CERTIFICATE-----\n"
+        + "MIIEbzCCA1egAwIBAgIJAIz+EYMBU6aXMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n"
+        + "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n"
+        + "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n"
+        + "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n"
+        + "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE2MTk0NVoXDTI4MTEwNTE2MTk0NVowgc0x\n"
+        + "CzAJBgNVBAYTAlVTMREwDwYDVQQIDAhNYXJ5bGFuZDEUMBIGA1UEBwwLRm9yZXN0\n"
+        + "IEhpbGwxFzAVBgNVBAoMDmh0dHBjb21wb25lbnRzMRowGAYDVQQLDBF0ZXN0IGNl\n"
+        + "cnRpZmljYXRlczEQMA4GA1UEAwwHZm9vLmNvbTEQMA4GA1UEAwwHYmFyLmNvbTEV\n"
+        + "MBMGA1UEAwwM6Iqx5a2QLmNvLmpwMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n"
+        + "ZXNAZ21haWwuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyGOv\n"
+        + "loI+jKnRHWKuhYB+cTIEwZhagKJ0f3rIY8WNgujB7PlpgpjUg4pNjYGViGjg7zhf\n"
+        + "bjhCtlNGXyRBti3GcaHiBIIP5nyCNn+Ay8tSWGo5v5Zc8BQcwHf0ZHLN6sD9m2uV\n"
+        + "Sp/6UqjS5ZyhzF5FzvvUo3xw8fecdnStXQfHhkBnLpTjHE5t7iu1JVjTuE0pcBva\n"
+        + "h2dWqDNxiIOQtXyKW8Sag1YxaunxQGqRNykSFiEJindxOSAnAxK6q/wGqcZ3zvFB\n"
+        + "TcVVkji1u2QH4rOMP3PPxAIMkB8ONkdHTco1DmbE6BfDHArDqUYxqJUlPGlMqrKb\n"
+        + "3fCFiT3eXehwR7nlzQIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQf\n"
+        + "Fh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUnxR3vz86\n"
+        + "tso4gkJIFiza0Mteh9gwHwYDVR0jBBgwFoAUe5raj5CZTlLSrNuzA1LKh6YNPg0w\n"
+        + "DQYJKoZIhvcNAQEFBQADggEBAGuZb8ai1NO2j4v3y9TLZvd5s0vh5/TE7n7RX+8U\n"
+        + "y37OL5k7x9nt0mM1TyAKxlCcY+9h6frue8MemZIILSIvMrtzccqNz0V1WKgA+Orf\n"
+        + "uUrabmn+CxHF5gpy6g1Qs2IjVYWA5f7FROn/J+Ad8gJYc1azOWCLQqSyfpNRLSvY\n"
+        + "EriQFEV63XvkJ8JrG62b+2OT2lqT4OO07gSPetppdlSa8NBSKP6Aro9RIX1ZjUZQ\n"
+        + "SpQFCfo02NO0uNRDPUdJx2huycdNb+AXHaO7eXevDLJ+QnqImIzxWiY6zLOdzjjI\n"
+        + "VBMkLHmnP7SjGSQ3XA4ByrQOxfOUTyLyE7NuemhHppuQPxE=\n" + "-----END CERTIFICATE-----\n")
+        .getBytes();
+
+    /**
+     * subjectAlt=foo.com
+     */
+    public static final byte[] X509_NO_CNS_FOO = ("-----BEGIN CERTIFICATE-----\n"
+        + "MIIESjCCAzKgAwIBAgIJAIz+EYMBU6aYMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD\n"
+        + "VQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEWMBQGA1UE\n"
+        + "ChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9uc19zc2wxHTAbBgNVBAMU\n"
+        + "FGRlbW9faW50ZXJtZWRpYXRlX2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZp\n"
+        + "ZXNAZ21haWwuY29tMB4XDTA2MTIxMTE2MjYxMFoXDTI4MTEwNTE2MjYxMFowgZIx\n"
+        + "CzAJBgNVBAYTAlVTMREwDwYDVQQIDAhNYXJ5bGFuZDEUMBIGA1UEBwwLRm9yZXN0\n"
+        + "IEhpbGwxFzAVBgNVBAoMDmh0dHBjb21wb25lbnRzMRowGAYDVQQLDBF0ZXN0IGNl\n"
+        + "cnRpZmljYXRlczElMCMGCSqGSIb3DQEJARYWanVsaXVzZGF2aWVzQGdtYWlsLmNv\n"
+        + "bTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMhjr5aCPoyp0R1iroWA\n"
+        + "fnEyBMGYWoCidH96yGPFjYLowez5aYKY1IOKTY2BlYho4O84X244QrZTRl8kQbYt\n"
+        + "xnGh4gSCD+Z8gjZ/gMvLUlhqOb+WXPAUHMB39GRyzerA/ZtrlUqf+lKo0uWcocxe\n"
+        + "Rc771KN8cPH3nHZ0rV0Hx4ZAZy6U4xxObe4rtSVY07hNKXAb2odnVqgzcYiDkLV8\n"
+        + "ilvEmoNWMWrp8UBqkTcpEhYhCYp3cTkgJwMSuqv8BqnGd87xQU3FVZI4tbtkB+Kz\n"
+        + "jD9zz8QCDJAfDjZHR03KNQ5mxOgXwxwKw6lGMaiVJTxpTKqym93whYk93l3ocEe5\n"
+        + "5c0CAwEAAaOBkDCBjTAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NM\n"
+        + "IEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUnxR3vz86tso4gkJIFiza\n"
+        + "0Mteh9gwHwYDVR0jBBgwFoAUe5raj5CZTlLSrNuzA1LKh6YNPg0wEgYDVR0RBAsw\n"
+        + "CYIHZm9vLmNvbTANBgkqhkiG9w0BAQUFAAOCAQEAjl78oMjzFdsMy6F1sGg/IkO8\n"
+        + "tF5yUgPgFYrs41yzAca7IQu6G9qtFDJz/7ehh/9HoG+oqCCIHPuIOmS7Sd0wnkyJ\n"
+        + "Y7Y04jVXIb3a6f6AgBkEFP1nOT0z6kjT7vkA5LJ2y3MiDcXuRNMSta5PYVnrX8aZ\n"
+        + "yiqVUNi40peuZ2R8mAUSBvWgD7z2qWhF8YgDb7wWaFjg53I36vWKn90ZEti3wNCw\n"
+        + "qAVqixM+J0qJmQStgAc53i2aTMvAQu3A3snvH/PHTBo+5UL72n9S1kZyNCsVf1Qo\n"
+        + "n8jKTiRriEM+fMFlcgQP284EBFzYHyCXFb9O/hMjK2+6mY9euMB1U1aFFzM/Bg==\n"
+        + "-----END CERTIFICATE-----\n").getBytes();
+
+    /**
+     * Intermediate CA for all of these.
+     */
+    public static final byte[] X509_INTERMEDIATE_CA = ("-----BEGIN CERTIFICATE-----\n"
+        + "MIIEnDCCA4SgAwIBAgIJAJTNwZ6yNa5cMA0GCSqGSIb3DQEBBQUAMIGGMQswCQYD\n"
+        + "VQQGEwJDQTELMAkGA1UECBMCQkMxFjAUBgNVBAoTDXd3dy5jdWNiYy5jb20xFDAS\n"
+        + "BgNVBAsUC2NvbW1vbnNfc3NsMRUwEwYDVQQDFAxkZW1vX3Jvb3RfY2ExJTAjBgkq\n"
+        + "hkiG9w0BCQEWFmp1bGl1c2Rhdmllc0BnbWFpbC5jb20wHhcNMDYxMTA1MjE0OTMx\n"
+        + "WhcNMDcxMTA1MjE0OTMxWjCBojELMAkGA1UEBhMCQ0ExCzAJBgNVBAgTAkJDMRIw\n"
+        + "EAYDVQQHEwlWYW5jb3V2ZXIxFjAUBgNVBAoTDXd3dy5jdWNiYy5jb20xFDASBgNV\n"
+        + "BAsUC2NvbW1vbnNfc3NsMR0wGwYDVQQDFBRkZW1vX2ludGVybWVkaWF0ZV9jYTEl\n"
+        + "MCMGCSqGSIb3DQEJARYWanVsaXVzZGF2aWVzQGdtYWlsLmNvbTCCASIwDQYJKoZI\n"
+        + "hvcNAQEBBQADggEPADCCAQoCggEBAL0S4y3vUO0EM6lwqOEfK8fvrUprIbsikXaG\n"
+        + "XzejcZ+T3l2Dc7t8WtBfRf78i4JypMqJQSijrUicj3H6mOMIReKaXm6ls4hA5d8w\n"
+        + "Lhmgiqsz/kW+gA8SeWGWRN683BD/RbQmzOls6ynBvap9jZlthXWBrSIlPCQoBLXY\n"
+        + "KVaxGzbL4ezaq+XFMKMQSm2uKwVmHHQNbfmZlPsuendBVomb/ked53Ab9IH6dwwN\n"
+        + "qJH9WIrvIzIVEXWlpvQ5MCqozM7u1akU+G8cazr8theGPCaYkzoXnigWua4OjdpV\n"
+        + "9z5ZDknhfBzG1AjapdG07FIirwWWgIyZXqZSD96ikmLtwT29qnsCAwEAAaOB7jCB\n"
+        + "6zAdBgNVHQ4EFgQUe5raj5CZTlLSrNuzA1LKh6YNPg0wgbsGA1UdIwSBszCBsIAU\n"
+        + "rN8eFIvMiRFXXgDqKumS0/W2AhOhgYykgYkwgYYxCzAJBgNVBAYTAkNBMQswCQYD\n"
+        + "VQQIEwJCQzEWMBQGA1UEChMNd3d3LmN1Y2JjLmNvbTEUMBIGA1UECxQLY29tbW9u\n"
+        + "c19zc2wxFTATBgNVBAMUDGRlbW9fcm9vdF9jYTElMCMGCSqGSIb3DQEJARYWanVs\n"
+        + "aXVzZGF2aWVzQGdtYWlsLmNvbYIJAJTNwZ6yNa5bMAwGA1UdEwQFMAMBAf8wDQYJ\n"
+        + "KoZIhvcNAQEFBQADggEBAIB4KMZvHD20pdKajFtMBpL7X4W4soq6EeTtjml3NYa9\n"
+        + "Qc52bsQEGNccKY9afYSBIndaQvFdtmz6HdoN+B8TjYShw2KhyjtKimGLpWYoi1YF\n"
+        + "e4aHdmA/Gp5xk8pZzR18FmooxC9RqBux+NAM2iTFSLgDtGIIj4sg2rbn6Bb6ZlQT\n"
+        + "1rg6VucXCA1629lNfMeNcu7CBNmUKIdaxHR/YJQallE0KfGRiOIWPrPj/VNk0YA6\n"
+        + "XFg0ocjqXJ2/N0N9rWVshMUaXgOh7m4D/5zga5/nuxDU+PoToA6mQ4bV6eCYqZbh\n"
+        + "aa1kQYtR9B4ZiG6pB82qVc2dCqStOH2FAEWos2gAVkQ=\n" + "-----END CERTIFICATE-----\n")
+        .getBytes();
+
+    /**
+     * Root CA for all of these.
+     */
+    public static final byte[] X509_ROOT_CA = ("-----BEGIN CERTIFICATE-----\n"
+        + "MIIEgDCCA2igAwIBAgIJAJTNwZ6yNa5bMA0GCSqGSIb3DQEBBQUAMIGGMQswCQYD\n"
+        + "VQQGEwJDQTELMAkGA1UECBMCQkMxFjAUBgNVBAoTDXd3dy5jdWNiYy5jb20xFDAS\n"
+        + "BgNVBAsUC2NvbW1vbnNfc3NsMRUwEwYDVQQDFAxkZW1vX3Jvb3RfY2ExJTAjBgkq\n"
+        + "hkiG9w0BCQEWFmp1bGl1c2Rhdmllc0BnbWFpbC5jb20wHhcNMDYxMTA1MjEzNjQz\n"
+        + "WhcNMjYxMTA1MjEzNjQzWjCBhjELMAkGA1UEBhMCQ0ExCzAJBgNVBAgTAkJDMRYw\n"
+        + "FAYDVQQKEw13d3cuY3VjYmMuY29tMRQwEgYDVQQLFAtjb21tb25zX3NzbDEVMBMG\n"
+        + "A1UEAxQMZGVtb19yb290X2NhMSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZpZXNA\n"
+        + "Z21haWwuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv+OnocmJ\n"
+        + "79UeO2hlCwK+Cle5uZWnU6uwJl+08z5cvebb5tT64WL9+psDbfgUH/Gm9JsuxKTg\n"
+        + "w1tZO/4duIgnaLNSx4HoqaTjwigd/hR3TsoGEPXTCkz1ikgTCOEDvl+iMid6aOrd\n"
+        + "mViE8HhscxKZ+h5FE7oHZyuT6gFoiaIXhFq+xK2w4ZwDz9L+paiwqywyUJJMnh9U\n"
+        + "jKorY+nua81N0oxpIhHPspCanDU4neMzCzYOZyLR/LqV5xORvHcFY84GWMz5hI25\n"
+        + "JbgaWJsYKuCAvNsnQwVoqKPGa7x1fn7x6oGsXJaCVt8weUwIj2xwg1lxMhrNaisH\n"
+        + "EvKpEAEnGGwWKQIDAQABo4HuMIHrMB0GA1UdDgQWBBSs3x4Ui8yJEVdeAOoq6ZLT\n"
+        + "9bYCEzCBuwYDVR0jBIGzMIGwgBSs3x4Ui8yJEVdeAOoq6ZLT9bYCE6GBjKSBiTCB\n"
+        + "hjELMAkGA1UEBhMCQ0ExCzAJBgNVBAgTAkJDMRYwFAYDVQQKEw13d3cuY3VjYmMu\n"
+        + "Y29tMRQwEgYDVQQLFAtjb21tb25zX3NzbDEVMBMGA1UEAxQMZGVtb19yb290X2Nh\n"
+        + "MSUwIwYJKoZIhvcNAQkBFhZqdWxpdXNkYXZpZXNAZ21haWwuY29tggkAlM3BnrI1\n"
+        + "rlswDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAlPl3/8h1LttR1svC\n"
+        + "S8RXbHpAWIT2BEDhGHUNjSmgDQNkE/itf/FCEXh0tlU4bYdtBSOHzflbnzOyIPId\n"
+        + "VZeSWs33V38xDFy6KoVg1gT8JxkLmE5S1vWkpsHIlpw/U6r7KD0Kx9FYx5AiXjw0\n"
+        + "lzz/zlVNuO2U09KIDwDPVG1mBzQiMiSWj1U1pM4KxINkWQwDy/fvu/I983s8lW5z\n"
+        + "hf2WuFNzQN3fcMK5dpBE9NVIu27oYuGYh2sak34v+7T700W2ooBB71qFXtm9P5rl\n"
+        + "Yp9RCEsg3KEEPNTtCBs8fROeXvLDrP0cmBIqwGYDuRNCxFDTOdjv6YGdA8nLOjaH\n" + "2dDk0g==\n"
+        + "-----END CERTIFICATE-----\n").getBytes();
+
+    /**
+     * Below is the private key for all the server certificates above (but
+     * not the intermediate CA or the root CA).  All of those server certs
+     * came from the same private key.
+     */
+    public static final String RSA_PUBLIC_MODULUS =
+        "00c863af96823e8ca9d11d62ae85807e713204c1985a80a2747f7ac863c5"
+            + "8d82e8c1ecf9698298d4838a4d8d81958868e0ef385f6e3842b653465f24"
+            + "41b62dc671a1e204820fe67c82367f80cbcb52586a39bf965cf0141cc077"
+            + "f46472cdeac0fd9b6b954a9ffa52a8d2e59ca1cc5e45cefbd4a37c70f1f7"
+            + "9c7674ad5d07c78640672e94e31c4e6dee2bb52558d3b84d29701bda8767"
+            + "56a83371888390b57c8a5bc49a8356316ae9f1406a913729121621098a77"
+            + "713920270312baabfc06a9c677cef1414dc5559238b5bb6407e2b38c3f73"
+            + "cfc4020c901f0e3647474dca350e66c4e817c31c0ac3a94631a895253c69"
+            + "4caab29bddf085893dde5de87047b9e5cd";
+
+    public static final String RSA_PUBLIC_EXPONENT = "65537";
+
+    public static final String RSA_PRIVATE_EXPONENT =
+        "577abd3295553d0efd4d38c13b62a6d03fa7b7e40cce4f1d5071877d96c6"
+            + "7a39a63f0f7ab21a89db8acae45587b3ef251309a70f74dc1ac02bde68f3"
+            + "8ed658e54e685ed370a18c054449512ea66a2252ed36e82b565b5159ec83"
+            + "f23df40ae189550a183865b25fd77789e960f0d8cedcd72f32d7a66edb4b"
+            + "a0a2baf3fbeb6c7d75f56ef0af9a7cff1c8c7f297d72eae7982164e50a89"
+            + "d450698cf598d39343201094241d2d180a95882a7111e58f4a5bdbc5c125"
+            + "a967dd6ed9ec614c5853e88e4c71e8b682a7cf89cb1d82b6fe78cc865084"
+            + "c8c5dfbb50c939df2b839c977b0245bfa3615e0592b527b1013d5b675ecb"
+            + "44e6b355c1df581f50997175166eef39";
+
+    public static final String RSA_PRIME1 =
+        "00fe759c4f0ce8b763880215e82767e7a937297668f4e4b1e119c6b22a3c"
+            + "a2c7b06c547d88d0aa45f645d7d3aeadaf7f8bc594deae0978529592977c"
+            + "b1ff890f05033a9e9e15551cad9fbf9c41d12139ccd99c1c3ac7b2197eff"
+            + "350d236bb900c1440953b64956e0a058ef824a2e16894af175177c77dbe1" + "fef7d8b532608d2513";
+
+    public static final String RSA_PRIME2 =
+        "00c99a45878737a4cf73f9896680b75487f1b669b7686a6ba07103856f31"
+            + "db668c2c440c44cdd116f708f631c37a9adf119f5b5cb58ffe3dc62e20af"
+            + "af72693d936dc6bb3c5194996468389c1f094079b81522e94572b4ad7d39"
+            + "529178e9b8ebaeb1f0fdd83b8731c5223f1dea125341d1d64917f6b1a6ae" + "c18d320510d79f859f";
+
+    public static final String RSA_EXPONENT1 =
+        "029febf0d4cd41b7011c2465b4a259bd6118486464c247236f44a169d61e"
+            + "47b9062508f674508d5031003ceabc57e714e600d71b2c75d5443db2da52"
+            + "6bb45a374f0537c5a1aab3150764ce93cf386c84346a6bd01f6732e42075"
+            + "c7a0e9e78a9e73b934e7d871d0f75673820089e129a1604438edcbbeb4e2" + "106467da112ce389";
+
+    public static final String RSA_EXPONENT2 =
+        "00827e76650c946afcd170038d32e1f8386ab00d6be78d830efe382e45d4"
+            + "7ad4bd04e6231ee22e66740efbf52838134932c9f8c460cdccdec58a1424"
+            + "4427859192fd6ab6c58b74e97941b0eaf577f2a11713af5e5952af3ae124"
+            + "9a9a892e98410dfa2628d9af668a43b5302fb7d496c9b2fec69f595292b6" + "e997f079b0f6314eb7";
+
+    public static final String RSA_COEFFICIENT =
+        "00e6b62add350f1a2a8968903ff76c31cf703b0d7326c4a620aef01225b7"
+            + "1640b3f2ec375208c5f7299863f6005b7799b6e529bb1133c8435bf5fdb5"
+            + "a786f6cd8a19ee7094a384e6557c600a38845a0960ddbfd1df18d0af5740"
+            + "001853788f1b5ccbf9affb4c52c9d2efdb8aab0183d86735b32737fb4e79" + "2b8a9c7d91c7d175ae";
+
+    /**
+     * subjectAlt=IP Address:127.0.0.1, email:oleg@ural.ru, DNS:localhost.localdomain
+     */
+    public static final byte[] X509_MULTIPLE_SUBJECT_ALT = ("-----BEGIN CERTIFICATE-----\n"
+        + "MIIDcTCCAtqgAwIBAgIBATANBgkqhkiG9w0BAQUFADBAMQswCQYDVQQGEwJDSDEL\n"
+        + "MAkGA1UECBMCWkgxDzANBgNVBAcTBlp1cmljaDETMBEGA1UEAxMKTXkgVGVzdCBD\n"
+        + "QTAeFw0wODEwMzExMTU3NDVaFw0wOTEwMzExMTU3NDVaMGkxCzAJBgNVBAYTAkNI\n"
+        + "MRAwDgYDVQQIEwdVbmtub3duMRAwDgYDVQQHEwdVbmtub3duMRAwDgYDVQQKEwdV\n"
+        + "bmtub3duMRAwDgYDVQQLEwdVbmtub3duMRIwEAYDVQQDEwlsb2NhbGhvc3QwggG4\n"
+        + "MIIBLAYHKoZIzjgEATCCAR8CgYEA/X9TgR11EilS30qcLuzk5/YRt1I870QAwx4/\n"
+        + "gLZRJmlFXUAiUftZPY1Y+r/F9bow9subVWzXgTuAHTRv8mZgt2uZUKWkn5/oBHsQ\n"
+        + "IsJPu6nX/rfGG/g7V+fGqKYVDwT7g/bTxR7DAjVUE1oWkTL2dfOuK2HXKu/yIgMZ\n"
+        + "ndFIAccCFQCXYFCPFSMLzLKSuYKi64QL8Fgc9QKBgQD34aCF1ps93su8q1w2uFe5\n"
+        + "eZSvu/o66oL5V0wLPQeCZ1FZV4661FlP5nEHEIGAtEkWcSPoTCgWE7fPCTKMyKbh\n"
+        + "PBZ6i1R8jSjgo64eK7OmdZFuo38L+iE1YvH7YnoBJDvMpPG+qFGQiaiD3+Fa5Z8G\n"
+        + "kotmXoB7VSVkAUw7/s9JKgOBhQACgYEA6ogAb/YLM1Rz9AoXKW4LA70VtFf7Mqqp\n"
+        + "divdu9f72WQc1vMKo1YMf3dQadkMfBYRvAAa1IXDnoiFCHhXnVRkWkoUBJyNebLB\n"
+        + "N92CZc0RVFZiMFgQMEh8UldnvAIi4cBk0/YuN3BGl4MzmquVIGrFovdWGqeaveOu\n"
+        + "Xcu4lKGJNiqjODA2MDQGA1UdEQQtMCuHBH8AAAGBDG9sZWdAdXJhbC5ydYIVbG9j\n"
+        + "YWxob3N0LmxvY2FsZG9tYWluMA0GCSqGSIb3DQEBBQUAA4GBAIgEwIoCSRkU3O7K\n"
+        + "USYaOYyfJB9hsvs6YpClvYXiQ/5kPGARP60pM62v4wC7wI9shEizokIAxY2+O3cC\n"
+        + "vwuJhNYaa2FJMELIwRN3XES8X8R6JHWbPaRjaAAPhczuEd8SZYy8yiVLmJTgw0gH\n"
+        + "BSW775NHlkjsscFVgXkNf0PobqJ9\n" + "-----END CERTIFICATE-----").getBytes();
+
+    /**
+     * subject CN=repository.infonotary.com (Multiple AVA in RDN).
+     */
+    public static final byte[] X509_MULTIPLE_VALUE_AVA = ("-----BEGIN CERTIFICATE-----\n"
+        + "MIIFxzCCBK+gAwIBAgIIRO/2+/XA7z4wDQYJKoZIhvcNAQEFBQAwgZwxgZkwCQYD\n"
+        + "VQQGDAJCRzAVBgNVBAoMDkluZm9Ob3RhcnkgUExDMBcGCgmSJomT8ixkARkWCWRv\n"
+        + "bWFpbi1jYTAtBgNVBAMMJmktTm90YXJ5IFRydXN0UGF0aCBWYWxpZGF0ZWQgRG9t\n"
+        + "YWluIENBMC0GA1UECwwmaS1Ob3RhcnkgVHJ1c3RQYXRoIFZhbGlkYXRlZCBEb21h\n"
+        + "aW4gQ0EwHhcNMTIwNjE4MDg1MzIyWhcNMTMwNjE4MDg1MzIyWjCBxjGBwzAJBgNV\n"
+        + "BAYTAkJHMBUGA1UEChMOSW5mb05vdGFyeSBQTEMwFwYDVQQLExBGaWxlcyBSZXBv\n"
+        + "c2l0b3J5MBcGCgmSJomT8ixkARkWCWRvbWFpbi1jYTAgBgNVBAMTGXJlcG9zaXRv\n"
+        + "cnkuaW5mb25vdGFyeS5jb20wIwYJKoZIhvcNAQkBFhZzdXBwb3J0QGluZm9ub3Rh\n"
+        + "cnkuY29tMCYGCSqGSIb3DQEJAhMZcmVwb3NpdG9yeS5pbmZvbm90YXJ5LmNvbTCC\n"
+        + "ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALKWjGpgsuz103xVEW/GSg5I\n"
+        + "tBoLbXPxockabOTHnOh0VO2sImycyhBH78nMj+VMexn4y+kdCOuJqAA5LApxyhTA\n"
+        + "KgKlRN7TfoC90IYHjB1dqLMIseg4YM7Oe0e4Z2nL50bHoqXg7OUHaILUQn7ufpYp\n"
+        + "+VCWxyI43KvaR4+HnST3x47wqeArg/rULGV1a16X+46cxq2eoMAcDfostXHaemvz\n"
+        + "vg/Wd5xcWfPbF/oY1/sBXH+AK+peVBMen82+3GtAWtNWbyPE3bT4RG+WgKUyfLZ1\n"
+        + "7A67rX9DkUEVMPQpa50MpLnrRveiM9w6R3mrMHMHbNnwID0Tqfds5zzOi/7cLD0C\n"
+        + "AwEAAaOCAd8wggHbMA4GA1UdDwEB/wQEAwIDuDATBgNVHSUEDDAKBggrBgEFBQcD\n"
+        + "ATBEBggrBgEFBQcBAQQ4MDYwNAYIKwYBBQUHMAGGKGh0dHA6Ly9vY3NwLmluZm9u\n"
+        + "b3RhcnkuY29tL3Jlc3BvbmRlci5jZ2kwgZAGA1UdIASBiDCBhTCBggYMKwYBBAGB\n"
+        + "rQABAgMBMHIwOAYIKwYBBQUHAgEWLGh0dHA6Ly9yZXBvc2l0b3J5LmluZm9ub3Rh\n"
+        + "cnkuY29tL2RvbWFpbi5odG1sMDYGCCsGAQUFBwICMCoaKGktTm90YXJ5IFZhbGlk\n"
+        + "YXRlZCBEb21haW4gQ2VydGlmaWNhdGUgQ1AwgYkGA1UdHwSBgTB/MDWgL6Athito\n"
+        + "dHRwOi8vY3JsLmluZm9ub3RhcnkuY29tL2NybC9kb21haW4tY2EuY3JsgQIBVjBG\n"
+        + "oECgPoY8bGRhcDovL2xkYXAuaW5mb25vdGFyeS5jb20vZGM9ZG9tYWluLWNhLGRj\n"
+        + "PWluZm9ub3RhcnksZGM9Y29tgQIBVjAPBgNVHRMBAf8EBTADAQEAMB0GA1UdDgQW\n"
+        + "BBTImKJZrgV/8n7mHrA0U5EeGsBvbzAfBgNVHSMEGDAWgBTbkorEK+bPdVPpvyVI\n"
+        + "PTxGFnuOoDANBgkqhkiG9w0BAQUFAAOCAQEAhsMbqsqvkbfVaKZ+wDY9rX3EtuDS\n"
+        + "isdAo4AjmWgTtj/aBGiEiXcIGP312x+0JF+mEEQ75ZOKN+WsM8eLB0F4aqylklk7\n"
+        + "6yRYauRXp8dfbXrT3ozxekt0cpSMqbzze456krI12nL+C00V2Iwq96k5J/yZboNW\n"
+        + "Q+ibCaEAHNiL4tGVHSHm6znkWvIuUTbDgDEsm5RdafO27suz5H6zMnV+VE6onN1J\n"
+        + "I1mQmUs44cg2HZAqnFBpDyJQhNYy8M7yGVaRkbfuVaMqiPa+xDPR5v7NFB3kxRq2\n"
+        + "Za2Snopi52eUxDEhJ0MNqFi3Jfj/ZSmJ+XHra5lU4R8lijCAq8SVLZCmIQ==\n"
+        + "-----END CERTIFICATE-----").getBytes();
+
+    public static final byte[] S_GOOGLE_COM = ("-----BEGIN CERTIFICATE-----\n"
+        + "MIICpzCCAY+gAwIBAgIBATANBgkqhkiG9w0BAQUFADAXMRUwEwYDVQQDDAwqLmdv\n"
+        + "b2dsZS5jb20wHhcNMTcwMTEzMjI0OTAzWhcNMTgwMTEzMjI0OTAzWjAXMRUwEwYD\n"
+        + "VQQDDAwqLmdvb2dsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB\n"
+        + "AQDHuzznuHdJ5PH344xCyGYnUnIRhyLGBKN3WDLLrXWtr/5Sf3Q1qkiMiJ4BINsh\n"
+        + "3Xy0z7VvHmMFlntgHXtkofBUPvTihxsVIypRkCZb5hpsWLotR10AW2JpVl/oxLP2\n"
+        + "227/36X1zKh33fjImLJl9KzGWHLsbCBleQQJOn7YRsNR/QBZO0XGGkN/R2rRfLF3\n"
+        + "rseRfI5gJjZkO0WDxocnf/iieOe0XNR0NAZaY1aozzPmZ/pRrOKYB8OFH7F73WOC\n"
+        + "lPIUGai/byJ9SpbXdLUcMlGhml/4XzcnV/WVRD2P/mlY+xEFG3UEy3ufhNnKFJul\n"
+        + "yjZrOaKbagamqtOyktzkjnerAgMBAAEwDQYJKoZIhvcNAQEFBQADggEBADaMcwVs\n"
+        + "w5kbnoDJzMBJ01H16T4u8k78i/ybwz7u7krgkU0tABXCRj7S/4Dt3jqQ/rV6evj4\n"
+        + "gIJ/2kZUp/PHKkV7CxWI48XBTAQUu9LEpxj0Hut3AtNMD9y/J6cFn2978tWsHFHI\n"
+        + "mYgvclKUDE4WFMvuxfQVuX3RcGQ5i8khEMczY/KVhZYDcLU1PU0GTTJqqrQm59Z4\n"
+        + "T4UyI3OPBR7Nb/kaU1fcgQ083uxRXcNYRMMZnU6c2oFnR+c6pO6aGoXo0C6rgC4R\n"
+        + "pOj4hPvHCfZO2xg6HAdQ7UPALLX8pu5KGot7GRc8yiJ/Q1nBEuiPKKu0MIwQoFgP\n"
+        + "WUux/APTsgLR7Vc=\n" + "-----END CERTIFICATE-----").getBytes();
+
+    public static final byte[] IP_1_1_1_1 = ("-----BEGIN CERTIFICATE-----\n"
+        + "MIICwjCCAaqgAwIBAgIBATANBgkqhkiG9w0BAQUFADAaMRgwFgYDVQQDEw9kdW1t\n"
+        + "eS12YWx1ZS5jb20wHhcNMTcwMTEzMjI1MTQ2WhcNMTgwMTEzMjI1MTQ2WjAaMRgw\n"
+        + "FgYDVQQDEw9kdW1teS12YWx1ZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw\n"
+        + "ggEKAoIBAQDfrapp3jHLp1RlElzpR/4sF9AcTYwMF1N+adkHRoVtmTlJV2lTIAjn\n"
+        + "QLauy0Kkzv8uxmbID3uROgrFNDQ5RxTTCe+kW/vE6Pyzr5Z5ayjSTKeycTE7mAC4\n"
+        + "6ntoCeEWiD593zlfqVo5PuRSp9Kusd+kexNVjC/BETDPa3yXctcH1ouW9GyGItgQ\n"
+        + "u4GhCE8cipKMuTltgfK+Gh/5e9lFG9/F2fD+wHUVBULLR3JOQoqwgk2zAwKDwLuS\n"
+        + "sEd1CBi35+W3apCKN0SEdTKIAxc/R+O/1j2hpOl9yXCCYyveGwJdFXVZtDcx+9/H\n"
+        + "7NXhOdmw/mTXC5fOQGKciEo2SXt8Wp89AgMBAAGjEzARMA8GA1UdEQQIMAaHBAEB\n"
+        + "AQEwDQYJKoZIhvcNAQEFBQADggEBAEAO6CE8twpcfdjk9oMjI5nX9GdC5Wt6+ujd\n"
+        + "tLj0SbXvMKzCLLkveT0xTEzXfyEo8KW2qYYvPP1h83BIxsbR/J3Swt35UQVofv+4\n"
+        + "JgO0FIdgB+iLEcjUh5+60xslylqWE+9bSWm4f06OXuv78tq5NYPZKku/3i4tqLRp\n"
+        + "gH2rTtjX7Q4olSS7GdAgfiA2AnDZAbMtxtsnTt/QFpYQqhlkqHVDwgkGP7C8aMBD\n"
+        + "RH0UIQCPxUkhwhtNmVyHO42r6oHXselZoVU6XRHuhogrGxPf/pzDUvrKBiJhsZQQ\n"
+        + "oEu+pZCwkFLiNwUoq1G2oDpkkdBWB0JcBXB2Txa536ezFFWZYc0=\n" + "-----END CERTIFICATE-----")
+        .getBytes();
+
+    public static final byte[] EMAIL_ALT_SUBJECT_NAME = ("-----BEGIN CERTIFICATE-----\n"
+        + "MIIDpTCCAo2gAwIBAgIJANqkMEtlkelbMA0GCSqGSIb3DQEBCwUAMHAxCzAJBgNV\n"
+        + "BAYTAlVTMQswCQYDVQQIDAJWQTERMA8GA1UEBwwIU29tZUNpdHkxEjAQBgNVBAoM\n"
+        + "CU15Q29tcGFueTETMBEGA1UECwwKTXlEaXZpc2lvbjEYMBYGA1UEAwwPd3d3LmNv\n"
+        + "bXBhbnkuY29tMB4XDTE4MDIxNTA3MjkzMFoXDTIwMDIxNTA3MjkzMFowcDELMAkG\n"
+        + "A1UEBhMCVVMxCzAJBgNVBAgMAlZBMREwDwYDVQQHDAhTb21lQ2l0eTESMBAGA1UE\n"
+        + "CgwJTXlDb21wYW55MRMwEQYDVQQLDApNeURpdmlzaW9uMRgwFgYDVQQDDA93d3cu\n"
+        + "Y29tcGFueS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC4v6Oq\n"
+        + "Ua0goRVn1cmT7MOpJhXFm3A70bTpvJIRpEjtGIz99hb34/9r5AYyf1VhKyWmBq24\n"
+        + "XNcOJ59XOlyjjbm2Tl811ufTOdcNbPadoVBmMt4039OSUFpVb4wAw2XPWLTCG2h1\n"
+        + "HNj9GuFHmwcDsg5EiIRrhDGQm2LLLAGoe5PdReoMZCeeWzNWvKTCV14pyRzwQhJL\n"
+        + "F1OmzLYzovbPfB8LZVhQgDbLsh034FScivf2oKDB+NEzAEagNpnrFR0MFLWGYsu1\n"
+        + "nWD5RiZi78HFGiibmhH7QrEPfGlo2eofuUga6naoBUROqkmMCIL8n1HZ/Ur0oGny\n"
+        + "vQCj1AyrfOhuVC53AgMBAAGjQjBAMAsGA1UdDwQEAwIEMDATBgNVHSUEDDAKBggr\n"
+        + "BgEFBQcDATAcBgNVHREEFTATgRFlbWFpbEBleGFtcGxlLmNvbTANBgkqhkiG9w0B\n"
+        + "AQsFAAOCAQEAZ0IsqRrsEmJ6Fa9Yo6PQtrKJrejN2TTDddVgyLQdokzWh/25JFad\n"
+        + "NCMYPH5KjTUyKf96hJDlDayjbKk1PMMhSZMU5OG9NOuGMH/dQttruG1ojse7KIKg\n"
+        + "yHDQrfq5Exxgfa7CMHRKAoTCY7JZhSLyVbTMVhmGfuUDad/RA86ZisXycp0ZmS97\n"
+        + "qDkAmzFL0sL0ZUWNNUh4ZUWvCUZwiuN08z70NjGqXMTDCf68p3SYxbII0xTfScgf\n"
+        + "aQ/A/hD7IbGGTexeoTwpEj01DNvefbQV6//neo32/R5XD0D5jn3TCgZcMThA6H3a\n"
+        + "VkEghVg+s7uMfL/UEebOBQWXQJ/uVoknMA==\n" + "-----END CERTIFICATE-----").getBytes();
+
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/FileChangeWatcherTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/FileChangeWatcherTest.java
index bbac072833f..4a062560edb 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/FileChangeWatcherTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/FileChangeWatcherTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.common;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
@@ -31,34 +31,25 @@
 import java.util.concurrent.atomic.AtomicInteger;
 import org.apache.commons.io.FileUtils;
 import org.apache.zookeeper.ZKTestCase;
-import org.apache.zookeeper.test.ClientBase;
-import org.junit.AfterClass;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 public class FileChangeWatcherTest extends ZKTestCase {
 
-    private static File tempDir;
-    private static File tempFile;
+    @TempDir
+    static File tempDir;
+    static File tempFile;
 
     private static final Logger LOG = LoggerFactory.getLogger(FileChangeWatcherTest.class);
 
-    @BeforeClass
+    private static final long FS_TIMEOUT = 30000L;
+
+    @BeforeAll
     public static void createTempFile() throws IOException {
-        tempDir = ClientBase.createEmptyTestDir();
         tempFile = File.createTempFile("zk_test_", "", tempDir);
-        tempFile.deleteOnExit();
-    }
-
-    @AfterClass
-    public static void cleanupTempDir() {
-        try {
-            FileUtils.deleteDirectory(tempDir);
-        } catch (IOException e) {
-            // ignore
-        }
     }
 
     @Test
@@ -87,9 +78,9 @@ public void testCallbackWorksOnFileChanges() throws IOException, InterruptedExce
                 FileUtils.writeStringToFile(tempFile, "Hello world " + i + "\n", StandardCharsets.UTF_8, true);
                 synchronized (events) {
                     if (events.size() < i + 1) {
-                        events.wait(3000L);
+                        events.wait(FS_TIMEOUT);
                     }
-                    assertEquals("Wrong number of events", i + 1, events.size());
+                    assertEquals(i + 1, events.size(), "Wrong number of events");
                     WatchEvent<?> event = events.get(i);
                     assertEquals(StandardWatchEventKinds.ENTRY_MODIFY, event.kind());
                     assertEquals(tempFile.getName(), event.context().toString());
@@ -128,7 +119,7 @@ public void testCallbackWorksOnFileTouched() throws IOException, InterruptedExce
             FileUtils.touch(tempFile);
             synchronized (events) {
                 if (events.isEmpty()) {
-                    events.wait(3000L);
+                    events.wait(FS_TIMEOUT);
                 }
                 assertFalse(events.isEmpty());
                 WatchEvent<?> event = events.get(0);
@@ -162,7 +153,7 @@ public void testCallbackWorksOnFileAdded() throws IOException, InterruptedExcept
             tempFile2.deleteOnExit();
             synchronized (events) {
                 if (events.isEmpty()) {
-                    events.wait(3000L);
+                    events.wait(FS_TIMEOUT);
                 }
                 assertFalse(events.isEmpty());
                 WatchEvent<?> event = events.get(0);
@@ -201,7 +192,7 @@ public void testCallbackWorksOnFileDeleted() throws IOException, InterruptedExce
             tempFile.delete();
             synchronized (events) {
                 if (events.isEmpty()) {
-                    events.wait(3000L);
+                    events.wait(FS_TIMEOUT);
                 }
                 assertFalse(events.isEmpty());
                 WatchEvent<?> event = events.get(0);
@@ -239,14 +230,14 @@ public void testCallbackErrorDoesNotCrashWatcherThread() throws IOException, Int
             FileUtils.writeStringToFile(tempFile, "Hello world\n", StandardCharsets.UTF_8, true);
             synchronized (callCount) {
                 while (callCount.get() == 0) {
-                    callCount.wait(3000L);
+                    callCount.wait(FS_TIMEOUT);
                 }
             }
             LOG.info("Modifying file again");
             FileUtils.writeStringToFile(tempFile, "Hello world again\n", StandardCharsets.UTF_8, true);
             synchronized (callCount) {
                 if (callCount.get() == 1) {
-                    callCount.wait(3000L);
+                    callCount.wait(FS_TIMEOUT);
                 }
             }
             // The value of callCount can exceed 1 only if the callback thread
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/FileKeyStoreLoaderBuilderProviderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/FileKeyStoreLoaderBuilderProviderTest.java
index 52640e50509..6c5f38aa24b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/FileKeyStoreLoaderBuilderProviderTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/FileKeyStoreLoaderBuilderProviderTest.java
@@ -18,9 +18,10 @@
 
 package org.apache.zookeeper.common;
 
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class FileKeyStoreLoaderBuilderProviderTest extends ZKTestCase {
 
@@ -42,9 +43,11 @@ public void testGetBuilderForPKCS12FileType() {
         assertTrue(builder instanceof PKCS12FileLoader.Builder);
     }
 
-    @Test(expected = NullPointerException.class)
+    @Test
     public void testGetBuilderForNullFileType() {
-        FileKeyStoreLoaderBuilderProvider.getBuilderForKeyStoreFileType(null);
+        assertThrows(NullPointerException.class, () -> {
+            FileKeyStoreLoaderBuilderProvider.getBuilderForKeyStoreFileType(null);
+        });
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/JKSFileLoaderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/JKSFileLoaderTest.java
index 7a349bcde6a..f9247b89c5e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/JKSFileLoaderTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/JKSFileLoaderTest.java
@@ -18,95 +18,133 @@
 
 package org.apache.zookeeper.common;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import java.io.IOException;
 import java.security.KeyStore;
-import java.util.Collection;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.MethodSource;
 
-@RunWith(Parameterized.class)
 public class JKSFileLoaderTest extends BaseX509ParameterizedTestCase {
 
-    @Parameterized.Parameters
-    public static Collection<Object[]> params() {
-        return BaseX509ParameterizedTestCase.defaultParams();
-    }
-
-    public JKSFileLoaderTest(
-            final X509KeyType caKeyType, final X509KeyType certKeyType, final String keyPassword, final Integer paramIndex) {
-        super(paramIndex, () -> {
-            try {
-                return X509TestContext.newBuilder().setTempDir(tempDir).setKeyStorePassword(keyPassword).setKeyStoreKeyType(certKeyType).setTrustStorePassword(keyPassword).setTrustStoreKeyType(caKeyType).build();
-            } catch (Exception e) {
-                throw new RuntimeException(e);
-            }
-        });
-    }
-
-    @Test
-    public void testLoadKeyStore() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStore(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.JKS).getAbsolutePath();
         KeyStore ks = new JKSFileLoader.Builder().setKeyStorePath(path).setKeyStorePassword(x509TestContext.getKeyStorePassword()).build().loadKeyStore();
         assertEquals(1, ks.size());
     }
 
-    @Test(expected = Exception.class)
-    public void testLoadKeyStoreWithWrongPassword() throws Exception {
-        String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.JKS).getAbsolutePath();
-        new JKSFileLoader.Builder().setKeyStorePath(path).setKeyStorePassword("wrong password").build().loadKeyStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStoreWithWrongPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(Exception.class, () -> {
+            String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.JKS).getAbsolutePath();
+            new JKSFileLoader.Builder().setKeyStorePath(path).setKeyStorePassword("wrong password").build().loadKeyStore();
+        });
     }
 
-    @Test(expected = IOException.class)
-    public void testLoadKeyStoreWithWrongFilePath() throws Exception {
-        String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.JKS).getAbsolutePath();
-        new JKSFileLoader.Builder().setKeyStorePath(path
-                                                            + ".does_not_exist").setKeyStorePassword(x509TestContext.getKeyStorePassword()).build().loadKeyStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStoreWithWrongFilePath(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(IOException.class, () -> {
+            String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.JKS).getAbsolutePath();
+            new JKSFileLoader.Builder().setKeyStorePath(path
+                    + ".does_not_exist").setKeyStorePassword(x509TestContext.getKeyStorePassword()).build().loadKeyStore();
+        });
     }
 
-    @Test(expected = NullPointerException.class)
-    public void testLoadKeyStoreWithNullFilePath() throws Exception {
-        new JKSFileLoader.Builder().setKeyStorePassword(x509TestContext.getKeyStorePassword()).build().loadKeyStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStoreWithNullFilePath(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(NullPointerException.class, () -> {
+            new JKSFileLoader.Builder().setKeyStorePassword(x509TestContext.getKeyStorePassword()).build().loadKeyStore();
+        });
     }
 
-    @Test(expected = IOException.class)
-    public void testLoadKeyStoreWithWrongFileType() throws Exception {
-        // Trying to load a PEM file with JKS loader should fail
-        String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
-        new JKSFileLoader.Builder().setKeyStorePath(path).setKeyStorePassword(x509TestContext.getKeyStorePassword()).build().loadKeyStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStoreWithWrongFileType(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(IOException.class, () -> {
+            // Trying to load a PEM file with JKS loader should fail
+            String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
+            new JKSFileLoader.Builder().setKeyStorePath(path).setKeyStorePassword(x509TestContext.getKeyStorePassword()).build().loadKeyStore();
+        });
     }
 
-    @Test
-    public void testLoadTrustStore() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStore(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.JKS).getAbsolutePath();
         KeyStore ts = new JKSFileLoader.Builder().setTrustStorePath(path).setTrustStorePassword(x509TestContext.getTrustStorePassword()).build().loadTrustStore();
         assertEquals(1, ts.size());
     }
 
-    @Test(expected = Exception.class)
-    public void testLoadTrustStoreWithWrongPassword() throws Exception {
-        String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.JKS).getAbsolutePath();
-        new JKSFileLoader.Builder().setTrustStorePath(path).setTrustStorePassword("wrong password").build().loadTrustStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStoreWithWrongPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(Exception.class, () -> {
+            String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.JKS).getAbsolutePath();
+            new JKSFileLoader.Builder().setTrustStorePath(path).setTrustStorePassword("wrong password").build().loadTrustStore();
+        });
     }
 
-    @Test(expected = IOException.class)
-    public void testLoadTrustStoreWithWrongFilePath() throws Exception {
-        String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.JKS).getAbsolutePath();
-        new JKSFileLoader.Builder().setTrustStorePath(path
-                                                              + ".does_not_exist").setTrustStorePassword(x509TestContext.getTrustStorePassword()).build().loadTrustStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStoreWithWrongFilePath(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(IOException.class, () -> {
+            String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.JKS).getAbsolutePath();
+            new JKSFileLoader.Builder().setTrustStorePath(path
+                    + ".does_not_exist").setTrustStorePassword(x509TestContext.getTrustStorePassword()).build().loadTrustStore();
+        });
     }
 
-    @Test(expected = NullPointerException.class)
-    public void testLoadTrustStoreWithNullFilePath() throws Exception {
-        new JKSFileLoader.Builder().setTrustStorePassword(x509TestContext.getTrustStorePassword()).build().loadTrustStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStoreWithNullFilePath(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(NullPointerException.class, () -> {
+            new JKSFileLoader.Builder().setTrustStorePassword(x509TestContext.getTrustStorePassword()).build().loadTrustStore();
+        });
     }
 
-    @Test(expected = IOException.class)
-    public void testLoadTrustStoreWithWrongFileType() throws Exception {
-        // Trying to load a PEM file with JKS loader should fail
-        String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
-        new JKSFileLoader.Builder().setTrustStorePath(path).setTrustStorePassword(x509TestContext.getTrustStorePassword()).build().loadTrustStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStoreWithWrongFileType(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(IOException.class, () -> {
+            // Trying to load a PEM file with JKS loader should fail
+            String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
+            new JKSFileLoader.Builder().setTrustStorePath(path).setTrustStorePassword(x509TestContext.getTrustStorePassword()).build().loadTrustStore();
+        });
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/KeyStoreFileTypeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/KeyStoreFileTypeTest.java
index feeed810345..3f7faaabcc5 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/KeyStoreFileTypeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/KeyStoreFileTypeTest.java
@@ -18,10 +18,11 @@
 
 package org.apache.zookeeper.common;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNull;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class KeyStoreFileTypeTest extends ZKTestCase {
 
@@ -30,6 +31,7 @@ public void testGetPropertyValue() {
         assertEquals("PEM", KeyStoreFileType.PEM.getPropertyValue());
         assertEquals("JKS", KeyStoreFileType.JKS.getPropertyValue());
         assertEquals("PKCS12", KeyStoreFileType.PKCS12.getPropertyValue());
+        assertEquals("BCFKS", KeyStoreFileType.BCFKS.getPropertyValue());
     }
 
     @Test
@@ -37,6 +39,7 @@ public void testFromPropertyValue() {
         assertEquals(KeyStoreFileType.PEM, KeyStoreFileType.fromPropertyValue("PEM"));
         assertEquals(KeyStoreFileType.JKS, KeyStoreFileType.fromPropertyValue("JKS"));
         assertEquals(KeyStoreFileType.PKCS12, KeyStoreFileType.fromPropertyValue("PKCS12"));
+        assertEquals(KeyStoreFileType.BCFKS, KeyStoreFileType.fromPropertyValue("BCFKS"));
         assertNull(KeyStoreFileType.fromPropertyValue(""));
         assertNull(KeyStoreFileType.fromPropertyValue(null));
     }
@@ -46,13 +49,16 @@ public void testFromPropertyValueIgnoresCase() {
         assertEquals(KeyStoreFileType.PEM, KeyStoreFileType.fromPropertyValue("pem"));
         assertEquals(KeyStoreFileType.JKS, KeyStoreFileType.fromPropertyValue("jks"));
         assertEquals(KeyStoreFileType.PKCS12, KeyStoreFileType.fromPropertyValue("pkcs12"));
+        assertEquals(KeyStoreFileType.BCFKS, KeyStoreFileType.fromPropertyValue("bcfks"));
         assertNull(KeyStoreFileType.fromPropertyValue(""));
         assertNull(KeyStoreFileType.fromPropertyValue(null));
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testFromPropertyValueThrowsOnBadPropertyValue() {
-        KeyStoreFileType.fromPropertyValue("foobar");
+        assertThrows(IllegalArgumentException.class, () -> {
+            KeyStoreFileType.fromPropertyValue("foobar");
+        });
     }
 
     @Test
@@ -63,11 +69,15 @@ public void testFromFilename() {
         assertEquals(KeyStoreFileType.PEM, KeyStoreFileType.fromFilename("/path/to/key/dir/mykey.pem"));
         assertEquals(KeyStoreFileType.PKCS12, KeyStoreFileType.fromFilename("mykey.p12"));
         assertEquals(KeyStoreFileType.PKCS12, KeyStoreFileType.fromFilename("/path/to/key/dir/mykey.p12"));
+        assertEquals(KeyStoreFileType.BCFKS, KeyStoreFileType.fromFilename("mykey.bcfks"));
+        assertEquals(KeyStoreFileType.BCFKS, KeyStoreFileType.fromFilename("/path/to/key/dir/mykey.bcfks"));
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testFromFilenameThrowsOnBadFileExtension() {
-        KeyStoreFileType.fromFilename("prod.key");
+        assertThrows(IllegalArgumentException.class, () -> {
+            KeyStoreFileType.fromFilename("prod.key");
+        });
     }
 
     @Test
@@ -76,18 +86,23 @@ public void testFromPropertyValueOrFileName() {
         assertEquals(KeyStoreFileType.JKS, KeyStoreFileType.fromPropertyValueOrFileName("JKS", "prod.key"));
         assertEquals(KeyStoreFileType.PEM, KeyStoreFileType.fromPropertyValueOrFileName("PEM", "prod.key"));
         assertEquals(KeyStoreFileType.PKCS12, KeyStoreFileType.fromPropertyValueOrFileName("PKCS12", "prod.key"));
+        assertEquals(KeyStoreFileType.BCFKS, KeyStoreFileType.fromPropertyValueOrFileName("BCFKS", "prod.key"));
         // Falls back to filename detection if no property value
         assertEquals(KeyStoreFileType.JKS, KeyStoreFileType.fromPropertyValueOrFileName("", "prod.jks"));
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testFromPropertyValueOrFileNameThrowsOnBadPropertyValue() {
-        KeyStoreFileType.fromPropertyValueOrFileName("foobar", "prod.jks");
+        assertThrows(IllegalArgumentException.class, () -> {
+            KeyStoreFileType.fromPropertyValueOrFileName("foobar", "prod.jks");
+        });
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testFromPropertyValueOrFileNameThrowsOnBadFileExtension() {
-        KeyStoreFileType.fromPropertyValueOrFileName("", "prod.key");
+        assertThrows(IllegalArgumentException.class, () -> {
+            KeyStoreFileType.fromPropertyValueOrFileName("", "prod.key");
+        });
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/LogRedactorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/LogRedactorTest.java
new file mode 100644
index 00000000000..a15696f0275
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/LogRedactorTest.java
@@ -0,0 +1,100 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Properties;
+import org.junit.jupiter.api.Test;
+
+class LogRedactorTest {
+
+    @Test
+    void testRedactValueWithPasswordKey() {
+        assertEquals("***", LogRedactor.redactValue("ssl.keyStore.password", "secret"));
+        assertEquals("***", LogRedactor.redactValue("ssl.trustStore.password", "secret"));
+        assertEquals("***", LogRedactor.redactValue("somePassword", "secret"));
+    }
+
+    @Test
+    void testRedactValueCaseInsensitive() {
+        assertEquals("***", LogRedactor.redactValue("ssl.keyStore.PASSWORD", "secret"));
+        assertEquals("***", LogRedactor.redactValue("ssl.keyStore.Password", "secret"));
+        assertEquals("***", LogRedactor.redactValue("ssl.keyStore.passWORD", "secret"));
+    }
+
+    @Test
+    void testRedactValueNonSensitiveKey() {
+        assertEquals("localhost", LogRedactor.redactValue("server.host", "localhost"));
+        assertEquals("8080", LogRedactor.redactValue("httpPort", "8080"));
+        assertEquals("/path/to/keystore", LogRedactor.redactValue("ssl.keyStore.location", "/path/to/keystore"));
+    }
+
+    @Test
+    void testRedactValueNullKey() {
+        assertEquals("someValue", LogRedactor.redactValue(null, "someValue"));
+    }
+
+    @Test
+    void testRedactSensitiveValuesWithStringMap() {
+        Map<String, String> config = new HashMap<>();
+        config.put("ssl.keyStore.location", "/path/to/keystore.jks");
+        config.put("ssl.keyStore.password", "SuperSecret");
+        config.put("httpPort", "9141");
+
+        Properties redacted = LogRedactor.redactSensitiveValues(config);
+
+        assertEquals("/path/to/keystore.jks", redacted.get("ssl.keyStore.location"));
+        assertEquals("***", redacted.get("ssl.keyStore.password"));
+        assertEquals("9141", redacted.get("httpPort"));
+    }
+
+    @Test
+    void testRedactSensitiveValuesWithProperties() {
+        Properties config = new Properties();
+        config.setProperty("ssl.trustStore.password", "TrustSecret");
+        config.setProperty("ssl.trustStore.location", "/path/to/truststore.jks");
+
+        Properties redacted = LogRedactor.redactSensitiveValues(config);
+
+        assertEquals("***", redacted.get("ssl.trustStore.password"));
+        assertEquals("/path/to/truststore.jks", redacted.get("ssl.trustStore.location"));
+    }
+
+    @Test
+    void testRedactSensitiveValuesSkipsNullValues() {
+        Map<String, String> config = new HashMap<>();
+        config.put("ssl.keyStore.location", null);
+        config.put("httpPort", "9141");
+
+        Properties redacted = LogRedactor.redactSensitiveValues(config);
+
+        assertFalse(redacted.containsKey("ssl.keyStore.location"));
+        assertEquals("9141", redacted.get("httpPort"));
+    }
+
+    @Test
+    void testRedactSensitiveValuesEmptyMap() {
+        Properties redacted = LogRedactor.redactSensitiveValues(new HashMap<>());
+        assertTrue(redacted.isEmpty());
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/NetUtilsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/NetUtilsTest.java
index c61eeba4e39..fbe49221470 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/NetUtilsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/NetUtilsTest.java
@@ -18,13 +18,13 @@
 
 package org.apache.zookeeper.common;
 
-import static org.hamcrest.CoreMatchers.anyOf;
 import static org.hamcrest.CoreMatchers.equalTo;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertThat;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import java.net.InetSocketAddress;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class NetUtilsTest extends ZKTestCase {
 
@@ -39,7 +39,7 @@ public class NetUtilsTest extends ZKTestCase {
     @Test
     public void testFormatInetAddrGoodIpv4() {
         InetSocketAddress isa = new InetSocketAddress(v4addr, port);
-        assertEquals("127.0.0.1:1234", NetUtils.formatInetAddr(isa));
+        assertEquals(v4local, NetUtils.formatInetAddr(isa));
     }
 
     @Test
@@ -59,8 +59,7 @@ public void testFormatInetAddrGoodIpv6Ext() {
     @Test
     public void testFormatInetAddrGoodHostname() {
         InetSocketAddress isa = new InetSocketAddress("localhost", 1234);
-
-        assertThat(NetUtils.formatInetAddr(isa), anyOf(equalTo(v4local), equalTo(v6local)));
+        assertThat(NetUtils.formatInetAddr(isa), equalTo("localhost:1234"));
     }
 
     @Test
@@ -69,4 +68,57 @@ public void testFormatAddrUnresolved() {
         assertEquals("doesnt.exist.com:1234", NetUtils.formatInetAddr(isa));
     }
 
+    @Test
+    public void tetGetIPV6HostAndPort_WhenHostDoesNotEndWithBracket() {
+        assertThrows(IllegalArgumentException.class, () -> {
+            NetUtils.getIPV6HostAndPort("[2001:0db8:85a3:0000:0000:8a2e:0370:7334:443");
+        });
+    }
+
+    @Test
+    public void tetGetIPV6HostAndPort_WhenNoPortAfterColon() {
+        assertThrows(IllegalArgumentException.class, () -> {
+            NetUtils.getIPV6HostAndPort("[2001:0db8:85a3:0000:0000:8a2e:0370:7334]:");
+        });
+    }
+
+    @Test
+    public void tetGetIPV6HostAndPort_WhenPortIsNotSeparatedProperly() {
+        assertThrows(IllegalArgumentException.class, () -> {
+            NetUtils.getIPV6HostAndPort("[2001:0db8:85a3:0000:0000:8a2e:0370:7334]2181");
+        });
+    }
+
+    @Test
+    public void tetGetIPV6HostAndPort_WhenHostIsEmpty() {
+        assertThrows(IllegalArgumentException.class, () -> {
+            NetUtils.getIPV6HostAndPort("[]:2181");
+        });
+    }
+
+    @Test
+    public void tetGetIPV6HostAndPort_EmptyStringArrayIfDoesNotStartWithBracket() {
+        String[] ipv6HostAndPort =
+            NetUtils.getIPV6HostAndPort("2001:0db8:85a3:0000:0000:8a2e:0370:7334]");
+        assertEquals(0, ipv6HostAndPort.length);
+    }
+
+    @Test
+    public void tetGetIPV6HostAndPort_ReturnHostPort() {
+        String[] ipv6HostAndPort =
+            NetUtils.getIPV6HostAndPort("[2001:0db8:85a3:0000:0000:8a2e:0370:7334]:2181");
+        assertEquals(2, ipv6HostAndPort.length);
+        assertEquals("2001:0db8:85a3:0000:0000:8a2e:0370:7334", ipv6HostAndPort[0]);
+        assertEquals("2181", ipv6HostAndPort[1]);
+    }
+
+    @Test
+    public void tetGetIPV6HostAndPort_ReturnHostPortPort() {
+        String[] ipv6HostAndPort =
+            NetUtils.getIPV6HostAndPort("[2001:0db8:85a3:0000:0000:8a2e:0370:7334]:2181:3181");
+        assertEquals(2, ipv6HostAndPort.length);
+        assertEquals("2001:0db8:85a3:0000:0000:8a2e:0370:7334", ipv6HostAndPort[0]);
+        assertEquals("2181:3181", ipv6HostAndPort[1]);
+    }
+
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/PEMFileLoaderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/PEMFileLoaderTest.java
index 05ef12e767c..8abe383a06e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/PEMFileLoaderTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/PEMFileLoaderTest.java
@@ -18,45 +18,23 @@
 
 package org.apache.zookeeper.common;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
 import java.security.KeyStore;
 import java.security.KeyStoreException;
-import java.util.Collection;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.MethodSource;
 
-@RunWith(Parameterized.class)
 public class PEMFileLoaderTest extends BaseX509ParameterizedTestCase {
 
-    @Parameterized.Parameters
-    public static Collection<Object[]> params() {
-        return BaseX509ParameterizedTestCase.defaultParams();
-    }
-
-    public PEMFileLoaderTest(
-        final X509KeyType caKeyType,
-        final X509KeyType certKeyType,
-        final String keyPassword,
-        final Integer paramIndex) {
-        super(paramIndex, () -> {
-            try {
-                return X509TestContext.newBuilder()
-                                      .setTempDir(tempDir)
-                                      .setKeyStorePassword(keyPassword)
-                                      .setKeyStoreKeyType(certKeyType)
-                                      .setTrustStorePassword(keyPassword)
-                                      .setTrustStoreKeyType(caKeyType)
-                                      .build();
-            } catch (Exception e) {
-                throw new RuntimeException(e);
-            }
-        });
-    }
-
-    @Test
-    public void testLoadKeyStore() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStore(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
         KeyStore ks = new PEMFileLoader.Builder()
             .setKeyStorePath(path)
@@ -66,76 +44,122 @@ public void testLoadKeyStore() throws Exception {
         assertEquals(1, ks.size());
     }
 
-    @Test(expected = Exception.class)
-    public void testLoadKeyStoreWithWrongPassword() throws Exception {
-        String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
-        new PEMFileLoader.Builder()
-            .setKeyStorePath(path)
-            .setKeyStorePassword("wrong password")
-            .build()
-            .loadKeyStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStoreWithWrongPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(Exception.class, () -> {
+            String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
+            new PEMFileLoader.Builder()
+                    .setKeyStorePath(path)
+                    .setKeyStorePassword("wrong password")
+                    .build()
+                    .loadKeyStore();
+        });
     }
 
-    @Test(expected = IOException.class)
-    public void testLoadKeyStoreWithWrongFilePath() throws Exception {
-        String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
-        new PEMFileLoader.Builder()
-            .setKeyStorePath(path + ".does_not_exist")
-            .setKeyStorePassword(x509TestContext.getKeyStorePassword())
-            .build()
-            .loadKeyStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStoreWithWrongFilePath(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(IOException.class, () -> {
+            String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
+            new PEMFileLoader.Builder()
+                    .setKeyStorePath(path + ".does_not_exist")
+                    .setKeyStorePassword(x509TestContext.getKeyStorePassword())
+                    .build()
+                    .loadKeyStore();
+        });
     }
 
-    @Test(expected = NullPointerException.class)
-    public void testLoadKeyStoreWithNullFilePath() throws Exception {
-        new PEMFileLoader.Builder()
-            .setKeyStorePassword(x509TestContext.getKeyStorePassword())
-            .build()
-            .loadKeyStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStoreWithNullFilePath(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(NullPointerException.class, () -> {
+            new PEMFileLoader.Builder()
+                    .setKeyStorePassword(x509TestContext.getKeyStorePassword())
+                    .build()
+                    .loadKeyStore();
+        });
     }
 
-    @Test(expected = KeyStoreException.class)
-    public void testLoadKeyStoreWithWrongFileType() throws Exception {
-        // Trying to load a JKS file with PEM loader should fail
-        String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.JKS).getAbsolutePath();
-        new PEMFileLoader.Builder()
-            .setKeyStorePath(path)
-            .setKeyStorePassword(x509TestContext.getKeyStorePassword())
-            .build()
-            .loadKeyStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStoreWithWrongFileType(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(KeyStoreException.class, () -> {
+            // Trying to load a JKS file with PEM loader should fail
+            String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.JKS).getAbsolutePath();
+            new PEMFileLoader.Builder()
+                    .setKeyStorePath(path)
+                    .setKeyStorePassword(x509TestContext.getKeyStorePassword())
+                    .build()
+                    .loadKeyStore();
+        });
     }
 
-    @Test
-    public void testLoadTrustStore() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStoreFromPemBundle(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
         KeyStore ts = new PEMFileLoader.Builder()
             .setTrustStorePath(path)
             .setTrustStorePassword(x509TestContext.getTrustStorePassword())
             .build()
             .loadTrustStore();
-        assertEquals(1, ts.size());
+        assertEquals(2, ts.size());
+        assertTrue(ts.containsAlias("cn=org.apache.zookeeper.common.x509testcontext root ca"));
+        assertTrue(ts.containsAlias("cn=org.apache.zookeeper.common.x509testcontext root ca-1"));
     }
 
-    @Test(expected = IOException.class)
-    public void testLoadTrustStoreWithWrongFilePath() throws Exception {
-        String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
-        new PEMFileLoader.Builder()
-            .setTrustStorePath(path + ".does_not_exist")
-            .setTrustStorePassword(x509TestContext.getTrustStorePassword())
-            .build()
-            .loadTrustStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStoreWithWrongFilePath(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(IOException.class, () -> {
+            String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
+            new PEMFileLoader.Builder()
+                    .setTrustStorePath(path + ".does_not_exist")
+                    .setTrustStorePassword(x509TestContext.getTrustStorePassword())
+                    .build()
+                    .loadTrustStore();
+        });
     }
 
-    @Test(expected = NullPointerException.class)
-    public void testLoadTrustStoreWithNullFilePath() throws Exception {
-        new PEMFileLoader.Builder()
-            .setTrustStorePassword(x509TestContext.getTrustStorePassword())
-            .build()
-            .loadTrustStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStoreWithNullFilePath(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(NullPointerException.class, () -> {
+            new PEMFileLoader.Builder()
+                    .setTrustStorePassword(x509TestContext.getTrustStorePassword())
+                    .build()
+                    .loadTrustStore();
+        });
     }
 
-    @Test
-    public void testLoadTrustStoreWithWrongFileType() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStoreWithWrongFileType(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         // Trying to load a JKS file with PEM loader should fail
         String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.JKS).getAbsolutePath();
         KeyStore ts = new PEMFileLoader.Builder()
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/PKCS12FileLoaderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/PKCS12FileLoaderTest.java
index 63d668315e2..93211f644db 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/PKCS12FileLoaderTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/PKCS12FileLoaderTest.java
@@ -18,44 +18,21 @@
 
 package org.apache.zookeeper.common;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import java.io.IOException;
 import java.security.KeyStore;
-import java.util.Collection;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.MethodSource;
 
-@RunWith(Parameterized.class)
 public class PKCS12FileLoaderTest extends BaseX509ParameterizedTestCase {
 
-    @Parameterized.Parameters
-    public static Collection<Object[]> params() {
-        return BaseX509ParameterizedTestCase.defaultParams();
-    }
-
-    public PKCS12FileLoaderTest(
-        final X509KeyType caKeyType,
-        final X509KeyType certKeyType,
-        final String keyPassword,
-        final Integer paramIndex) {
-        super(paramIndex, () -> {
-            try {
-                return X509TestContext.newBuilder()
-                                      .setTempDir(tempDir)
-                                      .setKeyStorePassword(keyPassword)
-                                      .setKeyStoreKeyType(certKeyType)
-                                      .setTrustStorePassword(keyPassword)
-                                      .setTrustStoreKeyType(caKeyType)
-                                      .build();
-            } catch (Exception e) {
-                throw new RuntimeException(e);
-            }
-        });
-    }
-
-    @Test
-    public void testLoadKeyStore() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStore(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath();
         KeyStore ks = new PKCS12FileLoader.Builder()
             .setKeyStorePath(path)
@@ -65,47 +42,75 @@ public void testLoadKeyStore() throws Exception {
         assertEquals(1, ks.size());
     }
 
-    @Test(expected = Exception.class)
-    public void testLoadKeyStoreWithWrongPassword() throws Exception {
-        String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath();
-        new PKCS12FileLoader.Builder()
-            .setKeyStorePath(path)
-            .setKeyStorePassword("wrong password")
-            .build()
-            .loadKeyStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStoreWithWrongPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(Exception.class, () -> {
+            String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath();
+            new PKCS12FileLoader.Builder()
+                    .setKeyStorePath(path)
+                    .setKeyStorePassword("wrong password")
+                    .build()
+                    .loadKeyStore();
+        });
     }
 
-    @Test(expected = IOException.class)
-    public void testLoadKeyStoreWithWrongFilePath() throws Exception {
-        String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath();
-        new PKCS12FileLoader.Builder()
-            .setKeyStorePath(path + ".does_not_exist")
-            .setKeyStorePassword(x509TestContext.getKeyStorePassword())
-            .build()
-            .loadKeyStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStoreWithWrongFilePath(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(IOException.class, () -> {
+            String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath();
+            new PKCS12FileLoader.Builder()
+                    .setKeyStorePath(path + ".does_not_exist")
+                    .setKeyStorePassword(x509TestContext.getKeyStorePassword())
+                    .build()
+                    .loadKeyStore();
+        });
     }
 
-    @Test(expected = NullPointerException.class)
-    public void testLoadKeyStoreWithNullFilePath() throws Exception {
-        new PKCS12FileLoader.Builder()
-            .setKeyStorePassword(x509TestContext.getKeyStorePassword())
-            .build()
-            .loadKeyStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStoreWithNullFilePath(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(NullPointerException.class, () -> {
+            new PKCS12FileLoader.Builder()
+                    .setKeyStorePassword(x509TestContext.getKeyStorePassword())
+                    .build()
+                    .loadKeyStore();
+        });
     }
 
-    @Test(expected = IOException.class)
-    public void testLoadKeyStoreWithWrongFileType() throws Exception {
-        // Trying to load a PEM file with PKCS12 loader should fail
-        String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
-        new PKCS12FileLoader.Builder()
-            .setKeyStorePath(path)
-            .setKeyStorePassword(x509TestContext.getKeyStorePassword())
-            .build()
-            .loadKeyStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadKeyStoreWithWrongFileType(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(IOException.class, () -> {
+            // Trying to load a PEM file with PKCS12 loader should fail
+            String path = x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
+            new PKCS12FileLoader.Builder()
+                    .setKeyStorePath(path)
+                    .setKeyStorePassword(x509TestContext.getKeyStorePassword())
+                    .build()
+                    .loadKeyStore();
+        });
     }
 
-    @Test
-    public void testLoadTrustStore() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStore(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath();
         KeyStore ts = new PKCS12FileLoader.Builder()
             .setTrustStorePath(path)
@@ -115,43 +120,67 @@ public void testLoadTrustStore() throws Exception {
         assertEquals(1, ts.size());
     }
 
-    @Test(expected = Exception.class)
-    public void testLoadTrustStoreWithWrongPassword() throws Exception {
-        String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath();
-        new PKCS12FileLoader.Builder()
-            .setTrustStorePath(path)
-            .setTrustStorePassword("wrong password")
-            .build()
-            .loadTrustStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStoreWithWrongPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(Exception.class, () -> {
+            String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath();
+            new PKCS12FileLoader.Builder()
+                    .setTrustStorePath(path)
+                    .setTrustStorePassword("wrong password")
+                    .build()
+                    .loadTrustStore();
+        });
     }
 
-    @Test(expected = IOException.class)
-    public void testLoadTrustStoreWithWrongFilePath() throws Exception {
-        String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath();
-        new PKCS12FileLoader.Builder()
-            .setTrustStorePath(path + ".does_not_exist")
-            .setTrustStorePassword(x509TestContext.getTrustStorePassword())
-            .build()
-            .loadTrustStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStoreWithWrongFilePath(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(IOException.class, () -> {
+            String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath();
+            new PKCS12FileLoader.Builder()
+                    .setTrustStorePath(path + ".does_not_exist")
+                    .setTrustStorePassword(x509TestContext.getTrustStorePassword())
+                    .build()
+                    .loadTrustStore();
+        });
     }
 
-    @Test(expected = NullPointerException.class)
-    public void testLoadTrustStoreWithNullFilePath() throws Exception {
-        new PKCS12FileLoader.Builder()
-            .setTrustStorePassword(x509TestContext.getTrustStorePassword())
-            .build()
-            .loadTrustStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStoreWithNullFilePath(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(NullPointerException.class, () -> {
+            new PKCS12FileLoader.Builder()
+                    .setTrustStorePassword(x509TestContext.getTrustStorePassword())
+                    .build()
+                    .loadTrustStore();
+        });
     }
 
-    @Test(expected = IOException.class)
-    public void testLoadTrustStoreWithWrongFileType() throws Exception {
-        // Trying to load a PEM file with PKCS12 loader should fail
-        String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
-        new PKCS12FileLoader.Builder()
-            .setTrustStorePath(path)
-            .setTrustStorePassword(x509TestContext.getTrustStorePassword())
-            .build()
-            .loadTrustStore();
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadTrustStoreWithWrongFileType(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(IOException.class, () -> {
+            // Trying to load a PEM file with PKCS12 loader should fail
+            String path = x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM).getAbsolutePath();
+            new PKCS12FileLoader.Builder()
+                    .setTrustStorePath(path)
+                    .setTrustStorePassword(x509TestContext.getTrustStorePassword())
+                    .build()
+                    .loadTrustStore();
+        });
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/PathTrieTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/PathTrieTest.java
index c7661647d91..1fac57f3365 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/PathTrieTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/PathTrieTest.java
@@ -18,29 +18,34 @@
 
 package org.apache.zookeeper.common;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import org.junit.Before;
-import org.junit.Test;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class PathTrieTest {
 
     private PathTrie pathTrie;
 
-    @Before
+    @BeforeEach
     public void before() {
         this.pathTrie = new PathTrie();
     }
 
-    @Test(expected = NullPointerException.class)
+    @Test
     public void addNullPath() {
-        this.pathTrie.addPath(null);
+        assertThrows(NullPointerException.class, () -> {
+            this.pathTrie.addPath(null);
+        });
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void addIllegalPath() {
-        this.pathTrie.addPath("");
+        assertThrows(IllegalArgumentException.class, () -> {
+            this.pathTrie.addPath("");
+        });
     }
 
     @Test
@@ -59,14 +64,18 @@ public void addPathToRootLeaves() {
         assertTrue(this.pathTrie.existsNode("/node1/node3"));
     }
 
-    @Test(expected = NullPointerException.class)
+    @Test
     public void deleteNullPath() {
-        this.pathTrie.deletePath(null);
+        assertThrows(NullPointerException.class, () -> {
+            this.pathTrie.deletePath(null);
+        });
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void deleteIllegalPath() {
-        this.pathTrie.deletePath("");
+        assertThrows(IllegalArgumentException.class, () -> {
+            this.pathTrie.deletePath("");
+        });
     }
 
     @Test
@@ -122,9 +131,11 @@ public void deleteRootPath() {
         assertTrue(this.pathTrie.existsNode("/node1/node3"));
     }
 
-    @Test(expected = NullPointerException.class)
+    @Test
     public void findMaxPrefixNullPath() {
-        this.pathTrie.findMaxPrefix(null);
+        assertThrows(NullPointerException.class, () -> {
+            this.pathTrie.findMaxPrefix(null);
+        });
     }
 
     @Test
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/PathUtilsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/PathUtilsTest.java
index 0d08286648c..fb4f4bd73bd 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/PathUtilsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/PathUtilsTest.java
@@ -18,8 +18,11 @@
 
 package org.apache.zookeeper.common;
 
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class PathUtilsTest extends ZKTestCase {
 
@@ -28,44 +31,60 @@ public void testValidatePath_ValidPath() {
         PathUtils.validatePath("/this is / a valid/path");
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testValidatePath_Null() {
-        PathUtils.validatePath(null);
+        assertThrows(IllegalArgumentException.class, () -> {
+            PathUtils.validatePath(null);
+        });
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testValidatePath_EmptyString() {
-        PathUtils.validatePath("");
+        assertThrows(IllegalArgumentException.class, () -> {
+            PathUtils.validatePath("");
+        });
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testValidatePath_NotAbsolutePath() {
-        PathUtils.validatePath("not/valid");
+        assertThrows(IllegalArgumentException.class, () -> {
+            PathUtils.validatePath("not/valid");
+        });
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testValidatePath_EndsWithSlash() {
-        PathUtils.validatePath("/ends/with/slash/");
+        assertThrows(IllegalArgumentException.class, () -> {
+            PathUtils.validatePath("/ends/with/slash/");
+        });
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testValidatePath_ContainsNullCharacter() {
-        PathUtils.validatePath("/test\u0000");
+        assertThrows(IllegalArgumentException.class, () -> {
+            PathUtils.validatePath("/test\u0000");
+        });
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testValidatePath_DoubleSlash() {
-        PathUtils.validatePath("/double//slash");
+        assertThrows(IllegalArgumentException.class, () -> {
+            PathUtils.validatePath("/double//slash");
+        });
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testValidatePath_SinglePeriod() {
-        PathUtils.validatePath("/single/./period");
+        assertThrows(IllegalArgumentException.class, () -> {
+            PathUtils.validatePath("/single/./period");
+        });
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testValidatePath_DoublePeriod() {
-        PathUtils.validatePath("/double/../period");
+        assertThrows(IllegalArgumentException.class, () -> {
+            PathUtils.validatePath("/double/../period");
+        });
     }
 
     @Test
@@ -74,14 +93,18 @@ public void testValidatePath_NameContainingPeriod() {
         PathUtils.validatePath("/name/with.period.");
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testValidatePath_0x01() {
-        PathUtils.validatePath("/test\u0001");
+        assertThrows(IllegalArgumentException.class, () -> {
+            PathUtils.validatePath("/test\u0001");
+        });
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testValidatePath_0x1F() {
-        PathUtils.validatePath("/test\u001F");
+        assertThrows(IllegalArgumentException.class, () -> {
+            PathUtils.validatePath("/test\u001F");
+        });
     }
 
     @Test // The first allowable character
@@ -95,24 +118,32 @@ public void testValidatePath_0x7e() {
         PathUtils.validatePath("/test\u007e");
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testValidatePath_0x7f() {
-        PathUtils.validatePath("/test\u007f");
+        assertThrows(IllegalArgumentException.class, () -> {
+            PathUtils.validatePath("/test\u007f");
+        });
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testValidatePath_0x9f() {
-        PathUtils.validatePath("/test\u009f");
+        assertThrows(IllegalArgumentException.class, () -> {
+            PathUtils.validatePath("/test\u009f");
+        });
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testValidatePath_ud800() {
-        PathUtils.validatePath("/test\ud800");
+        assertThrows(IllegalArgumentException.class, () -> {
+            PathUtils.validatePath("/test\ud800");
+        });
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testValidatePath_uf8ff() {
-        PathUtils.validatePath("/test\uf8ff");
+        assertThrows(IllegalArgumentException.class, () -> {
+            PathUtils.validatePath("/test\uf8ff");
+        });
     }
 
     @Test
@@ -120,9 +151,18 @@ public void testValidatePath_HighestAllowableChar() {
         PathUtils.validatePath("/test\uffef");
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testValidatePath_SupplementaryChar() {
-        PathUtils.validatePath("/test\ufff0");
+        assertThrows(IllegalArgumentException.class, () -> {
+            PathUtils.validatePath("/test\ufff0");
+        });
     }
 
+    @Test
+    public void testGetTopNamespace() {
+        assertEquals("n0", PathUtils.getTopNamespace("/n0/n1/n2/n3"));
+        assertNull(PathUtils.getTopNamespace("/"));
+        assertNull(PathUtils.getTopNamespace(""));
+        assertNull(PathUtils.getTopNamespace(null));
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/SecretUtilsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/SecretUtilsTest.java
new file mode 100644
index 00000000000..9c05a7725e6
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/SecretUtilsTest.java
@@ -0,0 +1,74 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import java.io.BufferedWriter;
+import java.io.File;
+import java.io.FileWriter;
+import java.io.IOException;
+import java.nio.file.Path;
+import org.junit.Test;
+import org.junit.jupiter.api.io.TempDir;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+
+public class SecretUtilsTest {
+
+    @TempDir
+    static File tempDir;
+
+    @ParameterizedTest
+    @ValueSource (strings = {"test secret", ""})
+    public void testReadSecret(final String secretTxt) throws Exception {
+        final Path secretFile = createSecretFile(secretTxt);
+
+        final char[] secret = SecretUtils.readSecret(secretFile.toString());
+        assertEquals(secretTxt, String.valueOf(secret));
+    }
+
+    @Test
+    public void tesReadSecret_withLineSeparator() throws Exception {
+        final String secretTxt = "test secret  with line separator" + System.lineSeparator();
+        final Path secretFile = createSecretFile(secretTxt);
+
+        final char[] secret = SecretUtils.readSecret(secretFile.toString());
+        assertEquals(secretTxt.substring(0, secretTxt.length() - 1), String.valueOf(secret));
+    }
+
+    @Test
+    public void testReadSecret_fileNotExist() {
+        final String pathToFile = "NonExistingFile";
+        final IllegalStateException exception =
+                assertThrows(IllegalStateException.class, () -> SecretUtils.readSecret(pathToFile));
+        assertEquals("Exception occurred while reading secret from file " + pathToFile, exception.getMessage());
+    }
+
+    public static Path createSecretFile(final String secretTxt) throws IOException {
+        final File tempFile = File.createTempFile("test_", ".secrete", tempDir);
+        final Path path = tempFile.toPath();
+
+        final BufferedWriter writer = new BufferedWriter(new FileWriter(path.toString()));
+        writer.append(secretTxt);
+        writer.close();
+
+        return path;
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/TimeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/TimeTest.java
index 85077be1f95..c760e3269ea 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/TimeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/TimeTest.java
@@ -18,7 +18,8 @@
 
 package org.apache.zookeeper.common;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.util.Calendar;
 import java.util.Date;
 import java.util.concurrent.atomic.AtomicInteger;
@@ -27,7 +28,7 @@
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 /**
  * Command line program for demonstrating robustness to clock
@@ -101,4 +102,54 @@ public void testElapsedTimeToDate() throws Exception {
         assertEquals(calculatedDate, realDate);
     }
 
+    @Test
+    public void testParseTimeInterval() throws Exception {
+        assertEquals(0, Time.parseTimeInterval("0"));
+        assertEquals(0, Time.parseTimeInterval("0s"));
+        assertEquals(0, Time.parseTimeInterval("0m"));
+        assertEquals(0, Time.parseTimeInterval("0h"));
+        assertEquals(0, Time.parseTimeInterval("0d"));
+        assertEquals(1000, Time.parseTimeInterval("1000"));
+        assertEquals(Time.SECOND, Time.parseTimeInterval("1s"));
+        assertEquals(Time.MINUTE, Time.parseTimeInterval("1m"));
+        assertEquals(Time.HOUR, Time.parseTimeInterval("1h"));
+        assertEquals(Time.DAY, Time.parseTimeInterval("1d"));
+        assertEquals(1234, Time.parseTimeInterval("1234ms"));
+        assertEquals(Time.parseTimeInterval("60s"), Time.parseTimeInterval("1m"));
+        assertEquals(Time.parseTimeInterval("120m"), Time.parseTimeInterval("2h"));
+        assertEquals(Time.parseTimeInterval("72h"), Time.parseTimeInterval("3d"));
+        try {
+            Time.parseTimeInterval("2x");
+            fail("should have thrown NumberFormatException");
+        } catch (NumberFormatException e) {
+        }
+        try {
+            Time.parseTimeInterval("");
+            fail("should have thrown NumberFormatException");
+        } catch (NumberFormatException e) {
+        }
+    }
+
+    @Test
+    public void testFormatTimeInterval() throws Exception {
+        assertEquals("0", Time.formatTimeIntervalMs(0));
+        assertEquals("0", Time.formatTimeIntervalMs(Time.parseTimeInterval("0")));
+        assertEquals("0", Time.formatTimeIntervalMs(Time.parseTimeInterval("0ms")));
+        assertEquals("0", Time.formatTimeIntervalMs(Time.parseTimeInterval("0s")));
+        assertEquals("0", Time.formatTimeIntervalMs(Time.parseTimeInterval("0m")));
+        assertEquals("0", Time.formatTimeIntervalMs(Time.parseTimeInterval("0h")));
+        assertEquals("0", Time.formatTimeIntervalMs(Time.parseTimeInterval("0d")));
+        assertEquals("500ms", Time.formatTimeIntervalMs(Time.parseTimeInterval("500ms")));
+        assertEquals("1m", Time.formatTimeIntervalMs(Time.parseTimeInterval("60s")));
+        assertEquals("61s", Time.formatTimeIntervalMs(Time.parseTimeInterval("61s")));
+        assertEquals("59m", Time.formatTimeIntervalMs(Time.parseTimeInterval("59m")));
+        assertEquals("1h", Time.formatTimeIntervalMs(Time.parseTimeInterval("60m")));
+        assertEquals("2h", Time.formatTimeIntervalMs(Time.parseTimeInterval("120m")));
+        assertEquals("61m", Time.formatTimeIntervalMs(Time.parseTimeInterval("61m")));
+        assertEquals("23h", Time.formatTimeIntervalMs(Time.parseTimeInterval("23h")));
+        assertEquals("1d", Time.formatTimeIntervalMs(Time.parseTimeInterval("24h")));
+        assertEquals("2d", Time.formatTimeIntervalMs(Time.parseTimeInterval("48h")));
+        assertEquals("25h", Time.formatTimeIntervalMs(Time.parseTimeInterval("25h")));
+        assertEquals("2d", Time.formatTimeIntervalMs(Time.parseTimeInterval("2d")));
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestContext.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestContext.java
index 71fde1e6c8c..80632e45c01 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestContext.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestContext.java
@@ -29,6 +29,7 @@
 import java.security.Security;
 import java.security.cert.X509Certificate;
 import java.util.Arrays;
+import java.util.List;
 import org.apache.commons.io.FileUtils;
 import org.bouncycastle.asn1.x500.X500NameBuilder;
 import org.bouncycastle.asn1.x500.style.BCStyle;
@@ -48,11 +49,12 @@ public class X509TestContext {
     private final X509KeyType trustStoreKeyType;
     private final KeyPair trustStoreKeyPair;
     private final long trustStoreCertExpirationMillis;
-    private final X509Certificate trustStoreCertificate;
+    private final List<X509Certificate> trustStoreCertificates;
     private final String trustStorePassword;
     private File trustStoreJksFile;
     private File trustStorePemFile;
     private File trustStorePkcs12File;
+    private File trustStoreBcfksFile;
 
     private final X509KeyType keyStoreKeyType;
     private final KeyPair keyStoreKeyPair;
@@ -62,6 +64,7 @@ public class X509TestContext {
     private File keyStoreJksFile;
     private File keyStorePemFile;
     private File keyStorePkcs12File;
+    private File keyStoreBcfksFile;
 
     private final Boolean hostnameVerification;
 
@@ -78,7 +81,7 @@ public class X509TestContext {
      * @throws GeneralSecurityException
      * @throws OperatorCreationException
      */
-    private X509TestContext(File tempDir, KeyPair trustStoreKeyPair, long trustStoreCertExpirationMillis, String trustStorePassword, KeyPair keyStoreKeyPair, long keyStoreCertExpirationMillis, String keyStorePassword, Boolean hostnameVerification) throws IOException, GeneralSecurityException, OperatorCreationException {
+    private X509TestContext(File tempDir, KeyPair trustStoreKeyPair, long trustStoreCertExpirationMillis, String trustStorePassword, KeyPair keyStoreKeyPair, long keyStoreCertExpirationMillis, String keyStorePassword, Boolean hostnameVerification) throws Exception {
         if (Security.getProvider(BouncyCastleProvider.PROVIDER_NAME) == null) {
             throw new IllegalStateException("BC Security provider was not found");
         }
@@ -97,11 +100,18 @@ private X509TestContext(File tempDir, KeyPair trustStoreKeyPair, long trustStore
 
         X500NameBuilder caNameBuilder = new X500NameBuilder(BCStyle.INSTANCE);
         caNameBuilder.addRDN(BCStyle.CN, MethodHandles.lookup().lookupClass().getCanonicalName() + " Root CA");
-        trustStoreCertificate = X509TestHelpers.newSelfSignedCACert(caNameBuilder.build(), trustStoreKeyPair, trustStoreCertExpirationMillis);
+        // Create two CA certs to test multiple certs in PEM bundles.
+        // Use same subject name to simulate multiple CA certs from the same CA (e.g. reissued cert with different key type).
+        trustStoreCertificates = Arrays.asList(
+                X509TestHelpers.newSelfSignedCACert(caNameBuilder.build(), trustStoreKeyPair,
+                        trustStoreCertExpirationMillis),
+                X509TestHelpers.newSelfSignedCACert(caNameBuilder.build(), trustStoreKeyPair,
+                        trustStoreCertExpirationMillis)
+        );
 
         X500NameBuilder nameBuilder = new X500NameBuilder(BCStyle.INSTANCE);
         nameBuilder.addRDN(BCStyle.CN, MethodHandles.lookup().lookupClass().getCanonicalName() + " Zookeeper Test");
-        keyStoreCertificate = X509TestHelpers.newCert(trustStoreCertificate, trustStoreKeyPair, nameBuilder.build(), keyStoreKeyPair.getPublic(), keyStoreCertExpirationMillis);
+        keyStoreCertificate = X509TestHelpers.newCert(trustStoreCertificates.get(0), trustStoreKeyPair, nameBuilder.build(), keyStoreKeyPair.getPublic(), keyStoreCertExpirationMillis);
         trustStorePkcs12File = trustStorePemFile = trustStoreJksFile = null;
         keyStorePkcs12File = keyStorePemFile = keyStoreJksFile = null;
 
@@ -137,8 +147,8 @@ public long getTrustStoreCertExpirationMillis() {
         return trustStoreCertExpirationMillis;
     }
 
-    public X509Certificate getTrustStoreCertificate() {
-        return trustStoreCertificate;
+    public List<X509Certificate> getTrustStoreCertificates() {
+        return trustStoreCertificates;
     }
 
     public String getTrustStorePassword() {
@@ -157,10 +167,12 @@ public File getTrustStoreFile(KeyStoreFileType storeFileType) throws IOException
         case JKS:
             return getTrustStoreJksFile();
         case PEM:
-            return getTrustStorePemFile();
+            return getTrustStorePemBundleFile();
         case PKCS12:
             return getTrustStorePkcs12File();
-        default:
+        case BCFKS:
+            return getTrustStoreBcfksFile();
+            default:
             throw new IllegalArgumentException("Invalid trust store type: "
                                                        + storeFileType
                                                        + ", must be one of: "
@@ -173,7 +185,7 @@ private File getTrustStoreJksFile() throws IOException {
             File trustStoreJksFile = File.createTempFile(TRUST_STORE_PREFIX, KeyStoreFileType.JKS.getDefaultFileExtension(), tempDir);
             trustStoreJksFile.deleteOnExit();
             try (final FileOutputStream trustStoreOutputStream = new FileOutputStream(trustStoreJksFile)) {
-                byte[] bytes = X509TestHelpers.certToJavaTrustStoreBytes(trustStoreCertificate, trustStorePassword);
+                byte[] bytes = X509TestHelpers.certToJavaTrustStoreBytes(trustStoreCertificates.get(0), trustStorePassword);
                 trustStoreOutputStream.write(bytes);
                 trustStoreOutputStream.flush();
             } catch (GeneralSecurityException e) {
@@ -184,11 +196,13 @@ private File getTrustStoreJksFile() throws IOException {
         return trustStoreJksFile;
     }
 
-    private File getTrustStorePemFile() throws IOException {
+    private File getTrustStorePemBundleFile() throws IOException {
         if (trustStorePemFile == null) {
             File trustStorePemFile = File.createTempFile(TRUST_STORE_PREFIX, KeyStoreFileType.PEM.getDefaultFileExtension(), tempDir);
             trustStorePemFile.deleteOnExit();
-            FileUtils.writeStringToFile(trustStorePemFile, X509TestHelpers.pemEncodeX509Certificate(trustStoreCertificate), StandardCharsets.US_ASCII, false);
+            for (X509Certificate cert : trustStoreCertificates) {
+                FileUtils.writeStringToFile(trustStorePemFile, X509TestHelpers.pemEncodeX509Certificate(cert), StandardCharsets.US_ASCII, true);
+            }
             this.trustStorePemFile = trustStorePemFile;
         }
         return trustStorePemFile;
@@ -199,7 +213,7 @@ private File getTrustStorePkcs12File() throws IOException {
             File trustStorePkcs12File = File.createTempFile(TRUST_STORE_PREFIX, KeyStoreFileType.PKCS12.getDefaultFileExtension(), tempDir);
             trustStorePkcs12File.deleteOnExit();
             try (final FileOutputStream trustStoreOutputStream = new FileOutputStream(trustStorePkcs12File)) {
-                byte[] bytes = X509TestHelpers.certToPKCS12TrustStoreBytes(trustStoreCertificate, trustStorePassword);
+                byte[] bytes = X509TestHelpers.certToPKCS12TrustStoreBytes(trustStoreCertificates.get(0), trustStorePassword);
                 trustStoreOutputStream.write(bytes);
                 trustStoreOutputStream.flush();
             } catch (GeneralSecurityException e) {
@@ -210,6 +224,23 @@ private File getTrustStorePkcs12File() throws IOException {
         return trustStorePkcs12File;
     }
 
+    private File getTrustStoreBcfksFile() throws IOException {
+        if (trustStoreBcfksFile == null) {
+            File trustStoreBcfksFile = File.createTempFile(
+                TRUST_STORE_PREFIX, KeyStoreFileType.BCFKS.getDefaultFileExtension(), tempDir);
+            trustStoreBcfksFile.deleteOnExit();
+            try (final FileOutputStream trustStoreOutputStream = new FileOutputStream(trustStoreBcfksFile)) {
+                byte[] bytes = X509TestHelpers.certToBCFKSTrustStoreBytes(trustStoreCertificates.get(0), trustStorePassword);
+                trustStoreOutputStream.write(bytes);
+                trustStoreOutputStream.flush();
+            } catch (GeneralSecurityException e) {
+                throw new IOException(e);
+            }
+            this.trustStoreBcfksFile = trustStoreBcfksFile;
+        }
+        return trustStoreBcfksFile;
+    }
+
     public X509KeyType getKeyStoreKeyType() {
         return keyStoreKeyType;
     }
@@ -235,9 +266,9 @@ public boolean isKeyStoreEncrypted() {
     }
 
     /**
-     * Returns the path to the key store file in the given format (JKS or PEM). Note that the file is created lazily,
+     * Returns the path to the key store file in the given format (JKS, PEM, ...). Note that the file is created lazily,
      * the first time this method is called. The key store file is temporary and will be deleted on exit.
-     * @param storeFileType the store file type (JKS or PEM).
+     * @param storeFileType the store file type (JKS, PEM, ...).
      * @return the path to the key store file.
      * @throws IOException if there is an error creating the key store file.
      */
@@ -249,6 +280,8 @@ public File getKeyStoreFile(KeyStoreFileType storeFileType) throws IOException {
             return getKeyStorePemFile();
         case PKCS12:
             return getKeyStorePkcs12File();
+        case BCFKS:
+            return getKeyStoreBcfksFile();
         default:
             throw new IllegalArgumentException("Invalid key store type: "
                                                        + storeFileType
@@ -303,6 +336,24 @@ private File getKeyStorePkcs12File() throws IOException {
         return keyStorePkcs12File;
     }
 
+    private File getKeyStoreBcfksFile() throws IOException {
+        if (keyStoreBcfksFile == null) {
+            File keyStoreBcfksFile = File.createTempFile(
+              KEY_STORE_PREFIX, KeyStoreFileType.BCFKS.getDefaultFileExtension(), tempDir);
+            keyStoreBcfksFile.deleteOnExit();
+            try (final FileOutputStream keyStoreOutputStream = new FileOutputStream(keyStoreBcfksFile)) {
+                byte[] bytes = X509TestHelpers.certAndPrivateKeyToBCFKSBytes(
+                  keyStoreCertificate, keyStoreKeyPair.getPrivate(), keyStorePassword);
+                keyStoreOutputStream.write(bytes);
+                keyStoreOutputStream.flush();
+            } catch (GeneralSecurityException e) {
+                throw new IOException(e);
+            }
+            this.keyStoreBcfksFile = keyStoreBcfksFile;
+        }
+        return keyStoreBcfksFile;
+    }
+
     /**
      * Sets the SSL system properties such that the given X509Util object can be used to create SSL Contexts that
      * will use the trust store and key store files created by this test context. Example usage:
@@ -314,8 +365,8 @@ private File getKeyStorePkcs12File() throws IOException {
      *     SSLContext ctx = x509Util.getDefaultSSLContext();
      * </pre>
      * @param x509Util the X509Util.
-     * @param keyStoreFileType the store file type to use for the key store (JKS or PEM).
-     * @param trustStoreFileType the store file type to use for the trust store (JKS or PEM).
+     * @param keyStoreFileType the store file type to use for the key store (JKS, PEM, ...).
+     * @param trustStoreFileType the store file type to use for the trust store (JKS, PEM, ...).
      * @throws IOException if there is an error creating the key store file or trust store file.
      */
     public void setSystemProperties(X509Util x509Util, KeyStoreFileType keyStoreFileType, KeyStoreFileType trustStoreFileType) throws IOException {
@@ -340,9 +391,11 @@ public void setSystemProperties(X509Util x509Util, KeyStoreFileType keyStoreFile
     public void clearSystemProperties(X509Util x509Util) {
         System.clearProperty(x509Util.getSslKeystoreLocationProperty());
         System.clearProperty(x509Util.getSslKeystorePasswdProperty());
+        System.clearProperty(x509Util.getSslKeystorePasswdPathProperty());
         System.clearProperty(x509Util.getSslKeystoreTypeProperty());
         System.clearProperty(x509Util.getSslTruststoreLocationProperty());
         System.clearProperty(x509Util.getSslTruststorePasswdProperty());
+        System.clearProperty(x509Util.getSslTruststorePasswdPathProperty());
         System.clearProperty(x509Util.getSslTruststoreTypeProperty());
         System.clearProperty(x509Util.getSslHostnameVerificationEnabledProperty());
     }
@@ -382,7 +435,7 @@ public Builder() {
          * @throws GeneralSecurityException
          * @throws OperatorCreationException
          */
-        public X509TestContext build() throws IOException, GeneralSecurityException, OperatorCreationException {
+        public X509TestContext build() throws Exception {
             KeyPair trustStoreKeyPair = X509TestHelpers.generateKeyPair(trustStoreKeyType);
             KeyPair keyStoreKeyPair = X509TestHelpers.generateKeyPair(keyStoreKeyType);
             return new X509TestContext(tempDir, trustStoreKeyPair, trustStoreCertExpirationMillis, trustStorePassword, keyStoreKeyPair, keyStoreCertExpirationMillis, keyStorePassword, hostnameVerification);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestHelpers.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestHelpers.java
index 4f169689743..761c718b865 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestHelpers.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509TestHelpers.java
@@ -36,11 +36,14 @@
 import java.security.cert.X509Certificate;
 import java.security.spec.ECGenParameterSpec;
 import java.security.spec.RSAKeyGenParameterSpec;
+import java.time.Duration;
 import java.util.Date;
 import org.bouncycastle.asn1.DERIA5String;
 import org.bouncycastle.asn1.DEROctetString;
 import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers;
 import org.bouncycastle.asn1.x500.X500Name;
+import org.bouncycastle.asn1.x500.X500NameBuilder;
+import org.bouncycastle.asn1.x500.style.BCStyle;
 import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
 import org.bouncycastle.asn1.x509.BasicConstraints;
 import org.bouncycastle.asn1.x509.ExtendedKeyUsage;
@@ -53,6 +56,7 @@
 import org.bouncycastle.cert.X509CertificateHolder;
 import org.bouncycastle.cert.X509v3CertificateBuilder;
 import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
+import org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder;
 import org.bouncycastle.crypto.params.AsymmetricKeyParameter;
 import org.bouncycastle.crypto.util.PrivateKeyFactory;
 import org.bouncycastle.jce.provider.BouncyCastleProvider;
@@ -72,7 +76,7 @@
 
 /**
  * This class contains helper methods for creating X509 certificates and key pairs, and for serializing them
- * to JKS or PEM files.
+ * to JKS, PEM or other keystore type files.
  */
 public class X509TestHelpers {
 
@@ -85,6 +89,27 @@ public class X509TestHelpers {
     // Per RFC 5280 section 4.1.2.2, X509 certificates can use up to 20 bytes == 160 bits for serial numbers.
     private static final int SERIAL_NUMBER_MAX_BITS = 20 * Byte.SIZE;
 
+    public static X509Certificate newSelfSignedCert(String name, KeyPair keyPair) throws IOException, OperatorCreationException, GeneralSecurityException {
+        X500NameBuilder caNameBuilder = new X500NameBuilder(BCStyle.INSTANCE);
+        caNameBuilder.addRDN(BCStyle.CN, name);
+        return newSelfSignedCACert(caNameBuilder.build(), keyPair, Duration.ofDays(1).toMillis());
+    }
+
+    @FunctionalInterface
+    public interface CertificateCustomization {
+        void customize(X509v3CertificateBuilder builder) throws Exception;
+    }
+
+    public static X509Certificate newCert(X509Certificate caCert, KeyPair caKeyPair, String name, PublicKey certPublicKey, CertificateCustomization customization) throws Exception {
+        X500NameBuilder nameBuilder = new X500NameBuilder(BCStyle.INSTANCE);
+        nameBuilder.addRDN(BCStyle.CN, name);
+        return newCert(caCert, caKeyPair, nameBuilder.build(), certPublicKey, Duration.ofDays(1).toMillis(), customization);
+    }
+
+    public static X509Certificate newCert(X509Certificate caCert, KeyPair caKeyPair, String name, PublicKey certPublicKey) throws Exception {
+        return newCert(caCert, caKeyPair, name, certPublicKey, null);
+    }
+
     /**
      * Uses the private key of the given key pair to create a self-signed CA certificate with the public half of the
      * key pair and the given subject and expiration. The issuer of the new cert will be equal to the subject.
@@ -102,6 +127,11 @@ public class X509TestHelpers {
      */
     public static X509Certificate newSelfSignedCACert(
             X500Name subject, KeyPair keyPair, long expirationMillis) throws IOException, OperatorCreationException, GeneralSecurityException {
+        return newSelfSignedCACert(subject, keyPair, expirationMillis, null);
+    }
+
+    public static X509Certificate newSelfSignedCACert(
+            X500Name subject, KeyPair keyPair, long expirationMillis, CertificateCustomization customization) throws IOException, OperatorCreationException, GeneralSecurityException {
         Date now = new Date();
         X509v3CertificateBuilder builder = initCertBuilder(subject, // for self-signed certs, issuer == subject
                                                            now, new Date(now.getTime()
@@ -129,12 +159,17 @@ now, new Date(now.getTime()
      * @throws GeneralSecurityException
      */
     public static X509Certificate newCert(
-            X509Certificate caCert, KeyPair caKeyPair, X500Name certSubject, PublicKey certPublicKey, long expirationMillis) throws IOException, OperatorCreationException, GeneralSecurityException {
+            X509Certificate caCert, KeyPair caKeyPair, X500Name certSubject, PublicKey certPublicKey, long expirationMillis) throws Exception {
+        return newCert(caCert, caKeyPair, certSubject, certPublicKey, expirationMillis, null);
+    }
+
+    public static X509Certificate newCert(
+            X509Certificate caCert, KeyPair caKeyPair, X500Name certSubject, PublicKey certPublicKey, long expirationMillis, CertificateCustomization customization) throws Exception {
         if (!caKeyPair.getPublic().equals(caCert.getPublicKey())) {
             throw new IllegalArgumentException("CA private key does not match the public key in the CA cert");
         }
         Date now = new Date();
-        X509v3CertificateBuilder builder = initCertBuilder(new X500Name(caCert.getIssuerDN().getName()), now, new Date(
+        X509v3CertificateBuilder builder = initCertBuilder(new X500Name(caCert.getIssuerX500Principal().getName()), now, new Date(
                 now.getTime()
                         + expirationMillis), certSubject, certPublicKey);
         builder.addExtension(Extension.basicConstraints, true, new BasicConstraints(false)); // not a CA
@@ -143,6 +178,9 @@ public static X509Certificate newCert(
         builder.addExtension(Extension.extendedKeyUsage, true, new ExtendedKeyUsage(new KeyPurposeId[]{KeyPurposeId.id_kp_serverAuth, KeyPurposeId.id_kp_clientAuth}));
 
         builder.addExtension(Extension.subjectAlternativeName, false, getLocalhostSubjectAltNames());
+        if (customization != null) {
+            customization.customize(builder);
+        }
         return buildAndSignCertificate(caKeyPair.getPrivate(), builder);
     }
 
@@ -172,7 +210,7 @@ private static GeneralNames getLocalhostSubjectAltNames() throws UnknownHostExce
      */
     private static X509v3CertificateBuilder initCertBuilder(
             X500Name issuer, Date notBefore, Date notAfter, X500Name subject, PublicKey subjectPublicKey) {
-        return new X509v3CertificateBuilder(issuer, new BigInteger(SERIAL_NUMBER_MAX_BITS, PRNG), notBefore, notAfter, subject, SubjectPublicKeyInfo.getInstance(subjectPublicKey.getEncoded()));
+        return new JcaX509v3CertificateBuilder(issuer, new BigInteger(SERIAL_NUMBER_MAX_BITS, PRNG), notBefore, notAfter, subject, SubjectPublicKeyInfo.getInstance(subjectPublicKey.getEncoded()));
     }
 
     /**
@@ -270,7 +308,7 @@ public static String pemEncodePrivateKey(
         JcaPEMWriter pemWriter = new JcaPEMWriter(stringWriter);
         OutputEncryptor encryptor = null;
         if (password != null && password.length() > 0) {
-            encryptor = new JceOpenSSLPKCS8EncryptorBuilder(PKCSObjectIdentifiers.pbeWithSHAAnd3_KeyTripleDES_CBC).setProvider(BouncyCastleProvider.PROVIDER_NAME).setRandom(PRNG).setPasssword(password.toCharArray()).build();
+            encryptor = new JceOpenSSLPKCS8EncryptorBuilder(PKCSObjectIdentifiers.pbeWithSHAAnd3_KeyTripleDES_CBC).setProvider(BouncyCastleProvider.PROVIDER_NAME).setRandom(PRNG).setPassword(password.toCharArray()).build();
         }
         pemWriter.writeObject(new JcaPKCS8Generator(key, encryptor));
         pemWriter.close();
@@ -325,10 +363,28 @@ public static byte[] certToPKCS12TrustStoreBytes(
         return certToTrustStoreBytes(cert, keyPassword, trustStore);
     }
 
+    /**
+     * Encodes the given X509Certificate as a BCFKS TrustStore, optionally protecting the cert with a password (though
+     * it's unclear why one would do this since certificates only contain public information and do not need to be
+     * kept secret). Returns the byte array encoding of the trust store, which may be written to a file and loaded to
+     * instantiate the trust store at a later point or in another process.
+     * @param cert the certificate to serialize.
+     * @param keyPassword an optional password to encrypt the trust store. If empty or null, the cert will not be encrypted.
+     * @return the serialized bytes of the BCFKS trust store.
+     * @throws IOException
+     * @throws GeneralSecurityException
+     */
+    public static byte[] certToBCFKSTrustStoreBytes(
+      X509Certificate cert,
+      String keyPassword) throws IOException, GeneralSecurityException {
+        KeyStore trustStore = KeyStore.getInstance("BCFKS");
+        return certToTrustStoreBytes(cert, keyPassword, trustStore);
+    }
+
     private static byte[] certToTrustStoreBytes(X509Certificate cert, String keyPassword, KeyStore trustStore) throws IOException, GeneralSecurityException {
         char[] keyPasswordChars = keyPassword == null ? new char[0] : keyPassword.toCharArray();
         trustStore.load(null, keyPasswordChars);
-        trustStore.setCertificateEntry(cert.getSubjectDN().toString(), cert);
+        trustStore.setCertificateEntry(cert.getSubjectX500Principal().toString(), cert);
         ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
         trustStore.store(outputStream, keyPasswordChars);
         outputStream.flush();
@@ -351,7 +407,7 @@ private static byte[] certToTrustStoreBytes(X509Certificate cert, String keyPass
     public static byte[] certAndPrivateKeyToJavaKeyStoreBytes(
             X509Certificate cert, PrivateKey privateKey, String keyPassword) throws IOException, GeneralSecurityException {
         KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
-        return certAndPrivateKeyToPKCS12Bytes(cert, privateKey, keyPassword, keyStore);
+        return certAndPrivateKeyToBytes(cert, privateKey, keyPassword, keyStore);
     }
 
     /**
@@ -368,10 +424,29 @@ public static byte[] certAndPrivateKeyToJavaKeyStoreBytes(
     public static byte[] certAndPrivateKeyToPKCS12Bytes(
             X509Certificate cert, PrivateKey privateKey, String keyPassword) throws IOException, GeneralSecurityException {
         KeyStore keyStore = KeyStore.getInstance("PKCS12");
-        return certAndPrivateKeyToPKCS12Bytes(cert, privateKey, keyPassword, keyStore);
+        return certAndPrivateKeyToBytes(cert, privateKey, keyPassword, keyStore);
+    }
+
+    /**
+     * Encodes the given X509Certificate and private key as a BCFKS KeyStore, optionally protecting the private key
+     * (and possibly the cert?) with a password. Returns the byte array encoding of the key store, which may be written
+     * to a file and loaded to instantiate the key store at a later point or in another process.
+     * @param cert the X509 certificate to serialize.
+     * @param privateKey the private key to serialize.
+     * @param keyPassword an optional key password. If empty or null, the private key will not be encrypted.
+     * @return the serialized bytes of the BCFKS key store.
+     * @throws IOException
+     * @throws GeneralSecurityException
+     */
+    public static byte[] certAndPrivateKeyToBCFKSBytes(
+      X509Certificate cert,
+      PrivateKey privateKey,
+      String keyPassword) throws IOException, GeneralSecurityException {
+        KeyStore keyStore = KeyStore.getInstance("BCFKS");
+        return certAndPrivateKeyToBytes(cert, privateKey, keyPassword, keyStore);
     }
 
-    private static byte[] certAndPrivateKeyToPKCS12Bytes(
+    private static byte[] certAndPrivateKeyToBytes(
             X509Certificate cert, PrivateKey privateKey, String keyPassword, KeyStore keyStore) throws IOException, GeneralSecurityException {
         char[] keyPasswordChars = keyPassword == null ? new char[0] : keyPassword.toCharArray();
         keyStore.load(null, keyPasswordChars);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilCrlPropertyTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilCrlPropertyTest.java
new file mode 100644
index 00000000000..154e738ce9b
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilCrlPropertyTest.java
@@ -0,0 +1,104 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.anyBoolean;
+import static org.mockito.Mockito.doAnswer;
+import static org.mockito.Mockito.spy;
+import java.security.Security;
+import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
+import javax.net.ssl.X509TrustManager;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+
+public class X509UtilCrlPropertyTest {
+    private static class TrustManagerCrlProperties implements X509TrustManager {
+        private final boolean crlEnabled;
+        private final boolean ocspEnabled;
+
+        public TrustManagerCrlProperties(boolean crlEnabled, boolean ocspEnabled) {
+            this.crlEnabled = crlEnabled;
+            this.ocspEnabled = ocspEnabled;
+        }
+
+        @Override
+        public X509Certificate[] getAcceptedIssuers() {
+            return new X509Certificate[0];
+        }
+
+        @Override
+        public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
+        }
+
+        @Override
+        public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
+        }
+    }
+
+    @ParameterizedTest
+    @ValueSource(classes = {ClientX509Util.class, QuorumX509Util.class})
+    public void testCrlProperties(Class<? extends X509Util> clazz) throws Exception {
+        try {
+            X509Util util = spy(clazz.getDeclaredConstructor().newInstance());
+
+            doAnswer(mock -> new TrustManagerCrlProperties(mock.getArgument(3, Boolean.class), mock.getArgument(4, Boolean.class)))
+                .when(util)
+                .createTrustManagerInternal(any(), any(), any(), anyBoolean(), anyBoolean(), anyBoolean(), anyBoolean(), anyBoolean(), anyBoolean());
+
+            ZKConfig config = new ZKConfig();
+            config.setProperty(util.getSslTruststoreLocationProperty(), "no-empty");
+
+            TrustManagerCrlProperties properties = (TrustManagerCrlProperties) util.buildTrustManager(config);
+
+            assertFalse(properties.crlEnabled);
+            assertFalse(properties.ocspEnabled);
+
+            // given: "com.sun.net.ssl.checkRevocation"
+            System.setProperty("com.sun.net.ssl.checkRevocation", "true");
+            properties = (TrustManagerCrlProperties) util.buildTrustManager(config);
+            // then: default to "com.sun.net.ssl.checkRevocation"
+            assertTrue(properties.crlEnabled);
+
+            // given: security property "ocsp.enable"
+            Security.setProperty("ocsp.enable", "true");
+            properties = (TrustManagerCrlProperties) util.buildTrustManager(config);
+            // then: default to "ocsp.enable"
+            assertTrue(properties.ocspEnabled);
+
+            // given: both "zookeeper.ssl.crl" and "com.sun.net.ssl.checkRevocation"
+            config.setProperty(util.getSslCrlEnabledProperty(), "false");
+            properties = (TrustManagerCrlProperties) util.buildTrustManager(config);
+            // then: "zookeeper.ssl.crl" take precedence
+            assertFalse(properties.crlEnabled);
+
+            // given: both "zookeeper.ssl.ocsp" and "ocsp.enable"
+            config.setProperty(util.getSslOcspEnabledProperty(), "false");
+            properties = (TrustManagerCrlProperties) util.buildTrustManager(config);
+            // then: "zookeeper.ssl.ocsp" take precedence
+            assertFalse(properties.ocspEnabled);
+        } finally {
+            System.clearProperty("com.sun.net.ssl.checkRevocation");
+            Security.setProperty("ocsp.enable", "false");
+        }
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
index 05d216b2b3b..660ca64bfdb 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
@@ -18,18 +18,24 @@
 
 package org.apache.zookeeper.common;
 
-import static org.junit.Assert.assertArrayEquals;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.apache.zookeeper.common.X509Util.FIPS_MODE_PROPERTY;
+import static org.apache.zookeeper.common.X509Util.TLS_1_2;
+import static org.apache.zookeeper.common.X509Util.TLS_1_3;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import io.netty.buffer.UnpooledByteBufAllocator;
+import io.netty.handler.ssl.SslContext;
 import java.io.IOException;
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
 import java.net.ServerSocket;
 import java.net.Socket;
+import java.nio.file.Path;
 import java.security.NoSuchAlgorithmException;
-import java.security.Security;
-import java.util.Collection;
+import java.util.Arrays;
+import java.util.List;
 import java.util.concurrent.Callable;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.ExecutionException;
@@ -42,6 +48,7 @@
 import javax.net.ssl.HandshakeCompletedEvent;
 import javax.net.ssl.HandshakeCompletedListener;
 import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLEngine;
 import javax.net.ssl.SSLHandshakeException;
 import javax.net.ssl.SSLServerSocket;
 import javax.net.ssl.SSLSocket;
@@ -50,13 +57,12 @@
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.server.ServerCnxnFactory;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Timeout;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.MethodSource;
+
 
-@RunWith(Parameterized.class)
 public class X509UtilTest extends BaseX509ParameterizedTestCase {
 
     private X509Util x509Util;
@@ -65,30 +71,10 @@ public class X509UtilTest extends BaseX509ParameterizedTestCase {
         "SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA"
     };
 
-    @Parameterized.Parameters
-    public static Collection<Object[]> params() {
-        return BaseX509ParameterizedTestCase.defaultParams();
-    }
-
-    public X509UtilTest(
-            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex) {
-        super(paramIndex, () -> {
-            try {
-                return X509TestContext.newBuilder()
-                                      .setTempDir(tempDir)
-                                      .setKeyStorePassword(keyPassword)
-                                      .setKeyStoreKeyType(certKeyType)
-                                      .setTrustStorePassword(keyPassword)
-                                      .setTrustStoreKeyType(caKeyType)
-                                      .build();
-            } catch (Exception e) {
-                throw new RuntimeException(e);
-            }
-        });
-    }
-
-    @Before
-    public void setUp() throws Exception {
+    public void init(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        super.init(caKeyType, certKeyType, keyPassword, paramIndex);
         try (X509Util x509util = new ClientX509Util()) {
             x509TestContext.setSystemProperties(x509util, KeyStoreFileType.JKS, KeyStoreFileType.JKS);
         }
@@ -97,7 +83,7 @@ public void setUp() throws Exception {
         x509Util = new ClientX509Util();
     }
 
-    @After
+    @AfterEach
     public void cleanUp() {
         x509TestContext.clearSystemProperties(x509Util);
         System.clearProperty(x509Util.getSslOcspEnabledProperty());
@@ -105,96 +91,187 @@ public void cleanUp() {
         System.clearProperty(x509Util.getCipherSuitesProperty());
         System.clearProperty(x509Util.getSslProtocolProperty());
         System.clearProperty(x509Util.getSslHandshakeDetectionTimeoutMillisProperty());
-        System.clearProperty("com.sun.net.ssl.checkRevocation");
-        System.clearProperty("com.sun.security.enableCRLDP");
-        Security.setProperty("ocsp.enable", Boolean.FALSE.toString());
-        Security.setProperty("com.sun.security.enableCRLDP", Boolean.FALSE.toString());
         System.clearProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY);
         System.clearProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET);
+        System.clearProperty(FIPS_MODE_PROPERTY);
         x509Util.close();
     }
 
-    @Test(timeout = 5000)
-    public void testCreateSSLContextWithoutCustomProtocol() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 5)
+    public void testCreateSSLContextWithoutCustomProtocol(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        System.setProperty(FIPS_MODE_PROPERTY, Boolean.FALSE.toString());
         SSLContext sslContext = x509Util.getDefaultSSLContext();
-        assertEquals(X509Util.DEFAULT_PROTOCOL, sslContext.getProtocol());
+        String defaultTlsProtocol = X509Util.defaultTlsProtocol(new ZKConfig());
+        assertEquals(defaultTlsProtocol, sslContext.getProtocol());
+
+        // Check that TLSv1.3 is selected in JDKs that support it (OpenJDK 8u272 and later).
+        List<String> supported = Arrays.asList(SSLContext.getDefault().getSupportedSSLParameters().getProtocols());
+        if (supported.contains(TLS_1_3)) {
+            // SSLContext protocol.
+            assertEquals(TLS_1_3, sslContext.getProtocol());
+            // Enabled protocols.
+            List<String> protos = Arrays.asList(sslContext.getDefaultSSLParameters().getProtocols());
+            assertTrue(protos.contains(TLS_1_2));
+            assertTrue(protos.contains(TLS_1_3));
+        } else {
+            assertEquals(TLS_1_2, sslContext.getProtocol());
+            assertArrayEquals(new String[]{TLS_1_2}, sslContext.getDefaultSSLParameters().getProtocols());
+        }
     }
 
-    @Test(timeout = 5000)
-    public void testCreateSSLContextWithCustomProtocol() throws Exception {
-        final String protocol = "TLSv1.1";
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 5)
+    public void testCreateSSLContextFIPSModeEnabled(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        System.setProperty(FIPS_MODE_PROPERTY, Boolean.TRUE.toString());
+        SSLContext sslContext = x509Util.getDefaultSSLContext();
+        assertEquals(TLS_1_2, sslContext.getProtocol());
+        assertArrayEquals(new String[]{TLS_1_2}, sslContext.getDefaultSSLParameters().getProtocols());
+    }
+
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 5)
+    public void testCreateSSLContextWithCustomProtocol(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        final String protocol = X509Util.TLS_1_1;
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         System.setProperty(x509Util.getSslProtocolProperty(), protocol);
         SSLContext sslContext = x509Util.getDefaultSSLContext();
         assertEquals(protocol, sslContext.getProtocol());
     }
 
-    @Test(timeout = 5000)
-    public void testCreateSSLContextWithoutKeyStoreLocation() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 5)
+    public void testCreateSSLContextWithoutKeyStoreLocation(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         System.clearProperty(x509Util.getSslKeystoreLocationProperty());
         x509Util.getDefaultSSLContext();
     }
 
-    @Test(timeout = 5000, expected = X509Exception.SSLContextException.class)
-    public void testCreateSSLContextWithoutKeyStorePassword() throws Exception {
-        if (!x509TestContext.isKeyStoreEncrypted()) {
-            throw new X509Exception.SSLContextException("");
-        }
-        System.clearProperty(x509Util.getSslKeystorePasswdProperty());
-        x509Util.getDefaultSSLContext();
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 5)
+    public void testCreateSSLContextWithoutKeyStorePassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(X509Exception.SSLContextException.class, () -> {
+            if (!x509TestContext.isKeyStoreEncrypted()) {
+                throw new X509Exception.SSLContextException("");
+            }
+            System.clearProperty(x509Util.getSslKeystorePasswdProperty());
+            x509Util.getDefaultSSLContext();
+        });
     }
 
-    @Test(timeout = 5000)
-    public void testCreateSSLContextWithCustomCipherSuites() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 5)
+    public void testCreateSSLContext_withKeyStorePasswordFromFile(final X509KeyType caKeyType,
+                                                                 final X509KeyType certKeyType,
+                                                                 final String keyPassword,
+                                                                 final Integer paramIndex) throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+
+        testCreateSSLContext_withPasswordFromFile(keyPassword,
+                x509Util.getSslKeystorePasswdProperty(),
+                x509Util.getSslKeystorePasswdPathProperty());
+    }
+
+
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 5)
+    public void testCreateSSLContext_withTrustStorePasswordFromFile(final X509KeyType caKeyType,
+                                                                   final X509KeyType certKeyType,
+                                                                   final String keyPassword,
+                                                                   final Integer paramIndex) throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+
+        testCreateSSLContext_withPasswordFromFile(keyPassword,
+                x509Util.getSslTruststorePasswdProperty(),
+                x509Util.getSslTruststorePasswdPathProperty());
+    }
+
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 5)
+    public void testCreateSSLContext_withWrongKeyStorePasswordFromFile(final X509KeyType caKeyType,
+                                                                      final X509KeyType certKeyType,
+                                                                      final String keyPassword,
+                                                                      final Integer paramIndex) throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        testCreateSSLContext_withWrongPasswordFromFile(keyPassword, x509Util.getSslKeystorePasswdPathProperty());
+    }
+
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 5)
+    public void testCreateSSLContext_withWrongTrustStorePasswordFromFile(final X509KeyType caKeyType,
+                                                                         final X509KeyType certKeyType,
+                                                                         final String keyPassword,
+                                                                         final Integer paramIndex) throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        testCreateSSLContext_withWrongPasswordFromFile(keyPassword, x509Util.getSslTruststorePasswdPathProperty());
+    }
+
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 5)
+    public void testCreateSSLContextWithCustomCipherSuites(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         setCustomCipherSuites();
         SSLSocket sslSocket = x509Util.createSSLSocket();
         assertArrayEquals(customCipherSuites, sslSocket.getEnabledCipherSuites());
     }
 
-    // It would be great to test the value of PKIXBuilderParameters#setRevocationEnabled but it does not appear to be
-    // possible
-    @Test(timeout = 5000)
-    public void testCRLEnabled() throws Exception {
-        System.setProperty(x509Util.getSslCrlEnabledProperty(), "true");
-        x509Util.getDefaultSSLContext();
-        assertTrue(Boolean.valueOf(System.getProperty("com.sun.net.ssl.checkRevocation")));
-        assertTrue(Boolean.valueOf(System.getProperty("com.sun.security.enableCRLDP")));
-        assertFalse(Boolean.valueOf(Security.getProperty("ocsp.enable")));
-    }
-
-    @Test(timeout = 5000)
-    public void testCRLDisabled() throws Exception {
-        x509Util.getDefaultSSLContext();
-        assertFalse(Boolean.valueOf(System.getProperty("com.sun.net.ssl.checkRevocation")));
-        assertFalse(Boolean.valueOf(System.getProperty("com.sun.security.enableCRLDP")));
-        assertFalse(Boolean.valueOf(Security.getProperty("ocsp.enable")));
-    }
-
-    @Test(timeout = 5000)
-    public void testOCSPEnabled() throws Exception {
-        System.setProperty(x509Util.getSslOcspEnabledProperty(), "true");
-        x509Util.getDefaultSSLContext();
-        assertTrue(Boolean.valueOf(System.getProperty("com.sun.net.ssl.checkRevocation")));
-        assertTrue(Boolean.valueOf(System.getProperty("com.sun.security.enableCRLDP")));
-        assertTrue(Boolean.valueOf(Security.getProperty("ocsp.enable")));
-    }
-
-    @Test(timeout = 5000)
-    public void testCreateSSLSocket() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 5)
+    public void testCreateSSLSocket(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         setCustomCipherSuites();
         SSLSocket sslSocket = x509Util.createSSLSocket();
         assertArrayEquals(customCipherSuites, sslSocket.getEnabledCipherSuites());
     }
 
-    @Test(timeout = 5000)
-    public void testCreateSSLServerSocketWithoutPort() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 5)
+    public void testCreateSSLServerSocketWithoutPort(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         setCustomCipherSuites();
         SSLServerSocket sslServerSocket = x509Util.createSSLServerSocket();
         assertArrayEquals(customCipherSuites, sslServerSocket.getEnabledCipherSuites());
         assertTrue(sslServerSocket.getNeedClientAuth());
     }
 
-    @Test(timeout = 5000)
-    public void testCreateSSLServerSocketWithPort() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 5)
+    public void testCreateSSLServerSocketWithPort(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         setCustomCipherSuites();
         int port = PortAssignment.unique();
         SSLServerSocket sslServerSocket = x509Util.createSSLServerSocket(port);
@@ -203,8 +280,12 @@ public void testCreateSSLServerSocketWithPort() throws Exception {
         assertTrue(sslServerSocket.getNeedClientAuth());
     }
 
-    @Test
-    public void testLoadPEMKeyStore() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPEMKeyStore(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         // Make sure we can instantiate a key manager from the PEM file on disk
         X509KeyManager km = X509Util.createKeyManager(
             x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM).getAbsolutePath(),
@@ -212,8 +293,12 @@ public void testLoadPEMKeyStore() throws Exception {
             KeyStoreFileType.PEM.getPropertyValue());
     }
 
-    @Test
-    public void testLoadPEMKeyStoreNullPassword() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPEMKeyStoreNullPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         if (!x509TestContext.getKeyStorePassword().isEmpty()) {
             return;
         }
@@ -224,8 +309,12 @@ public void testLoadPEMKeyStoreNullPassword() throws Exception {
             KeyStoreFileType.PEM.getPropertyValue());
     }
 
-    @Test
-    public void testLoadPEMKeyStoreAutodetectStoreFileType() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPEMKeyStoreAutodetectStoreFileType(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         // Make sure we can instantiate a key manager from the PEM file on disk
         X509KeyManager km = X509Util.createKeyManager(
             x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM).getAbsolutePath(),
@@ -233,17 +322,27 @@ public void testLoadPEMKeyStoreAutodetectStoreFileType() throws Exception {
             null /* null StoreFileType means 'autodetect from file extension' */);
     }
 
-    @Test(expected = X509Exception.KeyManagerException.class)
-    public void testLoadPEMKeyStoreWithWrongPassword() throws Exception {
-        // Attempting to load with the wrong key password should fail
-        X509KeyManager km = X509Util.createKeyManager(
-            x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM).getAbsolutePath(),
-            "wrong password", // intentionally use the wrong password
-            KeyStoreFileType.PEM.getPropertyValue());
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPEMKeyStoreWithWrongPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(X509Exception.KeyManagerException.class, () -> {
+            // Attempting to load with the wrong key password should fail
+            X509KeyManager km = X509Util.createKeyManager(
+                    x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM).getAbsolutePath(),
+                    "wrong password", // intentionally use the wrong password
+                    KeyStoreFileType.PEM.getPropertyValue());
+        });
     }
 
-    @Test
-    public void testLoadPEMTrustStore() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPEMTrustStore(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         // Make sure we can instantiate a trust manager from the PEM file on disk
         X509TrustManager tm = X509Util.createTrustManager(
             x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM).getAbsolutePath(),
@@ -251,11 +350,17 @@ public void testLoadPEMTrustStore() throws Exception {
             false,
             false,
             true,
-            true);
+            true,
+            false,
+            false);
     }
 
-    @Test
-    public void testLoadPEMTrustStoreNullPassword() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPEMTrustStoreNullPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         if (!x509TestContext.getTrustStorePassword().isEmpty()) {
             return;
         }
@@ -267,12 +372,18 @@ public void testLoadPEMTrustStoreNullPassword() throws Exception {
             false,
             false,
             true,
-            true);
+            true,
+            false,
+            false);
 
     }
 
-    @Test
-    public void testLoadPEMTrustStoreAutodetectStoreFileType() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPEMTrustStoreAutodetectStoreFileType(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         // Make sure we can instantiate a trust manager from the PEM file on disk
         X509TrustManager tm = X509Util.createTrustManager(
             x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM).getAbsolutePath(),
@@ -281,11 +392,17 @@ public void testLoadPEMTrustStoreAutodetectStoreFileType() throws Exception {
             false,
             false,
             true,
-            true);
+            true,
+            false,
+            false);
     }
 
-    @Test
-    public void testLoadJKSKeyStore() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadJKSKeyStore(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         // Make sure we can instantiate a key manager from the JKS file on disk
         X509KeyManager km = X509Util.createKeyManager(
             x509TestContext.getKeyStoreFile(KeyStoreFileType.JKS).getAbsolutePath(),
@@ -293,8 +410,12 @@ public void testLoadJKSKeyStore() throws Exception {
             KeyStoreFileType.JKS.getPropertyValue());
     }
 
-    @Test
-    public void testLoadJKSKeyStoreNullPassword() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadJKSKeyStoreNullPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         if (!x509TestContext.getKeyStorePassword().isEmpty()) {
             return;
         }
@@ -305,8 +426,12 @@ public void testLoadJKSKeyStoreNullPassword() throws Exception {
             KeyStoreFileType.JKS.getPropertyValue());
     }
 
-    @Test
-    public void testLoadJKSKeyStoreAutodetectStoreFileType() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadJKSKeyStoreAutodetectStoreFileType(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         // Make sure we can instantiate a key manager from the JKS file on disk
         X509KeyManager km = X509Util.createKeyManager(
             x509TestContext.getKeyStoreFile(KeyStoreFileType.JKS).getAbsolutePath(),
@@ -314,17 +439,27 @@ public void testLoadJKSKeyStoreAutodetectStoreFileType() throws Exception {
             null /* null StoreFileType means 'autodetect from file extension' */);
     }
 
-    @Test(expected = X509Exception.KeyManagerException.class)
-    public void testLoadJKSKeyStoreWithWrongPassword() throws Exception {
-        // Attempting to load with the wrong key password should fail
-        X509KeyManager km = X509Util.createKeyManager(
-            x509TestContext.getKeyStoreFile(KeyStoreFileType.JKS).getAbsolutePath(),
-            "wrong password",
-            KeyStoreFileType.JKS.getPropertyValue());
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadJKSKeyStoreWithWrongPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(X509Exception.KeyManagerException.class, () -> {
+            // Attempting to load with the wrong key password should fail
+            X509KeyManager km = X509Util.createKeyManager(
+                    x509TestContext.getKeyStoreFile(KeyStoreFileType.JKS).getAbsolutePath(),
+                    "wrong password",
+                    KeyStoreFileType.JKS.getPropertyValue());
+        });
     }
 
-    @Test
-    public void testLoadJKSTrustStore() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadJKSTrustStore(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         // Make sure we can instantiate a trust manager from the JKS file on disk
         X509TrustManager tm = X509Util.createTrustManager(
             x509TestContext.getTrustStoreFile(KeyStoreFileType.JKS).getAbsolutePath(),
@@ -333,11 +468,17 @@ public void testLoadJKSTrustStore() throws Exception {
             true,
             true,
             true,
-            true);
+            true,
+            false,
+            false);
     }
 
-    @Test
-    public void testLoadJKSTrustStoreNullPassword() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadJKSTrustStoreNullPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         if (!x509TestContext.getTrustStorePassword().isEmpty()) {
             return;
         }
@@ -349,11 +490,17 @@ public void testLoadJKSTrustStoreNullPassword() throws Exception {
             false,
             false,
             true,
-            true);
+            true,
+            false,
+            false);
     }
 
-    @Test
-    public void testLoadJKSTrustStoreAutodetectStoreFileType() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadJKSTrustStoreAutodetectStoreFileType(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         // Make sure we can instantiate a trust manager from the JKS file on disk
         X509TrustManager tm = X509Util.createTrustManager(
             x509TestContext.getTrustStoreFile(KeyStoreFileType.JKS).getAbsolutePath(),
@@ -362,24 +509,38 @@ public void testLoadJKSTrustStoreAutodetectStoreFileType() throws Exception {
             true,
             true,
             true,
-            true);
-    }
-
-    @Test(expected = X509Exception.TrustManagerException.class)
-    public void testLoadJKSTrustStoreWithWrongPassword() throws Exception {
-        // Attempting to load with the wrong key password should fail
-        X509TrustManager tm = X509Util.createTrustManager(
-            x509TestContext.getTrustStoreFile(KeyStoreFileType.JKS).getAbsolutePath(),
-            "wrong password",
-            KeyStoreFileType.JKS.getPropertyValue(),
-            true,
             true,
-            true,
-            true);
+            false,
+            false);
+    }
+
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadJKSTrustStoreWithWrongPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(X509Exception.TrustManagerException.class, () -> {
+            // Attempting to load with the wrong key password should fail
+            X509TrustManager tm = X509Util.createTrustManager(
+                    x509TestContext.getTrustStoreFile(KeyStoreFileType.JKS).getAbsolutePath(),
+                    "wrong password",
+                    KeyStoreFileType.JKS.getPropertyValue(),
+                    true,
+                    true,
+                    true,
+                    true,
+                    false,
+                    false);
+        });
     }
 
-    @Test
-    public void testLoadPKCS12KeyStore() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPKCS12KeyStore(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         // Make sure we can instantiate a key manager from the PKCS12 file on disk
         X509KeyManager km = X509Util.createKeyManager(
             x509TestContext.getKeyStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath(),
@@ -387,8 +548,12 @@ public void testLoadPKCS12KeyStore() throws Exception {
             KeyStoreFileType.PKCS12.getPropertyValue());
     }
 
-    @Test
-    public void testLoadPKCS12KeyStoreNullPassword() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPKCS12KeyStoreNullPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         if (!x509TestContext.getKeyStorePassword().isEmpty()) {
             return;
         }
@@ -399,8 +564,12 @@ public void testLoadPKCS12KeyStoreNullPassword() throws Exception {
             KeyStoreFileType.PKCS12.getPropertyValue());
     }
 
-    @Test
-    public void testLoadPKCS12KeyStoreAutodetectStoreFileType() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPKCS12KeyStoreAutodetectStoreFileType(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         // Make sure we can instantiate a key manager from the PKCS12 file on disk
         X509KeyManager km = X509Util.createKeyManager(
             x509TestContext.getKeyStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath(),
@@ -408,17 +577,27 @@ public void testLoadPKCS12KeyStoreAutodetectStoreFileType() throws Exception {
             null /* null StoreFileType means 'autodetect from file extension' */);
     }
 
-    @Test(expected = X509Exception.KeyManagerException.class)
-    public void testLoadPKCS12KeyStoreWithWrongPassword() throws Exception {
-        // Attempting to load with the wrong key password should fail
-        X509KeyManager km = X509Util.createKeyManager(
-            x509TestContext.getKeyStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath(),
-            "wrong password",
-            KeyStoreFileType.PKCS12.getPropertyValue());
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPKCS12KeyStoreWithWrongPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(X509Exception.KeyManagerException.class, () -> {
+            // Attempting to load with the wrong key password should fail
+            X509KeyManager km = X509Util.createKeyManager(
+                    x509TestContext.getKeyStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath(),
+                    "wrong password",
+                    KeyStoreFileType.PKCS12.getPropertyValue());
+        });
     }
 
-    @Test
-    public void testLoadPKCS12TrustStore() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPKCS12TrustStore(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         // Make sure we can instantiate a trust manager from the PKCS12 file on disk
         X509TrustManager tm = X509Util.createTrustManager(
             x509TestContext.getTrustStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath(),
@@ -426,11 +605,17 @@ public void testLoadPKCS12TrustStore() throws Exception {
             true,
             true,
             true,
-            true);
+            true,
+            false,
+            false);
     }
 
-    @Test
-    public void testLoadPKCS12TrustStoreNullPassword() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPKCS12TrustStoreNullPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         if (!x509TestContext.getTrustStorePassword().isEmpty()) {
             return;
         }
@@ -442,11 +627,17 @@ public void testLoadPKCS12TrustStoreNullPassword() throws Exception {
             false,
             false,
             true,
-            true);
+            true,
+            false,
+            false);
     }
 
-    @Test
-    public void testLoadPKCS12TrustStoreAutodetectStoreFileType() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPKCS12TrustStoreAutodetectStoreFileType(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         // Make sure we can instantiate a trust manager from the PKCS12 file on disk
         X509TrustManager tm = X509Util.createTrustManager(
             x509TestContext.getTrustStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath(),
@@ -455,24 +646,38 @@ public void testLoadPKCS12TrustStoreAutodetectStoreFileType() throws Exception {
             true,
             true,
             true,
-            true);
-    }
-
-    @Test(expected = X509Exception.TrustManagerException.class)
-    public void testLoadPKCS12TrustStoreWithWrongPassword() throws Exception {
-        // Attempting to load with the wrong key password should fail
-        X509TrustManager tm = X509Util.createTrustManager(
-            x509TestContext.getTrustStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath(),
-            "wrong password",
-            KeyStoreFileType.PKCS12.getPropertyValue(),
-            true,
-            true,
             true,
-            true);
+            false,
+            false);
+    }
+
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPKCS12TrustStoreWithWrongPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(X509Exception.TrustManagerException.class, () -> {
+            // Attempting to load with the wrong key password should fail
+            X509TrustManager tm = X509Util.createTrustManager(
+                    x509TestContext.getTrustStoreFile(KeyStoreFileType.PKCS12).getAbsolutePath(),
+                    "wrong password",
+                    KeyStoreFileType.PKCS12.getPropertyValue(),
+                    true,
+                    true,
+                    true,
+                    true,
+                    false,
+                    false);
+        });
     }
 
-    @Test
-    public void testGetSslHandshakeDetectionTimeoutMillisProperty() {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testGetSslHandshakeDetectionTimeoutMillisProperty(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         assertEquals(X509Util.DEFAULT_HANDSHAKE_DETECTION_TIMEOUT_MILLIS, x509Util.getSslHandshakeTimeoutMillis());
         // Note: need to create a new ClientX509Util each time to pick up modified property value
         String newPropertyString = Integer.toString(X509Util.DEFAULT_HANDSHAKE_DETECTION_TIMEOUT_MILLIS + 1);
@@ -493,16 +698,26 @@ public void testGetSslHandshakeDetectionTimeoutMillisProperty() {
         }
     }
 
-    @Test(expected = X509Exception.SSLContextException.class)
-    public void testCreateSSLContext_invalidCustomSSLContextClass() throws Exception {
-        ZKConfig zkConfig = new ZKConfig();
-        ClientX509Util clientX509Util = new ClientX509Util();
-        zkConfig.setProperty(clientX509Util.getSslContextSupplierClassProperty(), String.class.getCanonicalName());
-        clientX509Util.createSSLContext(zkConfig);
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testCreateSSLContext_invalidCustomSSLContextClass(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(X509Exception.SSLContextException.class, () -> {
+            ZKConfig zkConfig = new ZKConfig();
+            ClientX509Util clientX509Util = new ClientX509Util();
+            zkConfig.setProperty(clientX509Util.getSslContextSupplierClassProperty(), String.class.getCanonicalName());
+            clientX509Util.createSSLContext(zkConfig);
+        });
     }
 
-    @Test
-    public void testCreateSSLContext_validCustomSSLContextClass() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testCreateSSLContext_validCustomSSLContextClass(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         ZKConfig zkConfig = new ZKConfig();
         ClientX509Util clientX509Util = new ClientX509Util();
         zkConfig.setProperty(clientX509Util.getSslContextSupplierClassProperty(), SslContextSupplier.class.getName());
@@ -510,6 +725,42 @@ public void testCreateSSLContext_validCustomSSLContextClass() throws Exception {
         assertEquals(SSLContext.getDefault(), sslContext);
     }
 
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testCreateSSLContext_ocspWithJreProvider(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        ZKConfig zkConfig = new ZKConfig();
+        try (ClientX509Util clientX509Util = new ClientX509Util();) {
+            zkConfig.setProperty(clientX509Util.getSslOcspEnabledProperty(), "true");
+            // Must not throw IllegalArgumentException
+            clientX509Util.createSSLContext(zkConfig);
+        }
+    }
+
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testCreateSSLContext_hostnameVerificationNoCustomTrustStore(X509KeyType caKeyType,
+            X509KeyType certKeyType, String keyPassword, Integer paramIndex) throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        // No truststore
+        System.clearProperty(x509Util.getSslTruststoreLocationProperty());
+        // Verify client hostname too
+        System.setProperty(x509Util.getSslClientHostnameVerificationEnabledProperty(), "true");
+        ZKConfig zkConfig = new ZKConfig();
+        try (ClientX509Util clientX509Util = new ClientX509Util();) {
+            UnpooledByteBufAllocator byteBufAllocator = new UnpooledByteBufAllocator(false);
+            SslContext clientContext = clientX509Util.createNettySslContextForClient(zkConfig);
+            SSLEngine clientEngine = clientContext.newEngine(byteBufAllocator);
+            assertEquals(clientEngine.getSSLParameters().getEndpointIdentificationAlgorithm(), "HTTPS");
+
+            SslContext serverContext = clientX509Util.createNettySslContextForServer(zkConfig);
+            SSLEngine serverEngine = serverContext.newEngine(byteBufAllocator);
+            assertEquals(serverEngine.getSSLParameters().getEndpointIdentificationAlgorithm(), "HTTPS");
+        }
+    }
+
     private static void forceClose(Socket s) {
         if (s == null || s.isClosed()) {
             return;
@@ -531,104 +782,72 @@ private static void forceClose(ServerSocket s) {
     }
 
     // This test makes sure that client-initiated TLS renegotiation does not
-    // succeed. We explicitly disable it at the top of X509Util.java.
-    @Test(expected = SSLHandshakeException.class)
-    public void testClientRenegotiationFails() throws Throwable {
-        int port = PortAssignment.unique();
-        ExecutorService workerPool = Executors.newCachedThreadPool();
-        final SSLServerSocket listeningSocket = x509Util.createSSLServerSocket();
-        SSLSocket clientSocket = null;
-        SSLSocket serverSocket = null;
-        final AtomicInteger handshakesCompleted = new AtomicInteger(0);
-        final CountDownLatch handshakeCompleted = new CountDownLatch(1);
-        try {
-            InetSocketAddress localServerAddress = new InetSocketAddress(InetAddress.getLoopbackAddress(), port);
-            listeningSocket.bind(localServerAddress);
-            Future<SSLSocket> acceptFuture;
-            acceptFuture = workerPool.submit(new Callable<SSLSocket>() {
-                @Override
-                public SSLSocket call() throws Exception {
-                    SSLSocket sslSocket = (SSLSocket) listeningSocket.accept();
-                    sslSocket.addHandshakeCompletedListener(new HandshakeCompletedListener() {
-                        @Override
-                        public void handshakeCompleted(HandshakeCompletedEvent handshakeCompletedEvent) {
-                            handshakesCompleted.getAndIncrement();
-                            handshakeCompleted.countDown();
+    // succeed when using TLSv1.2. We explicitly disable it at the top of X509Util.java.
+    // Force TLSv1.2 since the renegotiation feature is not supported anymore in TLSv1.3 and the test becomes invalid.
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testClientRenegotiationFails(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Throwable {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(SSLHandshakeException.class, () -> {
+            int port = PortAssignment.unique();
+            ExecutorService workerPool = Executors.newCachedThreadPool();
+            final SSLServerSocket listeningSocket = x509Util.createSSLServerSocket();
+            SSLSocket clientSocket = null;
+            SSLSocket serverSocket = null;
+            final AtomicInteger handshakesCompleted = new AtomicInteger(0);
+            final CountDownLatch handshakeCompleted = new CountDownLatch(1);
+            try {
+                InetSocketAddress localServerAddress = new InetSocketAddress(InetAddress.getLoopbackAddress(), port);
+                listeningSocket.bind(localServerAddress);
+                Future<SSLSocket> acceptFuture;
+                acceptFuture = workerPool.submit(new Callable<SSLSocket>() {
+                    @Override
+                    public SSLSocket call() throws Exception {
+                        SSLSocket sslSocket = (SSLSocket) listeningSocket.accept();
+                        sslSocket.setEnabledProtocols(new String[]{X509Util.TLS_1_2});
+                        sslSocket.addHandshakeCompletedListener(new HandshakeCompletedListener() {
+                            @Override
+                            public void handshakeCompleted(HandshakeCompletedEvent handshakeCompletedEvent) {
+                                handshakesCompleted.getAndIncrement();
+                                handshakeCompleted.countDown();
+                            }
+                        });
+                        assertEquals(1, sslSocket.getInputStream().read());
+                        try {
+                            // 2nd read is after the renegotiation attempt and will fail
+                            sslSocket.getInputStream().read();
+                            return sslSocket;
+                        } catch (Exception e) {
+                            forceClose(sslSocket);
+                            throw e;
                         }
-                    });
-                    assertEquals(1, sslSocket.getInputStream().read());
-                    try {
-                        // 2nd read is after the renegotiation attempt and will fail
-                        sslSocket.getInputStream().read();
-                        return sslSocket;
-                    } catch (Exception e) {
-                        forceClose(sslSocket);
-                        throw e;
                     }
+                });
+                clientSocket = x509Util.createSSLSocket();
+                clientSocket.connect(localServerAddress);
+                clientSocket.getOutputStream().write(1);
+                // Attempt to renegotiate after establishing the connection
+                clientSocket.startHandshake();
+                clientSocket.getOutputStream().write(1);
+                // The exception is thrown on the server side, we need to unwrap it
+                try {
+                    serverSocket = acceptFuture.get();
+                } catch (ExecutionException e) {
+                    throw e.getCause();
                 }
-            });
-            clientSocket = x509Util.createSSLSocket();
-            clientSocket.connect(localServerAddress);
-            clientSocket.getOutputStream().write(1);
-            // Attempt to renegotiate after establishing the connection
-            clientSocket.startHandshake();
-            clientSocket.getOutputStream().write(1);
-            // The exception is thrown on the server side, we need to unwrap it
-            try {
-                serverSocket = acceptFuture.get();
-            } catch (ExecutionException e) {
-                throw e.getCause();
+            } finally {
+                forceClose(serverSocket);
+                forceClose(clientSocket);
+                forceClose(listeningSocket);
+                workerPool.shutdown();
+                // Make sure the first handshake completed and only the second
+                // one failed.
+                handshakeCompleted.await(5, TimeUnit.SECONDS);
+                assertEquals(1, handshakesCompleted.get());
             }
-        } finally {
-            forceClose(serverSocket);
-            forceClose(clientSocket);
-            forceClose(listeningSocket);
-            workerPool.shutdown();
-            // Make sure the first handshake completed and only the second
-            // one failed.
-            handshakeCompleted.await(5, TimeUnit.SECONDS);
-            assertEquals(1, handshakesCompleted.get());
-        }
-    }
-
-    @Test
-    public void testGetDefaultCipherSuitesJava8() {
-        String[] cipherSuites = X509Util.getDefaultCipherSuitesForJavaVersion("1.8");
-        // Java 8 default should have the CBC suites first
-        assertTrue(cipherSuites[0].contains("CBC"));
-    }
-
-    @Test
-    public void testGetDefaultCipherSuitesJava9() {
-        String[] cipherSuites = X509Util.getDefaultCipherSuitesForJavaVersion("9");
-        // Java 9+ default should have the GCM suites first
-        assertTrue(cipherSuites[0].contains("GCM"));
-    }
-
-    @Test
-    public void testGetDefaultCipherSuitesJava10() {
-        String[] cipherSuites = X509Util.getDefaultCipherSuitesForJavaVersion("10");
-        // Java 9+ default should have the GCM suites first
-        assertTrue(cipherSuites[0].contains("GCM"));
-    }
-
-    @Test
-    public void testGetDefaultCipherSuitesJava11() {
-        String[] cipherSuites = X509Util.getDefaultCipherSuitesForJavaVersion("11");
-        // Java 9+ default should have the GCM suites first
-        assertTrue(cipherSuites[0].contains("GCM"));
-    }
-
-    @Test
-    public void testGetDefaultCipherSuitesUnknownVersion() {
-        String[] cipherSuites = X509Util.getDefaultCipherSuitesForJavaVersion("notaversion");
-        // If version can't be parsed, use the more conservative Java 8 default
-        assertTrue(cipherSuites[0].contains("CBC"));
-    }
-
-    @Test(expected = NullPointerException.class)
-    public void testGetDefaultCipherSuitesNullVersion() {
-        X509Util.getDefaultCipherSuitesForJavaVersion(null);
+        });
     }
 
     // Warning: this will reset the x509Util
@@ -651,4 +870,26 @@ public SSLContext get() {
 
     }
 
+    private void testCreateSSLContext_withPasswordFromFile(final String keyPassword,
+                                                           final String propertyName,
+                                                           final String pathPropertyName) throws Exception {
+
+        final Path secretFile = SecretUtilsTest.createSecretFile(keyPassword);
+
+        System.clearProperty(propertyName);
+        System.setProperty(pathPropertyName, secretFile.toString());
+
+        x509Util.getDefaultSSLContext();
+    }
+
+    private void testCreateSSLContext_withWrongPasswordFromFile(final String keyPassword,
+                                                                final String pathPropertyName) throws Exception {
+
+        final Path secretFile = SecretUtilsTest.createSecretFile(keyPassword + "_wrong");
+
+        assertThrows(X509Exception.SSLContextException.class, () -> {
+            System.setProperty(pathPropertyName, secretFile.toString());
+            x509Util.getDefaultSSLContext();
+        });
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKConfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKConfigTest.java
index eff1bfb3d29..31af82d34e0 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKConfigTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKConfigTest.java
@@ -18,30 +18,43 @@
 
 package org.apache.zookeeper.common;
 
-
-import static org.junit.Assert.assertEquals;
-import java.util.concurrent.TimeUnit;
-import org.junit.After;
-import org.junit.Rule;
-import org.junit.Test;
-import org.junit.rules.Timeout;
-
-
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import ch.qos.logback.classic.Level;
+import java.io.File;
+import java.io.IOException;
+import org.apache.zookeeper.test.LoggerTestTool;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 public class ZKConfigTest {
 
-    X509Util x509Util = new ClientX509Util();
+    private final X509Util x509Util = new ClientX509Util();
+    private static LoggerTestTool loggerTestTool;
 
-    @Rule
-    public Timeout timeout = new Timeout(10, TimeUnit.SECONDS);
+    @BeforeAll
+    public static void setUpBeforeClass() {
+        loggerTestTool = new LoggerTestTool(ZKConfig.class, Level.DEBUG);
+    }
+
+    @AfterAll
+    public static void tearDownAfterClass() throws Exception {
+        loggerTestTool.close();
+    }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         System.clearProperty(x509Util.getSslProtocolProperty());
     }
 
     // property is not set we should get the default value
     @Test
+    @Timeout(value = 10)
     public void testBooleanRetrievalFromPropertyDefault() {
         ZKConfig conf = new ZKConfig();
         String prop = "UnSetProperty" + System.currentTimeMillis();
@@ -52,6 +65,7 @@ public void testBooleanRetrievalFromPropertyDefault() {
 
     // property is set to an valid boolean, we should get the set value
     @Test
+    @Timeout(value = 10)
     public void testBooleanRetrievalFromProperty() {
         boolean value = true;
         boolean defaultValue = false;
@@ -63,6 +77,7 @@ public void testBooleanRetrievalFromProperty() {
 
     // property is set but with white spaces in the beginning
     @Test
+    @Timeout(value = 10)
     public void testBooleanRetrievalFromPropertyWithWhitespacesInBeginning() {
         boolean value = true;
         boolean defaultValue = false;
@@ -74,6 +89,7 @@ public void testBooleanRetrievalFromPropertyWithWhitespacesInBeginning() {
 
     // property is set but with white spaces at the end
     @Test
+    @Timeout(value = 10)
     public void testBooleanRetrievalFromPropertyWithWhitespacesAtEnd() {
         boolean value = true;
         boolean defaultValue = false;
@@ -85,6 +101,7 @@ public void testBooleanRetrievalFromPropertyWithWhitespacesAtEnd() {
 
     // property is set but with white spaces at the beginning and the end
     @Test
+    @Timeout(value = 10)
     public void testBooleanRetrievalFromPropertyWithWhitespacesAtBeginningAndEnd() {
         boolean value = true;
         boolean defaultValue = false;
@@ -93,4 +110,52 @@ public void testBooleanRetrievalFromPropertyWithWhitespacesAtBeginningAndEnd() {
         boolean result = conf.getBoolean(x509Util.getSslProtocolProperty(), defaultValue);
         assertEquals(value, result);
     }
+
+    @Test
+    public void testLogRedactorFromConfigFile() throws ConfigException, IOException {
+        // Arrange
+        File configFile = new File("./src/test/resources/zookeeper-client.config");
+
+        // Act
+        new ZKConfig(configFile.toPath());
+
+        // Assert
+        String logLine = loggerTestTool.readLogLine("ZK Config");
+        assertNotNull(logLine, "Unable to find ZK Config line in the logs");
+        assertFalse(logLine.contains("FileSecret456!"), "Logs should not contain any secrets");
+        assertFalse(logLine.contains("AnotherFileSecret789!"), "Logs should not contain any secrets");
+        assertTrue(logLine.contains("/home/zookeeper/top_secret.txt"));      // what we shouldn't redact
+    }
+
+    @Test
+    public void testLogRedactorInDebugLogs() throws IOException {
+        // Arrange
+        ZKConfig conf = new ZKConfig();
+
+        // Act
+        conf.setProperty("zookeeper.some.secret.password", "0ldP4ssw0rd");
+        conf.setProperty("zookeeper.some.secret.password", "N3Ws3cr3t");
+
+        // Assert
+        String logLine = loggerTestTool.readLogLine("replaced with new value");
+        assertNotNull(logLine, "Unable to find relevant line in the logs");
+        assertFalse(logLine.contains("0ldP4ssw0rd"), "Logs should not contain any secrets");
+        assertFalse(logLine.contains("N3Ws3cr3t"), "Logs should not contain any secrets");
+    }
+
+    @Test
+    public void testDontRedactorInDebugLogs() throws IOException {
+        // Arrange
+        ZKConfig conf = new ZKConfig();
+
+        // Act
+        conf.setProperty("zookeeper.some.secret.passwordPath", "/home/zookeeper/old_secret.txt");  // what we shouldn't redact
+        conf.setProperty("zookeeper.some.secret.passwordPath", "/home/zookeeper/new_secret.txt");  // what we shouldn't redact
+
+        // Assert
+        String logLine = loggerTestTool.readLogLine("replaced with new value");
+        assertNotNull(logLine, "Unable to find relevant line in the logs");
+        assertTrue(logLine.contains("/home/zookeeper/new_secret.txt"));
+    }
+
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKHostnameVerifierTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKHostnameVerifierTest.java
new file mode 100644
index 00000000000..37f29c1e8ec
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKHostnameVerifierTest.java
@@ -0,0 +1,161 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common;
+
+import static org.junit.jupiter.api.Assertions.fail;
+import java.io.ByteArrayInputStream;
+import java.io.InputStream;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import javax.net.ssl.SSLException;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+/**
+ * Note: These test cases (and resources) have been taken from the Apache HttpComponents project.
+ */
+public class ZKHostnameVerifierTest {
+
+    private ZKHostnameVerifier impl;
+
+    @BeforeEach
+    public void setup() {
+        impl = new ZKHostnameVerifier();
+    }
+
+    @Test
+    public void testVerify() throws Exception {
+        final CertificateFactory cf = CertificateFactory.getInstance("X.509");
+        InputStream in;
+        X509Certificate x509;
+        in = new ByteArrayInputStream(CertificatesToPlayWith.X509_FOO);
+        x509 = (X509Certificate) cf.generateCertificate(in);
+
+        impl.verify("foo.com", x509);
+        exceptionPlease(impl, "a.foo.com", x509);
+        exceptionPlease(impl, "bar.com", x509);
+
+        in = new ByteArrayInputStream(CertificatesToPlayWith.X509_HANAKO);
+        x509 = (X509Certificate) cf.generateCertificate(in);
+        impl.verify("\u82b1\u5b50.co.jp", x509);
+        exceptionPlease(impl, "a.\u82b1\u5b50.co.jp", x509);
+
+        in = new ByteArrayInputStream(CertificatesToPlayWith.X509_FOO_BAR);
+        x509 = (X509Certificate) cf.generateCertificate(in);
+        exceptionPlease(impl, "foo.com", x509);
+        exceptionPlease(impl, "a.foo.com", x509);
+        impl.verify("bar.com", x509);
+        exceptionPlease(impl, "a.bar.com", x509);
+
+        in = new ByteArrayInputStream(CertificatesToPlayWith.X509_FOO_BAR_HANAKO);
+        x509 = (X509Certificate) cf.generateCertificate(in);
+        exceptionPlease(impl, "foo.com", x509);
+        exceptionPlease(impl, "a.foo.com", x509);
+        impl.verify("bar.com", x509);
+        exceptionPlease(impl, "a.bar.com", x509);
+
+        /*
+           Java isn't extracting international subjectAlts properly.  (Or
+           OpenSSL isn't storing them properly).
+        */
+        // DEFAULT.verify("\u82b1\u5b50.co.jp", x509 );
+        // impl.verify("\u82b1\u5b50.co.jp", x509 );
+        exceptionPlease(impl, "a.\u82b1\u5b50.co.jp", x509);
+
+        in = new ByteArrayInputStream(CertificatesToPlayWith.X509_NO_CNS_FOO);
+        x509 = (X509Certificate) cf.generateCertificate(in);
+        impl.verify("foo.com", x509);
+        exceptionPlease(impl, "a.foo.com", x509);
+
+        in = new ByteArrayInputStream(CertificatesToPlayWith.X509_NO_CNS_FOO);
+        x509 = (X509Certificate) cf.generateCertificate(in);
+        impl.verify("foo.com", x509);
+        exceptionPlease(impl, "a.foo.com", x509);
+
+        in = new ByteArrayInputStream(CertificatesToPlayWith.X509_THREE_CNS_FOO_BAR_HANAKO);
+        x509 = (X509Certificate) cf.generateCertificate(in);
+        exceptionPlease(impl, "foo.com", x509);
+        exceptionPlease(impl, "a.foo.com", x509);
+        exceptionPlease(impl, "bar.com", x509);
+        exceptionPlease(impl, "a.bar.com", x509);
+        impl.verify("\u82b1\u5b50.co.jp", x509);
+        exceptionPlease(impl, "a.\u82b1\u5b50.co.jp", x509);
+
+        in = new ByteArrayInputStream(CertificatesToPlayWith.X509_WILD_FOO);
+        x509 = (X509Certificate) cf.generateCertificate(in);
+        exceptionPlease(impl, "foo.com", x509);
+        impl.verify("www.foo.com", x509);
+        impl.verify("\u82b1\u5b50.foo.com", x509);
+        exceptionPlease(impl, "a.b.foo.com", x509);
+
+        in = new ByteArrayInputStream(CertificatesToPlayWith.X509_WILD_CO_JP);
+        x509 = (X509Certificate) cf.generateCertificate(in);
+        // Silly test because no-one would ever be able to lookup an IP address
+        // using "*.co.jp".
+        impl.verify("*.co.jp", x509);
+        impl.verify("foo.co.jp", x509);
+        impl.verify("\u82b1\u5b50.co.jp", x509);
+
+        in = new ByteArrayInputStream(CertificatesToPlayWith.X509_WILD_FOO_BAR_HANAKO);
+        x509 = (X509Certificate) cf.generateCertificate(in);
+        // try the foo.com variations
+        exceptionPlease(impl, "foo.com", x509);
+        exceptionPlease(impl, "www.foo.com", x509);
+        exceptionPlease(impl, "\u82b1\u5b50.foo.com", x509);
+        exceptionPlease(impl, "a.b.foo.com", x509);
+        // try the bar.com variations
+        exceptionPlease(impl, "bar.com", x509);
+        impl.verify("www.bar.com", x509);
+        impl.verify("\u82b1\u5b50.bar.com", x509);
+        exceptionPlease(impl, "a.b.bar.com", x509);
+
+        in = new ByteArrayInputStream(CertificatesToPlayWith.X509_MULTIPLE_VALUE_AVA);
+        x509 = (X509Certificate) cf.generateCertificate(in);
+        impl.verify("repository.infonotary.com", x509);
+
+        in = new ByteArrayInputStream(CertificatesToPlayWith.S_GOOGLE_COM);
+        x509 = (X509Certificate) cf.generateCertificate(in);
+        impl.verify("*.google.com", x509);
+
+        in = new ByteArrayInputStream(CertificatesToPlayWith.S_GOOGLE_COM);
+        x509 = (X509Certificate) cf.generateCertificate(in);
+        impl.verify("*.Google.com", x509);
+
+        in = new ByteArrayInputStream(CertificatesToPlayWith.IP_1_1_1_1);
+        x509 = (X509Certificate) cf.generateCertificate(in);
+        impl.verify("1.1.1.1", x509);
+
+        exceptionPlease(impl, "1.1.1.2", x509);
+        exceptionPlease(impl, "dummy-value.com", x509);
+
+        in = new ByteArrayInputStream(CertificatesToPlayWith.EMAIL_ALT_SUBJECT_NAME);
+        x509 = (X509Certificate) cf.generateCertificate(in);
+        impl.verify("www.company.com", x509);
+    }
+
+    private void exceptionPlease(final ZKHostnameVerifier hv, final String host,
+                                 final X509Certificate x509) {
+        try {
+            hv.verify(host, x509);
+            fail("HostnameVerifier shouldn't allow [" + host + "]");
+        } catch (final SSLException e) {
+            // whew!  we're okay!
+        }
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKTrustManagerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKTrustManagerTest.java
index 66fabed7f10..568f2ef502f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKTrustManagerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ZKTrustManagerTest.java
@@ -18,6 +18,9 @@
 
 package org.apache.zookeeper.common;
 
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
@@ -25,15 +28,24 @@
 import java.math.BigInteger;
 import java.net.InetAddress;
 import java.net.Socket;
+import java.net.UnknownHostException;
 import java.security.KeyPair;
 import java.security.KeyPairGenerator;
 import java.security.Security;
+import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.Calendar;
+import java.util.Collections;
 import java.util.Date;
+import java.util.LinkedHashMap;
 import java.util.List;
+import java.util.Map;
 import java.util.Random;
+import java.util.concurrent.CopyOnWriteArrayList;
+import javax.net.ssl.SSLException;
+import javax.net.ssl.SSLSession;
 import javax.net.ssl.X509ExtendedTrustManager;
 import org.apache.zookeeper.ZKTestCase;
 import org.bouncycastle.asn1.x500.X500NameBuilder;
@@ -49,26 +61,47 @@
 import org.bouncycastle.jce.provider.BouncyCastleProvider;
 import org.bouncycastle.operator.ContentSigner;
 import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
-import org.junit.AfterClass;
-import org.junit.Before;
-import org.junit.BeforeClass;
-import org.junit.Test;
-import org.mockito.invocation.InvocationOnMock;
+import org.burningwave.tools.net.DefaultHostResolver;
+import org.burningwave.tools.net.HostResolutionRequestInterceptor;
+import org.burningwave.tools.net.MappedHostResolver;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.mockito.stubbing.Answer;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 // We can only test calls to ZKTrustManager using Sockets (not SSLEngines). This can be fine since the logic is the same.
 public class ZKTrustManagerTest extends ZKTestCase {
 
+    protected static final Logger LOG = LoggerFactory.getLogger(ZKTrustManagerTest.class);
+
     private static KeyPair keyPair;
 
     private X509ExtendedTrustManager mockX509ExtendedTrustManager;
     private static final String IP_ADDRESS = "127.0.0.1";
     private static final String HOSTNAME = "localhost";
-
-    private InetAddress mockInetAddress;
     private Socket mockSocket;
 
-    @BeforeClass
+    @BeforeAll
+    public static void setupDNSMocks() {
+        Map<String, String> hostAliases = new LinkedHashMap<>();
+        hostAliases.put(HOSTNAME, IP_ADDRESS);
+
+        HostResolutionRequestInterceptor.INSTANCE.install(
+                new MappedHostResolver(hostAliases),
+                DefaultHostResolver.INSTANCE
+        );
+    }
+
+    @AfterAll
+    public static void clearDNSMocks() {
+        HostResolutionRequestInterceptor.INSTANCE.uninstall();
+    }
+
+    @BeforeAll
     public static void createKeyPair() throws Exception {
         Security.addProvider(new BouncyCastleProvider());
         KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA", BouncyCastleProvider.PROVIDER_NAME);
@@ -76,40 +109,25 @@ public static void createKeyPair() throws Exception {
         keyPair = keyPairGenerator.genKeyPair();
     }
 
-    @AfterClass
+    @AfterAll
     public static void removeBouncyCastleProvider() throws Exception {
         Security.removeProvider("BC");
     }
 
-    @Before
+    @BeforeEach
     public void setup() throws Exception {
         mockX509ExtendedTrustManager = mock(X509ExtendedTrustManager.class);
+        mockSocket = createSocketWithHostname();
+    }
+
+    @AfterEach
+    public void tearDown() throws Exception {
+        if (mockSocket != null) {
+            mockSocket.close();
+        }
+    }
 
-        mockInetAddress = mock(InetAddress.class);
-        when(mockInetAddress.getHostAddress()).thenAnswer(new Answer() {
-            @Override
-            public Object answer(InvocationOnMock invocationOnMock) throws Throwable {
-                return IP_ADDRESS;
-            }
-        });
-
-        when(mockInetAddress.getHostName()).thenAnswer(new Answer() {
-            @Override
-            public Object answer(InvocationOnMock invocationOnMock) throws Throwable {
-                return HOSTNAME;
-            }
-        });
-
-        mockSocket = mock(Socket.class);
-        when(mockSocket.getInetAddress()).thenAnswer(new Answer() {
-            @Override
-            public Object answer(InvocationOnMock invocationOnMock) throws Throwable {
-                return mockInetAddress;
-            }
-        });
-    }
-
-    private X509Certificate[] createSelfSignedCertifcateChain(String ipAddress, String hostname) throws Exception {
+    private X509Certificate[] createSelfSignedCertificateChain(String ipAddress, String hostname) throws Exception {
         X500NameBuilder nameBuilder = new X500NameBuilder(BCStyle.INSTANCE);
         nameBuilder.addRDN(BCStyle.CN, "NOT_LOCALHOST");
         Date notBefore = new Date();
@@ -143,106 +161,198 @@ private X509Certificate[] createSelfSignedCertifcateChain(String ipAddress, Stri
 
     @Test
     public void testServerHostnameVerificationWithHostnameVerificationDisabled() throws Exception {
-        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, false, false);
+        VerifiableHostnameVerifier hostnameVerifier = new VerifiableHostnameVerifier();
+        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, false, false,
+                hostnameVerifier, false);
 
-        X509Certificate[] certificateChain = createSelfSignedCertifcateChain(IP_ADDRESS, HOSTNAME);
+        X509Certificate[] certificateChain = createSelfSignedCertificateChain(IP_ADDRESS, HOSTNAME);
         zkTrustManager.checkServerTrusted(certificateChain, null, mockSocket);
-
-        verify(mockInetAddress, times(0)).getHostAddress();
-        verify(mockInetAddress, times(0)).getHostName();
+        verify(mockSocket, times(0)).getInetAddress();
+        assertTrue(hostnameVerifier.hosts.isEmpty());
 
         verify(mockX509ExtendedTrustManager, times(1)).checkServerTrusted(certificateChain, null, mockSocket);
     }
 
     @Test
     public void testServerHostnameVerificationWithHostnameVerificationDisabledAndClientHostnameVerificationEnabled() throws Exception {
-        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, false, true);
+        VerifiableHostnameVerifier hostnameVerifier = new VerifiableHostnameVerifier();
+        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, false, true,
+                hostnameVerifier, false);
 
-        X509Certificate[] certificateChain = createSelfSignedCertifcateChain(IP_ADDRESS, HOSTNAME);
+        X509Certificate[] certificateChain = createSelfSignedCertificateChain(IP_ADDRESS, HOSTNAME);
         zkTrustManager.checkServerTrusted(certificateChain, null, mockSocket);
+        verify(mockSocket, times(0)).getInetAddress();
 
-        verify(mockInetAddress, times(0)).getHostAddress();
-        verify(mockInetAddress, times(0)).getHostName();
+        assertTrue(hostnameVerifier.hosts.isEmpty());
 
         verify(mockX509ExtendedTrustManager, times(1)).checkServerTrusted(certificateChain, null, mockSocket);
     }
 
     @Test
     public void testServerHostnameVerificationWithIPAddress() throws Exception {
-        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, false);
+        VerifiableHostnameVerifier hostnameVerifier = new VerifiableHostnameVerifier();
+        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, false,
+                hostnameVerifier, false);
 
-        X509Certificate[] certificateChain = createSelfSignedCertifcateChain(IP_ADDRESS, null);
+        X509Certificate[] certificateChain = createSelfSignedCertificateChain(IP_ADDRESS, null);
         zkTrustManager.checkServerTrusted(certificateChain, null, mockSocket);
+        verify(mockSocket, times(1)).getInetAddress();
 
-        verify(mockInetAddress, times(1)).getHostAddress();
-        verify(mockInetAddress, times(0)).getHostName();
+        assertEquals(Arrays.asList(IP_ADDRESS), hostnameVerifier.hosts);
 
         verify(mockX509ExtendedTrustManager, times(1)).checkServerTrusted(certificateChain, null, mockSocket);
     }
 
     @Test
     public void testServerHostnameVerificationWithHostname() throws Exception {
-        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, false);
+        VerifiableHostnameVerifier hostnameVerifier = new VerifiableHostnameVerifier();
+        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, false,
+                hostnameVerifier, false);
 
-        X509Certificate[] certificateChain = createSelfSignedCertifcateChain(null, HOSTNAME);
+        X509Certificate[] certificateChain = createSelfSignedCertificateChain(null, HOSTNAME);
         zkTrustManager.checkServerTrusted(certificateChain, null, mockSocket);
+        verify(mockSocket, times(1)).getInetAddress();
 
-        verify(mockInetAddress, times(1)).getHostAddress();
-        verify(mockInetAddress, times(1)).getHostName();
+        assertEquals(Arrays.asList(IP_ADDRESS, HOSTNAME), hostnameVerifier.hosts);
 
         verify(mockX509ExtendedTrustManager, times(1)).checkServerTrusted(certificateChain, null, mockSocket);
     }
 
     @Test
     public void testClientHostnameVerificationWithHostnameVerificationDisabled() throws Exception {
-        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, false, true);
+        VerifiableHostnameVerifier hostnameVerifier = new VerifiableHostnameVerifier();
+        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, false, true,
+                hostnameVerifier, false);
 
-        X509Certificate[] certificateChain = createSelfSignedCertifcateChain(null, HOSTNAME);
+        X509Certificate[] certificateChain = createSelfSignedCertificateChain(null, HOSTNAME);
         zkTrustManager.checkClientTrusted(certificateChain, null, mockSocket);
+        verify(mockSocket, times(1)).getInetAddress();
 
-        verify(mockInetAddress, times(1)).getHostAddress();
-        verify(mockInetAddress, times(1)).getHostName();
+        assertEquals(Arrays.asList(IP_ADDRESS, HOSTNAME), hostnameVerifier.hosts);
 
         verify(mockX509ExtendedTrustManager, times(1)).checkClientTrusted(certificateChain, null, mockSocket);
     }
 
     @Test
     public void testClientHostnameVerificationWithClientHostnameVerificationDisabled() throws Exception {
-        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, false);
+        VerifiableHostnameVerifier hostnameVerifier = new VerifiableHostnameVerifier();
+        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true,
+                false, hostnameVerifier, false);
 
-        X509Certificate[] certificateChain = createSelfSignedCertifcateChain(null, HOSTNAME);
+        X509Certificate[] certificateChain = createSelfSignedCertificateChain(null, HOSTNAME);
         zkTrustManager.checkClientTrusted(certificateChain, null, mockSocket);
+        verify(mockSocket, times(0)).getInetAddress();
 
-        verify(mockInetAddress, times(0)).getHostAddress();
-        verify(mockInetAddress, times(0)).getHostName();
+        assertTrue(hostnameVerifier.hosts.isEmpty());
 
         verify(mockX509ExtendedTrustManager, times(1)).checkClientTrusted(certificateChain, null, mockSocket);
     }
 
     @Test
     public void testClientHostnameVerificationWithIPAddress() throws Exception {
-        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, true);
+        VerifiableHostnameVerifier hostnameVerifier = new VerifiableHostnameVerifier();
+        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, true,
+                hostnameVerifier, false);
 
-        X509Certificate[] certificateChain = createSelfSignedCertifcateChain(IP_ADDRESS, null);
+        X509Certificate[] certificateChain = createSelfSignedCertificateChain(IP_ADDRESS, null);
         zkTrustManager.checkClientTrusted(certificateChain, null, mockSocket);
+        verify(mockSocket, times(1)).getInetAddress();
 
-        verify(mockInetAddress, times(1)).getHostAddress();
-        verify(mockInetAddress, times(0)).getHostName();
+        assertEquals(Arrays.asList(IP_ADDRESS), hostnameVerifier.hosts);
 
         verify(mockX509ExtendedTrustManager, times(1)).checkClientTrusted(certificateChain, null, mockSocket);
     }
 
     @Test
     public void testClientHostnameVerificationWithHostname() throws Exception {
-        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, true);
+        VerifiableHostnameVerifier hostnameVerifier = new VerifiableHostnameVerifier();
+        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, true,
+                hostnameVerifier, false);
 
-        X509Certificate[] certificateChain = createSelfSignedCertifcateChain(null, HOSTNAME);
+        X509Certificate[] certificateChain = createSelfSignedCertificateChain(null, HOSTNAME);
         zkTrustManager.checkClientTrusted(certificateChain, null, mockSocket);
+        verify(mockSocket, times(1)).getInetAddress();
 
-        verify(mockInetAddress, times(1)).getHostAddress();
-        verify(mockInetAddress, times(1)).getHostName();
+        assertEquals(Arrays.asList(IP_ADDRESS, HOSTNAME), hostnameVerifier.hosts);
 
         verify(mockX509ExtendedTrustManager, times(1)).checkClientTrusted(certificateChain, null, mockSocket);
     }
 
+    @Test
+    public void testClientHostnameVerificationWithIpAddress_CertHostnameSan_NoReverseLookup_Fail() throws Exception {
+        VerifiableHostnameVerifier hostnameVerifier = new VerifiableHostnameVerifier();
+        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, true,
+            hostnameVerifier, false);
+
+        X509Certificate[] certificateChain = createSelfSignedCertificateChain(null, HOSTNAME);
+        try (Socket s = createSocketWithIpAddress()) {
+            assertThrows(CertificateException.class, () -> zkTrustManager.checkClientTrusted(certificateChain, null, s));
+            verify(s, times(1)).getInetAddress();
+            assertEquals(Collections.singletonList(IP_ADDRESS), hostnameVerifier.hosts);
+            verify(mockX509ExtendedTrustManager, times(1)).checkClientTrusted(certificateChain, null, s);
+        }
+    }
+
+    @Test
+    public void testClientHostnameVerificationWithIpAddress_CertHostnameSan_WithReverseLookup() throws Exception {
+        VerifiableHostnameVerifier hostnameVerifier = new VerifiableHostnameVerifier();
+        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, true,
+            hostnameVerifier, true);
+
+        X509Certificate[] certificateChain = createSelfSignedCertificateChain(null, HOSTNAME);
+        try (Socket s = createSocketWithIpAddress()) {
+            zkTrustManager.checkClientTrusted(certificateChain, null, s);
+            verify(s, times(1)).getInetAddress();
+            assertEquals(Arrays.asList(IP_ADDRESS, HOSTNAME), hostnameVerifier.hosts);
+            verify(mockX509ExtendedTrustManager, times(1)).checkClientTrusted(certificateChain, null, s);
+        }
+    }
+
+    @Test
+    public void testClientHostnameVerificationWithIpAddress_CertIpSan() throws Exception {
+        VerifiableHostnameVerifier hostnameVerifier = new VerifiableHostnameVerifier();
+        ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, true,
+            hostnameVerifier, false);
+
+        X509Certificate[] certificateChain = createSelfSignedCertificateChain(IP_ADDRESS, null);
+        try (Socket s = createSocketWithIpAddress()) {
+            zkTrustManager.checkClientTrusted(certificateChain, null, s);
+            verify(s, times(1)).getInetAddress();
+            assertEquals(Collections.singletonList(IP_ADDRESS), hostnameVerifier.hosts);
+            verify(mockX509ExtendedTrustManager, times(1)).checkClientTrusted(certificateChain, null, s);
+        }
+    }
+
+    private Socket createSocketWithHostname() throws UnknownHostException {
+        InetAddress mockInetAddress = InetAddress.getByName(HOSTNAME);
+        Socket s = mock(Socket.class);
+        when(s.getInetAddress()).thenAnswer((Answer) invocationOnMock -> mockInetAddress);
+        return s;
+    }
+
+    private Socket createSocketWithIpAddress() throws UnknownHostException {
+        InetAddress mockInetAddress = InetAddress.getByName(IP_ADDRESS);
+        Socket s = mock(Socket.class);
+        when(s.getInetAddress()).thenAnswer((Answer) invocationOnMock -> mockInetAddress);
+        return s;
+    }
+
+    static class VerifiableHostnameVerifier extends ZKHostnameVerifier {
+
+        List<String> hosts = new CopyOnWriteArrayList<>();
+
+        @Override
+        public boolean verify(String host, SSLSession session) {
+            throw new IllegalArgumentException("not expected to be called by these tests");
+        }
+
+        @Override
+        void verify(String host, X509Certificate cert) throws SSLException {
+            LOG.info("verifyWithX509Certificate {} {}", host, cert);
+            hosts.add(host);
+            super.verify(host, cert);
+        }
+    }
+
+
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/Ca.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/Ca.java
new file mode 100644
index 00000000000..dfeea301243
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/Ca.java
@@ -0,0 +1,193 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common.ssl;
+
+import com.sun.net.httpserver.HttpServer;
+import java.io.FileWriter;
+import java.math.BigInteger;
+import java.net.InetSocketAddress;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.StandardCopyOption;
+import java.security.KeyPair;
+import java.security.cert.X509Certificate;
+import java.time.Instant;
+import java.util.Collections;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Objects;
+import java.util.concurrent.atomic.AtomicLong;
+import org.apache.zookeeper.common.X509TestHelpers;
+import org.bouncycastle.asn1.ASN1GeneralizedTime;
+import org.bouncycastle.asn1.ocsp.RevokedInfo;
+import org.bouncycastle.asn1.x509.CRLNumber;
+import org.bouncycastle.asn1.x509.CRLReason;
+import org.bouncycastle.asn1.x509.Extension;
+import org.bouncycastle.cert.X509CRLHolder;
+import org.bouncycastle.cert.X509v2CRLBuilder;
+import org.bouncycastle.cert.jcajce.JcaX509ExtensionUtils;
+import org.bouncycastle.cert.jcajce.JcaX509v2CRLBuilder;
+import org.bouncycastle.openssl.MiscPEMGenerator;
+import org.bouncycastle.operator.ContentSigner;
+import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
+import org.bouncycastle.util.io.pem.PemWriter;
+
+public class Ca implements AutoCloseable {
+    public static class CaBuilder {
+        private final Path dir;
+        private String name = "CA";
+        private boolean ocsp = false;
+
+        CaBuilder(Path dir) {
+            this.dir = dir;
+        }
+
+        public CaBuilder withName(String name) {
+            this.name = Objects.requireNonNull(name);
+            return this;
+        }
+
+        public CaBuilder withOcsp() {
+            this.ocsp = true;
+            return this;
+        }
+
+        public Ca build() throws Exception {
+            KeyPair caKey = X509TestHelpers.generateRSAKeyPair();
+            X509Certificate caCert = X509TestHelpers.newSelfSignedCert(name, caKey);
+            if (ocsp) {
+                HttpServer ocspServer = HttpServer.create(new InetSocketAddress("127.0.0.1", 0), 0);
+                Ca ca = new Ca(dir, name, caKey, caCert, ocspServer);
+                ca.ocspServer.createContext("/", new OCSPHandler(ca));
+                ca.ocspServer.start();
+                return ca;
+            }
+            return new Ca(dir, name, caKey, caCert, null);
+        }
+    }
+
+    public final Path dir;
+    public final String name;
+    public final KeyPair key;
+    public final X509Certificate cert;
+    public final Map<X509Certificate, RevokedInfo> crlRevokedCerts = Collections.synchronizedMap(new HashMap<>());
+    public final Map<X509Certificate, RevokedInfo> ocspRevokedCerts = Collections.synchronizedMap(new HashMap<>());
+    public final HttpServer ocspServer;
+    public final AtomicLong crlNumber = new AtomicLong(1);
+    public final PemFile pemFile;
+
+    Ca(Path dir, String name, KeyPair key, X509Certificate cert, HttpServer ocspServer) throws Exception {
+        this.dir = dir;
+        this.name = name;
+        this.key = key;
+        this.cert = cert;
+        this.ocspServer = ocspServer;
+        this.pemFile = writePem();
+    }
+
+    private PemFile writePem() throws Exception {
+        String pem = X509TestHelpers.pemEncodeX509Certificate(cert);
+        Path file = Files.createTempFile(dir, name, ".pem");
+        Files.write(file, pem.getBytes());
+        return new PemFile(file, "");
+    }
+
+    // Check result of crldp could be cached, so use per-cert crl file.
+    public void flush_crl(Cert cert) throws Exception {
+        Objects.requireNonNull(cert.crl, "cert is signed with no crldp");
+        Instant now = Instant.now();
+
+        X509v2CRLBuilder builder = new JcaX509v2CRLBuilder(cert.cert.getIssuerX500Principal(), Date.from(now));
+        builder.setNextUpdate(Date.from(now.plusSeconds(2)));
+
+        builder.addExtension(Extension.authorityKeyIdentifier, false, new JcaX509ExtensionUtils().createAuthorityKeyIdentifier(this.cert));
+        builder.addExtension(Extension.cRLNumber, false, new CRLNumber(BigInteger.valueOf(crlNumber.getAndAdd(1L))));
+
+        for (Map.Entry<X509Certificate, RevokedInfo> entry : crlRevokedCerts.entrySet()) {
+            builder.addCRLEntry(entry.getKey().getSerialNumber(), entry.getValue().getRevocationTime().getDate(), CRLReason.cACompromise);
+        }
+
+        ContentSigner contentSigner = new JcaContentSignerBuilder("SHA256WithRSAEncryption").build(this.key.getPrivate());
+        X509CRLHolder crlHolder = builder.build(contentSigner);
+
+        Path tmpFile = Files.createTempFile(dir, "crldp-", ".pem.tmp");
+        PemWriter pemWriter = new PemWriter(new FileWriter(tmpFile.toFile()));
+        pemWriter.writeObject(new MiscPEMGenerator(crlHolder));
+        pemWriter.flush();
+        pemWriter.close();
+
+        Files.move(tmpFile, cert.crl, StandardCopyOption.REPLACE_EXISTING, StandardCopyOption.ATOMIC_MOVE);
+    }
+
+    public void revoke_through_crldp(Cert cert) throws Exception {
+        Date now = new Date();
+        RevokedInfo revokedInfo = new RevokedInfo(new ASN1GeneralizedTime(now), CRLReason.lookup(CRLReason.cACompromise));
+        this.crlRevokedCerts.put(cert.cert, revokedInfo);
+        flush_crl(cert);
+    }
+
+    public void revoke_through_ocsp(X509Certificate cert) throws Exception {
+        Date now = new Date();
+        RevokedInfo revokedInfo = new RevokedInfo(new ASN1GeneralizedTime(now), CRLReason.lookup(CRLReason.cACompromise));
+        this.ocspRevokedCerts.put(cert, revokedInfo);
+    }
+
+    public CertSigner signer(String name) throws Exception {
+        return new CertSigner(this, name);
+    }
+
+    public Cert sign(String name) throws Exception {
+        return signer(name).sign();
+    }
+
+    public Cert sign_with_crldp(String name) throws Exception {
+        return signer(name).withCrldp().sign();
+    }
+
+    public Cert sign_with_ocsp(String name) throws Exception {
+        return signer(name).withOcsp().sign();
+    }
+
+    public static CaBuilder builder(Path dir) {
+        return new CaBuilder(dir);
+    }
+
+    public static Ca create(Path dir) throws Exception {
+        return Ca.builder(dir).build();
+    }
+
+    public static Ca create(String name, Path dir) throws Exception {
+        return Ca.builder(dir).withName(name).build();
+    }
+
+    public String getOcspAddress() {
+        if (ocspServer != null) {
+            return String.format("http://127.0.0.1:%d", ocspServer.getAddress().getPort());
+        }
+        throw new IllegalStateException("No OCSP server available");
+    }
+
+    @Override
+    public void close() throws Exception {
+        if (ocspServer != null) {
+            ocspServer.stop(0);
+        }
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/Cert.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/Cert.java
new file mode 100644
index 00000000000..d388a7a5d6a
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/Cert.java
@@ -0,0 +1,91 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common.ssl;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.security.KeyPair;
+import java.security.cert.X509Certificate;
+import java.util.Properties;
+import java.util.UUID;
+import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.common.X509TestHelpers;
+
+public class Cert {
+    public final String name;
+    public final KeyPair key;
+    public final X509Certificate cert;
+    public final Path dir;
+    public final Path crl;
+
+    Cert(String name, KeyPair key, X509Certificate cert, Path dir, Path crl) {
+        this.name = name;
+        this.key = key;
+        this.cert = cert;
+        this.dir = dir;
+        this.crl = crl;
+    }
+
+    public PemFile writePem() throws Exception {
+        String password = UUID.randomUUID().toString();
+        String pem = X509TestHelpers.pemEncodeCertAndPrivateKey(cert, key.getPrivate(), password);
+        Path file = Files.createTempFile(dir, name, ".pem");
+        Files.write(file, pem.getBytes());
+        return new PemFile(file, password);
+    }
+
+    public Properties buildServerProperties(Ca ca) throws Exception {
+        final Properties config = new Properties();
+        config.put("clientPort", "0");
+        config.put("secureClientPort", "0");
+
+        // explicitly ipv4 to avoid dns lookup issue
+        config.put("clientPortAddress", "127.0.0.1");
+        config.put("secureClientPortAddress", "127.0.0.1");
+
+        config.put("admin.enableServer", "false");
+        config.put("admin.rateLimiterIntervalInMS", "0");
+
+        PemFile serverPem = writePem();
+
+        // TLS config fields
+        config.put("ssl.keyStore.location", serverPem.file.toString());
+        config.put("ssl.keyStore.password", serverPem.password);
+        config.put("ssl.trustStore.location", ca.pemFile.file.toString());
+
+        // Netty is required for TLS
+        config.put("serverCnxnFactory", org.apache.zookeeper.server.NettyServerCnxnFactory.class.getName());
+        config.put("4lw.commands.whitelist", "*");
+        return config;
+    }
+
+    public ZKClientConfig buildClientConfig(Ca ca) throws Exception {
+        PemFile pemFile = writePem();
+
+        ZKClientConfig config = new ZKClientConfig();
+        config.setProperty("zookeeper.client.secure", "true");
+        config.setProperty("zookeeper.ssl.keyStore.password", pemFile.password);
+        config.setProperty("zookeeper.ssl.keyStore.location", pemFile.file.toString());
+        config.setProperty("zookeeper.ssl.trustStore.location", ca.pemFile.file.toString());
+
+        // only netty supports TLS
+        config.setProperty("zookeeper.clientCnxnSocket", org.apache.zookeeper.ClientCnxnSocketNetty.class.getName());
+        return config;
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/CertSigner.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/CertSigner.java
new file mode 100644
index 00000000000..28ae6d61ee6
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/CertSigner.java
@@ -0,0 +1,174 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common.ssl;
+
+import java.math.BigInteger;
+import java.net.InetAddress;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.security.KeyPair;
+import java.security.cert.X509Certificate;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.Date;
+import java.util.List;
+import java.util.Random;
+import org.apache.zookeeper.common.X509TestHelpers;
+import org.bouncycastle.asn1.x500.X500Name;
+import org.bouncycastle.asn1.x509.AuthorityInformationAccess;
+import org.bouncycastle.asn1.x509.BasicConstraints;
+import org.bouncycastle.asn1.x509.CRLDistPoint;
+import org.bouncycastle.asn1.x509.DistributionPoint;
+import org.bouncycastle.asn1.x509.DistributionPointName;
+import org.bouncycastle.asn1.x509.Extension;
+import org.bouncycastle.asn1.x509.GeneralName;
+import org.bouncycastle.asn1.x509.GeneralNames;
+import org.bouncycastle.asn1.x509.KeyUsage;
+import org.bouncycastle.asn1.x509.X509ObjectIdentifiers;
+import org.bouncycastle.cert.X509CertificateHolder;
+import org.bouncycastle.cert.X509v3CertificateBuilder;
+import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
+import org.bouncycastle.cert.jcajce.JcaX509CertificateHolder;
+import org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder;
+import org.bouncycastle.operator.ContentSigner;
+import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
+
+public class CertSigner {
+    private final Ca ca;
+    private final String name;
+
+    private Path crldp;
+    private boolean ocsp;
+
+    private final List<String> dnsNames = new ArrayList<>();
+    private final List<String> ipAddresses = new ArrayList<>();
+    private Duration expiration = Duration.ofDays(1);
+    private X509CertBuilder certBuilder;
+
+    CertSigner(Ca ca, String name) {
+        this.ca = ca;
+        this.name = name;
+    }
+
+    public CertSigner withCrldp() throws Exception {
+        this.crldp = Files.createTempFile(ca.dir, String.format("%s-crldp-", name), ".pem");
+        return this;
+    }
+
+    public CertSigner withOcsp() {
+        this.ocsp = true;
+        return this;
+    }
+
+    public CertSigner withDnsName(String name) {
+        dnsNames.add(name);
+        return this;
+    }
+
+    public CertSigner withResolvedDns(String name) throws Exception {
+        dnsNames.add(name);
+        InetAddress[] localAddresses = InetAddress.getAllByName("localhost");
+        for (InetAddress addr : localAddresses) {
+            ipAddresses.add(addr.getHostAddress());
+        }
+        return this;
+    }
+
+    public CertSigner withIpAddress(String ipAddress) {
+        ipAddresses.add(ipAddress);
+        return this;
+    }
+
+    /**
+     * Default to {@code Duration.ofDays(1)}.
+     */
+    public CertSigner withExpiration(Duration expiration) {
+        this.expiration = expiration;
+        return this;
+    }
+
+    public CertSigner withCertBuilder(X509CertBuilder certBuilder) {
+        this.certBuilder = certBuilder;
+        return this;
+    }
+
+    public Cert sign() throws Exception {
+        X509CertificateHolder holder = new JcaX509CertificateHolder(ca.cert);
+        ContentSigner signer = new JcaContentSignerBuilder("SHA256WithRSAEncryption").build(ca.key.getPrivate());
+
+        List<GeneralName> generalNames = new ArrayList<>();
+        for (String dnsName : dnsNames) {
+            generalNames.add(new GeneralName(GeneralName.dNSName, dnsName));
+        }
+        for (String ipAddress : ipAddresses) {
+            generalNames.add(new GeneralName(GeneralName.iPAddress, ipAddress));
+        }
+
+        Instant now = Instant.now();
+        KeyPair key = X509TestHelpers.generateRSAKeyPair();
+        JcaX509v3CertificateBuilder jcaX509v3CertificateBuilder = new JcaX509v3CertificateBuilder(
+                holder.getSubject(),
+                new BigInteger(128, new Random()),
+                Date.from(now.minus(Duration.ofSeconds(10))),
+                Date.from(now.plus(expiration)),
+                new X500Name(String.format("CN=%s", name)),
+                key.getPublic());
+        X509v3CertificateBuilder certificateBuilder = jcaX509v3CertificateBuilder
+                .addExtension(Extension.basicConstraints, true, new BasicConstraints(false))
+                .addExtension(Extension.keyUsage, true, new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyEncipherment));
+
+        if (!generalNames.isEmpty()) {
+            certificateBuilder.addExtension(
+                    Extension.subjectAlternativeName,
+                    true,
+                    new GeneralNames(generalNames.toArray(new GeneralName[]{})));
+        }
+
+        if (crldp != null) {
+            DistributionPointName distPointOne = new DistributionPointName(
+                    new GeneralNames(new GeneralName(GeneralName.uniformResourceIdentifier, "file://" + crldp.toAbsolutePath())));
+
+            certificateBuilder.addExtension(
+                    Extension.cRLDistributionPoints,
+                    false,
+                    new CRLDistPoint(new DistributionPoint[]{new DistributionPoint(distPointOne, null, null)}));
+        }
+
+        if (ocsp) {
+            certificateBuilder.addExtension(
+                    Extension.authorityInfoAccess,
+                    false,
+                    new AuthorityInformationAccess(
+                            X509ObjectIdentifiers.ocspAccessMethod,
+                            new GeneralName(GeneralName.uniformResourceIdentifier, ca.getOcspAddress())));
+        }
+
+        if (certBuilder != null) {
+            certBuilder.build(certificateBuilder);
+        }
+
+        X509Certificate certificate = new JcaX509CertificateConverter().getCertificate(certificateBuilder.build(signer));
+        Cert cert = new Cert(name, key, certificate, ca.dir, crldp);
+        if (crldp != null) {
+            ca.flush_crl(cert);
+        }
+        return cert;
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/OCSPHandler.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/OCSPHandler.java
new file mode 100644
index 00000000000..5cf37ac3802
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/OCSPHandler.java
@@ -0,0 +1,128 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common.ssl;
+
+import com.sun.net.httpserver.Headers;
+import com.sun.net.httpserver.HttpHandler;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.net.URLDecoder;
+import java.util.Arrays;
+import java.util.Base64;
+import java.util.Calendar;
+import java.util.Map;
+import java.util.stream.Collectors;
+import org.bouncycastle.asn1.ocsp.OCSPResponse;
+import org.bouncycastle.asn1.ocsp.OCSPResponseStatus;
+import org.bouncycastle.asn1.ocsp.RevokedInfo;
+import org.bouncycastle.cert.X509CertificateHolder;
+import org.bouncycastle.cert.jcajce.JcaX509CertificateHolder;
+import org.bouncycastle.cert.ocsp.BasicOCSPResp;
+import org.bouncycastle.cert.ocsp.BasicOCSPRespBuilder;
+import org.bouncycastle.cert.ocsp.CertificateID;
+import org.bouncycastle.cert.ocsp.CertificateStatus;
+import org.bouncycastle.cert.ocsp.OCSPReq;
+import org.bouncycastle.cert.ocsp.OCSPResp;
+import org.bouncycastle.cert.ocsp.OCSPRespBuilder;
+import org.bouncycastle.cert.ocsp.Req;
+import org.bouncycastle.cert.ocsp.RevokedStatus;
+import org.bouncycastle.cert.ocsp.jcajce.JcaBasicOCSPRespBuilder;
+import org.bouncycastle.cert.ocsp.jcajce.JcaCertificateID;
+import org.bouncycastle.operator.ContentSigner;
+import org.bouncycastle.operator.DigestCalculator;
+import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
+import org.bouncycastle.operator.jcajce.JcaDigestCalculatorProviderBuilder;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+class OCSPHandler implements HttpHandler {
+    private static final Logger LOG = LoggerFactory.getLogger(OCSPHandler.class);
+
+    private final Ca ca;
+
+    public OCSPHandler(Ca ca) {
+        this.ca = ca;
+    }
+
+    @Override
+    public void handle(com.sun.net.httpserver.HttpExchange httpExchange) throws IOException {
+        byte[] responseBytes;
+        try {
+            String uri = httpExchange.getRequestURI().toString();
+            LOG.info("OCSP request: {} {}", httpExchange.getRequestMethod(), uri);
+            httpExchange.getRequestHeaders().entrySet().forEach((e) -> {
+                LOG.info("OCSP request header: {} {}", e.getKey(), e.getValue());
+            });
+            InputStream request = httpExchange.getRequestBody();
+            byte[] requestBytes = new byte[10000];
+            int len = request.read(requestBytes);
+            LOG.info("OCSP request size {}", len);
+
+            if (len < 0) {
+                String removedUriEncoding = URLDecoder.decode(uri.substring(1), "utf-8");
+                LOG.info("OCSP request from URI no encoding {}", removedUriEncoding);
+                requestBytes = Base64.getDecoder().decode(removedUriEncoding);
+            }
+            OCSPReq ocspRequest = new OCSPReq(requestBytes);
+            Req[] requestList = ocspRequest.getRequestList();
+            LOG.info("requestList {}", Arrays.toString(requestList));
+
+            DigestCalculator digestCalculator = new JcaDigestCalculatorProviderBuilder().build().get(CertificateID.HASH_SHA1);
+
+            Map<CertificateID, RevokedInfo> revokedCerts = ca.ocspRevokedCerts.entrySet().stream().collect(Collectors.toMap(entry -> {
+                try {
+                    return new JcaCertificateID(digestCalculator, ca.cert, entry.getKey().getSerialNumber());
+                } catch (Exception ex) {
+                    throw new RuntimeException(ex);
+                }
+            }, Map.Entry::getValue));
+
+            BasicOCSPRespBuilder responseBuilder = new JcaBasicOCSPRespBuilder(ca.key.getPublic(), digestCalculator);
+            for (Req req : requestList) {
+                CertificateID certId = req.getCertID();
+                CertificateStatus certificateStatus = CertificateStatus.GOOD;
+                RevokedInfo revokedInfo = revokedCerts.get(certId);
+                if (revokedInfo != null) {
+                    certificateStatus = new RevokedStatus(revokedInfo);
+                }
+                responseBuilder.addResponse(certId, certificateStatus, null);
+            }
+
+            X509CertificateHolder[] chain = new X509CertificateHolder[]{new JcaX509CertificateHolder(ca.cert)};
+            ContentSigner signer = new JcaContentSignerBuilder("SHA1withRSA").setProvider("BC").build(ca.key.getPrivate());
+            BasicOCSPResp ocspResponse = responseBuilder.build(signer, chain, Calendar.getInstance().getTime());
+            LOG.info("response {}", ocspResponse);
+            responseBytes = new OCSPRespBuilder().build(OCSPRespBuilder.SUCCESSFUL, ocspResponse).getEncoded();
+            LOG.error("OCSP server response OK");
+        } catch (Throwable exception) {
+            LOG.error("Internal OCSP server error", exception);
+            responseBytes = new OCSPResp(new OCSPResponse(new OCSPResponseStatus(OCSPRespBuilder.INTERNAL_ERROR), null)).getEncoded();
+        }
+
+        Headers rh = httpExchange.getResponseHeaders();
+        rh.set("Content-Type", "application/ocsp-response");
+        httpExchange.sendResponseHeaders(200, responseBytes.length);
+
+        OutputStream os = httpExchange.getResponseBody();
+        os.write(responseBytes);
+        os.close();
+    }
+
+}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/SymbolArg.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/PemFile.java
similarity index 75%
rename from zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/SymbolArg.java
rename to zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/PemFile.java
index 077553b1f05..c7f95a9e0ea 100644
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/SymbolArg.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/PemFile.java
@@ -1,4 +1,4 @@
-/**
+/*
  * Licensed to the Apache Software Foundation (ASF) under one
  * or more contributor license agreements.  See the NOTICE file
  * distributed with this work for additional information
@@ -15,13 +15,17 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.apache.zookeeper.graph.filterops;
 
-import org.apache.zookeeper.graph.FilterOp.*;
+package org.apache.zookeeper.common.ssl;
 
-public class SymbolArg extends Arg<String> {
-    public SymbolArg(String value) {
-	super(ArgType.SYMBOL);
-	this.value = value;
+import java.nio.file.Path;
+
+public class PemFile {
+    public final Path file;
+    public final String password;
+
+    public PemFile(Path file, String password) {
+        this.file = file;
+        this.password = password;
     }
-};
+}
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/NumberArg.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/X509CertBuilder.java
similarity index 77%
rename from zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/NumberArg.java
rename to zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/X509CertBuilder.java
index d6b584d855f..962a099fc35 100644
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/filterops/NumberArg.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/ssl/X509CertBuilder.java
@@ -1,4 +1,4 @@
-/**
+/*
  * Licensed to the Apache Software Foundation (ASF) under one
  * or more contributor license agreements.  See the NOTICE file
  * distributed with this work for additional information
@@ -15,14 +15,12 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.apache.zookeeper.graph.filterops;
 
-import org.apache.zookeeper.graph.FilterOp.*;
+package org.apache.zookeeper.common.ssl;
 
-public class NumberArg extends Arg<Long> {
-    public NumberArg(Long value) {
-	super(ArgType.NUMBER);
-	this.value = value;
-    }
-};
+import org.bouncycastle.cert.X509v3CertificateBuilder;
 
+@FunctionalInterface
+public interface X509CertBuilder {
+    void build(X509v3CertificateBuilder builder) throws Exception;
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/compat/ProtocolManagerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/compat/ProtocolManagerTest.java
new file mode 100644
index 00000000000..5a87274e0e7
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/compat/ProtocolManagerTest.java
@@ -0,0 +1,149 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.compat;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.util.Arrays;
+import org.apache.jute.BinaryInputArchive;
+import org.apache.jute.BinaryOutputArchive;
+import org.apache.jute.InputArchive;
+import org.apache.jute.OutputArchive;
+import org.apache.zookeeper.proto.ConnectRequest;
+import org.apache.zookeeper.proto.ConnectResponse;
+import org.junit.jupiter.api.Test;
+
+public class ProtocolManagerTest {
+
+    private static byte[] serializeConnectRequest(ConnectRequest request, boolean withReadOnly) throws IOException {
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        OutputArchive oa = BinaryOutputArchive.getArchive(baos);
+        request.serialize(oa, "connect");
+        baos.close();
+        byte[] bytes = baos.toByteArray();
+
+        if (withReadOnly) {
+            return bytes;
+        } else {
+            return Arrays.copyOf(bytes, bytes.length - 1);
+        }
+    }
+
+    @Test
+    public void testDeserializeConnectRequestWithReadonly() throws IOException {
+        ProtocolManager protocolManager = new ProtocolManager();
+
+        ConnectRequest req1 = new ConnectRequest();
+        req1.setPasswd(new byte[16]);
+        req1.setReadOnly(true);
+
+        byte[] bytes = serializeConnectRequest(req1, true);
+
+        // Current protocol.
+        assertEquals(45, bytes.length);
+
+        InputArchive ia = BinaryInputArchive.getArchive(new ByteArrayInputStream(bytes));
+        ConnectRequest req2 = protocolManager.deserializeConnectRequest(ia);
+
+        assertEquals(true, protocolManager.isReadonlyAvailable());
+        assertEquals(true, req2.getReadOnly());
+    }
+
+    @Test
+    public void testDeserializeConnectRequestWithoutReadonly() throws IOException {
+        ProtocolManager protocolManager = new ProtocolManager();
+
+        ConnectRequest req1 = new ConnectRequest();
+        req1.setPasswd(new byte[16]);
+        // Should get truncated.
+        req1.setReadOnly(true);
+
+        byte[] bytes = serializeConnectRequest(req1, false);
+
+        // 3.4 protocol.
+        assertEquals(44, bytes.length);
+
+        InputArchive ia = BinaryInputArchive.getArchive(new ByteArrayInputStream(bytes));
+        ConnectRequest req2 = protocolManager.deserializeConnectRequest(ia);
+
+        assertEquals(false, protocolManager.isReadonlyAvailable());
+        assertEquals(false, req2.getReadOnly());
+    }
+
+    private static ProtocolManager prepareProtocolManager(boolean withReadOnly) throws IOException {
+        ProtocolManager protocolManager = new ProtocolManager();
+
+        ConnectRequest req1 = new ConnectRequest();
+        req1.setPasswd(new byte[16]);
+        req1.setReadOnly(true);
+
+        byte[] bytes = serializeConnectRequest(req1, withReadOnly);
+
+        InputArchive ia = BinaryInputArchive.getArchive(new ByteArrayInputStream(bytes));
+        // Detects the current protocol.
+        ConnectRequest req2 = protocolManager.deserializeConnectRequest(ia);
+
+        return protocolManager;
+    }
+
+    @Test
+    public void testSerializeConnectResponseWithReadonly() throws IOException {
+        ProtocolManager protocolManager = prepareProtocolManager(true);
+
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        BinaryOutputArchive os = BinaryOutputArchive.getArchive(baos);
+
+        ConnectResponse rsp = new ConnectResponse();
+        rsp.setPasswd(new byte[16]);
+        rsp.setReadOnly(true);
+
+        // Should use the current protocol.
+        protocolManager.serializeConnectResponse(rsp, os);
+
+        baos.close();
+
+        byte[] bytes = baos.toByteArray();
+
+        assertEquals(37, bytes.length);
+        assertEquals(1, bytes[bytes.length - 1]);
+    }
+
+    @Test
+    public void testSerializeConnectResponseWithoutReadonly() throws IOException {
+        ProtocolManager protocolManager = prepareProtocolManager(false);
+
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        BinaryOutputArchive os = BinaryOutputArchive.getArchive(baos);
+
+        ConnectResponse rsp = new ConnectResponse();
+        rsp.setPasswd(new byte[16]);
+        rsp.setReadOnly(true);
+
+        // Should use the 3.4 protocol.
+        protocolManager.serializeConnectResponse(rsp, os);
+
+        baos.close();
+
+        byte[] bytes = baos.toByteArray();
+
+        assertEquals(36, bytes.length);
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/BlueThrottleTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/BlueThrottleTest.java
index 8b64c2b2e79..26586677bba 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/BlueThrottleTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/BlueThrottleTest.java
@@ -18,17 +18,16 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.Random;
 import java.util.concurrent.TimeoutException;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.QuorumUtil;
-import org.junit.Assert;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -67,7 +66,7 @@ public BlueThrottleWithMockRandom(MockRandom random) {
     @Test
     public void testThrottleDisabled() {
         BlueThrottle throttler = new BlueThrottle();
-        assertTrue("Throttle should be disabled by default", throttler.checkLimit(1));
+        assertTrue(throttler.checkLimit(1), "Throttle should be disabled by default");
     }
 
     @Test
@@ -75,8 +74,8 @@ public void testThrottleWithoutRefill() {
         BlueThrottle throttler = new BlueThrottle();
         throttler.setMaxTokens(1);
         throttler.setFillTime(2000);
-        assertTrue("First request should be allowed", throttler.checkLimit(1));
-        assertFalse("Second request should be denied", throttler.checkLimit(1));
+        assertTrue(throttler.checkLimit(1), "First request should be allowed");
+        assertFalse(throttler.checkLimit(1), "Second request should be denied");
     }
 
     @Test
@@ -84,12 +83,12 @@ public void testThrottleWithRefill() throws InterruptedException {
         BlueThrottle throttler = new BlueThrottle();
         throttler.setMaxTokens(1);
         throttler.setFillTime(500);
-        assertTrue("First request should be allowed", throttler.checkLimit(1));
-        assertFalse("Second request should be denied", throttler.checkLimit(1));
+        assertTrue(throttler.checkLimit(1), "First request should be allowed");
+        assertFalse(throttler.checkLimit(1), "Second request should be denied");
 
         //wait for the bucket to be refilled
         Thread.sleep(750);
-        assertTrue("Third request should be allowed since we've got a new token", throttler.checkLimit(1));
+        assertTrue(throttler.checkLimit(1), "Third request should be allowed since we've got a new token");
     }
 
     @Test
@@ -103,21 +102,21 @@ public void testThrottleWithoutRandomDropping() throws InterruptedException {
         for (int i = 0; i < maxTokens; i++) {
             throttler.checkLimit(1);
         }
-        assertEquals("All tokens should be used up by now", throttler.getMaxTokens(), throttler.getDeficit());
+        assertEquals(throttler.getMaxTokens(), throttler.getDeficit(), "All tokens should be used up by now");
 
         Thread.sleep(110);
         throttler.checkLimit(1);
-        assertFalse("Dropping probability should still be zero", throttler.getDropChance() > 0);
+        assertFalse(throttler.getDropChance() > 0, "Dropping probability should still be zero");
 
         //allow bucket to be refilled
         Thread.sleep(1500);
 
         for (int i = 0; i < maxTokens; i++) {
-            assertTrue("The first " + maxTokens + " requests should be allowed", throttler.checkLimit(1));
+            assertTrue(throttler.checkLimit(1), "The first " + maxTokens + " requests should be allowed");
         }
 
         for (int i = 0; i < maxTokens; i++) {
-            assertFalse("The latter " + maxTokens + " requests should be denied", throttler.checkLimit(1));
+            assertFalse(throttler.checkLimit(1), "The latter " + maxTokens + " requests should be denied");
         }
     }
 
@@ -134,12 +133,12 @@ public void testThrottleWithRandomDropping() throws InterruptedException {
         for (int i = 0; i < maxTokens; i++) {
             throttler.checkLimit(1);
         }
-        assertEquals("All tokens should be used up by now", throttler.getMaxTokens(), throttler.getDeficit());
+        assertEquals(throttler.getMaxTokens(), throttler.getDeficit(), "All tokens should be used up by now");
 
         Thread.sleep(120);
         //this will trigger dropping probability being increased
         throttler.checkLimit(1);
-        assertTrue("Dropping probability should be increased", throttler.getDropChance() > 0);
+        assertTrue(throttler.getDropChance() > 0, "Dropping probability should be increased");
         LOG.info("Dropping probability is {}", throttler.getDropChance());
 
         //allow bucket to be refilled
@@ -154,7 +153,7 @@ public void testThrottleWithRandomDropping() throws InterruptedException {
         }
 
         LOG.info("Send {} requests, {} are accepted", maxTokens, accepted);
-        assertTrue("The dropping should be distributed", accepted < maxTokens);
+        assertTrue(accepted < maxTokens, "The dropping should be distributed");
 
         accepted = 0;
 
@@ -165,7 +164,7 @@ public void testThrottleWithRandomDropping() throws InterruptedException {
         }
 
         LOG.info("Send another {} requests, {} are accepted", maxTokens, accepted);
-        assertTrue("Later requests should have a chance", accepted > 0);
+        assertTrue(accepted > 0, "Later requests should have a chance");
     }
 
     private QuorumUtil quorumUtil = new QuorumUtil(1);
@@ -212,7 +211,7 @@ public void testNoThrottling() throws Exception {
 
         int connected = connect(10);
 
-        Assert.assertEquals(10, connected);
+        assertEquals(10, connected);
         shutdownQuorum();
     }
 
@@ -227,7 +226,7 @@ public void testThrottling() throws Exception {
 
 
         int connected = connect(3);
-        Assert.assertEquals(2, connected);
+        assertEquals(2, connected);
         shutdownQuorum();
 
         quorumUtil.enableLocalSession(false);
@@ -239,7 +238,7 @@ public void testThrottling() throws Exception {
 
 
         connected = connect(3);
-        Assert.assertEquals(2, connected);
+        assertEquals(2, connected);
         shutdownQuorum();
     }
 
@@ -256,7 +255,7 @@ public void testWeighedThrottling() throws Exception {
 
         //try to create 11 local sessions, 10 created, because we have only 10 tokens
         int connected = connect(11);
-        Assert.assertEquals(10, connected);
+        assertEquals(10, connected);
         shutdownQuorum();
 
         quorumUtil.enableLocalSession(false);
@@ -265,14 +264,14 @@ public void testWeighedThrottling() throws Exception {
         quorumUtil.getPeer(1).peer.getActiveServer().connThrottle().setFillCount(0);
         //tyr to create 11 global sessions, 3 created, because we have 10 tokens and each connection needs 3
         connected = connect(11);
-        Assert.assertEquals(3, connected);
+        assertEquals(3, connected);
         shutdownQuorum();
 
         quorumUtil.startAll();
         quorumUtil.getPeer(1).peer.getActiveServer().connThrottle().setMaxTokens(10);
         quorumUtil.getPeer(1).peer.getActiveServer().connThrottle().setFillCount(0);
         connected = connect(2);
-        Assert.assertEquals(2, connected);
+        assertEquals(2, connected);
 
         quorumUtil.shutdown(1);
         watchers[0].waitForDisconnected(RAPID_TIMEOUT);
@@ -293,7 +292,7 @@ public void testWeighedThrottling() throws Exception {
         }
         //each reconnect takes two tokens, we have 3, so only one reconnects
         LOG.info("reconnected {}", reconnected);
-        Assert.assertEquals(1, reconnected);
+        assertEquals(1, reconnected);
         shutdownQuorum();
     }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ByteBufferInputStreamTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ByteBufferInputStreamTest.java
index 7e8c3870e14..126a49458ef 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ByteBufferInputStreamTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ByteBufferInputStreamTest.java
@@ -18,22 +18,23 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertArrayEquals;
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import java.nio.ByteBuffer;
 import java.nio.charset.StandardCharsets;
 import java.util.Arrays;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Before;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class ByteBufferInputStreamTest extends ZKTestCase {
 
     private static final byte[] DATA_BYTES_0 = "Apache ZooKeeper".getBytes(StandardCharsets.UTF_8);
 
     private static byte[] DATA_BYTES;
-    @BeforeClass
+    @BeforeAll
     public static void setUpClass() {
         int len = DATA_BYTES_0.length + 2;
         DATA_BYTES = new byte[len];
@@ -45,7 +46,7 @@ public static void setUpClass() {
     private ByteBuffer bb;
     private ByteBufferInputStream in;
     private byte[] bs;
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         bb = ByteBuffer.wrap(DATA_BYTES);
         in = new ByteBufferInputStream(bb);
@@ -66,9 +67,11 @@ public void testReadArrayOffsetLength() throws Exception {
         byte[] expected = new byte[]{(byte) 1, (byte) 2, DATA_BYTES[0], (byte) 4};
         assertArrayEquals(expected, bs);
     }
-    @Test(expected = IndexOutOfBoundsException.class)
+    @Test
     public void testReadArrayOffsetLength_LengthTooLarge() throws Exception {
-        in.read(bs, 2, 3);
+        assertThrows(IndexOutOfBoundsException.class, () -> {
+            in.read(bs, 2, 3);
+        });
     }
     @Test
     public void testReadArrayOffsetLength_HitEndOfStream() throws Exception {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/CRCTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/CRCTest.java
index c57a65f7912..26e7b051a75 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/CRCTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/CRCTest.java
@@ -19,8 +19,8 @@
 package org.apache.zookeeper.server;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.BufferedInputStream;
 import java.io.File;
 import java.io.FileInputStream;
@@ -43,7 +43,8 @@
 import org.apache.zookeeper.server.persistence.FileTxnLog;
 import org.apache.zookeeper.server.persistence.TxnLog.TxnIterator;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -70,14 +71,14 @@ private void corruptFile(File file) throws IOException {
     }
 
     /** return if checksum matches for a snapshot **/
-    private boolean getCheckSum(FileSnap snap, File snapFile) throws IOException {
+    private boolean getCheckSum(File snapFile) throws IOException {
         DataTree dt = new DataTree();
-        Map<Long, Integer> sessions = new ConcurrentHashMap<Long, Integer>();
+        Map<Long, Integer> sessions = new ConcurrentHashMap<>();
         InputStream snapIS = new BufferedInputStream(new FileInputStream(snapFile));
         CheckedInputStream crcIn = new CheckedInputStream(snapIS, new Adler32());
         InputArchive ia = BinaryInputArchive.getArchive(crcIn);
         try {
-            snap.deserialize(dt, sessions, ia);
+            FileSnap.deserialize(dt, sessions, ia);
         } catch (IOException ie) {
             // we failed on the most recent snapshot
             // must be incomplete
@@ -102,8 +103,7 @@ private boolean getCheckSum(FileSnap snap, File snapFile) throws IOException {
      * @throws Exception
      */
     @Test
-    public void testChecksums() throws Exception {
-        File tmpDir = ClientBase.createTmpDir();
+    public void testChecksums(@TempDir File tmpDir) throws Exception {
         ClientBase.setupTestEnv();
         ZooKeeperServer zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
         SyncRequestProcessor.setSnapCount(150);
@@ -111,7 +111,7 @@ public void testChecksums() throws Exception {
         ServerCnxnFactory f = ServerCnxnFactory.createFactory(PORT, -1);
         f.startup(zks);
         LOG.info("starting up the zookeeper server .. waiting");
-        assertTrue("waiting for server being up", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up");
         ZooKeeper zk = ClientBase.createZKClient(HOSTPORT);
         try {
             for (int i = 0; i < 2000; i++) {
@@ -122,7 +122,7 @@ public void testChecksums() throws Exception {
         }
         f.shutdown();
         zks.shutdown();
-        assertTrue("waiting for server down", ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT), "waiting for server down");
 
         File versionDir = new File(tmpDir, "version-2");
         File[] list = versionDir.listFiles();
@@ -154,16 +154,16 @@ public void testChecksums() throws Exception {
         List<File> snapFiles = snap.findNRecentSnapshots(2);
         snapFile = snapFiles.get(0);
         corruptFile(snapFile);
-        boolean cfile = false;
+        boolean cfile;
         try {
-            cfile = getCheckSum(snap, snapFile);
+            cfile = getCheckSum(snapFile);
         } catch (IOException ie) {
-            //the last snapshot seems incompelte
+            //the last snapshot seems incomplete
             // corrupt the last but one
             // and use that
             snapFile = snapFiles.get(1);
             corruptFile(snapFile);
-            cfile = getCheckSum(snap, snapFile);
+            cfile = getCheckSum(snapFile);
         }
         assertTrue(cfile);
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ClientSSLReloadTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ClientSSLReloadTest.java
new file mode 100644
index 00000000000..3589a21a8e7
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ClientSSLReloadTest.java
@@ -0,0 +1,222 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p/>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p/>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.server;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.io.File;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.security.Security;
+import java.util.Properties;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.TimeUnit;
+import org.apache.commons.io.FileUtils;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.WatchedEvent;
+import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.common.KeyStoreFileType;
+import org.apache.zookeeper.common.X509KeyType;
+import org.apache.zookeeper.common.X509TestContext;
+import org.apache.zookeeper.server.embedded.ExitHandler;
+import org.apache.zookeeper.server.embedded.ZooKeeperServerEmbedded;
+import org.apache.zookeeper.server.embedded.ZookeeperServeInfo;
+import org.apache.zookeeper.test.ClientBase;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class ClientSSLReloadTest extends ZKTestCase {
+    protected static final Logger LOG = LoggerFactory.getLogger(ClientSSLReloadTest.class);
+
+    private X509TestContext x509TestContext1;
+    private X509TestContext x509TestContext2;
+
+    @TempDir
+    File dir1;
+    @TempDir
+    File dir2;
+
+    private File keyStoreFile1;
+    private File trustStoreFile1;
+
+    private File keyStoreFile2;
+    private File trustStoreFile2;
+
+    @BeforeEach
+    public void setup() throws Exception {
+
+        Security.addProvider(new BouncyCastleProvider());
+
+        x509TestContext1 = X509TestContext.newBuilder()
+                .setTempDir(dir1)
+                .setKeyStoreKeyType(X509KeyType.EC)
+                .setTrustStoreKeyType(X509KeyType.EC)
+                .build();
+
+        x509TestContext2 = X509TestContext.newBuilder()
+                .setTempDir(dir2)
+                .setKeyStoreKeyType(X509KeyType.EC)
+                .setTrustStoreKeyType(X509KeyType.EC)
+                .build();
+
+        keyStoreFile1 = x509TestContext1.getKeyStoreFile(KeyStoreFileType.PEM);
+        trustStoreFile1 = x509TestContext1.getTrustStoreFile(KeyStoreFileType.PEM);
+
+        keyStoreFile2 = x509TestContext2.getKeyStoreFile(KeyStoreFileType.PEM);
+        trustStoreFile2 = x509TestContext2.getTrustStoreFile(KeyStoreFileType.PEM);
+
+        String testDataPath = System.getProperty("test.data.dir", "src/test/resources/data");
+    }
+
+    @AfterEach
+    public void teardown() throws Exception {
+        Security.removeProvider(BouncyCastleProvider.PROVIDER_NAME);
+    }
+
+    /*
+     * This test performs certificate reload on a ZK server and checks the server presented certificate to the client.
+     * 1) setup() creates two sets of certificates to be used by the test.
+     * 2) Start the ZK server with TLS configuration ("client.certReload" config property will refresh the key and trust store for ClientX509Util at runtime)
+     * 3) ZK client will connect to the server on the secure client port using keyStoreFile1 and trustStoreFile1.
+     * 4) Update the keyStoreFile1 and trustStoreFile1 files in the filesystem with keyStoreFile2 and trustStoreFile2.
+     * 5) Till FileChangeWatcher thread is triggered & SSLContext options are reset, ZK client should continue to connect.
+     *    In Junit tests, FileChangeWatcher thread is not triggered immediately upon certificate update in the filesystem.
+     * 6) Once the certificates are reloaded by the server, ZK client connect will fail.
+     * 7) Next, create a new ZK client with updated keystore & truststore paths (keyStoreFile2 and trustStoreFile2).
+     * 8) Server should accept the connection on the secure client port.
+     */
+    @Test
+    public void certificateReloadTest() throws Exception {
+
+        final Properties configZookeeper = getServerConfig();
+        try (ZooKeeperServerEmbedded zkServer = ZooKeeperServerEmbedded
+                .builder()
+                .baseDir(dir1.toPath())
+                .configuration(configZookeeper)
+                .exitHandler(ExitHandler.LOG_ONLY)
+                .build()) {
+            zkServer.start();
+            assertTrue(ClientBase.waitForServerUp(zkServer.getConnectionString(), 60000));
+            for (int i = 0; i < 100; i++) {
+                ZookeeperServeInfo.ServerInfo status = ZookeeperServeInfo.getStatus("StandaloneServer*");
+                if (status.isLeader() && status.isStandaloneMode()) {
+                    break;
+                }
+                Thread.sleep(100);
+            }
+            ZookeeperServeInfo.ServerInfo status = ZookeeperServeInfo.getStatus("StandaloneServer*");
+            assertTrue(status.isLeader());
+            assertTrue(status.isStandaloneMode());
+
+            CountDownLatch l = new CountDownLatch(1);
+            ZKClientConfig zKClientConfig = getZKClientConfig();
+            // ZK client object created which will connect with keyStoreFile1 and trustStoreFile1 to the server.
+            try (ZooKeeper zk = new ZooKeeper(zkServer.getSecureConnectionString(), 60000, (WatchedEvent event) -> {
+                switch (event.getState()) {
+                    case SyncConnected:
+                        l.countDown();
+                        break;
+                }
+            }, zKClientConfig)) {
+                assertTrue(zk.getClientConfig().getBoolean(ZKClientConfig.SECURE_CLIENT));
+                assertTrue(l.await(10, TimeUnit.SECONDS));
+            }
+
+            LOG.info("Updating keyStore & trustStore files !!!!");
+            // Update the keyStoreFile1 and trustStoreFile1 files in the filesystem with keyStoreFile2 & trustStoreFile2
+            FileUtils.writeStringToFile(keyStoreFile1, FileUtils.readFileToString(keyStoreFile2, StandardCharsets.US_ASCII), StandardCharsets.US_ASCII, false);
+            FileUtils.writeStringToFile(trustStoreFile1, FileUtils.readFileToString(trustStoreFile2, StandardCharsets.US_ASCII), StandardCharsets.US_ASCII, false);
+
+            // Till FileChangeWatcher thread is triggered & SSLContext options are reset, ZK client should continue connecting.
+            for (int i = 0; i < 5; i++) {
+                CountDownLatch l2 = new CountDownLatch(1);
+                Thread.sleep(5000);
+                try (ZooKeeper zk = new ZooKeeper(zkServer.getSecureConnectionString(), 60000, (WatchedEvent event) -> {
+                    switch (event.getState()) {
+                        case SyncConnected:
+                            l.countDown();
+                            break;
+                    }
+                }, zKClientConfig)) {
+                    if (!l2.await(5, TimeUnit.SECONDS)) {
+                        LOG.error("Unable to connect to zk server");
+                        break;
+                    }
+                }
+            }
+            // Use the updated keyStore and trustStore paths when creating the client; Refreshed server should authenticate the client.
+            zKClientConfig.setProperty("zookeeper.ssl.keyStore.location", keyStoreFile2.getAbsolutePath());
+            zKClientConfig.setProperty("zookeeper.ssl.trustStore.location", trustStoreFile2.getAbsolutePath());
+            zKClientConfig.setProperty("zookeeper.ssl.keyStore.type", "PEM");
+            zKClientConfig.setProperty("zookeeper.ssl.trustStore.type", "PEM");
+            CountDownLatch l3 = new CountDownLatch(1);
+            try (ZooKeeper zk = new ZooKeeper(zkServer.getSecureConnectionString(), 60000, (WatchedEvent event) -> {
+                switch (event.getState()) {
+                    case SyncConnected:
+                        l3.countDown();
+                        break;
+                }
+            }, zKClientConfig)) {
+                assertTrue(zk.getClientConfig().getBoolean(ZKClientConfig.SECURE_CLIENT));
+                assertTrue(l3.await(10, TimeUnit.SECONDS));
+            }
+        }
+    }
+
+    private Properties getServerConfig() {
+        int clientPort = PortAssignment.unique();
+        int clientSecurePort = PortAssignment.unique();
+
+        final Properties configZookeeper = new Properties();
+        configZookeeper.put("clientPort", clientPort + "");
+        configZookeeper.put("secureClientPort", clientSecurePort + "");
+        configZookeeper.put("host", "localhost");
+        configZookeeper.put("ticktime", "4000");
+        configZookeeper.put("client.certReload", "true");
+        // TLS config fields
+        configZookeeper.put("ssl.keyStore.location", keyStoreFile1.getAbsolutePath());
+        configZookeeper.put("ssl.trustStore.location", trustStoreFile1.getAbsolutePath());
+        configZookeeper.put("ssl.keyStore.type", "PEM");
+        configZookeeper.put("ssl.trustStore.type", "PEM");
+        // Netty is required for TLS
+        configZookeeper.put("serverCnxnFactory", org.apache.zookeeper.server.NettyServerCnxnFactory.class.getName());
+        return configZookeeper;
+    }
+
+    private ZKClientConfig getZKClientConfig() throws IOException {
+        // Saving copies in JKS format to be used for client calls even after writeStringToFile overwrites keyStoreFile1 and trustStoreFile1
+        File clientKeyStore = x509TestContext1.getKeyStoreFile(KeyStoreFileType.JKS);
+        File clientTrustStore = x509TestContext1.getTrustStoreFile(KeyStoreFileType.JKS);
+
+        ZKClientConfig zKClientConfig = new ZKClientConfig();
+        zKClientConfig.setProperty("zookeeper.client.secure", "true");
+        zKClientConfig.setProperty("zookeeper.ssl.keyStore.location", clientKeyStore.getAbsolutePath());
+        zKClientConfig.setProperty("zookeeper.ssl.trustStore.location", clientTrustStore.getAbsolutePath());
+        zKClientConfig.setProperty("zookeeper.ssl.keyStore.type", "JKS");
+        zKClientConfig.setProperty("zookeeper.ssl.trustStore.type", "JKS");
+        // only netty supports TLS
+        zKClientConfig.setProperty("zookeeper.clientCnxnSocket", org.apache.zookeeper.ClientCnxnSocketNetty.class.getName());
+        return zKClientConfig;
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ClientSSLRevocationTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ClientSSLRevocationTest.java
new file mode 100644
index 00000000000..0471e79520f
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ClientSSLRevocationTest.java
@@ -0,0 +1,276 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.security.Security;
+import java.util.Properties;
+import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.common.ssl.Ca;
+import org.apache.zookeeper.common.ssl.Cert;
+import org.apache.zookeeper.server.embedded.ExitHandler;
+import org.apache.zookeeper.server.embedded.ZooKeeperServerEmbedded;
+import org.apache.zookeeper.test.ClientBase;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+
+public class ClientSSLRevocationTest {
+    @BeforeEach
+    public void setup() throws Exception {
+        Security.addProvider(new BouncyCastleProvider());
+    }
+
+    @AfterEach
+    public void cleanup() throws Exception {
+        Security.removeProvider(BouncyCastleProvider.PROVIDER_NAME);
+
+        Security.setProperty("ocsp.enable", "false");
+        System.clearProperty("com.sun.net.ssl.checkRevocation");
+        System.clearProperty("zookeeper.ssl.crl");
+        System.clearProperty("zookeeper.ssl.ocsp");
+    }
+
+    @Test
+    public void testRevocationDisabled(@TempDir Path tmpDir) throws Exception {
+        // given: crl not enabled
+        try (Ca ca = Ca.builder(tmpDir).withOcsp().build()) {
+            Cert serverCert = ca.sign_with_ocsp("server");
+            final Properties config = serverCert.buildServerProperties(ca);
+            // given: revoked server cert
+            ca.revoke_through_ocsp(serverCert.cert);
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
+                    .configuration(config)
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                Cert client1Cert = ca.sign_with_crldp("client1");
+                ca.revoke_through_crldp(client1Cert);
+
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                // when: connect with revoked cert.
+                // then: connected
+                ZKClientConfig client1Config = client1Cert.buildClientConfig(ca);
+                assertTrue(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, client1Config));
+            }
+        }
+    }
+
+    @ParameterizedTest(name = "clientRevoked = {0}")
+    @ValueSource(booleans = {true, false})
+    public void testRevocationInClientUsingCrldp(boolean clientRevoked, @TempDir Path tmpDir) throws Exception {
+        try (Ca ca = Ca.create(tmpDir)) {
+            // given: server cert with crldp
+            Cert server1Cert = ca.sign_with_crldp("server1");
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
+                    .configuration(server1Cert.buildServerProperties(ca))
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                Cert clientCert = ca.sign_with_crldp("client1");
+                if (clientRevoked) {
+                    // crl in server side is disabled, so it does not matter whether
+                    // client cert is revoked or not.
+                    ca.revoke_through_crldp(clientCert);
+                }
+
+                // then: ssl authentication succeed when crl is disabled
+                ZKClientConfig clientConfig = clientCert.buildClientConfig(ca);
+                assertTrue(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, clientConfig));
+
+                // when: valid server cert
+                // then: ssl authentication succeed when crl is enabled
+                clientConfig.setProperty("zookeeper.ssl.crl", "true");
+                assertTrue(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, clientConfig));
+            }
+
+            // crldp check is not realtime, so we have to start a new server with revoked cert
+
+            // given: revoked server cert with crldp
+            Cert server2Cert = ca.sign_with_crldp("server2");
+            ca.revoke_through_crldp(server2Cert);
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server2.data"))
+                    .configuration(server2Cert.buildServerProperties(ca))
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                Cert clientCert = ca.sign_with_crldp("client1");
+                if (clientRevoked) {
+                    // crl in server side is disabled, so it does not matter whether
+                    // client cert is revoked or not.
+                    ca.revoke_through_crldp(clientCert);
+                }
+
+                // then: ssl authentication succeed when crl is disabled
+                ZKClientConfig clientConfig = clientCert.buildClientConfig(ca);
+                assertTrue(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, clientConfig));
+
+                // then: ssl authentication failed when crl is enabled
+                clientConfig.setProperty("zookeeper.ssl.crl", "true");
+                assertFalse(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, clientConfig));
+            }
+        }
+    }
+
+    @ParameterizedTest(name = "clientRevoked = {0}")
+    @ValueSource(booleans = {true, false})
+    public void testRevocationInClientUsingOCSP(boolean clientRevoked, @TempDir Path tmpDir) throws Exception {
+        try (Ca ca = Ca.builder(tmpDir).withOcsp().build()) {
+            // given: server cert with ocsp
+            Cert serverCert = ca.sign_with_ocsp("server1");
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
+                    .configuration(serverCert.buildServerProperties(ca))
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                Cert clientCert = ca.sign_with_ocsp("client");
+                if (clientRevoked) {
+                    // crl in server side is disabled, so it does not matter whether
+                    // client cert is revoked or not.
+                    ca.revoke_through_ocsp(clientCert.cert);
+                }
+
+                ZKClientConfig clientConfig = clientCert.buildClientConfig(ca);
+
+                // when: connect to serve with valid cert
+                // then: connected
+                //
+                // we can't config crl using jvm properties as server will access them also
+                // see: https://issues.apache.org/jira/browse/ZOOKEEPER-4875
+                clientConfig.setProperty("zookeeper.ssl.crl", "true");
+                clientConfig.setProperty("zookeeper.ssl.ocsp", "true");
+                assertTrue(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, clientConfig));
+
+                // when: server cert get revoked
+                ca.revoke_through_ocsp(serverCert.cert);
+
+                // then: ssl authentication failed when crl is enabled
+                assertFalse(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, clientConfig));
+
+                // then: ssl authentication succeed when crl is disabled
+                clientConfig.setProperty("zookeeper.ssl.crl", "false");
+                assertTrue(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, clientConfig));
+            }
+        }
+    }
+
+    @ParameterizedTest(name = "serverRevoked = {0}")
+    @ValueSource(booleans = {true, false})
+    public void testRevocationInServerUsingCrldp(boolean serverRevoked, @TempDir Path tmpDir) throws Exception {
+        try (Ca ca = Ca.create(tmpDir)) {
+            // given: server with crl enabled
+            System.setProperty("zookeeper.ssl.crl", "true");
+            Cert serverCert = ca.sign_with_crldp("server1");
+            if (serverRevoked) {
+                // crl in client side will be disabled, so it does not matter whether
+                // server cert is revoked or not.
+                ca.revoke_through_crldp(serverCert);
+            }
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
+                    .configuration(serverCert.buildServerProperties(ca))
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                // when: valid client cert with crldp
+                // then: ssl authentication failed when crl is enabled
+                Cert client1Cert = ca.sign_with_crldp("client1");
+                ZKClientConfig client1Config = client1Cert.buildClientConfig(ca);
+                client1Config.setProperty("zookeeper.ssl.crl", "false");
+                assertTrue(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, client1Config));
+
+                Cert client2Cert = ca.sign_with_crldp("client2");
+                ca.revoke_through_crldp(client2Cert);
+
+                // when: revoked client cert with crldp
+                // then: ssl authentication failed when crl is enabled
+                ZKClientConfig client2Config = client2Cert.buildClientConfig(ca);
+                client2Config.setProperty("zookeeper.ssl.crl", "false");
+                assertFalse(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, client2Config));
+            }
+        }
+    }
+
+    @ParameterizedTest(name = "serverRevoked = {0}")
+    @ValueSource(booleans = {true, false})
+    public void testRevocationInServerUsingOCSP(boolean serverRevoked, @TempDir Path tmpDir) throws Exception {
+        try (Ca ca = Ca.builder(tmpDir).withOcsp().build()) {
+            // given: server with crl and ocsp enabled
+            System.setProperty("com.sun.net.ssl.checkRevocation", "true");
+            System.setProperty("zookeeper.ssl.ocsp", "true");
+            Cert serverCert = ca.sign("server1");
+            if (serverRevoked) {
+                // crl in client side will be disabled, so it does not matter whether
+                // server cert is revoked or not.
+                ca.revoke_through_ocsp(serverCert.cert);
+            }
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
+                    .configuration(serverCert.buildServerProperties(ca))
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                // when: valid client cert with crldp
+                // then: ssl authentication failed when crl is enabled
+                Cert client1Cert = ca.sign_with_ocsp("client1");
+                ZKClientConfig client1Config = client1Cert.buildClientConfig(ca);
+                client1Config.setProperty("zookeeper.ssl.crl", "false");
+                assertTrue(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, client1Config));
+
+                // ocsp is realtime, so we can reuse this client.
+                ca.revoke_through_ocsp(client1Cert.cert);
+                assertFalse(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, client1Config));
+            }
+        }
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ConnectionMetricsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ConnectionMetricsTest.java
index 2b10f9be137..ac734d2969f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ConnectionMetricsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ConnectionMetricsTest.java
@@ -19,7 +19,7 @@
 package org.apache.zookeeper.server;
 
 import static org.apache.zookeeper.server.NIOServerCnxnFactory.ZOOKEEPER_NIO_SESSIONLESS_CNXN_TIMEOUT;
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
@@ -41,7 +41,7 @@
 import org.apache.zookeeper.metrics.MetricsUtils;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.QuorumUtil;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -57,8 +57,8 @@ public void testRevalidateCount() throws Exception {
         util.enableLocalSession(false);
         util.startAll();
 
-        int follower1 = (int) util.getFollowerQuorumPeers().get(0).getId();
-        int follower2 = (int) util.getFollowerQuorumPeers().get(1).getId();
+        int follower1 = (int) util.getFollowerQuorumPeers().get(0).getMyId();
+        int follower2 = (int) util.getFollowerQuorumPeers().get(1).getMyId();
         LOG.info("connecting to server: {}", follower1);
         ClientBase.CountdownWatcher watcher = new ClientBase.CountdownWatcher();
         // create a connection to follower
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateContainerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateContainerTest.java
index b1aa70932cd..589f61369d9 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateContainerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateContainerTest.java
@@ -18,16 +18,18 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+import java.io.IOException;
+import java.time.Duration;
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.Collections;
 import java.util.concurrent.BlockingQueue;
-import java.util.concurrent.Callable;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.Executors;
 import java.util.concurrent.LinkedBlockingQueue;
@@ -37,19 +39,24 @@
 import java.util.concurrent.atomic.AtomicLong;
 import org.apache.zookeeper.AsyncCallback;
 import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.DeleteContainerRequest;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.Op;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 public class CreateContainerTest extends ClientBase {
 
     private ZooKeeper zk;
     private Semaphore completedContainerDeletions;
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         super.setUp();
@@ -68,28 +75,52 @@ public void addCommittedProposal(Request request) {
         serverFactory.zkServer.setZKDatabase(testDatabase);
     }
 
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
+        System.clearProperty("znode.container.checkIntervalMs");
+        System.clearProperty("znode.container.maxPerMinute");
+        System.clearProperty("znode.container.maxNeverUsedInterval");
+
         super.tearDown();
         zk.close();
     }
 
-    @Test(timeout = 30000)
+    @Test
+    public void testContainerManagerDefaults() {
+        ContainerManager containerManager = new ContainerManager(serverFactory.getZooKeeperServer().getZKDatabase(), serverFactory.getZooKeeperServer().firstProcessor);
+        assertEquals((int) Duration.ofMinutes(1).toMillis(), containerManager.getCheckIntervalMs());
+        assertEquals(10000, containerManager.getMaxPerMinute());
+        assertEquals((int) Duration.ofMinutes(5).toMillis(), containerManager.getMaxNeverUsedIntervalMs());
+
+        System.setProperty("znode.container.checkIntervalMs", "1000");
+        System.setProperty("znode.container.maxPerMinute", "1000");
+        System.setProperty("znode.container.maxNeverUsedIntervalMs", "10000");
+        containerManager = new ContainerManager(serverFactory.getZooKeeperServer().getZKDatabase(), serverFactory.getZooKeeperServer().firstProcessor);
+        assertEquals(1000, containerManager.getCheckIntervalMs());
+        assertEquals(1000, containerManager.getMaxPerMinute());
+        assertEquals(10000, containerManager.getMaxNeverUsedIntervalMs());
+    }
+
+    @Test
+    @Timeout(value = 30)
     public void testCreate() throws KeeperException, InterruptedException {
         createNoStatVerifyResult("/foo");
         createNoStatVerifyResult("/foo/child");
     }
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testCreateWithStat() throws KeeperException, InterruptedException {
         Stat stat = createWithStatVerifyResult("/foo");
         Stat childStat = createWithStatVerifyResult("/foo/child");
         // Don't expect to get the same stats for different creates.
-        assertFalse(stat.equals(childStat));
+        assertNotEquals(stat, childStat);
     }
 
     @SuppressWarnings("ConstantConditions")
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testCreateWithNullStat() throws KeeperException, InterruptedException {
         final String name = "/foo";
         assertNull(zk.exists(name, false));
@@ -102,7 +133,8 @@ public void testCreateWithNullStat() throws KeeperException, InterruptedExceptio
         assertNotNull(zk.exists(name, false));
     }
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testSimpleDeletion() throws KeeperException, InterruptedException {
         zk.create("/foo", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.CONTAINER);
         zk.create("/foo/bar", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
@@ -112,10 +144,11 @@ public void testSimpleDeletion() throws KeeperException, InterruptedException {
         containerManager.checkContainers();
 
         assertTrue(completedContainerDeletions.tryAcquire(1, TimeUnit.SECONDS));
-        assertNull("Container should have been deleted", zk.exists("/foo", false));
+        assertNull(zk.exists("/foo", false), "Container should have been deleted");
     }
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testMultiWithContainerSimple() throws KeeperException, InterruptedException {
         Op createContainer = Op.create("/foo", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.CONTAINER);
         zk.multi(Collections.singletonList(createContainer));
@@ -124,7 +157,8 @@ public void testMultiWithContainerSimple() throws KeeperException, InterruptedEx
         assertEquals(dataTree.getContainers().size(), 1);
     }
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testMultiWithContainer() throws KeeperException, InterruptedException {
         Op createContainer = Op.create("/foo", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.CONTAINER);
         Op createChild = Op.create("/foo/bar", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
@@ -139,7 +173,7 @@ public void testMultiWithContainer() throws KeeperException, InterruptedExceptio
         containerManager.checkContainers();
 
         assertTrue(completedContainerDeletions.tryAcquire(1, TimeUnit.SECONDS));
-        assertNull("Container should have been deleted", zk.exists("/foo", false));
+        assertNull(zk.exists("/foo", false), "Container should have been deleted");
 
         createContainer = Op.create("/foo", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.CONTAINER);
         createChild = Op.create("/foo/bar", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
@@ -149,10 +183,11 @@ public void testMultiWithContainer() throws KeeperException, InterruptedExceptio
         containerManager.checkContainers();
 
         assertTrue(completedContainerDeletions.tryAcquire(1, TimeUnit.SECONDS));
-        assertNull("Container should have been deleted", zk.exists("/foo", false));
+        assertNull(zk.exists("/foo", false), "Container should have been deleted");
     }
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testSimpleDeletionAsync() throws KeeperException, InterruptedException {
         final CountDownLatch latch = new CountDownLatch(1);
         AsyncCallback.Create2Callback cb = (rc, path, ctx, name, stat) -> {
@@ -168,10 +203,11 @@ public void testSimpleDeletionAsync() throws KeeperException, InterruptedExcepti
         containerManager.checkContainers();
 
         assertTrue(completedContainerDeletions.tryAcquire(1, TimeUnit.SECONDS));
-        assertNull("Container should have been deleted", zk.exists("/foo", false));
+        assertNull(zk.exists("/foo", false), "Container should have been deleted");
     }
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testCascadingDeletion() throws KeeperException, InterruptedException {
         zk.create("/foo", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.CONTAINER);
         zk.create("/foo/bar", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.CONTAINER);
@@ -184,34 +220,39 @@ public void testCascadingDeletion() throws KeeperException, InterruptedException
         containerManager.checkContainers();
         assertTrue(completedContainerDeletions.tryAcquire(1, TimeUnit.SECONDS));
 
-        assertNull("Container should have been deleted", zk.exists("/foo/bar", false));
-        assertNull("Container should have been deleted", zk.exists("/foo", false));
+        assertNull(zk.exists("/foo/bar", false), "Container should have been deleted");
+        assertNull(zk.exists("/foo", false), "Container should have been deleted");
     }
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testFalseEmpty() throws KeeperException, InterruptedException {
         zk.create("/foo", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.CONTAINER);
         zk.create("/foo/bar", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
         ContainerManager containerManager = new ContainerManager(serverFactory.getZooKeeperServer().getZKDatabase(), serverFactory.getZooKeeperServer().firstProcessor, 1, 100) {
-            @Override
-            protected Collection<String> getCandidates() {
+            @Override protected Collection<String> getCandidates() {
                 return Collections.singletonList("/foo");
             }
         };
         containerManager.checkContainers();
 
         assertTrue(completedContainerDeletions.tryAcquire(1, TimeUnit.SECONDS));
-        assertNotNull("Container should have not been deleted", zk.exists("/foo", false));
+        assertNotNull(zk.exists("/foo", false), "Container should have not been deleted");
     }
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testMaxPerMinute() throws InterruptedException {
-        final BlockingQueue<String> queue = new LinkedBlockingQueue<String>();
+        final BlockingQueue<String> queue = new LinkedBlockingQueue<>();
         RequestProcessor processor = new RequestProcessor() {
             @Override
             public void processRequest(Request request) {
-                queue.add(new String(request.request.array()));
+                try {
+                    queue.add(request.readRequestRecord(DeleteContainerRequest::new).getPath());
+                } catch (IOException e) {
+                    fail(e);
+                }
             }
 
             @Override
@@ -229,24 +270,21 @@ protected Collection<String> getCandidates() {
                 return Arrays.asList("/one", "/two", "/three", "/four");
             }
         };
-        Executors.newSingleThreadExecutor().submit(new Callable<Void>() {
-            @Override
-            public Void call() throws Exception {
-                containerManager.checkContainers();
-                return null;
-            }
+        Executors.newSingleThreadExecutor().submit(() -> {
+            containerManager.checkContainers();
+            return null;
         });
-        assertEquals(queue.poll(5, TimeUnit.SECONDS), "/one");
-        assertEquals(queue.poll(5, TimeUnit.SECONDS), "/two");
-        assertEquals(queue.size(), 0);
+        assertEquals("/one", queue.poll(5, TimeUnit.SECONDS));
+        assertEquals("/two", queue.poll(5, TimeUnit.SECONDS));
+        assertEquals(0, queue.size());
         Thread.sleep(500);
-        assertEquals(queue.size(), 0);
-
-        assertEquals(queue.poll(5, TimeUnit.SECONDS), "/three");
-        assertEquals(queue.poll(5, TimeUnit.SECONDS), "/four");
+        assertEquals(0, queue.size());
+        assertEquals("/three", queue.poll(5, TimeUnit.SECONDS));
+        assertEquals("/four", queue.poll(5, TimeUnit.SECONDS));
     }
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testMaxNeverUsedInterval() throws KeeperException, InterruptedException {
         zk.create("/foo", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.CONTAINER);
         AtomicLong elapsed = new AtomicLong(0);
@@ -265,49 +303,48 @@ protected long getElapsed(DataNode node) {
         };
         containerManager.checkContainers(); // elapsed time will appear to be 0 - container will not get deleted
         assertEquals(deletesQty.get(), 0);
-        assertNotNull("Container should not have been deleted", zk.exists("/foo", false));
+        assertNotNull(zk.exists("/foo", false), "Container should not have been deleted");
 
         elapsed.set(10000);
         containerManager.checkContainers(); // elapsed time will appear to be 10000 - container should get deleted
         assertTrue(completedContainerDeletions.tryAcquire(1, TimeUnit.SECONDS));
-        assertNull("Container should have been deleted", zk.exists("/foo", false));
+        assertNull(zk.exists("/foo", false), "Container should have been deleted");
     }
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testZeroMaxNeverUsedInterval() throws KeeperException, InterruptedException {
         zk.create("/foo", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.CONTAINER);
         AtomicInteger deletesQty = new AtomicInteger(0);
         ContainerManager containerManager = new ContainerManager(serverFactory.getZooKeeperServer().getZKDatabase(), serverFactory.getZooKeeperServer().firstProcessor, 1, 100, 0) {
-            @Override
-            protected void postDeleteRequest(Request request) throws RequestProcessor.RequestProcessorException {
+            @Override protected void postDeleteRequest(Request request) throws RequestProcessor.RequestProcessorException {
                 deletesQty.incrementAndGet();
                 super.postDeleteRequest(request);
             }
 
-            @Override
-            protected long getElapsed(DataNode node) {
+            @Override protected long getElapsed(DataNode node) {
                 return 10000;   // some number greater than 0
             }
         };
         containerManager.checkContainers(); // elapsed time will appear to be 0 - container will not get deleted
         assertEquals(deletesQty.get(), 0);
-        assertNotNull("Container should not have been deleted", zk.exists("/foo", false));
+        assertNotNull(zk.exists("/foo", false), "Container should not have been deleted");
     }
 
     private void createNoStatVerifyResult(String newName) throws KeeperException, InterruptedException {
-        assertNull("Node existed before created", zk.exists(newName, false));
+        assertNull(zk.exists(newName, false), "Node existed before created");
         zk.create(newName, newName.getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.CONTAINER);
-        assertNotNull("Node was not created as expected", zk.exists(newName, false));
+        assertNotNull(zk.exists(newName, false), "Node was not created as expected");
     }
 
     private Stat createWithStatVerifyResult(String newName) throws KeeperException, InterruptedException {
-        assertNull("Node existed before created", zk.exists(newName, false));
+        assertNull(zk.exists(newName, false), "Node existed before created");
         Stat stat = new Stat();
         zk.create(newName, newName.getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.CONTAINER, stat);
         validateCreateStat(stat, newName);
 
         Stat referenceStat = zk.exists(newName, false);
-        assertNotNull("Node was not created as expected", referenceStat);
+        assertNotNull(referenceStat, "Node was not created as expected");
         assertEquals(referenceStat, stat);
 
         return stat;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateTTLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateTTLTest.java
index d48f7132242..ae37bc6a1d3 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateTTLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/CreateTTLTest.java
@@ -18,17 +18,21 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.Collections;
 import java.util.List;
+import java.util.Map;
 import java.util.concurrent.atomic.AtomicLong;
 import org.apache.zookeeper.AsyncCallback;
 import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.CreateOptions;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.KeeperException.Code;
 import org.apache.zookeeper.Op;
@@ -36,12 +40,16 @@
 import org.apache.zookeeper.TestableZooKeeper;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.data.Stat;
+import org.apache.zookeeper.metrics.MetricsUtils;
 import org.apache.zookeeper.proto.CreateResponse;
 import org.apache.zookeeper.proto.CreateTTLRequest;
 import org.apache.zookeeper.proto.ReplyHeader;
 import org.apache.zookeeper.proto.RequestHeader;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.TestInfo;
 
 public class CreateTTLTest extends ClientBase {
 
@@ -51,13 +59,20 @@ public class CreateTTLTest extends ClientBase {
 
     @Override
     public void setUp() throws Exception {
+        // to be able to get the test method name a testInfo object is needed
+        // to override the parent's setUp method we need this empty method
+    }
+
+    @BeforeEach
+    public void setUp(TestInfo testInfo) throws Exception {
         System.setProperty(
             EphemeralType.EXTENDED_TYPES_ENABLED_PROPERTY,
-            disabledTests.contains(getTestName()) ? "false" : "true");
+            disabledTests.contains(testInfo.getTestMethod().get().getName()) ? "false" : "true");
         super.setUpWithServerId(254);
         zk = createClient();
     }
 
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         System.clearProperty(EphemeralType.EXTENDED_TYPES_ENABLED_PROPERTY);
@@ -74,11 +89,16 @@ public void testCreate() throws KeeperException, InterruptedException {
         final AtomicLong fakeElapsed = new AtomicLong(0);
         ContainerManager containerManager = newContainerManager(fakeElapsed);
         containerManager.checkContainers();
-        assertNotNull("Ttl node should not have been deleted yet", zk.exists("/foo", false));
+        assertNotNull(zk.exists("/foo", false), "Ttl node should not have been deleted yet");
 
         fakeElapsed.set(1000);
         containerManager.checkContainers();
-        assertNull("Ttl node should have been deleted", zk.exists("/foo", false));
+        assertNull(zk.exists("/foo", false), "Ttl node should have been deleted");
+
+        // validate created and deleted TTL nodes count
+        Map<String, Object> metrics = MetricsUtils.currentServerMetrics();
+        assertTrue((long) metrics.get("ttl_node_created_count") >= 1);
+        assertTrue((long) metrics.get("ttl_node_deleted_count") >= 1);
     }
 
     @Test
@@ -89,16 +109,16 @@ public void testBadTTLs() throws InterruptedException, KeeperException {
         CreateTTLRequest request = new CreateTTLRequest(path, new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_WITH_TTL.toFlag(), -100);
         CreateResponse response = new CreateResponse();
         ReplyHeader r = zk.submitRequest(h, request, response, null);
-        assertEquals("An invalid CreateTTLRequest should throw BadArguments", r.getErr(), Code.BADARGUMENTS.intValue());
-        assertNull("An invalid CreateTTLRequest should not result in znode creation", zk.exists(path, false));
+        assertEquals(r.getErr(), Code.BADARGUMENTS.intValue(), "An invalid CreateTTLRequest should throw BadArguments");
+        assertNull(zk.exists(path, false), "An invalid CreateTTLRequest should not result in znode creation");
 
         request = new CreateTTLRequest(path, new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_WITH_TTL.toFlag(),
                                        EphemeralType.TTL.maxValue()
                                                + 1);
         response = new CreateResponse();
         r = zk.submitRequest(h, request, response, null);
-        assertEquals("An invalid CreateTTLRequest should throw BadArguments", r.getErr(), Code.BADARGUMENTS.intValue());
-        assertNull("An invalid CreateTTLRequest should not result in znode creation", zk.exists(path, false));
+        assertEquals(r.getErr(), Code.BADARGUMENTS.intValue(), "An invalid CreateTTLRequest should throw BadArguments");
+        assertNull(zk.exists(path, false), "An invalid CreateTTLRequest should not result in znode creation");
     }
 
     @Test
@@ -109,8 +129,8 @@ public void testMaxTTLs() throws InterruptedException, KeeperException {
         CreateTTLRequest request = new CreateTTLRequest(path, new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_WITH_TTL.toFlag(), EphemeralType.TTL.maxValue());
         CreateResponse response = new CreateResponse();
         ReplyHeader r = zk.submitRequest(h, request, response, null);
-        assertEquals("EphemeralType.getMaxTTL() should succeed", r.getErr(), Code.OK.intValue());
-        assertNotNull("Node should exist", zk.exists(path, false));
+        assertEquals(r.getErr(), Code.OK.intValue(), "EphemeralType.getMaxTTL() should succeed");
+        assertNotNull(zk.exists(path, false), "Node should exist");
     }
 
     @Test
@@ -122,11 +142,11 @@ public void testCreateSequential() throws KeeperException, InterruptedException
         final AtomicLong fakeElapsed = new AtomicLong(0);
         ContainerManager containerManager = newContainerManager(fakeElapsed);
         containerManager.checkContainers();
-        assertNotNull("Ttl node should not have been deleted yet", zk.exists(path, false));
+        assertNotNull(zk.exists(path, false), "Ttl node should not have been deleted yet");
 
         fakeElapsed.set(1000);
         containerManager.checkContainers();
-        assertNull("Ttl node should have been deleted", zk.exists(path, false));
+        assertNull(zk.exists(path, false), "Ttl node should have been deleted");
     }
 
     @Test
@@ -139,11 +159,11 @@ public void testCreateAsync() throws KeeperException, InterruptedException {
         final AtomicLong fakeElapsed = new AtomicLong(0);
         ContainerManager containerManager = newContainerManager(fakeElapsed);
         containerManager.checkContainers();
-        assertNotNull("Ttl node should not have been deleted yet", zk.exists("/foo", false));
+        assertNotNull(zk.exists("/foo", false), "Ttl node should not have been deleted yet");
 
         fakeElapsed.set(1000);
         containerManager.checkContainers();
-        assertNull("Ttl node should have been deleted", zk.exists("/foo", false));
+        assertNull(zk.exists("/foo", false), "Ttl node should have been deleted");
     }
 
     @Test
@@ -155,46 +175,63 @@ public void testModifying() throws KeeperException, InterruptedException {
         final AtomicLong fakeElapsed = new AtomicLong(0);
         ContainerManager containerManager = newContainerManager(fakeElapsed);
         containerManager.checkContainers();
-        assertNotNull("Ttl node should not have been deleted yet", zk.exists("/foo", false));
+        assertNotNull(zk.exists("/foo", false), "Ttl node should not have been deleted yet");
 
         for (int i = 0; i < 10; ++i) {
             fakeElapsed.set(50);
             zk.setData("/foo", new byte[i + 1], -1);
             containerManager.checkContainers();
-            assertNotNull("Ttl node should not have been deleted yet", zk.exists("/foo", false));
+            assertNotNull(zk.exists("/foo", false), "Ttl node should not have been deleted yet");
         }
 
         fakeElapsed.set(200);
         containerManager.checkContainers();
-        assertNull("Ttl node should have been deleted", zk.exists("/foo", false));
+        assertNull(zk.exists("/foo", false), "Ttl node should have been deleted");
     }
 
     @Test
     public void testMulti() throws KeeperException, InterruptedException {
-        Op createTtl = Op.create("/a", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_WITH_TTL, 100);
-        Op createTtlSequential = Op.create("/b", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_SEQUENTIAL_WITH_TTL, 200);
+        CreateOptions options = CreateOptions
+                .newBuilder(ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_WITH_TTL)
+                .withTtl(100)
+                .build();
+        CreateOptions sequentialOptions = CreateOptions
+                .newBuilder(ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_SEQUENTIAL_WITH_TTL)
+                .withTtl(200)
+                .build();
+        Op createTtl = Op.create("/a", new byte[0], options.getAcl(), options.getCreateMode(), options.getTtl());
+        Op createTtl2 = Op.create("/a2", new byte[0], options);
+        Op createTtlSequential = Op.create("/b", new byte[0], sequentialOptions.getAcl(), sequentialOptions.getCreateMode(), sequentialOptions.getTtl());
+        Op createTtlSequential2 = Op.create("/b2", new byte[0], sequentialOptions);
         Op createNonTtl = Op.create("/c", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        List<OpResult> results = zk.multi(Arrays.asList(createTtl, createTtlSequential, createNonTtl));
-        String sequentialPath = ((OpResult.CreateResult) results.get(1)).getPath();
+        List<OpResult> results = zk.multi(Arrays.asList(createTtl, createTtl2, createTtlSequential, createTtlSequential2, createNonTtl));
+        String sequentialPath = ((OpResult.CreateResult) results.get(2)).getPath();
+        String sequentialPath2 = ((OpResult.CreateResult) results.get(3)).getPath();
 
         final AtomicLong fakeElapsed = new AtomicLong(0);
         ContainerManager containerManager = newContainerManager(fakeElapsed);
         containerManager.checkContainers();
-        assertNotNull("node should not have been deleted yet", zk.exists("/a", false));
-        assertNotNull("node should not have been deleted yet", zk.exists(sequentialPath, false));
-        assertNotNull("node should never be deleted", zk.exists("/c", false));
+        assertNotNull(zk.exists("/a", false), "node should not have been deleted yet");
+        assertNotNull(zk.exists("/a2", false), "node should not have been deleted yet");
+        assertNotNull(zk.exists(sequentialPath, false), "node should not have been deleted yet");
+        assertNotNull(zk.exists(sequentialPath2, false), "node should not have been deleted yet");
+        assertNotNull(zk.exists("/c", false), "node should never be deleted");
 
         fakeElapsed.set(110);
         containerManager.checkContainers();
-        assertNull("node should have been deleted", zk.exists("/a", false));
-        assertNotNull("node should not have been deleted yet", zk.exists(sequentialPath, false));
-        assertNotNull("node should never be deleted", zk.exists("/c", false));
+        assertNull(zk.exists("/a", false), "node should have been deleted");
+        assertNull(zk.exists("/a2", false), "node should have been deleted");
+        assertNotNull(zk.exists(sequentialPath, false), "node should not have been deleted yet");
+        assertNotNull(zk.exists(sequentialPath2, false), "node should not have been deleted yet");
+        assertNotNull(zk.exists("/c", false), "node should never be deleted");
 
         fakeElapsed.set(210);
         containerManager.checkContainers();
-        assertNull("node should have been deleted", zk.exists("/a", false));
-        assertNull("node should have been deleted", zk.exists(sequentialPath, false));
-        assertNotNull("node should never be deleted", zk.exists("/c", false));
+        assertNull(zk.exists("/a", false), "node should have been deleted");
+        assertNull(zk.exists("/a2", false), "node should have been deleted");
+        assertNull(zk.exists(sequentialPath, false), "node should have been deleted");
+        assertNull(zk.exists(sequentialPath2, false), "node should have been deleted");
+        assertNotNull(zk.exists("/c", false), "node should never be deleted");
     }
 
     @Test
@@ -236,10 +273,12 @@ public void testBadUsage() throws KeeperException, InterruptedException {
         }
     }
 
-    @Test(expected = KeeperException.UnimplementedException.class)
+    @Test
     public void testDisabled() throws KeeperException, InterruptedException {
-        // note, setUp() enables this test based on the test name
-        zk.create("/foo", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_WITH_TTL, new Stat(), 100);
+        assertThrows(KeeperException.UnimplementedException.class, () -> {
+            // note, setUp() enables this test based on the test name
+            zk.create("/foo", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_WITH_TTL, new Stat(), 100);
+        });
     }
 
     private ContainerManager newContainerManager(final AtomicLong fakeElapsed) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataNodeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataNodeTest.java
index 0fb6f686479..ceb9efa25de 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataNodeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataNodeTest.java
@@ -18,16 +18,16 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.Set;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class DataNodeTest {
 
     @Test
-    public void testGetChildrenShouldReturnEmptySetWhenThereAreNoChidren() {
+    public void testGetChildrenShouldReturnEmptySetWhenThereAreNoChildren() {
         // create DataNode and call getChildren
         DataNode dataNode = new DataNode();
         Set<String> children = dataNode.getChildren();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataTreeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataTreeTest.java
index da9a12a3c52..89a2f17b75f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataTreeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/DataTreeTest.java
@@ -18,12 +18,13 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.DataInputStream;
@@ -51,7 +52,8 @@
 import org.apache.zookeeper.metrics.MetricsUtils;
 import org.apache.zookeeper.txn.CreateTxn;
 import org.apache.zookeeper.txn.TxnHeader;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -63,7 +65,8 @@ public class DataTreeTest extends ZKTestCase {
      * For ZOOKEEPER-1755 - Test race condition when taking dumpEphemerals and
      * removing the session related ephemerals from DataTree structure
      */
-    @Test(timeout = 60000)
+    @Test
+    @Timeout(value = 60)
     public void testDumpEphemerals() throws Exception {
         int count = 1000;
         long session = 1000;
@@ -91,7 +94,7 @@ public void run() {
         killZkClientSession(session, zxid, dataTree, count);
         running.set(false);
         thread.join();
-        assertFalse("Should have got exception while dumpEphemerals!", exceptionDuringDumpEphemerals.get());
+        assertFalse(exceptionDuringDumpEphemerals.get(), "Should have got exception while dumpEphemerals!");
     }
 
     private void killZkClientSession(long session, long zxid, final DataTree dataTree, int count) {
@@ -107,7 +110,8 @@ private void createEphemeralNode(long session, final DataTree dataTree, int coun
         }
     }
 
-    @Test(timeout = 60000)
+    @Test
+    @Timeout(value = 60)
     public void testRootWatchTriggered() throws Exception {
         DataTree dt = new DataTree();
 
@@ -122,13 +126,14 @@ public void testRootWatchTriggered() throws Exception {
         // add a new node, should trigger a watch
         dt.createNode("/xyz", new byte[0], null, 0, dt.getNode("/").stat.getCversion() + 1, 1, 1);
 
-        assertTrue("Root node watch not triggered", fire.isDone());
+        assertTrue(fire.isDone(), "Root node watch not triggered");
     }
 
     /**
      * For ZOOKEEPER-1046 test if cversion is getting incremented correctly.
      */
-    @Test(timeout = 60000)
+    @Test
+    @Timeout(value = 60)
     public void testIncrementCversion() throws Exception {
         try {
             // digestCalculator gets initialized for the new DataTree constructor based on the system property
@@ -142,15 +147,9 @@ public void testIncrementCversion() throws Exception {
             dt.setCversionPzxid("/test/", prevCversion + 1, prevPzxid + 1);
             int newCversion = zk.stat.getCversion();
             long newPzxid = zk.stat.getPzxid();
-            assertTrue("<cversion, pzxid> verification failed. Expected: <"
-                                      + (prevCversion + 1)
-                                      + ", "
-                                      + (prevPzxid + 1)
-                                      + ">, found: <"
-                                      + newCversion
-                                      + ", "
-                                      + newPzxid
-                                      + ">", (newCversion == prevCversion + 1 && newPzxid == prevPzxid + 1));
+            assertTrue((newCversion == prevCversion + 1 && newPzxid == prevPzxid + 1),
+                "<cversion, pzxid> verification failed. Expected: <" + (prevCversion + 1) + ", "
+                    + (prevPzxid + 1) + ">, found: <" + newCversion + ", " + newPzxid + ">");
             assertNotEquals(digestBefore, dt.getTreeDigest());
         } finally {
             ZooKeeperServer.setDigestEnabled(false);
@@ -168,7 +167,8 @@ public void testNoCversionRevert() throws Exception {
         parent = dt.getNode("/");
         int newCversion = parent.stat.getCversion();
         long newPzxid = parent.stat.getPzxid();
-        assertTrue("<cversion, pzxid> verification failed. Expected: <"
+        assertTrue((newCversion >= currentCversion && newPzxid >= currentPzxid),
+            "<cversion, pzxid> verification failed. Expected: <"
                                   + currentCversion
                                   + ", "
                                   + currentPzxid
@@ -176,7 +176,7 @@ public void testNoCversionRevert() throws Exception {
                                   + newCversion
                                   + ", "
                                   + newPzxid
-                                  + ">", (newCversion >= currentCversion && newPzxid >= currentPzxid));
+                                  + ">");
     }
 
     @Test
@@ -226,15 +226,16 @@ public void testDigestUpdatedWhenReplayCreateTxnForExistNode() {
         }
     }
 
-    @Test(timeout = 60000)
+    @Test
+    @Timeout(value = 60)
     public void testPathTrieClearOnDeserialize() throws Exception {
 
         //Create a DataTree with quota nodes so PathTrie get updated
         DataTree dserTree = new DataTree();
 
         dserTree.createNode("/bug", new byte[20], null, -1, 1, 1, 1);
-        dserTree.createNode(Quotas.quotaZookeeper + "/bug", null, null, -1, 1, 1, 1);
-        dserTree.createNode(Quotas.quotaPath("/bug"), new byte[20], null, -1, 1, 1, 1);
+        dserTree.createNode(Quotas.quotaPath("/bug"), null, null, -1, 1, 1, 1);
+        dserTree.createNode(Quotas.limitPath("/bug"), new byte[20], null, -1, 1, 1, 1);
         dserTree.createNode(Quotas.statPath("/bug"), new byte[20], null, -1, 1, 1, 1);
 
         //deserialize a DataTree; this should clear the old /bug nodes and pathTrie
@@ -254,20 +255,21 @@ public void testPathTrieClearOnDeserialize() throws Exception {
         PathTrie pTrie = (PathTrie) pfield.get(dserTree);
 
         //Check that the node path is removed from pTrie
-        assertEquals("/bug is still in pTrie", "/", pTrie.findMaxPrefix("/bug"));
+        assertEquals("/", pTrie.findMaxPrefix("/bug"), "/bug is still in pTrie");
     }
 
 
     /* ZOOKEEPER-3531 - org.apache.zookeeper.server.DataTree#serialize calls the aclCache.serialize when doing
      * dataree serialization, however, org.apache.zookeeper.server.ReferenceCountedACLCache#serialize
-     * could get stuck at OutputArchieve.writeInt due to potential network/disk issues.
+     * could get stuck at OutputArchive.writeInt due to potential network/disk issues.
      * This can cause the system experiences hanging issues similar to ZooKeeper-2201.
      * This test verifies the fix that we should not hold ACL cache during dumping aclcache to snapshots
     */
-    @Test(timeout = 60000)
+    @Test
+    @Timeout(value = 60)
     public void testSerializeDoesntLockACLCacheWhileWriting() throws Exception {
         DataTree tree = new DataTree();
-        tree.createNode("/marker", new byte[]{42}, null, -1, 1, 1, 1);
+        tree.createNode("/marker", new byte[] { 42 }, null, -1, 1, 1, 1);
         final AtomicBoolean ranTestCase = new AtomicBoolean();
         DataOutputStream out = new DataOutputStream(new ByteArrayOutputStream());
         BinaryOutputArchive oa = new BinaryOutputArchive(out) {
@@ -290,7 +292,7 @@ public void run() {
                     boolean acquired = semaphore.tryAcquire(30, TimeUnit.SECONDS);
                     //This is the real assertion - could another thread lock
                     //the ACLCache
-                    assertTrue("Couldn't acquire a lock on the ACLCache while we were calling tree.serialize", acquired);
+                    assertTrue(acquired, "Couldn't acquire a lock on the ACLCache while we were calling tree.serialize");
                 } catch (InterruptedException e1) {
                     throw new RuntimeException(e1);
                 }
@@ -303,15 +305,16 @@ public void run() {
         tree.serialize(oa, "test");
 
         //Let's make sure that we hit the code that ran the real assertion above
-        assertTrue("Didn't find the expected node", ranTestCase.get());
+        assertTrue(ranTestCase.get(), "Didn't find the expected node");
     }
 
     /* ZOOKEEPER-3531 - similarly for aclCache.deserialize, we should not hold lock either
     */
-    @Test(timeout = 60000)
+    @Test
+    @Timeout(value = 60)
     public void testDeserializeDoesntLockACLCacheWhileReading() throws Exception {
         DataTree tree = new DataTree();
-        tree.createNode("/marker", new byte[]{42}, null, -1, 1, 1, 1);
+        tree.createNode("/marker", new byte[] { 42 }, null, -1, 1, 1, 1);
         final AtomicBoolean ranTestCase = new AtomicBoolean();
         ByteArrayOutputStream baos = new ByteArrayOutputStream();
         DataOutputStream out = new DataOutputStream(baos);
@@ -341,7 +344,7 @@ public void run() {
                     boolean acquired = semaphore.tryAcquire(30, TimeUnit.SECONDS);
                     //This is the real assertion - could another thread lock
                     //the ACLCache
-                    assertTrue("Couldn't acquire a lock on the ACLCache while we were calling tree.deserialize", acquired);
+                    assertTrue(acquired, "Couldn't acquire a lock on the ACLCache while we were calling tree.deserialize");
                 } catch (InterruptedException e1) {
                     throw new RuntimeException(e1);
                 }
@@ -354,7 +357,7 @@ public void run() {
         tree2.deserialize(ia, "test");
 
         //Let's make sure that we hit the code that ran the real assertion above
-        assertTrue("Didn't find the expected node", ranTestCase.get());
+        assertTrue(ranTestCase.get(), "Didn't find the expected node");
     }
 
     /*
@@ -365,10 +368,11 @@ public void run() {
      * currently being written, i.e. that DataTree.serializeNode does not hold
      * the DataNode lock while calling OutputArchive.writeRecord.
      */
-    @Test(timeout = 60000)
+    @Test
+    @Timeout(value = 60)
     public void testSerializeDoesntLockDataNodeWhileWriting() throws Exception {
         DataTree tree = new DataTree();
-        tree.createNode("/marker", new byte[]{42}, null, -1, 1, 1, 1);
+        tree.createNode("/marker", new byte[] { 42 }, null, -1, 1, 1, 1);
         final DataNode markerNode = tree.getNode("/marker");
         final AtomicBoolean ranTestCase = new AtomicBoolean();
         DataOutputStream out = new DataOutputStream(new ByteArrayOutputStream());
@@ -395,7 +399,7 @@ public void run() {
                             boolean acquired = semaphore.tryAcquire(30, TimeUnit.SECONDS);
                             //This is the real assertion - could another thread lock
                             //the DataNode we're currently writing
-                            assertTrue("Couldn't acquire a lock on the DataNode while we were calling tree.serialize", acquired);
+                            assertTrue(acquired, "Couldn't acquire a lock on the DataNode while we were calling tree.serialize");
                         } catch (InterruptedException e1) {
                             throw new RuntimeException(e1);
                         }
@@ -410,19 +414,19 @@ public void run() {
         tree.serialize(oa, "test");
 
         //Let's make sure that we hit the code that ran the real assertion above
-        assertTrue("Didn't find the expected node", ranTestCase.get());
+        assertTrue(ranTestCase.get(), "Didn't find the expected node");
     }
 
-    @Test(timeout = 60000)
+    @Test
+    @Timeout(value = 60)
     public void testReconfigACLClearOnDeserialize() throws Exception {
-
         DataTree tree = new DataTree();
         // simulate the upgrading scenario, where the reconfig znode
         // doesn't exist and the acl cache is empty
         tree.deleteNode(ZooDefs.CONFIG_NODE, 1);
         tree.getReferenceCountedAclCache().aclIndex = 0;
 
-        assertEquals("expected to have 1 acl in acl cache map", 0, tree.aclCacheSize());
+        assertEquals(0, tree.aclCacheSize(), "expected to have 1 acl in acl cache map");
 
         // serialize the data with one znode with acl
         tree.createNode("/bug", new byte[20], ZooDefs.Ids.OPEN_ACL_UNSAFE, -1, 1, 1, 1);
@@ -436,15 +440,15 @@ public void testReconfigACLClearOnDeserialize() throws Exception {
         BinaryInputArchive ia = BinaryInputArchive.getArchive(bais);
         tree.deserialize(ia, "test");
 
-        assertEquals("expected to have 1 acl in acl cache map", 1, tree.aclCacheSize());
-        assertEquals("expected to have the same acl", ZooDefs.Ids.OPEN_ACL_UNSAFE, tree.getACL("/bug", new Stat()));
+        assertEquals(1, tree.aclCacheSize(), "expected to have 1 acl in acl cache map");
+        assertEquals(ZooDefs.Ids.OPEN_ACL_UNSAFE, tree.getACL("/bug", new Stat()), "expected to have the same acl");
 
         // simulate the upgrading case where the config node will be created
         // again after leader election
         tree.addConfigNode();
 
-        assertEquals("expected to have 2 acl in acl cache map", 2, tree.aclCacheSize());
-        assertEquals("expected to have the same acl", ZooDefs.Ids.OPEN_ACL_UNSAFE, tree.getACL("/bug", new Stat()));
+        assertEquals(2, tree.aclCacheSize(), "expected to have 2 acl in acl cache map");
+        assertEquals(ZooDefs.Ids.OPEN_ACL_UNSAFE, tree.getACL("/bug", new Stat()), "expected to have the same acl");
     }
 
     @Test
@@ -513,6 +517,21 @@ public void testDeserializeZxidDigest() throws Exception {
         }
     }
 
+    @Test
+    public void testSerializeLastProcessedZxid_Enabled() throws Exception {
+        testSerializeLastProcessedZxid(true, true);
+    }
+
+    @Test
+    public void testSerializeLastProcessedZxid_Disabled() throws Exception {
+        testSerializeLastProcessedZxid(false, false);
+    }
+
+    @Test
+    public void testSerializeLastProcessedZxid_BackwardCompatibility() throws Exception {
+        testSerializeLastProcessedZxid(true, false);
+    }
+
     @Test
     public void testDataTreeMetrics() throws Exception {
         ServerMetrics.getMetrics().resetAll();
@@ -613,4 +632,59 @@ public void testDigest() throws Exception {
         }
     }
 
+    @Test
+    public void testCreateNodeFixMissingACL() throws Exception {
+        DataTree dt = new DataTree();
+        ReferenceCountedACLCache aclCache = dt.getReferenceCountedAclCache();
+
+        dt.createNode("/the_parent", new byte[0], ZooDefs.Ids.CREATOR_ALL_ACL, -1, 1, 1, 0);
+        Long aclId = dt.getNode("/the_parent").acl;
+        aclCache.removeUsage(aclId);
+        aclCache.purgeUnused();
+        // try to re-create the parent -> throws NodeExistsException, but fixes the deleted ACL
+        assertThrows(NodeExistsException.class, () ->
+            dt.createNode("/the_parent", new byte[0], ZooDefs.Ids.CREATOR_ALL_ACL, -1, 1, 1, 0));
+        dt.createNode("/the_parent/the_child", new byte[0], ZooDefs.Ids.CREATOR_ALL_ACL, -1, 2, 2, 2);
+    }
+
+    private DataTree buildDataTreeForTest() {
+        final DataTree dt = new DataTree();
+        assertEquals(dt.lastProcessedZxid, 0);
+
+        dt.processTxn(
+                new TxnHeader(100, 1000, 1, 30, ZooDefs.OpCode.create),
+                new CreateTxn("/foo", "".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, false, 1),
+                null);
+        assertEquals(dt.lastProcessedZxid, 1);
+        return dt;
+    }
+
+    private void testSerializeLastProcessedZxid(boolean enableForSerialize, boolean enableForDeserialize) throws Exception{
+        final DataTree dt = buildDataTreeForTest();
+
+        try (final ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
+            ZooKeeperServer.setSerializeLastProcessedZxidEnabled(enableForSerialize);
+            final BinaryOutputArchive oa = BinaryOutputArchive.getArchive(baos);
+            if (enableForSerialize) {
+                assertTrue(dt.serializeLastProcessedZxid(oa));
+            } else {
+                assertFalse(dt.serializeLastProcessedZxid(oa));
+            }
+            baos.flush();
+
+            ZooKeeperServer.setSerializeLastProcessedZxidEnabled(enableForDeserialize);
+            try (final ByteArrayInputStream bais = new ByteArrayInputStream(baos.toByteArray())) {
+                final InputArchive ia = BinaryInputArchive.getArchive(bais);
+                if (enableForDeserialize) {
+                    assertTrue(dt.deserializeLastProcessedZxid(ia));
+                } else {
+                    assertFalse(dt.deserializeLastProcessedZxid(ia));
+                }
+                assertEquals(dt.lastProcessedZxid, 1);
+            }
+        } finally {
+            ZooKeeperServer.setSerializeLastProcessedZxidEnabled(true);
+        }
+    }
+
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/DatadirCleanupManagerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/DatadirCleanupManagerTest.java
index d8b21850ece..566e540be2a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/DatadirCleanupManagerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/DatadirCleanupManagerTest.java
@@ -21,58 +21,59 @@
 import static org.apache.zookeeper.server.DatadirCleanupManager.PurgeTaskStatus.COMPLETED;
 import static org.apache.zookeeper.server.DatadirCleanupManager.PurgeTaskStatus.NOT_STARTED;
 import static org.apache.zookeeper.server.DatadirCleanupManager.PurgeTaskStatus.STARTED;
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.io.File;
 import org.apache.zookeeper.ZKTestCase;
-import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 
 public class DatadirCleanupManagerTest extends ZKTestCase {
 
     private DatadirCleanupManager purgeMgr;
+    @TempDir
+    File tmpDir;
     private File snapDir;
     private File dataLogDir;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
-        File dataDir = ClientBase.createTmpDir();
-        snapDir = dataDir;
-        dataLogDir = dataDir;
+        snapDir = tmpDir;
+        dataLogDir = tmpDir;
     }
 
     @Test
     public void testPurgeTask() throws Exception {
         purgeMgr = new DatadirCleanupManager(snapDir, dataLogDir, 3, 1);
         purgeMgr.start();
-        assertEquals("Data log directory is not set as configured", dataLogDir, purgeMgr.getDataLogDir());
-        assertEquals("Snapshot directory is not set as configured", snapDir, purgeMgr.getSnapDir());
-        assertEquals("Snapshot retain count is not set as configured", 3, purgeMgr.getSnapRetainCount());
-        assertEquals("Purge task is not started", STARTED, purgeMgr.getPurgeTaskStatus());
+        assertEquals(dataLogDir, purgeMgr.getDataLogDir(), "Data log directory is not set as configured");
+        assertEquals(snapDir, purgeMgr.getSnapDir(), "Snapshot directory is not set as configured");
+        assertEquals(3, purgeMgr.getSnapRetainCount(), "Snapshot retain count is not set as configured");
+        assertEquals(STARTED, purgeMgr.getPurgeTaskStatus(), "Purge task is not started");
         purgeMgr.shutdown();
-        assertEquals("Purge task is still running after shutdown", COMPLETED, purgeMgr.getPurgeTaskStatus());
+        assertEquals(COMPLETED, purgeMgr.getPurgeTaskStatus(), "Purge task is still running after shutdown");
     }
 
     @Test
     public void testWithZeroPurgeInterval() throws Exception {
         purgeMgr = new DatadirCleanupManager(snapDir, dataLogDir, 3, 0);
         purgeMgr.start();
-        assertEquals("Purge task is scheduled with zero purge interval", NOT_STARTED, purgeMgr.getPurgeTaskStatus());
+        assertEquals(NOT_STARTED, purgeMgr.getPurgeTaskStatus(), "Purge task is scheduled with zero purge interval");
         purgeMgr.shutdown();
-        assertEquals("Purge task is scheduled with zero purge interval", NOT_STARTED, purgeMgr.getPurgeTaskStatus());
+        assertEquals(NOT_STARTED, purgeMgr.getPurgeTaskStatus(), "Purge task is scheduled with zero purge interval");
     }
 
     @Test
     public void testWithNegativePurgeInterval() throws Exception {
         purgeMgr = new DatadirCleanupManager(snapDir, dataLogDir, 3, -1);
         purgeMgr.start();
-        assertEquals("Purge task is scheduled with negative purge interval", NOT_STARTED, purgeMgr.getPurgeTaskStatus());
+        assertEquals(NOT_STARTED, purgeMgr.getPurgeTaskStatus(), "Purge task is scheduled with negative purge interval");
         purgeMgr.shutdown();
-        assertEquals("Purge task is scheduled with negative purge interval", NOT_STARTED, purgeMgr.getPurgeTaskStatus());
+        assertEquals(NOT_STARTED, purgeMgr.getPurgeTaskStatus(), "Purge task is scheduled with negative purge interval");
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         if (purgeMgr != null) {
             purgeMgr.shutdown();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/DeserializationPerfTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/DeserializationPerfTest.java
index 064b53e0898..b45a883e33e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/DeserializationPerfTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/DeserializationPerfTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
@@ -26,7 +26,7 @@
 import org.apache.jute.BinaryOutputArchive;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/Emulate353TTLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/Emulate353TTLTest.java
index 7967beb2c22..8bb67774d4d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/Emulate353TTLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/Emulate353TTLTest.java
@@ -19,10 +19,10 @@
 package org.apache.zookeeper.server;
 
 import static org.hamcrest.CoreMatchers.equalTo;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertThat;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
 import java.util.concurrent.atomic.AtomicLong;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
@@ -30,12 +30,15 @@
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class Emulate353TTLTest extends ClientBase {
 
     private TestableZooKeeper zk;
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         System.setProperty(EphemeralType.EXTENDED_TYPES_ENABLED_PROPERTY, "true");
@@ -44,6 +47,7 @@ public void setUp() throws Exception {
         zk = createClient();
     }
 
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         System.clearProperty(EphemeralType.EXTENDED_TYPES_ENABLED_PROPERTY);
@@ -61,11 +65,11 @@ public void testCreate() throws KeeperException, InterruptedException {
         final AtomicLong fakeElapsed = new AtomicLong(0);
         ContainerManager containerManager = newContainerManager(fakeElapsed);
         containerManager.checkContainers();
-        assertNotNull("Ttl node should not have been deleted yet", zk.exists("/foo", false));
+        assertNotNull(zk.exists("/foo", false), "Ttl node should not have been deleted yet");
 
         fakeElapsed.set(1000);
         containerManager.checkContainers();
-        assertNull("Ttl node should have been deleted", zk.exists("/foo", false));
+        assertNull(zk.exists("/foo", false), "Ttl node should have been deleted");
     }
 
     @Test
@@ -78,11 +82,11 @@ public void test353TTL() throws KeeperException, InterruptedException {
         final AtomicLong fakeElapsed = new AtomicLong(0);
         ContainerManager containerManager = newContainerManager(fakeElapsed);
         containerManager.checkContainers();
-        assertNotNull("Ttl node should not have been deleted yet", zk.exists("/foo", false));
+        assertNotNull(zk.exists("/foo", false), "Ttl node should not have been deleted yet");
 
         fakeElapsed.set(1000);
         containerManager.checkContainers();
-        assertNull("Ttl node should have been deleted", zk.exists("/foo", false));
+        assertNull(zk.exists("/foo", false), "Ttl node should have been deleted");
     }
 
     @Test
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/EphemeralTypeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/EphemeralTypeTest.java
index 5021f0f7cd7..77b53f485ff 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/EphemeralTypeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/EphemeralTypeTest.java
@@ -19,22 +19,23 @@
 package org.apache.zookeeper.server;
 
 import static org.hamcrest.CoreMatchers.equalTo;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertThat;
-import static org.junit.Assert.fail;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.fail;
 import org.apache.zookeeper.CreateMode;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class EphemeralTypeTest {
 
-    @Before
+    @BeforeEach
     public void setUp() {
         System.setProperty(EphemeralType.EXTENDED_TYPES_ENABLED_PROPERTY, "true");
     }
 
-    @After
+    @AfterEach
     public void tearDown() {
         System.clearProperty(EphemeralType.EXTENDED_TYPES_ENABLED_PROPERTY);
     }
@@ -92,11 +93,13 @@ public void testEphemeralOwner_extendedFeature_TTL() {
         assertThat(EphemeralType.get(0xff00000000000000L), equalTo(EphemeralType.TTL));
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testEphemeralOwner_extendedFeature_extendedTypeUnsupported() {
-        // 0xff = Extended feature is ON
-        // 0x0001 = Unsupported extended type id (1)
-        EphemeralType.get(0xff00010000000000L);
+        assertThrows(IllegalArgumentException.class, () -> {
+            // 0xff = Extended feature is ON
+            // 0x0001 = Unsupported extended type id (1)
+            EphemeralType.get(0xff00010000000000L);
+        });
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/FinalRequestProcessorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/FinalRequestProcessorTest.java
index 1d4309f04df..cb86963e48a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/FinalRequestProcessorTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/FinalRequestProcessorTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.server;
 
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.equalTo;
-import static org.junit.Assert.assertThat;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.ArgumentMatchers.eq;
@@ -43,14 +43,14 @@
 import org.apache.zookeeper.proto.GetACLRequest;
 import org.apache.zookeeper.proto.GetACLResponse;
 import org.apache.zookeeper.proto.ReplyHeader;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.mockito.invocation.InvocationOnMock;
 import org.mockito.stubbing.Answer;
 
 public class FinalRequestProcessorTest {
 
-    private List<ACL> testACLs = new ArrayList<ACL>();
+    private List<ACL> testACLs = new ArrayList<>();
     private final Record[] responseRecord = new Record[1];
     private final ReplyHeader[] replyHeaders = new ReplyHeader[1];
 
@@ -58,7 +58,7 @@ public class FinalRequestProcessorTest {
     private ByteBuffer bb;
     private FinalRequestProcessor processor;
 
-    @Before
+    @BeforeEach
     public void setUp() throws KeeperException.NoNodeException, IOException {
         testACLs.clear();
         testACLs.addAll(Arrays.asList(new ACL(ZooDefs.Perms.ALL, new Id("digest", "user:secrethash")), new ACL(ZooDefs.Perms.ADMIN, new Id("digest", "adminuser:adminsecret")), new ACL(ZooDefs.Perms.READ, new Id("world", "anyone"))));
@@ -96,7 +96,7 @@ public void testACLDigestHashHiding_NoAuth_WorldCanRead() {
         // Arrange
 
         // Act
-        Request r = new Request(cnxn, 0, 0, ZooDefs.OpCode.getACL, bb, new ArrayList<Id>());
+        Request r = new Request(cnxn, 0, 0, ZooDefs.OpCode.getACL, RequestRecord.fromBytes(bb), new ArrayList<Id>());
         processor.processRequest(r);
 
         // Assert
@@ -109,7 +109,7 @@ public void testACLDigestHashHiding_NoAuth_NoWorld() {
         testACLs.remove(2);
 
         // Act
-        Request r = new Request(cnxn, 0, 0, ZooDefs.OpCode.getACL, bb, new ArrayList<Id>());
+        Request r = new Request(cnxn, 0, 0, ZooDefs.OpCode.getACL, RequestRecord.fromBytes(bb), new ArrayList<Id>());
         processor.processRequest(r);
 
         // Assert
@@ -119,11 +119,11 @@ public void testACLDigestHashHiding_NoAuth_NoWorld() {
     @Test
     public void testACLDigestHashHiding_UserCanRead() {
         // Arrange
-        List<Id> authInfo = new ArrayList<Id>();
+        List<Id> authInfo = new ArrayList<>();
         authInfo.add(new Id("digest", "otheruser:somesecrethash"));
 
         // Act
-        Request r = new Request(cnxn, 0, 0, ZooDefs.OpCode.getACL, bb, authInfo);
+        Request r = new Request(cnxn, 0, 0, ZooDefs.OpCode.getACL, RequestRecord.fromBytes(bb), authInfo);
         processor.processRequest(r);
 
         // Assert
@@ -133,11 +133,11 @@ public void testACLDigestHashHiding_UserCanRead() {
     @Test
     public void testACLDigestHashHiding_UserCanAll() {
         // Arrange
-        List<Id> authInfo = new ArrayList<Id>();
+        List<Id> authInfo = new ArrayList<>();
         authInfo.add(new Id("digest", "user:secrethash"));
 
         // Act
-        Request r = new Request(cnxn, 0, 0, ZooDefs.OpCode.getACL, bb, authInfo);
+        Request r = new Request(cnxn, 0, 0, ZooDefs.OpCode.getACL, RequestRecord.fromBytes(bb), authInfo);
         processor.processRequest(r);
 
         // Assert
@@ -147,11 +147,11 @@ public void testACLDigestHashHiding_UserCanAll() {
     @Test
     public void testACLDigestHashHiding_AdminUser() {
         // Arrange
-        List<Id> authInfo = new ArrayList<Id>();
+        List<Id> authInfo = new ArrayList<>();
         authInfo.add(new Id("digest", "adminuser:adminsecret"));
 
         // Act
-        Request r = new Request(cnxn, 0, 0, ZooDefs.OpCode.getACL, bb, authInfo);
+        Request r = new Request(cnxn, 0, 0, ZooDefs.OpCode.getACL, RequestRecord.fromBytes(bb), authInfo);
         processor.processRequest(r);
 
         // Assert
@@ -163,15 +163,15 @@ public void testACLDigestHashHiding_OnlyAdmin() {
         // Arrange
         testACLs.clear();
         testACLs.addAll(Arrays.asList(new ACL(ZooDefs.Perms.READ, new Id("digest", "user:secrethash")), new ACL(ZooDefs.Perms.ADMIN, new Id("digest", "adminuser:adminsecret"))));
-        List<Id> authInfo = new ArrayList<Id>();
+        List<Id> authInfo = new ArrayList<>();
         authInfo.add(new Id("digest", "adminuser:adminsecret"));
 
         // Act
-        Request r = new Request(cnxn, 0, 0, ZooDefs.OpCode.getACL, bb, authInfo);
+        Request r = new Request(cnxn, 0, 0, ZooDefs.OpCode.getACL, RequestRecord.fromBytes(bb), authInfo);
         processor.processRequest(r);
 
         // Assert
-        assertTrue("Not a GetACL response. Auth failed?", responseRecord[0] instanceof GetACLResponse);
+        assertTrue(responseRecord[0] instanceof GetACLResponse, "Not a GetACL response. Auth failed?");
         GetACLResponse rsp = (GetACLResponse) responseRecord[0];
         assertThat("Number of ACLs in the response are different", rsp.getAcl().size(), equalTo(2));
 
@@ -181,7 +181,7 @@ public void testACLDigestHashHiding_OnlyAdmin() {
     }
 
     private void assertMasked(boolean masked) {
-        assertTrue("Not a GetACL response. Auth failed?", responseRecord[0] instanceof GetACLResponse);
+        assertTrue(responseRecord[0] instanceof GetACLResponse, "Not a GetACL response. Auth failed?");
         GetACLResponse rsp = (GetACLResponse) responseRecord[0];
         assertThat("Number of ACLs in the response are different", rsp.getAcl().size(), equalTo(3));
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/InvalidSnapCountTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/InvalidSnapCountTest.java
index a7a4aeabe17..0be30d04cae 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/InvalidSnapCountTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/InvalidSnapCountTest.java
@@ -19,8 +19,8 @@
 package org.apache.zookeeper.server;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.FileWriter;
 import java.io.IOException;
@@ -29,7 +29,7 @@
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.common.PathUtils;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -109,9 +109,8 @@ public void testInvalidSnapCount() throws Exception {
         MainThread main = new MainThread(CLIENT_PORT);
         main.start();
 
-        assertTrue(
-                "waiting for server being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT),
+                "waiting for server being up");
 
         assertEquals(SyncRequestProcessor.getSnapCount(), 2);
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/InvalidSnapshotTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/InvalidSnapshotTest.java
index f048c9217c5..88f5a88548b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/InvalidSnapshotTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/InvalidSnapshotTest.java
@@ -18,14 +18,14 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.RandomAccessFile;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -72,7 +72,7 @@ public void testInvalidSnapshot() throws Exception {
         // verify that the expected data exists and wasn't lost
         zk = createClient();
         try {
-            assertTrue("the node should exist", (zk.exists("/invalidsnap-1999", false) != null));
+            assertTrue((zk.exists("/invalidsnap-1999", false) != null), "the node should exist");
         } finally {
             zk.close();
         }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/MockServerCnxn.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/MockServerCnxn.java
index a82eab3764d..af095921dad 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/MockServerCnxn.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/MockServerCnxn.java
@@ -22,8 +22,10 @@
 import java.net.InetSocketAddress;
 import java.nio.ByteBuffer;
 import java.security.cert.Certificate;
+import java.util.List;
 import org.apache.jute.Record;
 import org.apache.zookeeper.WatchedEvent;
+import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.proto.ReplyHeader;
 
@@ -46,8 +48,9 @@ public void close(DisconnectReason reason) {
     }
 
     @Override
-    public void sendResponse(ReplyHeader h, Record r, String tag,
+    public int sendResponse(ReplyHeader h, Record r, String tag,
                              String cacheKey, Stat stat, int opCode) throws IOException {
+        return 0;
     }
 
     @Override
@@ -55,7 +58,7 @@ public void sendCloseSession() {
     }
 
     @Override
-    public void process(WatchedEvent event) {
+    public void process(WatchedEvent event, List<ACL> acl) {
     }
 
     @Override
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/MultiOpSessionUpgradeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/MultiOpSessionUpgradeTest.java
index 6e35d2c5785..6826910103c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/MultiOpSessionUpgradeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/MultiOpSessionUpgradeTest.java
@@ -18,12 +18,12 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.nio.ByteBuffer;
@@ -44,7 +44,8 @@
 import org.apache.zookeeper.server.quorum.QuorumZooKeeperServer;
 import org.apache.zookeeper.server.quorum.UpgradeableSessionTracker;
 import org.apache.zookeeper.test.QuorumBase;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -52,6 +53,7 @@ public class MultiOpSessionUpgradeTest extends QuorumBase {
 
     protected static final Logger LOG = LoggerFactory.getLogger(MultiOpSessionUpgradeTest.class);
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         localSessionsEnabled = true;
@@ -68,9 +70,9 @@ public void ephemeralCreateMultiOpTest() throws KeeperException, InterruptedExce
         zk.create(path, new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
         QuorumZooKeeperServer server = getConnectedServer(zk.getSessionId());
-        assertNotNull("unable to find server interlocutor", server);
+        assertNotNull(server, "unable to find server interlocutor");
         UpgradeableSessionTracker sessionTracker = (UpgradeableSessionTracker) server.getSessionTracker();
-        assertFalse("session already global", sessionTracker.isGlobalSession(zk.getSessionId()));
+        assertFalse(sessionTracker.isGlobalSession(zk.getSessionId()), "session already global");
 
         List<OpResult> multi = null;
         try {
@@ -89,7 +91,7 @@ public void ephemeralCreateMultiOpTest() throws KeeperException, InterruptedExce
         assertEquals(data, new String(zk.getData(path + "/e", false, null)));
         assertEquals(data, new String(zk.getData(path + "/p", false, null)));
         assertEquals(data, new String(zk.getData(path + "/q", false, null)));
-        assertTrue("session not promoted", sessionTracker.isGlobalSession(zk.getSessionId()));
+        assertTrue(sessionTracker.isGlobalSession(zk.getSessionId()), "session not promoted");
     }
 
     @Test
@@ -100,13 +102,13 @@ public void directCheckUpgradeSessionTest() throws IOException, InterruptedExcep
         zk.create(path, new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
         QuorumZooKeeperServer server = getConnectedServer(zk.getSessionId());
-        assertNotNull("unable to find server interlocutor", server);
+        assertNotNull(server, "unable to find server interlocutor");
 
         Request readRequest = makeGetDataRequest(path, zk.getSessionId());
         Request createRequest = makeCreateRequest(path + "/e", zk.getSessionId());
-        assertNull("tried to upgrade on a read", server.checkUpgradeSession(readRequest));
-        assertNotNull("failed to upgrade on a create", server.checkUpgradeSession(createRequest));
-        assertNull("tried to upgrade after successful promotion", server.checkUpgradeSession(createRequest));
+        assertNull(server.checkUpgradeSession(readRequest), "tried to upgrade on a read");
+        assertNotNull(server.checkUpgradeSession(createRequest), "failed to upgrade on a create");
+        assertNull(server.checkUpgradeSession(createRequest), "tried to upgrade after successful promotion");
     }
 
     private Request makeGetDataRequest(String path, long sessionId) throws IOException {
@@ -115,7 +117,7 @@ private Request makeGetDataRequest(String path, long sessionId) throws IOExcepti
         GetDataRequest getDataRequest = new GetDataRequest(path, false);
         getDataRequest.serialize(boa, "request");
         ByteBuffer bb = ByteBuffer.wrap(boas.toByteArray());
-        return new Request(null, sessionId, 1, ZooDefs.OpCode.getData, bb, new ArrayList<Id>());
+        return new Request(null, sessionId, 1, ZooDefs.OpCode.getData, RequestRecord.fromBytes(bb), new ArrayList<Id>());
     }
 
     private Request makeCreateRequest(String path, long sessionId) throws IOException {
@@ -124,7 +126,7 @@ private Request makeCreateRequest(String path, long sessionId) throws IOExceptio
         CreateRequest createRequest = new CreateRequest(path, "data".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL.toFlag());
         createRequest.serialize(boa, "request");
         ByteBuffer bb = ByteBuffer.wrap(boas.toByteArray());
-        return new Request(null, sessionId, 1, ZooDefs.OpCode.create2, bb, new ArrayList<Id>());
+        return new Request(null, sessionId, 1, ZooDefs.OpCode.create2, RequestRecord.fromBytes(bb), new ArrayList<Id>());
     }
 
     private QuorumZooKeeperServer getConnectedServer(long sessionId) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/NIOServerCnxnFactoryTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/NIOServerCnxnFactoryTest.java
index 715c15a839b..237842b13cb 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/NIOServerCnxnFactoryTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/NIOServerCnxnFactoryTest.java
@@ -18,43 +18,48 @@
 
 package org.apache.zookeeper.server;
 
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import java.io.IOException;
 import java.net.InetSocketAddress;
 import java.net.ServerSocket;
 import java.net.SocketException;
 import org.apache.zookeeper.PortAssignment;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class NIOServerCnxnFactoryTest {
 
     private InetSocketAddress listenAddress;
     private NIOServerCnxnFactory factory;
 
-    @Before
+    @BeforeEach
     public void setUp() throws IOException {
         listenAddress = new InetSocketAddress(PortAssignment.unique());
         factory = new NIOServerCnxnFactory();
         factory.configure(listenAddress, 100);
     }
 
-    @After
+    @AfterEach
     public void tearDown() {
         if (factory != null) {
             factory.shutdown();
         }
     }
 
-    @Test(expected = SocketException.class)
+    @Test
     public void testStartupWithoutStart_SocketAlreadyBound() throws IOException {
-        ServerSocket ss = new ServerSocket(listenAddress.getPort());
+        assertThrows(SocketException.class, () -> {
+            ServerSocket ss = new ServerSocket(listenAddress.getPort());
+        });
     }
 
-    @Test(expected = SocketException.class)
+    @Test
     public void testStartupWithStart_SocketAlreadyBound() throws IOException {
-        factory.start();
-        ServerSocket ss = new ServerSocket(listenAddress.getPort());
+        assertThrows(SocketException.class, () -> {
+            factory.start();
+            ServerSocket ss = new ServerSocket(listenAddress.getPort());
+        });
     }
 
     @Test
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/NIOServerCnxnTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/NIOServerCnxnTest.java
index fc917e09bbc..f6ee6094c32 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/NIOServerCnxnTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/NIOServerCnxnTest.java
@@ -18,12 +18,12 @@
 
 package org.apache.zookeeper.server;
 
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.equalTo;
 import static org.hamcrest.Matchers.greaterThan;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertThat;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
@@ -31,7 +31,8 @@
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.server.quorum.BufferStats;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -42,7 +43,8 @@ public class NIOServerCnxnTest extends ClientBase {
     /**
      * Test operations on ServerCnxn after socket closure.
      */
-    @Test(timeout = 60000)
+    @Test
+    @Timeout(value = 60)
     public void testOperationsAfterCnxnClose() throws IOException, InterruptedException, KeeperException {
         final ZooKeeper zk = createClient();
 
@@ -50,10 +52,11 @@ public void testOperationsAfterCnxnClose() throws IOException, InterruptedExcept
         try {
             // make sure zkclient works
             zk.create(path, "test".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-            assertNotNull("Didn't create znode:" + path, zk.exists(path, false));
+            assertNotNull(zk.exists(path, false), "Didn't create znode:" + path);
             // Defaults ServerCnxnFactory would be instantiated with
             // NIOServerCnxnFactory
-            assertTrue("Didn't instantiate ServerCnxnFactory with NIOServerCnxnFactory!", serverFactory instanceof NIOServerCnxnFactory);
+            assertTrue(serverFactory instanceof NIOServerCnxnFactory,
+                "Didn't instantiate ServerCnxnFactory with NIOServerCnxnFactory!");
             Iterable<ServerCnxn> connections = serverFactory.getConnections();
             for (ServerCnxn serverCnxn : connections) {
                 serverCnxn.close(ServerCnxn.DisconnectReason.CHANNEL_CLOSED_EXCEPTION);
@@ -67,7 +70,6 @@ public void testOperationsAfterCnxnClose() throws IOException, InterruptedExcept
         } finally {
             zk.close();
         }
-
     }
 
     @Test
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnFactoryTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnFactoryTest.java
index 76136c4ee4f..41808be706c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnFactoryTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnFactoryTest.java
@@ -18,6 +18,10 @@
 
 package org.apache.zookeeper.server;
 
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.net.InetSocketAddress;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.LinkedBlockingQueue;
@@ -32,12 +36,10 @@
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.SSLAuthTest;
 import org.hamcrest.Matchers;
-import org.junit.Assert;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-
 public class NettyServerCnxnFactoryTest extends ClientBase {
 
     private static final Logger LOG = LoggerFactory
@@ -78,14 +80,14 @@ public void testRebind() throws Exception {
         NettyServerCnxnFactory factory = new NettyServerCnxnFactory();
         factory.configure(addr, 100, -1, false);
         factory.start();
-        Assert.assertTrue(factory.getParentChannel().isActive());
+        assertTrue(factory.getParentChannel().isActive());
 
         factory.reconfigure(addr);
 
         // wait the state change
         Thread.sleep(100);
 
-        Assert.assertTrue(factory.getParentChannel().isActive());
+        assertTrue(factory.getParentChannel().isActive());
     }
 
     @Test
@@ -95,14 +97,14 @@ public void testRebindIPv4IPv6() throws Exception {
         NettyServerCnxnFactory factory = new NettyServerCnxnFactory();
         factory.configure(addr, 100, -1, false);
         factory.start();
-        Assert.assertTrue(factory.getParentChannel().isActive());
+        assertTrue(factory.getParentChannel().isActive());
 
         factory.reconfigure(new InetSocketAddress("[0:0:0:0:0:0:0:0]", randomPort));
 
         // wait the state change
         Thread.sleep(100);
 
-        Assert.assertTrue(factory.getParentChannel().isActive());
+        assertTrue(factory.getParentChannel().isActive());
     }
 
     /*
@@ -124,7 +126,7 @@ public void testOutstandingHandshakeLimit() throws Exception {
         // initializing the statistics
         SimpleCounter tlsHandshakeExceeded = (SimpleCounter) ServerMetrics.getMetrics().TLS_HANDSHAKE_EXCEEDED;
         tlsHandshakeExceeded.reset();
-        Assert.assertEquals(tlsHandshakeExceeded.get(), 0);
+        assertEquals(tlsHandshakeExceeded.get(), 0);
 
         // setting the HandshakeLimit to 3, so only 3 SSL handshakes can happen in parallel
         NettyServerCnxnFactory factory = (NettyServerCnxnFactory) serverFactory;
@@ -150,20 +152,20 @@ public void testOutstandingHandshakeLimit() throws Exception {
         int actualConnections = cnxnCreated.get();
         LOG.info("created {} connections", actualConnections);
         if (!allConnectionsCreatedInTime) {
-          Assert.fail(String.format("Only %d out of %d connections created!", actualConnections, cnxnLimit));
+            fail(String.format("Only %d out of %d connections created!", actualConnections, cnxnLimit));
         }
 
         // Assert the server refused some of the connections because the handshake limit was reached
         // (throttling should be greater than 0)
         long handshakeThrottledNum = tlsHandshakeExceeded.get();
         LOG.info("TLS_HANDSHAKE_EXCEEDED: {}", handshakeThrottledNum);
-        Assert.assertThat("The number of handshake throttled should be "
+        assertThat("The number of handshake throttled should be "
                 + "greater than 0", handshakeThrottledNum, Matchers.greaterThan(0L));
 
         // Assert there is no outstanding handshake anymore, all the clients connected in the end
         int outstandingHandshakeNum = factory.getOutstandingHandshakeNum();
         LOG.info("outstanding handshake is {}", outstandingHandshakeNum);
-        Assert.assertThat("The outstanding handshake number should be 0 "
+        assertThat("The outstanding handshake number should be 0 "
                 + "after all cnxns established", outstandingHandshakeNum, Matchers.is(0));
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnTest.java
index 646d2051f03..d7cf9765fe6 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/NettyServerCnxnTest.java
@@ -18,34 +18,56 @@
 
 package org.apache.zookeeper.server;
 
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.equalTo;
 import static org.hamcrest.Matchers.greaterThan;
-import static org.junit.Assert.assertArrayEquals;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertThat;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+import static org.mockito.Mockito.doNothing;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.when;
+import io.netty.channel.Channel;
+import io.netty.channel.ChannelFuture;
+import io.netty.channel.ChannelHandlerContext;
+import io.netty.channel.ChannelId;
+import io.netty.channel.ChannelPipeline;
+import io.netty.util.Attribute;
 import java.io.IOException;
+import java.net.InetSocketAddress;
 import java.net.ProtocolException;
 import java.nio.charset.StandardCharsets;
+import java.util.List;
 import java.util.Random;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicInteger;
 import org.apache.zookeeper.AsyncCallback.DataCallback;
+import org.apache.zookeeper.ClientCnxnSocketNetty;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.common.ClientX509Util;
+import org.apache.zookeeper.common.NettyUtils;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.server.quorum.BufferStats;
+import org.apache.zookeeper.server.quorum.LeaderZooKeeperServer;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.SSLAuthTest;
 import org.apache.zookeeper.test.TestByteBufAllocator;
-import org.junit.Test;
+import org.apache.zookeeper.test.TestUtils;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
+import org.mockito.Mockito;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -57,6 +79,7 @@ public class NettyServerCnxnTest extends ClientBase {
 
     private static final Logger LOG = LoggerFactory.getLogger(NettyServerCnxnTest.class);
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         System.setProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY, "org.apache.zookeeper.server.NettyServerCnxnFactory");
@@ -66,6 +89,7 @@ public void setUp() throws Exception {
         super.setUp();
     }
 
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         super.tearDown();
@@ -81,9 +105,10 @@ public void tearDown() throws Exception {
      *
      * @see <a href="https://issues.jboss.org/browse/NETTY-412">NETTY-412</a>
      */
-    @Test(timeout = 40000)
+    @Test
+    @Timeout(value = 40)
     public void testSendCloseSession() throws Exception {
-        assertTrue("Didn't instantiate ServerCnxnFactory with NettyServerCnxnFactory!", serverFactory instanceof NettyServerCnxnFactory);
+        assertTrue(serverFactory instanceof NettyServerCnxnFactory, "Didn't instantiate ServerCnxnFactory with NettyServerCnxnFactory!");
 
         final ZooKeeper zk = createClient();
         final ZooKeeperServer zkServer = serverFactory.getZooKeeperServer();
@@ -92,10 +117,10 @@ public void testSendCloseSession() throws Exception {
             // make sure zkclient works
             zk.create(path, "test".getBytes(StandardCharsets.UTF_8), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
             // set on watch
-            assertNotNull("Didn't create znode:" + path, zk.exists(path, true));
+            assertNotNull(zk.exists(path, true), "Didn't create znode:" + path);
             assertEquals(1, zkServer.getZKDatabase().getDataTree().getWatchCount());
             Iterable<ServerCnxn> connections = serverFactory.getConnections();
-            assertEquals("Mismatch in number of live connections!", 1, serverFactory.getNumAliveConnections());
+            assertEquals(1, serverFactory.getNumAliveConnections(), "Mismatch in number of live connections!");
             for (ServerCnxn serverCnxn : connections) {
                 serverCnxn.sendCloseSession();
             }
@@ -120,12 +145,14 @@ public void testSendCloseSession() throws Exception {
      * is set to 1. This tests that if more than one connection is attempted, the
      * connection fails.
      */
-    @Test(timeout = 40000, expected = ProtocolException.class)
-    public void testMaxConnectionPerIpSurpased() throws Exception {
-        assertTrue("Did not instantiate ServerCnxnFactory with NettyServerCnxnFactory!", serverFactory instanceof NettyServerCnxnFactory);
-
-        try (final ZooKeeper zk1 = createClient(); final ZooKeeper zk2 = createClient()) {
-        }
+    @Test
+    @Timeout(value = 40)
+    public void testMaxConnectionPerIpSurpased() {
+        assertTrue(serverFactory instanceof NettyServerCnxnFactory, "Did not instantiate ServerCnxnFactory with NettyServerCnxnFactory!");
+        assertThrows(ProtocolException.class, () -> {
+            try (final ZooKeeper zk1 = createClient(); final ZooKeeper zk2 = createClient()) {
+            }
+        });
     }
 
     @Test
@@ -139,7 +166,91 @@ public void testClientResponseStatsUpdate() throws IOException, InterruptedExcep
             assertThat("Last client response size should be greater than 0 after client request was performed", clientResponseStats.getLastBufferSize(), greaterThan(0));
 
             byte[] contents = zk.getData("/a", null, null);
-            assertArrayEquals("unexpected data", "test".getBytes(StandardCharsets.UTF_8), contents);
+            assertArrayEquals("test".getBytes(StandardCharsets.UTF_8), contents, "unexpected data");
+        }
+    }
+
+    @Test
+    public void testNonMTLSLocalConn() throws IOException, InterruptedException, KeeperException {
+        try (ZooKeeper zk = createClient()) {
+            ServerStats serverStats = serverFactory.getZooKeeperServer().serverStats();
+            //2 for local stat connection and this client
+            assertEquals(2, serverStats.getNonMTLSLocalConnCount());
+            assertEquals(0, serverStats.getNonMTLSRemoteConnCount());
+        }
+    }
+
+    @Test
+    public void testNonMTLSRemoteConn() throws Exception {
+        LeaderZooKeeperServer zks = mock(LeaderZooKeeperServer.class);
+        when(zks.isRunning()).thenReturn(true);
+        ServerStats.Provider providerMock = mock(ServerStats.Provider.class);
+        when(zks.serverStats()).thenReturn(new ServerStats(providerMock));
+        testNonMTLSRemoteConn(zks, false, false);
+    }
+
+    @Test
+    public void testNonMTLSRemoteConnZookKeeperServerNotReady() throws Exception {
+        testNonMTLSRemoteConn(null, false, false);
+    }
+
+    @Test
+    public void testNonMTLSRemoteConnZookKeeperServerNotReadyEarlyDropEnabled() throws Exception {
+        testNonMTLSRemoteConn(null, false, true);
+    }
+
+    @Test
+    public void testMTLSRemoteConnZookKeeperServerNotReadyEarlyDropEnabled() throws Exception {
+        testNonMTLSRemoteConn(null, true, true);
+    }
+
+    @Test
+    public void testMTLSRemoteConnZookKeeperServerNotReadyEarlyDropDisabled() throws Exception {
+        testNonMTLSRemoteConn(null, true, true);
+    }
+
+    @SuppressWarnings("unchecked")
+    private void testNonMTLSRemoteConn(ZooKeeperServer zks, boolean secure, boolean earlyDrop) throws Exception {
+        try {
+            System.setProperty(NettyServerCnxnFactory.EARLY_DROP_SECURE_CONNECTION_HANDSHAKES, earlyDrop + "");
+
+            Channel channel = mock(Channel.class);
+            ChannelId id = mock(ChannelId.class);
+            ChannelFuture success = mock(ChannelFuture.class);
+            ChannelHandlerContext context = mock(ChannelHandlerContext.class);
+            ChannelPipeline channelPipeline = mock(ChannelPipeline.class);
+
+            when(context.channel()).thenReturn(channel);
+            when(channel.pipeline()).thenReturn(channelPipeline);
+            when(success.channel()).thenReturn(channel);
+            when(channel.closeFuture()).thenReturn(success);
+
+            InetSocketAddress address = new InetSocketAddress(0);
+            when(channel.remoteAddress()).thenReturn(address);
+            when(channel.id()).thenReturn(id);
+            NettyServerCnxnFactory factory = new NettyServerCnxnFactory();
+            factory.setSecure(secure);
+            factory.setZooKeeperServer(zks);
+            Attribute atr = mock(Attribute.class);
+            Mockito.doReturn(atr).when(channel).attr(
+                    Mockito.any()
+            );
+            doNothing().when(atr).set(Mockito.any());
+            factory.channelHandler.channelActive(context);
+
+            if (zks != null)  {
+                assertEquals(0, zks.serverStats().getNonMTLSLocalConnCount());
+                assertEquals(1, zks.serverStats().getNonMTLSRemoteConnCount());
+            } else {
+                if (earlyDrop && secure) {
+                    // the channel must have been forcibly closed
+                    Mockito.verify(channel, times(1)).close();
+                } else {
+                    Mockito.verify(channel, times(0)).close();
+                }
+            }
+        } finally {
+            System.clearProperty(NettyServerCnxnFactory.EARLY_DROP_SECURE_CONNECTION_HANDSHAKES);
         }
     }
 
@@ -175,7 +286,7 @@ public void run() {
             }
 
             byte[] contents = zk.getData("/a", null, null);
-            assertArrayEquals("unexpected data", "test".getBytes(StandardCharsets.UTF_8), contents);
+            assertArrayEquals("test".getBytes(StandardCharsets.UTF_8), contents, "unexpected data");
 
             // As above, but don't do the throttled read. Make the request bytes wait in the socket
             // input buffer until after throttling is turned off. Need to make sure both modes work.
@@ -193,7 +304,7 @@ public void run() {
             }
 
             contents = zk.getData("/a", null, null);
-            assertArrayEquals("unexpected data", "test".getBytes(StandardCharsets.UTF_8), contents);
+            assertArrayEquals("test".getBytes(StandardCharsets.UTF_8), contents, "unexpected data");
         }
     }
 
@@ -217,6 +328,37 @@ public void testEnableDisableThrottling_nonSecure_sequentially() throws Exceptio
         runEnableDisableThrottling(false, false);
     }
 
+    @Test
+    public void testNettyUsesDaemonThreads() throws Exception {
+        assertTrue(serverFactory instanceof NettyServerCnxnFactory,
+                "Didn't instantiate ServerCnxnFactory with NettyServerCnxnFactory!");
+
+        // Use Netty in the client to check the threads on both the client and server side
+        System.setProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET, ClientCnxnSocketNetty.class.getName());
+        try {
+            final ZooKeeperServer zkServer = serverFactory.getZooKeeperServer();
+            try (ZooKeeper zk = createClient()) {
+                final String path = "/a";
+                // make sure connection is established
+                zk.create(path, "test".getBytes(StandardCharsets.UTF_8), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+                List<Thread> threads = TestUtils.getAllThreads();
+                boolean foundThread = false;
+                for (Thread t : threads) {
+                    if (t.getName().startsWith(NettyUtils.THREAD_POOL_NAME_PREFIX)) {
+                        foundThread = true;
+                        assertTrue(t.isDaemon(), "All Netty threads started by ZK must daemon threads");
+                    }
+                }
+                assertTrue(foundThread, "Did not find any Netty ZK Threads");
+            } finally {
+                zkServer.shutdown();
+            }
+        } finally {
+            System.clearProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET);
+        }
+    }
+
     private void runEnableDisableThrottling(boolean secure, boolean randomDisableEnable) throws Exception {
         ClientX509Util x509Util = null;
         if (secure) {
@@ -293,7 +435,7 @@ public void run() {
                             zk.getData(path, null, new DataCallback() {
                                 @Override
                                 public void processResult(int rc, String path, Object ctx, byte[] data, Stat stat) {
-                                    if (rc == 0) {
+                                    if (rc == KeeperException.Code.OK.intValue()) {
                                         successResponse.addAndGet(1);
                                     } else {
                                         LOG.info("failed response is {}", rc);
@@ -326,5 +468,4 @@ public void processResult(int rc, String path, Object ctx, byte[] data, Stat sta
             }
         }
     }
-
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/NodeHashMapImplTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/NodeHashMapImplTest.java
index b34dc90cf02..f59b0d11e14 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/NodeHashMapImplTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/NodeHashMapImplTest.java
@@ -18,24 +18,24 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
 import java.util.Map;
 import java.util.Set;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.data.StatPersisted;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class NodeHashMapImplTest extends ZKTestCase {
 
-    @Before
+    @BeforeEach
     public void setUp() {
         ZooKeeperServer.setDigestEnabled(true);
     }
 
-    @After
+    @AfterEach
     public void tearDown() {
         ZooKeeperServer.setDigestEnabled(false);
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorMetricsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorMetricsTest.java
index 77dc6c78a54..bfb0db5f3fb 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorMetricsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorMetricsTest.java
@@ -18,10 +18,10 @@
 
 package org.apache.zookeeper.server;
 
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.number.OrderingComparison.greaterThan;
 import static org.hamcrest.number.OrderingComparison.greaterThanOrEqualTo;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyLong;
 import static org.mockito.ArgumentMatchers.anyString;
@@ -29,15 +29,12 @@
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.spy;
 import static org.mockito.Mockito.when;
-import java.io.ByteArrayOutputStream;
 import java.io.IOException;
-import java.nio.ByteBuffer;
 import java.util.HashSet;
 import java.util.Map;
 import java.util.Set;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
-import org.apache.jute.BinaryOutputArchive;
 import org.apache.jute.Record;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.WatchedEvent;
@@ -51,9 +48,9 @@
 import org.apache.zookeeper.proto.SetDataRequest;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.QuorumUtil;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -64,7 +61,7 @@ public class PrepRequestProcessorMetricsTest extends ZKTestCase {
     ZooKeeperServer zks;
     RequestProcessor nextProcessor;
 
-    @Before
+    @BeforeEach
     public void setup() {
         System.setProperty(ZooKeeperServer.SKIP_ACL, "true");
         zks = spy(new ZooKeeperServer());
@@ -88,18 +85,13 @@ public void setup() {
         ServerMetrics.getMetrics().resetAll();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         System.clearProperty(ZooKeeperServer.SKIP_ACL);
     }
 
     private Request createRequest(Record record, int opCode) throws IOException {
-        // encoding
-        ByteArrayOutputStream baos = new ByteArrayOutputStream();
-        BinaryOutputArchive boa = BinaryOutputArchive.getArchive(baos);
-        record.serialize(boa, "request");
-        baos.close();
-        return new Request(null, 1L, 0, opCode, ByteBuffer.wrap(baos.toByteArray()), null);
+        return new Request(null, 1L, 0, opCode, RequestRecord.fromRecord(record), null);
     }
 
     private Request createRequest(String path, int opCode) throws IOException {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java
index 48e58905f84..3cf993abbb3 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/PrepRequestProcessorTest.java
@@ -18,25 +18,22 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
-import java.io.ByteArrayOutputStream;
 import java.io.File;
-import java.io.IOException;
 import java.io.PrintWriter;
-import java.nio.ByteBuffer;
 import java.util.Arrays;
+import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
-import org.apache.jute.BinaryOutputArchive;
 import org.apache.jute.Record;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
@@ -48,6 +45,7 @@
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooDefs.OpCode;
 import org.apache.zookeeper.data.Id;
+import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.proto.CreateRequest;
 import org.apache.zookeeper.proto.ReconfigRequest;
 import org.apache.zookeeper.proto.RequestHeader;
@@ -62,16 +60,15 @@
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.txn.ErrorTxn;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+import org.apache.zookeeper.txn.SetDataTxn;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 
 
 public class PrepRequestProcessorTest extends ClientBase {
 
-    private static final Logger LOG = LoggerFactory.getLogger(PrepRequestProcessorTest.class);
     private static final int CONNECTION_TIMEOUT = 3000;
     private static String HOSTPORT = "127.0.0.1:" + PortAssignment.unique();
     private CountDownLatch pLatch;
@@ -81,9 +78,11 @@ public class PrepRequestProcessorTest extends ClientBase {
     private PrepRequestProcessor processor;
     private Request outcome;
 
-    @Before
-    public void setup() throws Exception {
-        File tmpDir = ClientBase.createTmpDir();
+    private boolean isReconfigEnabledPreviously;
+    private boolean isStandaloneEnabledPreviously;
+
+    @BeforeEach
+    public void setup(@TempDir File tmpDir) throws Exception {
         ClientBase.setupTestEnv();
         zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
         SyncRequestProcessor.setSnapCount(100);
@@ -91,11 +90,14 @@ public void setup() throws Exception {
 
         servcnxnf = ServerCnxnFactory.createFactory(PORT, -1);
         servcnxnf.startup(zks);
-        assertTrue("waiting for server being up ", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up ");
         zks.sessionTracker = new MySessionTracker();
+
+        isReconfigEnabledPreviously = QuorumPeerConfig.isReconfigEnabled();
+        isStandaloneEnabledPreviously = QuorumPeerConfig.isStandaloneEnabled();
     }
 
-    @After
+    @AfterEach
     public void teardown() throws Exception {
         if (servcnxnf != null) {
             servcnxnf.shutdown();
@@ -103,40 +105,38 @@ public void teardown() throws Exception {
         if (zks != null) {
             zks.shutdown();
         }
+
+        // reset the reconfig option
+        QuorumPeerConfig.setReconfigEnabled(isReconfigEnabledPreviously);
+        QuorumPeerConfig.setStandaloneEnabled(isStandaloneEnabledPreviously);
     }
 
     @Test
     public void testPRequest() throws Exception {
         pLatch = new CountDownLatch(1);
         processor = new PrepRequestProcessor(zks, new MyRequestProcessor());
-        Request foo = new Request(null, 1L, 1, OpCode.create, ByteBuffer.allocate(3), null);
+        Request foo = new Request(null, 1L, 1, OpCode.create, RequestRecord.fromBytes(new byte[3]), null);
         processor.pRequest(foo);
 
-        assertEquals("Request should have marshalling error", new ErrorTxn(KeeperException.Code.MARSHALLINGERROR.intValue()), outcome.getTxn());
-        assertTrue("request hasn't been processed in chain", pLatch.await(5, TimeUnit.SECONDS));
+        assertEquals(new ErrorTxn(KeeperException.Code.MARSHALLINGERROR.intValue()), outcome.getTxn(), "Request should have marshalling error");
+        assertTrue(pLatch.await(5, TimeUnit.SECONDS), "request hasn't been processed in chain");
     }
 
-    private Request createRequest(Record record, int opCode) throws IOException {
+    private Request createRequest(Record record, int opCode) {
         return createRequest(record, opCode, 1L);
     }
 
-    private Request createRequest(Record record, int opCode, long sessionId) throws IOException {
+    private Request createRequest(Record record, int opCode, long sessionId) {
         return createRequest(record, opCode, sessionId, false);
     }
 
-    private Request createRequest(Record record, int opCode, boolean admin) throws IOException {
+    private Request createRequest(Record record, int opCode, boolean admin) {
         return createRequest(record, opCode, 1L, admin);
     }
 
-    private Request createRequest(Record record, int opCode, long sessionId, boolean admin) throws IOException {
-        // encoding
-        ByteArrayOutputStream baos = new ByteArrayOutputStream();
-        BinaryOutputArchive boa = BinaryOutputArchive.getArchive(baos);
-        record.serialize(boa, "request");
-        baos.close();
-        // Id
-        List<Id> ids = Arrays.asList(admin ? new Id("super", "super user") : Ids.ANYONE_ID_UNSAFE);
-        return new Request(null, sessionId, 0, opCode, ByteBuffer.wrap(baos.toByteArray()), ids);
+    private Request createRequest(Record record, int opCode, long sessionId, boolean admin) {
+        List<Id> ids = Collections.singletonList(admin ? new Id("super", "super user") : Ids.ANYONE_ID_UNSAFE);
+        return new Request(null, sessionId, 0, opCode, RequestRecord.fromRecord(record), ids);
     }
 
     private void process(List<Op> ops) throws Exception {
@@ -147,7 +147,7 @@ private void process(List<Op> ops) throws Exception {
         Request req = createRequest(record, OpCode.multi, false);
 
         processor.pRequest(req);
-        assertTrue("request hasn't been processed in chain", pLatch.await(5, TimeUnit.SECONDS));
+        assertTrue(pLatch.await(5, TimeUnit.SECONDS), "request hasn't been processed in chain");
     }
 
     /**
@@ -163,25 +163,28 @@ public void testMultiOutstandingChange() throws Exception {
         process(Arrays.asList(Op.setData("/foo", new byte[0], -1)));
 
         ChangeRecord cr = zks.outstandingChangesForPath.get("/foo");
-        assertNotNull("Change record wasn't set", cr);
-        assertEquals("Record zxid wasn't set correctly", 1, cr.zxid);
+        assertNotNull(cr, "Change record wasn't set");
+        assertEquals(1, cr.zxid, "Record zxid wasn't set correctly");
 
         process(Arrays.asList(Op.delete("/foo", -1)));
         cr = zks.outstandingChangesForPath.get("/foo");
-        assertEquals("Record zxid wasn't set correctly", 2, cr.zxid);
+        assertEquals(2, cr.zxid, "Record zxid wasn't set correctly");
 
         // It should fail and shouldn't change outstanding record.
         process(Arrays.asList(Op.delete("/foo", -1)));
         cr = zks.outstandingChangesForPath.get("/foo");
         // zxid should still be previous result because record's not changed.
-        assertEquals("Record zxid wasn't set correctly", 2, cr.zxid);
+        assertEquals(2, cr.zxid, "Record zxid wasn't set correctly");
     }
 
     @Test
     public void testReconfigWithAnotherOutstandingChange() throws Exception {
+        QuorumPeerConfig.setReconfigEnabled(true);
+        QuorumPeerConfig.setStandaloneEnabled(false);
+
         QuorumPeer qp = new QuorumPeer();
         QuorumVerifier quorumVerifierMock = mock(QuorumVerifier.class);
-        when(quorumVerifierMock.getAllMembers()).thenReturn(LeaderBeanTest.getMockedPeerViews(qp.getId()));
+        when(quorumVerifierMock.getAllMembers()).thenReturn(LeaderBeanTest.getMockedPeerViews(qp.getMyId()));
 
         qp.setQuorumVerifier(quorumVerifierMock, false);
         FileTxnSnapLog snapLog = new FileTxnSnapLog(tmpDir, tmpDir);
@@ -194,24 +197,14 @@ public void testReconfigWithAnotherOutstandingChange() throws Exception {
         Record record = new CreateRequest("/foo", "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT.toFlag());
         pLatch = new CountDownLatch(1);
         processor.pRequest(createRequest(record, OpCode.create, false));
-        assertTrue("request hasn't been processed in chain", pLatch.await(5, TimeUnit.SECONDS));
+        assertTrue(pLatch.await(5, TimeUnit.SECONDS), "request hasn't been processed in chain");
 
-        boolean isReconfigEnabledPreviously = QuorumPeerConfig.isReconfigEnabled();
-        boolean isStandaloneEnabledPreviously = QuorumPeerConfig.isStandaloneEnabled();
-        QuorumPeerConfig.setReconfigEnabled(true);
-        QuorumPeerConfig.setStandaloneEnabled(false);
-        try {
-            String newMember = "server.0=localhost:" + PortAssignment.unique()  + ":" + PortAssignment.unique() + ":participant";
-            record = new ReconfigRequest(null, null, newMember, 0);
-            pLatch = new CountDownLatch(1);
-            processor.pRequest(createRequest(record, OpCode.reconfig, true));
-            assertTrue("request hasn't been processed in chain", pLatch.await(5, TimeUnit.SECONDS));
-            assertEquals(outcome.getHdr().getType(), OpCode.reconfig);   // Verifies that there was no error.
-        } finally {
-            // reset the reconfig option
-            QuorumPeerConfig.setReconfigEnabled(isReconfigEnabledPreviously);
-            QuorumPeerConfig.setStandaloneEnabled(isStandaloneEnabledPreviously);
-        }
+        String newMember = "server.0=localhost:" + PortAssignment.unique()  + ":" + PortAssignment.unique() + ":participant";
+        record = new ReconfigRequest(null, null, newMember, 0);
+        pLatch = new CountDownLatch(1);
+        processor.pRequest(createRequest(record, OpCode.reconfig, true));
+        assertTrue(pLatch.await(5, TimeUnit.SECONDS), "request hasn't been processed in chain");
+        assertEquals(outcome.getHdr().getType(), OpCode.reconfig);   // Verifies that there was no error.
     }
 
     /**
@@ -380,7 +373,7 @@ public void checkGlobalSession(long sessionId, Object owner) throws SessionExpir
         }
         @Override
         public Map<Long, Set<Long>> getSessionExpiryMap() {
-            return new HashMap<Long, Set<Long>>();
+            return new HashMap<>();
         }
         @Override
         public long getLocalSessionCount() {
@@ -391,6 +384,119 @@ public long getLocalSessionCount() {
         public boolean isLocalSessionsEnabled() {
             return false;
         }
+
+        public Set<Long> globalSessions() {
+            return Collections.emptySet();
+        }
+
+        public Set<Long> localSessions() {
+            return Collections.emptySet();
+        }
+    }
+
+    @Test
+    public void testCheckAndIncVersion() throws Exception {
+        zks.getZKDatabase().dataTree.createNode("/foo", new byte[0], Ids.OPEN_ACL_UNSAFE, 0, 0, 0, 0);
+        pLatch = new CountDownLatch(1);
+        processor = new PrepRequestProcessor(zks, new MyRequestProcessor());
+
+        SetDataRequest record = new SetDataRequest("/foo", new byte[0], 0);
+        Request req = createRequest(record, OpCode.setData, false);
+        processor.pRequest(req);
+        pLatch.await();
+        assertEquals(OpCode.setData, outcome.getHdr().getType());
+        assertTrue(outcome.getTxn() instanceof SetDataTxn);
+        SetDataTxn setDataTxn = (SetDataTxn) outcome.getTxn();
+        assertEquals(1, setDataTxn.getVersion());
+    }
+
+    @Test
+    public void testCheckAndIncVersionOverflow() throws Exception {
+        Stat customStat = new Stat();
+        customStat.setVersion(Integer.MAX_VALUE);
+        zks.getZKDatabase().dataTree.createNode("/foo", new byte[0], Ids.OPEN_ACL_UNSAFE, 0, 0, 0, 0);
+        DataNode node = zks.getZKDatabase().dataTree.getNode("/foo");
+        node.stat = DataTree.createStat(Integer.MAX_VALUE);
+
+        pLatch = new CountDownLatch(1);
+        processor = new PrepRequestProcessor(zks, new MyRequestProcessor());
+
+        SetDataRequest record = new SetDataRequest("/foo", new byte[0], Integer.MAX_VALUE);
+        Request req = createRequest(record, OpCode.setData, false);
+        processor.pRequest(req);
+        pLatch.await();
+        assertEquals(OpCode.setData, outcome.getHdr().getType());
+        assertTrue(outcome.getTxn() instanceof SetDataTxn);
+        SetDataTxn setDataTxn = (SetDataTxn) outcome.getTxn();
+        assertEquals(Integer.MIN_VALUE, setDataTxn.getVersion());
+    }
+    @Test
+    public void testCheckAndIncVersionWithNegativeNumber() throws Exception {
+        zks.getZKDatabase().dataTree.createNode("/foo", new byte[0], Ids.OPEN_ACL_UNSAFE, 0, 0, 0, 0);
+        DataNode node = zks.getZKDatabase().dataTree.getNode("/foo");
+        node.stat = DataTree.createStat(Integer.MIN_VALUE);
+
+        pLatch = new CountDownLatch(1);
+        processor = new PrepRequestProcessor(zks, new MyRequestProcessor());
+
+        SetDataRequest record = new SetDataRequest("/foo", new byte[0], Integer.MIN_VALUE);
+        Request req = createRequest(record, OpCode.setData, false);
+        processor.pRequest(req);
+        pLatch.await();
+        assertEquals(OpCode.setData, outcome.getHdr().getType());
+        assertTrue(outcome.getTxn() instanceof SetDataTxn);
+        SetDataTxn setDataTxn = (SetDataTxn) outcome.getTxn();
+        assertEquals(Integer.MIN_VALUE + 1, setDataTxn.getVersion());
+    }
+
+    @Test
+    public void testCheckAndIncToZeroFromNegativeTwo() throws Exception {
+        zks.getZKDatabase().dataTree.createNode("/foo", new byte[0], Ids.OPEN_ACL_UNSAFE, 0, 0, 0, 0);
+        DataNode node = zks.getZKDatabase().dataTree.getNode("/foo");
+        node.stat = DataTree.createStat(-2);
+
+        pLatch = new CountDownLatch(1);
+        processor = new PrepRequestProcessor(zks, new MyRequestProcessor());
+
+        SetDataRequest record = new SetDataRequest("/foo", new byte[0], -2);
+        Request req = createRequest(record, OpCode.setData, false);
+        processor.pRequest(req);
+        pLatch.await();
+        assertEquals(OpCode.setData, outcome.getHdr().getType());
+        assertTrue(outcome.getTxn() instanceof SetDataTxn);
+        SetDataTxn setDataTxn = (SetDataTxn) outcome.getTxn();
+        assertEquals(0, setDataTxn.getVersion());
     }
 
+    @Test
+    public void testCheckAndIncSkipEqualityCheck() throws Exception {
+        zks.getZKDatabase().dataTree.createNode("/foo", new byte[0], Ids.OPEN_ACL_UNSAFE, 0, 0, 0, 0);
+        DataNode node = zks.getZKDatabase().dataTree.getNode("/foo");
+
+        pLatch = new CountDownLatch(1);
+        processor = new PrepRequestProcessor(zks, new MyRequestProcessor());
+
+        SetDataRequest record = new SetDataRequest("/foo", new byte[0], -1);
+        Request req = createRequest(record, OpCode.setData, false);
+        processor.pRequest(req);
+        pLatch.await();
+        assertEquals(OpCode.setData, outcome.getHdr().getType());
+        assertTrue(outcome.getTxn() instanceof SetDataTxn);
+        SetDataTxn setDataTxn = (SetDataTxn) outcome.getTxn();
+        assertEquals(1, setDataTxn.getVersion());
+    }
+
+    @Test
+    public void testCheckAndIncWithBadVersion() throws Exception {
+        zks.getZKDatabase().dataTree.createNode("/foo", new byte[0], Ids.OPEN_ACL_UNSAFE, 0, 0, 0, 0);
+        pLatch = new CountDownLatch(1);
+        processor = new PrepRequestProcessor(zks, new MyRequestProcessor());
+
+        SetDataRequest record = new SetDataRequest("/foo", new byte[0], 1);
+        Request req = createRequest(record, OpCode.setData, false);
+        processor.pRequest(req);
+        pLatch.await();
+        assertEquals(OpCode.error, outcome.getHdr().getType());
+        assertEquals(KeeperException.Code.BADVERSION, outcome.getException().code());
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/PurgeTxnTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/PurgeTxnTest.java
index 804e23726ee..1e02adab86c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/PurgeTxnTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/PurgeTxnTest.java
@@ -18,11 +18,11 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.IOException;
 import java.io.OutputStream;
@@ -49,9 +49,9 @@
 import org.apache.zookeeper.server.persistence.SnapStream;
 import org.apache.zookeeper.server.persistence.Util;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -63,12 +63,12 @@ public class PurgeTxnTest extends ZKTestCase {
     private static final long OP_TIMEOUT_IN_MILLIS = 120000;
     private File tmpDir;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         tmpDir = ClientBase.createTmpDir();
     }
 
-    @After
+    @AfterEach
     public void teardown() {
         if (null != tmpDir) {
             ClientBase.recursiveDelete(tmpDir);
@@ -87,7 +87,7 @@ public void testPurge() throws Exception {
         final int PORT = Integer.parseInt(HOSTPORT.split(":")[1]);
         ServerCnxnFactory f = ServerCnxnFactory.createFactory(PORT, -1);
         f.startup(zks);
-        assertTrue("waiting for server being up ", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up ");
         ZooKeeper zk = ClientBase.createZKClient(HOSTPORT);
         try {
             for (int i = 0; i < 2000; i++) {
@@ -98,7 +98,7 @@ public void testPurge() throws Exception {
         }
         f.shutdown();
         zks.getTxnLogFactory().close();
-        assertTrue("waiting for server to shutdown", ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server to shutdown");
         // now corrupt the snapshot
         PurgeTxnLog.purge(tmpDir, tmpDir, 3);
         FileTxnSnapLog snaplog = new FileTxnSnapLog(tmpDir, tmpDir);
@@ -109,14 +109,14 @@ public void testPurge() throws Exception {
                 numSnaps++;
             }
         }
-        assertTrue("exactly 3 snapshots ", (numSnaps == 3));
+        assertTrue((numSnaps == 3), "exactly 3 snapshots ");
         snaplog.close();
         zks.shutdown();
     }
 
     /**
      * Tests purge when logs are rolling or a new snapshot is created, then
-     * these newer files should alse be excluded in the current cycle.
+     * these newer files should also be excluded in the current cycle.
      *
      * For frequent snapshotting, configured SnapCount to 30. There are three
      * threads which will create 1000 znodes each and simultaneously do purge
@@ -130,7 +130,7 @@ public void testPurgeWhenLogRollingInProgress() throws Exception {
         final int PORT = Integer.parseInt(HOSTPORT.split(":")[1]);
         ServerCnxnFactory f = ServerCnxnFactory.createFactory(PORT, -1);
         f.startup(zks);
-        assertTrue("waiting for server being up ", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up ");
         final ZooKeeper zk = ClientBase.createZKClient(HOSTPORT);
         final CountDownLatch doPurge = new CountDownLatch(1);
         final CountDownLatch purgeFinished = new CountDownLatch(1);
@@ -153,8 +153,8 @@ public void run() {
         }.start();
         final int thCount = 3;
         List<String> znodes = manyClientOps(zk, doPurge, thCount, "/invalidsnap");
-        assertTrue("Purging is not finished!", purgeFinished.await(OP_TIMEOUT_IN_MILLIS, TimeUnit.MILLISECONDS));
-        assertFalse("Purging failed!", opFailed.get());
+        assertTrue(purgeFinished.await(OP_TIMEOUT_IN_MILLIS, TimeUnit.MILLISECONDS), "Purging is not finished!");
+        assertFalse(opFailed.get(), "Purging failed!");
         for (String znode : znodes) {
             try {
                 zk.getData(znode, false, null);
@@ -179,22 +179,22 @@ public void testFindNValidSnapshots() throws Exception {
         int offset = 0;
 
         File version2 = new File(tmpDir.toString(), "version-2");
-        assertTrue("Failed to create version_2 dir:" + version2.toString(), version2.mkdir());
+        assertTrue(version2.mkdir(), "Failed to create version_2 dir:" + version2.toString());
 
         // Test that with no snaps, findNValidSnapshots returns empty list
         FileTxnSnapLog txnLog = new FileTxnSnapLog(tmpDir, tmpDir);
         List<File> foundSnaps = txnLog.findNValidSnapshots(1);
         assertEquals(0, foundSnaps.size());
 
-        List<File> expectedNRecentSnapFiles = new ArrayList<File>();
+        List<File> expectedNRecentSnapFiles = new ArrayList<>();
         int counter = offset + (2 * nRecentCount);
         for (int i = 0; i < nRecentCount; i++) {
             // simulate log file
             File logFile = new File(version2 + "/log." + Long.toHexString(--counter));
-            assertTrue("Failed to create log File:" + logFile.toString(), logFile.createNewFile());
+            assertTrue(logFile.createNewFile(), "Failed to create log File:" + logFile.toString());
             // simulate snapshot file
             File snapFile = new File(version2 + "/snapshot." + Long.toHexString(--counter));
-            assertTrue("Failed to create snap File:" + snapFile.toString(), snapFile.createNewFile());
+            assertTrue(snapFile.createNewFile(), "Failed to create snap File:" + snapFile.toString());
             makeValidSnapshot(snapFile);
             // add the n recent snap files for assertion
             if (i < nRecentSnap) {
@@ -205,17 +205,17 @@ public void testFindNValidSnapshots() throws Exception {
         // Test that when we ask for recent snaps we get the number we asked for and
         // the files we expected
         List<File> nRecentValidSnapFiles = txnLog.findNValidSnapshots(nRecentSnap);
-        assertEquals("exactly 4 snapshots ", 4, nRecentValidSnapFiles.size());
+        assertEquals(4, nRecentValidSnapFiles.size(), "exactly 4 snapshots ");
         expectedNRecentSnapFiles.removeAll(nRecentValidSnapFiles);
-        assertEquals("Didn't get the recent snap files", 0, expectedNRecentSnapFiles.size());
+        assertEquals(0, expectedNRecentSnapFiles.size(), "Didn't get the recent snap files");
 
         // Test that when asking for more snaps than we created, we still only get snaps
         // not logs or anything else (per ZOOKEEPER-2420)
         nRecentValidSnapFiles = txnLog.findNValidSnapshots(nRecentCount + 5);
         assertEquals(nRecentCount, nRecentValidSnapFiles.size());
         for (File f : nRecentValidSnapFiles) {
-            assertTrue("findNValidSnapshots() returned a non-snapshot: "
-                                      + f.getPath(), (Util.getZxidFromName(f.getName(), "snapshot") != -1));
+            assertTrue((Util.getZxidFromName(f.getName(), "snapshot") != -1),
+                    "findNValidSnapshots() returned a non-snapshot: " + f.getPath());
         }
 
         txnLog.close();
@@ -233,13 +233,13 @@ public void testSnapFilesGreaterThanToRetain() throws Exception {
         int fileToPurgeCount = 2;
         AtomicInteger offset = new AtomicInteger(0);
         File version2 = new File(tmpDir.toString(), "version-2");
-        assertTrue("Failed to create version_2 dir:" + version2.toString(), version2.mkdir());
-        List<File> snapsToPurge = new ArrayList<File>();
-        List<File> logsToPurge = new ArrayList<File>();
-        List<File> snaps = new ArrayList<File>();
-        List<File> logs = new ArrayList<File>();
-        List<File> snapsAboveRecentFiles = new ArrayList<File>();
-        List<File> logsAboveRecentFiles = new ArrayList<File>();
+        assertTrue(version2.mkdir(), "Failed to create version_2 dir:" + version2.toString());
+        List<File> snapsToPurge = new ArrayList<>();
+        List<File> logsToPurge = new ArrayList<>();
+        List<File> snaps = new ArrayList<>();
+        List<File> logs = new ArrayList<>();
+        List<File> snapsAboveRecentFiles = new ArrayList<>();
+        List<File> logsAboveRecentFiles = new ArrayList<>();
         createDataDirFiles(offset, fileToPurgeCount, false, version2, snapsToPurge, logsToPurge);
         createDataDirFiles(offset, nRecentCount, false, version2, snaps, logs);
         logs.add(logsToPurge.remove(0)); // log that precedes first retained snapshot is also retained
@@ -284,9 +284,9 @@ public void internalTestSnapFilesEqualsToRetain(boolean testWithPrecedingLogFile
         int nRecentCount = 3;
         AtomicInteger offset = new AtomicInteger(0);
         File version2 = new File(tmpDir.toString(), "version-2");
-        assertTrue("Failed to create version_2 dir:" + version2.toString(), version2.mkdir());
-        List<File> snaps = new ArrayList<File>();
-        List<File> logs = new ArrayList<File>();
+        assertTrue(version2.mkdir(), "Failed to create version_2 dir:" + version2.toString());
+        List<File> snaps = new ArrayList<>();
+        List<File> logs = new ArrayList<>();
         createDataDirFiles(offset, nRecentCount, testWithPrecedingLogFile, version2, snaps, logs);
 
         FileTxnSnapLog txnLog = new FileTxnSnapLog(tmpDir, tmpDir);
@@ -306,11 +306,11 @@ public void testSnapFilesLessThanToRetain() throws Exception {
         int fileToPurgeCount = 2;
         AtomicInteger offset = new AtomicInteger(0);
         File version2 = new File(tmpDir.toString(), "version-2");
-        assertTrue("Failed to create version_2 dir:" + version2.toString(), version2.mkdir());
-        List<File> snapsToPurge = new ArrayList<File>();
-        List<File> logsToPurge = new ArrayList<File>();
-        List<File> snaps = new ArrayList<File>();
-        List<File> logs = new ArrayList<File>();
+        assertTrue(version2.mkdir(), "Failed to create version_2 dir:" + version2.toString());
+        List<File> snapsToPurge = new ArrayList<>();
+        List<File> logsToPurge = new ArrayList<>();
+        List<File> snaps = new ArrayList<>();
+        List<File> logs = new ArrayList<>();
         createDataDirFiles(offset, fileToPurgeCount, false, version2, snapsToPurge, logsToPurge);
         createDataDirFiles(offset, nRecentCount, false, version2, snaps, logs);
         logs.add(logsToPurge.remove(0)); // log that precedes first retained snapshot is also retained
@@ -433,7 +433,7 @@ public void testPurgeDoesNotDeleteOverlappingLogFile() throws Exception {
         final int PORT = Integer.parseInt(HOSTPORT.split(":")[1]);
         ServerCnxnFactory f = ServerCnxnFactory.createFactory(PORT, -1);
         f.startup(zks);
-        assertTrue("waiting for server being up ", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up ");
         ZooKeeper zk = ClientBase.createZKClient(HOSTPORT);
 
         // Unique identifier for each znode that we create.
@@ -461,7 +461,7 @@ public void testPurgeDoesNotDeleteOverlappingLogFile() throws Exception {
         f.shutdown();
         zks.getTxnLogFactory().close();
         zks.shutdown();
-        assertTrue("waiting for server to shutdown", ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server to shutdown");
 
         // Purge snapshot and log files.
         PurgeTxnLog.purge(tmpDir, tmpDir, SNAP_RETAIN_COUNT);
@@ -480,7 +480,7 @@ public void testPurgeDoesNotDeleteOverlappingLogFile() throws Exception {
          */
         final String lastZnode = "/snap-" + (unique - 1);
         final Stat stat = zk.exists(lastZnode, false);
-        assertNotNull("Last znode does not exist: " + lastZnode, stat);
+        assertNotNull(stat, "Last znode does not exist: " + lastZnode);
 
         // Shutdown for the last time.
         f.shutdown();
@@ -529,7 +529,7 @@ public void testPurgeTxnLogWhenRecentSnapshotsAreAllInvalid() throws Exception {
 
     private File createDataDirLogFile(File version_2, int Zxid) throws IOException {
         File logFile = new File(version_2 + "/log." + Long.toHexString(Zxid));
-        assertTrue("Failed to create log File:" + logFile.toString(), logFile.createNewFile());
+        assertTrue(logFile.createNewFile(), "Failed to create log File:" + logFile.toString());
         return logFile;
     }
 
@@ -544,7 +544,7 @@ private void createDataDirFiles(AtomicInteger offset, int limit, boolean createP
             logs.add(createDataDirLogFile(version_2, --counter));
             // simulate snapshot file
             File snapFile = new File(version_2 + "/snapshot." + Long.toHexString(--counter));
-            assertTrue("Failed to create snap File:" + snapFile.toString(), snapFile.createNewFile());
+            assertTrue(snapFile.createNewFile(), "Failed to create snap File:" + snapFile.toString());
             snaps.add(snapFile);
         }
         if (createPrecedingLogFile) {
@@ -554,13 +554,13 @@ private void createDataDirFiles(AtomicInteger offset, int limit, boolean createP
 
     private void verifyFilesAfterPurge(List<File> logs, boolean exists) {
         for (File file : logs) {
-            assertEquals("After purging, file " + file, exists, file.exists());
+            assertEquals(exists, file.exists(), "After purging, file " + file);
         }
     }
 
     private List<String> manyClientOps(final ZooKeeper zk, final CountDownLatch doPurge, int thCount, final String prefix) {
         Thread[] ths = new Thread[thCount];
-        final List<String> znodes = Collections.synchronizedList(new ArrayList<String>());
+        final List<String> znodes = Collections.synchronizedList(new ArrayList<>());
         final CountDownLatch finished = new CountDownLatch(thCount);
         final AtomicReference<Exception> exception = new AtomicReference<>();
         for (int indx = 0; indx < thCount; indx++) {
@@ -593,7 +593,7 @@ private List<String> manyClientOps(final ZooKeeper zk, final CountDownLatch doPu
                 LOG.error("unexpected exception during running ZkClient ops:", exception.get());
                 fail("unexpected exception during running ZkClient ops, see in the logs above");
             }
-            assertTrue("ZkClient ops not finished in time!", operationsFinishedSuccessfully);
+            assertTrue(operationsFinishedSuccessfully, "ZkClient ops not finished in time!");
         } catch (InterruptedException ie) {
             LOG.error("Unexpected exception", ie);
             fail("Unexpected exception occurred!");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ReferenceCountedACLCacheTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ReferenceCountedACLCacheTest.java
index 6bb5d954c36..83b1a154230 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ReferenceCountedACLCacheTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ReferenceCountedACLCacheTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
@@ -32,7 +32,7 @@
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Id;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class ReferenceCountedACLCacheTest {
 
@@ -50,18 +50,18 @@ public void testSameACLGivesSameID() {
 
     @Test
     public void testWhetherOrderingMatters() {
-        List<ACL> testACL = new ArrayList<ACL>();
+        List<ACL> testACL = new ArrayList<>();
         testACL.add(new ACL(ZooDefs.Perms.READ, new Id("scheme", "ro")));
         testACL.add(new ACL(ZooDefs.Perms.WRITE, new Id("scheme", "rw")));
 
         ReferenceCountedACLCache cache = new ReferenceCountedACLCache();
         Long aclId = cache.convertAcls(testACL);
 
-        List<ACL> testACL2 = new ArrayList<ACL>();
+        List<ACL> testACL2 = new ArrayList<>();
         testACL2.add(new ACL(ZooDefs.Perms.WRITE, new Id("scheme", "rw")));
         testACL2.add(new ACL(ZooDefs.Perms.READ, new Id("scheme", "ro")));
 
-        assertFalse(aclId.equals(cache.convertAcls(testACL2)));
+        assertNotEquals(aclId, cache.convertAcls(testACL2));
     }
 
     @Test
@@ -90,7 +90,7 @@ public void testCacheSize() {
         List<ACL> testACL3 = createACL("differentId");
 
         Long aclId3 = cache.convertAcls(testACL3);
-        assertFalse(aclId3.equals(aclId));
+        assertNotEquals(aclId3, aclId);
         assertEquals(2, cache.size());
     }
 
@@ -126,7 +126,7 @@ public void testMultipleAddsAndRemove() {
         assertEquals(1, cache.size());
 
         Long newId = cache.convertAcls(testACL);
-        assertFalse(aclId.equals(newId));
+        assertNotEquals(aclId, newId);
     }
 
     @Test
@@ -255,9 +255,9 @@ public void testPurgeUnused() throws IOException {
         assertEquals(2, deserializedCache.size());
         assertEquals(aclId1, deserializedCache.convertAcls(acl1));
         assertEquals(aclId2, deserializedCache.convertAcls(acl2));
-        assertFalse(acl3.equals(deserializedCache.convertAcls(acl3)));
-        assertFalse(acl4.equals(deserializedCache.convertAcls(acl4)));
-        assertFalse(acl5.equals(deserializedCache.convertAcls(acl5)));
+        assertNotEquals(acl3, deserializedCache.convertAcls(acl3));
+        assertNotEquals(acl4, deserializedCache.convertAcls(acl4));
+        assertNotEquals(acl5, deserializedCache.convertAcls(acl5));
     }
 
     private void callAddUsageNTimes(ReferenceCountedACLCache deserializedCache, Long aclId, int num) {
@@ -279,7 +279,7 @@ private Long convertACLsNTimes(ReferenceCountedACLCache cache, List<ACL> acl, in
     }
 
     private List<ACL> createACL(String id) {
-        List<ACL> acl1 = new ArrayList<ACL>();
+        List<ACL> acl1 = new ArrayList<>();
         acl1.add(new ACL(ZooDefs.Perms.ADMIN, new Id("scheme", id)));
         return acl1;
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/RequestThrottlerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/RequestThrottlerTest.java
index 3afe81c6029..088f80c4857 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/RequestThrottlerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/RequestThrottlerTest.java
@@ -19,8 +19,10 @@
 package org.apache.zookeeper.server;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
+import static org.hamcrest.Matchers.greaterThanOrEqualTo;
+import static org.hamcrest.Matchers.is;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.IOException;
 import java.util.Map;
@@ -35,10 +37,9 @@
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.metrics.MetricsUtils;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Assert;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -47,6 +48,7 @@ public class RequestThrottlerTest extends ZKTestCase {
     private static final Logger LOG = LoggerFactory.getLogger(RequestThrottlerTest.class);
 
     private static String HOSTPORT = "127.0.0.1:" + PortAssignment.unique();
+    private static String GLOBAL_OUTSTANDING_LIMIT = "1";
     private static final int TOTAL_REQUESTS = 5;
     private static final int STALL_TIME = 5000;
 
@@ -67,13 +69,15 @@ public class RequestThrottlerTest extends ZKTestCase {
 
     CountDownLatch disconnected = null;
 
+    CountDownLatch throttled = null;
+    CountDownLatch throttling = null;
+
     ZooKeeperServer zks = null;
     ServerCnxnFactory f = null;
     ZooKeeper zk = null;
     int connectionLossCount = 0;
 
-
-    @Before
+    @BeforeEach
     public void setup() throws Exception {
         // start a server and create a client
         File tmpDir = ClientBase.createTmpDir();
@@ -83,7 +87,7 @@ public void setup() throws Exception {
         f = ServerCnxnFactory.createFactory(PORT, -1);
         f.startup(zks);
         LOG.info("starting up the zookeeper server .. waiting");
-        assertTrue("waiting for server being up", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up");
 
         resumeProcess = null;
         submitted = null;
@@ -91,7 +95,7 @@ public void setup() throws Exception {
         zk = ClientBase.createZKClient(HOSTPORT);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         // shut down the server and the client
         if (null != zk) {
@@ -115,6 +119,11 @@ public TestZooKeeperServer(File snapDir, File logDir, int tickTime) throws IOExc
             super(snapDir, logDir, tickTime);
         }
 
+        @Override
+        protected RequestThrottler createRequestThrottler() {
+            return new TestRequestThrottler(this);
+        }
+
         @Override
         protected void setupRequestProcessors() {
             RequestProcessor finalProcessor = new FinalRequestProcessor(this);
@@ -141,6 +150,24 @@ public void requestFinished(Request request) {
         }
     }
 
+    class TestRequestThrottler extends RequestThrottler {
+        public TestRequestThrottler(ZooKeeperServer zks) {
+            super(zks);
+        }
+
+        @Override
+        synchronized void throttleSleep(int stallTime) throws InterruptedException {
+            if (throttling != null) {
+                throttling.countDown();
+            }
+            super.throttleSleep(stallTime);
+            // Defend against unstable timing and potential spurious wakeup.
+            if (throttled != null) {
+                assertTrue(throttled.await(20, TimeUnit.SECONDS));
+            }
+        }
+    }
+
     class TestPrepRequestProcessor extends PrepRequestProcessor {
 
         public TestPrepRequestProcessor(ZooKeeperServer zks, RequestProcessor syncProcessor) {
@@ -191,18 +218,19 @@ public void testRequestThrottler() throws Exception {
 
         // make sure the server received all 5 requests
         submitted.await(5, TimeUnit.SECONDS);
-        Map<String, Object> metrics = MetricsUtils.currentServerMetrics();
 
         // but only two requests can get into the pipeline because of the throttler
-        assertEquals(2L, (long) metrics.get("prep_processor_request_queued"));
-        assertEquals(1L, (long) metrics.get("request_throttle_wait_count"));
+        waitForMetric("prep_processor_request_queued", is(2L));
+        waitForMetric("request_throttle_wait_count", greaterThanOrEqualTo(1L));
 
         // let the requests go through the pipeline and the throttler will be waken up to allow more requests
         // to enter the pipeline
         resumeProcess.countDown();
-        entered.await(STALL_TIME, TimeUnit.MILLISECONDS);
 
-        metrics = MetricsUtils.currentServerMetrics();
+        // wait for more than one STALL_TIME to reduce timeout before wakeup
+        assertTrue(entered.await(STALL_TIME + 5000, TimeUnit.MILLISECONDS));
+
+        Map<String, Object> metrics = MetricsUtils.currentServerMetrics();
         assertEquals(TOTAL_REQUESTS, (long) metrics.get("prep_processor_request_queued"));
     }
 
@@ -221,6 +249,9 @@ public void testDropStaleRequests() throws Exception {
         resumeProcess = new CountDownLatch(1);
         submitted = new CountDownLatch(TOTAL_REQUESTS);
 
+        throttled = new CountDownLatch(1);
+        throttling = new CountDownLatch(1);
+
         // send 5 requests asynchronously
         for (int i = 0; i < TOTAL_REQUESTS; i++) {
             zk.create("/request_throttle_test- " + i, ("/request_throttle_test- "
@@ -229,18 +260,20 @@ public void testDropStaleRequests() throws Exception {
         }
 
         // make sure the server received all 5 requests
-        submitted.await(5, TimeUnit.SECONDS);
-        Map<String, Object> metrics = MetricsUtils.currentServerMetrics();
-
-        // but only two requests can get into the pipeline because of the throttler
-        assertEquals(2L, (long) metrics.get("prep_processor_request_queued"));
-        assertEquals(1L, (long) metrics.get("request_throttle_wait_count"));
+        assertTrue(submitted.await(5, TimeUnit.SECONDS));
 
+        // stale throttled requests
+        assertTrue(throttling.await(5, TimeUnit.SECONDS));
         for (ServerCnxn cnxn : f.cnxns) {
             cnxn.setStale();
         }
+        throttled.countDown();
         zk = null;
 
+        // only first three requests are counted as finished
+        finished = new CountDownLatch(3);
+
+        // let the requests go through the pipeline
         resumeProcess.countDown();
         LOG.info("raise the latch");
 
@@ -248,10 +281,18 @@ public void testDropStaleRequests() throws Exception {
             Thread.sleep(50);
         }
 
+        assertTrue(finished.await(5, TimeUnit.SECONDS));
+
+        // assert after all requests processed to avoid concurrent issues as metrics are
+        // counted in different threads.
+        Map<String, Object> metrics = MetricsUtils.currentServerMetrics();
+
+        // only two requests can get into the pipeline because of the throttler
+        assertEquals(2L, (long) metrics.get("prep_processor_request_queued"));
+
         // the rest of the 3 requests will be dropped
         // but only the first one for a connection will be counted
-        metrics = MetricsUtils.currentServerMetrics();
-        assertEquals(2L, (long) metrics.get("prep_processor_request_queued"));
+        assertEquals(1L, (long) metrics.get("request_throttle_wait_count"));
         assertEquals(1, (long) metrics.get("stale_requests_dropped"));
     }
 
@@ -261,13 +302,22 @@ public void testLargeRequestThrottling() throws Exception {
 
         AsyncCallback.StringCallback createCallback = (rc, path, ctx, name) -> {
             if (KeeperException.Code.get(rc) == KeeperException.Code.CONNECTIONLOSS) {
-                disconnected.countDown();
                 connectionLossCount++;
+                disconnected.countDown();
             }
         };
 
-        // we allow five requests in the pipeline
-        RequestThrottler.setMaxRequests(5);
+        // the total length of the request is about 170-180 bytes, so only two requests are allowed
+        byte[] data = new byte[100];
+        // the third request will incur throttle. We don't send more requests to avoid reconnecting
+        // due to unstable test environment(e.g. slow sending).
+        int number_requests = 3;
+
+        // we allow more requests in the pipeline
+        RequestThrottler.setMaxRequests(number_requests + 2);
+
+        // request could become stale in processor threads due to throttle in io thread
+        RequestThrottler.setDropStaleRequests(false);
 
         // enable large request throttling
         zks.setLargeRequestThreshold(150);
@@ -277,34 +327,68 @@ public void testLargeRequestThrottling() throws Exception {
         resumeProcess = new CountDownLatch(1);
         // the connection will be close when large requests exceed the limit
         // we can't use the submitted latch because requests after close won't be submitted
-        disconnected = new CountDownLatch(TOTAL_REQUESTS);
+        disconnected = new CountDownLatch(number_requests);
 
-        // the total length of the request is about 170-180 bytes, so only two requests are allowed
-        byte[] data = new byte[100];
-
-        // send 5 requests asynchronously
-        for (int i = 0; i < TOTAL_REQUESTS; i++) {
+        // send requests asynchronously
+        for (int i = 0; i < number_requests; i++) {
             zk.create("/request_throttle_test- " + i , data,
                     ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, createCallback, null);
         }
 
-        // make sure the server received all 5 requests
-        disconnected.await(5, TimeUnit.SECONDS);
-        Map<String, Object> metrics = MetricsUtils.currentServerMetrics();
-
-        // but only two requests can get into the pipeline because they are large requests
-        // the connection will be closed
-        Assert.assertEquals(2L, (long) metrics.get("prep_processor_request_queued"));
-        Assert.assertEquals(1L, (long) metrics.get("large_requests_rejected"));
-        Assert.assertEquals(5, connectionLossCount);
+        // make sure the server received all requests
+        assertTrue(disconnected.await(30, TimeUnit.SECONDS));
 
         finished = new CountDownLatch(2);
         // let the requests go through the pipeline
         resumeProcess.countDown();
-        finished.await(5, TimeUnit.SECONDS);
+        assertTrue(finished.await(5, TimeUnit.SECONDS));
+
+        // assert metrics after finished so metrics in no io threads are set also.
+        Map<String, Object> metrics = MetricsUtils.currentServerMetrics();
+
+        // but only two requests can get into the pipeline because they are large requests
+        // the connection will be closed
+        assertEquals(2L, (long) metrics.get("prep_processor_request_queued"));
+        assertEquals(1L, (long) metrics.get("large_requests_rejected"));
+        assertEquals(number_requests, connectionLossCount);
 
         // when the two requests finish, they are stale because the connection is closed already
-        metrics = MetricsUtils.currentServerMetrics();
-        Assert.assertEquals(2, (long) metrics.get("stale_replies"));
+        assertEquals(2, (long) metrics.get("stale_replies"));
+    }
+
+    @Test
+    public void testGlobalOutstandingRequestThrottlingWithRequestThrottlerDisabled() throws Exception {
+        try {
+            System.setProperty(ZooKeeperServer.GLOBAL_OUTSTANDING_LIMIT, GLOBAL_OUTSTANDING_LIMIT);
+
+            ServerMetrics.getMetrics().resetAll();
+
+            // Here we disable RequestThrottler and let incoming requests queued at first request processor.
+            RequestThrottler.setMaxRequests(0);
+            resumeProcess = new CountDownLatch(1);
+            int totalRequests = 10;
+
+            for (int i = 0; i < totalRequests; i++) {
+                zk.create("/request_throttle_test- " + i, ("/request_throttle_test- "
+                        + i).getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, (rc, path, ctx, name) -> {
+                }, null);
+            }
+
+            // We should start throttling instead of queuing more requests.
+            //
+            // We always allow up to GLOBAL_OUTSTANDING_LIMIT + 1 number of requests coming in request processing pipeline
+            // before throttling. For the next request, we will throttle by disabling receiving future requests but we still
+            // allow this single request coming in. Ideally, the total number of queued requests in processing pipeline would
+            // be GLOBAL_OUTSTANDING_LIMIT + 2.
+            //
+            // But due to leak of consistent view of number of outstanding requests, the number could be larger.
+            waitForMetric("prep_processor_request_queued", greaterThanOrEqualTo(Long.parseLong(GLOBAL_OUTSTANDING_LIMIT) + 2));
+
+            resumeProcess.countDown();
+        } catch (Exception e) {
+            throw e;
+        } finally {
+            System.clearProperty(ZooKeeperServer.GLOBAL_OUTSTANDING_LIMIT);
+        }
     }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/SSLHostnameVerificationTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/SSLHostnameVerificationTest.java
new file mode 100644
index 00000000000..bee6abb4b14
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/SSLHostnameVerificationTest.java
@@ -0,0 +1,529 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.security.Security;
+import java.time.Duration;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.Properties;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;
+import org.apache.zookeeper.WatchedEvent;
+import org.apache.zookeeper.Watcher;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.common.ssl.Ca;
+import org.apache.zookeeper.common.ssl.Cert;
+import org.apache.zookeeper.server.embedded.ExitHandler;
+import org.apache.zookeeper.server.embedded.ZooKeeperServerEmbedded;
+import org.apache.zookeeper.test.ClientBase;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.burningwave.tools.net.HostResolutionRequestInterceptor;
+import org.burningwave.tools.net.MappedHostResolver;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.CsvSource;
+import org.junit.jupiter.params.provider.ValueSource;
+
+public class SSLHostnameVerificationTest {
+    @BeforeAll
+    public static void setupDNSMocks() {
+        Map<String, String> hostAliases = new LinkedHashMap<>();
+
+        // avoid resolving "localhost" to ipv6 address "::1"
+        hostAliases.put("localhost", "127.0.0.1");
+        HostResolutionRequestInterceptor.INSTANCE.install(new MappedHostResolver(hostAliases));
+        HostResolutionRequestInterceptor.INSTANCE.clearCache();
+    }
+
+    @AfterAll
+    public static void clearDNSMocks() {
+        HostResolutionRequestInterceptor.INSTANCE.uninstall();
+    }
+
+    @BeforeAll
+    public static void setup() {
+        Security.addProvider(new BouncyCastleProvider());
+    }
+
+    @AfterAll
+    public static void cleanup() {
+        Security.removeProvider("BC");
+    }
+
+    Watcher.Event.KeeperState checkConnectState(String connectString, ZKClientConfig clientConfig) throws Exception {
+        Duration timeout = Duration.ofSeconds(1);
+        Watcher.Event.KeeperState state;
+        CompletableFuture<WatchedEvent> future = new CompletableFuture<>();
+        try (ZooKeeper zk = new ZooKeeper(connectString, (int) timeout.toMillis(), future::complete, clientConfig)) {
+            try {
+                WatchedEvent event = future.get(timeout.toMillis() * 2, TimeUnit.MILLISECONDS);
+                state = event.getState();
+            } catch (TimeoutException ignored) {
+                // See: ZOOKEEPER-4508, ZOOKEEPER-4921, ZOOKEEPER-4923
+                state = Watcher.Event.KeeperState.Expired;
+            }
+        }
+        return state;
+    }
+
+    @ParameterizedTest(name = "{0}, fips-mode: {1}")
+    @CsvSource({
+            "localhost, true",
+            "localhost, false",
+            "127.0.0.1, true",
+            "127.0.0.1, false",
+    })
+    public void testClientHostnameVerificationWithMismatchNames(String serverHost, boolean fipsEnabled, @TempDir Path tmpDir) throws Exception {
+        try (Ca ca = Ca.create(tmpDir)) {
+            // given: server with cert mismatching cn/dns/ip
+            Cert server1Cert = ca.signer("abc0").withDnsName("abc1").withIpAddress("192.168.0.10").sign();
+            Properties config = server1Cert.buildServerProperties(ca);
+            config.put("ssl.hostnameVerification", "false");
+            config.put("secureClientPortAddress", serverHost);
+
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
+                    .configuration(config)
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                // server ready
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                Cert clientCert = ca.sign("client");
+                ZKClientConfig clientConfig = clientCert.buildClientConfig(ca);
+                clientConfig.setProperty("zookeeper.sasl.client", "false");
+                clientConfig.setProperty("zookeeper.fips-mode", Boolean.toString(fipsEnabled));
+                clientConfig.setProperty("zookeeper.ssl.hostnameVerification", "true");
+
+                // when: connect using mismatched dns/ip
+                String connectionString =  server.getSecureConnectionString();
+                // then: connection rejected by us as no matching name
+                assertEquals(Watcher.Event.KeeperState.Expired, checkConnectState(server.getSecureConnectionString(), clientConfig));
+            }
+        }
+    }
+
+    @Test
+    public void testClientHostnameVerificationWithMatchingCnName(@TempDir Path tmpDir) throws Exception {
+        try (Ca ca = Ca.create(tmpDir)) {
+            // given: server cert with cn name "localhost"
+            Cert server1Cert = ca.signer("localhost").sign();
+            Properties config = server1Cert.buildServerProperties(ca);
+            config.put("ssl.hostnameVerification", "false");
+
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
+                    .configuration(config)
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                // server ready
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                Cert clientCert = ca.sign("client");
+                ZKClientConfig clientConfig = clientCert.buildClientConfig(ca);
+                clientConfig.setProperty("zookeeper.sasl.client", "false");
+                clientConfig.setProperty("zookeeper.ssl.hostnameVerification", "true");
+                clientConfig.setProperty("zookeeper.fips-mode", "false");
+
+                // when: connect using matching dns
+                String connectionString =  "localhost:" + server.getSecureClientPort();
+                // then: connected as there is no other sans
+                assertEquals(Watcher.Event.KeeperState.SyncConnected, checkConnectState(connectionString, clientConfig));
+            }
+        }
+    }
+
+    @Test
+    public void testClientHostnameVerificationWithMatchingReversedDnsName(@TempDir Path tmpDir) throws Exception {
+        try (Ca ca = Ca.create(tmpDir)) {
+            // given: server cert with cn name "localhost"
+            Cert server1Cert = ca.signer("localhost").sign();
+            Properties config = server1Cert.buildServerProperties(ca);
+            config.put("ssl.hostnameVerification", "false");
+
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
+                    .configuration(config)
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                // server ready
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                Cert clientCert = ca.sign("client");
+                ZKClientConfig clientConfig = clientCert.buildClientConfig(ca);
+                clientConfig.setProperty("zookeeper.sasl.client", "false");
+                clientConfig.setProperty("zookeeper.ssl.hostnameVerification", "true");
+                clientConfig.setProperty("zookeeper.fips-mode", "false");
+
+                // when: connect using matching reversed dns
+                String connectionString =  "127.0.0.1:" + server.getSecureClientPort();
+                clientConfig.setProperty("zookeeper.ssl.allowReverseDnsLookup", "true");
+                // then: connected as there is no other sans
+                assertEquals(Watcher.Event.KeeperState.SyncConnected, checkConnectState(connectionString, clientConfig));
+            }
+        }
+    }
+
+
+    @Test
+    public void testClientHostnameVerificationWithMatchingDisabledReversedDnsName(@TempDir Path tmpDir) throws Exception {
+        try (Ca ca = Ca.create(tmpDir)) {
+            // given: server cert with cn name "localhost"
+            Cert server1Cert = ca.signer("localhost").sign();
+            Properties config = server1Cert.buildServerProperties(ca);
+            config.put("ssl.hostnameVerification", "false");
+
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
+                    .configuration(config)
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                // server ready
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                Cert clientCert = ca.sign("client");
+                ZKClientConfig clientConfig = clientCert.buildClientConfig(ca);
+                clientConfig.setProperty("zookeeper.sasl.client", "false");
+                clientConfig.setProperty("zookeeper.ssl.hostnameVerification", "true");
+                clientConfig.setProperty("zookeeper.fips-mode", "false");
+
+                // when: connect using matching reversed dns
+                String connectionString =  "127.0.0.1:" + server.getSecureClientPort();
+                clientConfig.setProperty("zookeeper.ssl.allowReverseDnsLookup", "false");
+                // then: connected as there is no other sans
+                assertEquals(Watcher.Event.KeeperState.Expired, checkConnectState(connectionString, clientConfig));
+            }
+        }
+    }
+    @ParameterizedTest
+    @ValueSource(strings = {"localhost", "127.0.0.1"})
+    public void testClientHostnameVerificationWithMatchingCnNameButMismatchingSan(String serverHost, @TempDir Path tmpDir) throws Exception {
+        try (Ca ca = Ca.create(tmpDir)) {
+            // given: server with cert matching cn
+            Cert server1Cert = ca.signer("localhost").withDnsName("abc1").withIpAddress("192.168.0.10").sign();
+            Properties config = server1Cert.buildServerProperties(ca);
+            config.put("ssl.hostnameVerification", "false");
+
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
+                    .configuration(config)
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                // server ready
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                Cert clientCert = ca.sign("client");
+                ZKClientConfig clientConfig = clientCert.buildClientConfig(ca);
+                clientConfig.setProperty("zookeeper.ssl.hostnameVerification", "true");
+                clientConfig.setProperty("zookeeper.sasl.client", "false");
+                clientConfig.setProperty("zookeeper.ssl.allowReverseDnsLookup", "true");
+                clientConfig.setProperty("zookeeper.fips-mode", "false");
+
+                // when: connect with dns or ip resolved to cn name
+                String connectionString = String.format("%s:%d", serverHost, server.getSecureClientPort());
+
+                // then: fail to connect
+                //
+                // CN matching has been deprecated by rfc2818 and can be used
+                // as fallback only when no subjectAlts are available
+                assertEquals(Watcher.Event.KeeperState.Expired, checkConnectState(connectionString, clientConfig));
+            }
+        }
+    }
+
+    @ParameterizedTest
+    @ValueSource(strings = {"localhost", "127.0.0.1"})
+    public void testClientHostnameVerificationWithMatchingIpAddress(String serverHost, @TempDir Path tmpDir) throws Exception {
+        try (Ca ca = Ca.create(tmpDir)) {
+            // given: server with cert mismatching ip
+            Cert server1Cert = ca.signer("abc0").withDnsName("abc1").withIpAddress("127.0.0.1").sign();
+            Properties config = server1Cert.buildServerProperties(ca);
+            config.put("ssl.hostnameVerification", "false");
+
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
+                    .configuration(config)
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                // server ready
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                Cert clientCert = ca.sign("client");
+                ZKClientConfig clientConfig = clientCert.buildClientConfig(ca);
+                clientConfig.setProperty("zookeeper.ssl.hostnameVerification", "true");
+                clientConfig.setProperty("zookeeper.sasl.client", "false");
+                clientConfig.setProperty("zookeeper.fips-mode", "false");
+
+                // when: connect with matching ip or its dns
+                String connectionString = String.format("%s:%d", serverHost, server.getSecureClientPort());
+
+                // then: connected
+                assertEquals(Watcher.Event.KeeperState.SyncConnected, checkConnectState(connectionString, clientConfig));
+            }
+        }
+    }
+
+    @Test
+    public void testClientHostnameVerificationFipsModeWithIpAddress(@TempDir Path tmpDir) throws Exception {
+        try (Ca ca = Ca.create(tmpDir)) {
+            // given: server with cert mismatching ip
+            Cert server1Cert = ca.signer("abc0").withDnsName("abc1").withIpAddress("127.0.0.1").sign();
+            Properties config = server1Cert.buildServerProperties(ca);
+            config.put("ssl.hostnameVerification", "false");
+
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
+                    .configuration(config)
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                // server ready
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                Cert clientCert = ca.sign("client");
+                ZKClientConfig clientConfig = clientCert.buildClientConfig(ca);
+                clientConfig.setProperty("zookeeper.ssl.hostnameVerification", "true");
+                clientConfig.setProperty("zookeeper.sasl.client", "false");
+                clientConfig.setProperty("zookeeper.fips-mode", "true");
+
+                // when: connect with ip's dns
+                String connectionString = String.format("localhost:%d", server.getSecureClientPort());
+                // then: rejected as fips-mode don't do dns lookup
+                assertEquals(Watcher.Event.KeeperState.Expired, checkConnectState(connectionString, clientConfig));
+
+                // when: connect with ip address
+                connectionString = String.format("127.0.0.1:%d", server.getSecureClientPort());
+                // then: connected
+                assertEquals(Watcher.Event.KeeperState.SyncConnected, checkConnectState(connectionString, clientConfig));
+            }
+        }
+    }
+
+    @Test
+    public void testClientHostnameVerificationFipsModeWithDns(@TempDir Path tmpDir) throws Exception {
+        try (Ca ca = Ca.create(tmpDir)) {
+            // given: server cert with dns "localhost"
+            Cert server1Cert = ca.signer("abc0").withDnsName("localhost").sign();
+            Properties config = server1Cert.buildServerProperties(ca);
+            config.put("ssl.hostnameVerification", "false");
+
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
+                    .configuration(config)
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                // server ready
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                Cert clientCert = ca.sign("client");
+                ZKClientConfig clientConfig = clientCert.buildClientConfig(ca);
+                clientConfig.setProperty("zookeeper.ssl.hostnameVerification", "true");
+                clientConfig.setProperty("zookeeper.sasl.client", "false");
+                clientConfig.setProperty("zookeeper.fips-mode", "true");
+
+                // when: connect with ip address
+                String connectionString = String.format("127.0.0.1:%d", server.getSecureClientPort());
+                // then: fail as fips-mode won't do reverse dns lookup
+                assertEquals(Watcher.Event.KeeperState.Expired, checkConnectState(connectionString, clientConfig));
+
+                // when: connect with "localhost"
+                connectionString = String.format("localhost:%d", server.getSecureClientPort());
+                // then: succeed
+                assertEquals(Watcher.Event.KeeperState.SyncConnected, checkConnectState(connectionString, clientConfig));
+            }
+        }
+    }
+
+    @Test
+    public void testClientHostnameVerificationWithMatchingDnsName(@TempDir Path tmpDir) throws Exception {
+        try (Ca ca = Ca.create(tmpDir)) {
+            // given: server cert with dns name "localhost"
+            Cert server1Cert = ca.signer("abc0").withDnsName("localhost").withIpAddress("192.168.0.10").sign();
+            Properties config = server1Cert.buildServerProperties(ca);
+            config.put("ssl.hostnameVerification", "false");
+
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
+                    .configuration(config)
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                // server ready
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                Cert clientCert = ca.sign("client");
+                ZKClientConfig clientConfig = clientCert.buildClientConfig(ca);
+                clientConfig.setProperty("zookeeper.sasl.client", "false");
+                clientConfig.setProperty("zookeeper.fips-mode", "false");
+                clientConfig.setProperty("zookeeper.ssl.hostnameVerification", "true");
+                clientConfig.setProperty("zookeeper.ssl.allowReverseDnsLookup", "true");
+
+                // when: connect to "127.0.0.1"
+                String connectionString = String.format("127.0.0.1:%d", server.getSecureClientPort());
+                // then: connected as ZKHostnameVerifier will do reverse dns lookup
+                assertEquals(Watcher.Event.KeeperState.SyncConnected, checkConnectState(connectionString, clientConfig));
+
+                // when: connect to "localhost"
+                connectionString = String.format("localhost:%d", server.getSecureClientPort());
+                // then: connected as dns match
+                assertEquals(Watcher.Event.KeeperState.SyncConnected, checkConnectState(connectionString, clientConfig));
+            }
+        }
+    }
+
+    @ParameterizedTest
+    @ValueSource(strings = {"x509", ""})
+    public void testServerHostnameVerification(String authProvider, @TempDir Path tmpDir) throws Exception {
+        try (Ca ca = Ca.create(tmpDir)) {
+            Cert cert = ca.sign("server");
+
+            // given: server with client hostname verification enabled
+            Properties config = cert.buildServerProperties(ca);
+            config.put("ssl.hostnameVerification", "true");
+            config.put("ssl.clientHostnameVerification", "true");
+            config.put("ssl.allowReverseDnsLookup", "false");
+            config.put("fips-mode", "false");
+            if (!authProvider.isEmpty()) {
+                config.put("ssl.authProvider", "x509");
+            }
+
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
+                    .configuration(config)
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                // server ready
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                // // when: connect with matching dns name
+                Cert client1Cert = ca.signer("client1").withDnsName("localhost").sign();
+                ZKClientConfig client1Config = client1Cert.buildClientConfig(ca);
+                client1Config.setProperty("zookeeper.ssl.hostnameVerification", "false");
+
+                // then: connected
+                assertTrue(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, client1Config));
+
+                // when: connect with matching ip address
+                Cert client2Cert = ca.signer("client2").withIpAddress("127.0.0.1").sign();
+                ZKClientConfig client2Config = client2Cert.buildClientConfig(ca);
+                client2Config.setProperty("zookeeper.ssl.hostnameVerification", "false");
+
+                // then: connected
+                assertTrue(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, client2Config));
+
+                // when: connect with matching cn name
+                Cert client3Cert = ca.signer("localhost").sign();
+                ZKClientConfig client3Config = client3Cert.buildClientConfig(ca);
+                client3Config.setProperty("zookeeper.ssl.hostnameVerification", "false");
+
+                // then: connected
+                assertTrue(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, client3Config));
+
+                // when: connect with mismatching cert name
+                Cert client4Cert = ca.signer("client4").withDnsName("abc").sign();
+                ZKClientConfig client4Config = client4Cert.buildClientConfig(ca);
+                client4Config.setProperty("zookeeper.ssl.hostnameVerification", "false");
+
+                // then: fail to connect
+                assertFalse(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, client4Config));
+            }
+        }
+    }
+
+    /**
+     * FIPS mode disallow custom trust manager so server has no way to validate against client's endpoint.
+     */
+    @ParameterizedTest
+    @ValueSource(strings = {"x509", ""})
+    public void testServerHostnameVerificationFipsMode(String authProvider, @TempDir Path tmpDir) throws Exception {
+        try (Ca ca = Ca.create(tmpDir)) {
+            Cert cert = ca.sign("server");
+
+            Properties config = cert.buildServerProperties(ca);
+
+            // given: server in fips mode with client hostname verification enabled
+            config.put("ssl.hostnameVerification", "true");
+            config.put("ssl.clientHostnameVerification", "true");
+            config.put("fips-mode", "true");
+
+            if (!authProvider.isEmpty()) {
+                config.put("ssl.authProvider", "x509");
+            }
+
+            try (ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded
+                    .builder()
+                    .baseDir(Files.createTempDirectory(tmpDir, "server.data"))
+                    .configuration(config)
+                    .exitHandler(ExitHandler.LOG_ONLY)
+                    .build()) {
+                server.start();
+
+                // server ready
+                assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), 60000));
+
+                // // when: connect with matching dns name
+                Cert client1Cert = ca.signer("localhost").withResolvedDns("localhost").sign();
+                ZKClientConfig client1Config = client1Cert.buildClientConfig(ca);
+                client1Config.setProperty("zookeeper.ssl.hostnameVerification", "false");
+
+                // then: fail to connect
+                assertFalse(ClientBase.waitForServerUp(server.getSecureConnectionString(), 6000, true, client1Config));
+            }
+        }
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/SerializationPerfTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/SerializationPerfTest.java
index 1ff0a76f6d4..49c454bcb4c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/SerializationPerfTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/SerializationPerfTest.java
@@ -23,7 +23,7 @@
 import org.apache.jute.BinaryOutputArchive;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerCnxnFactoryTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerCnxnFactoryTest.java
new file mode 100644
index 00000000000..f8fb125ca4e
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerCnxnFactoryTest.java
@@ -0,0 +1,156 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.doThrow;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.mockingDetails;
+import java.util.Arrays;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.EnumSource;
+
+public class ServerCnxnFactoryTest {
+    public enum FactoryType {
+        NIO, NETTY
+    }
+
+    private ServerCnxnFactory factory;
+
+    @AfterEach
+    public void tearDown() {
+        if (factory != null) {
+            try {
+                factory.shutdown();
+            } catch (Exception e) {
+                // Ignore all shutdown exceptions in tests since factory may not be fully initialized
+            }
+        }
+    }
+
+    @ParameterizedTest
+    @EnumSource(FactoryType.class)
+    public void testShedConnections_InvalidPercentage(final FactoryType factoryType) {
+        factory = createFactory(factoryType);
+        assertThrows(IllegalArgumentException.class, () -> factory.shedConnections(-1));
+        assertThrows(IllegalArgumentException.class, () -> factory.shedConnections(101));
+    }
+
+    @ParameterizedTest
+    @EnumSource(FactoryType.class)
+    public void testShedConnections_ValidPercentages(final FactoryType factoryType) {
+        factory = createFactory(factoryType);
+
+        assertEquals(0, factory.shedConnections(0));
+        assertEquals(0, factory.shedConnections(50));
+        assertEquals(0, factory.shedConnections(100));
+    }
+
+    @ParameterizedTest
+    @EnumSource(FactoryType.class)
+    public void testShedConnections_DeterministicBehavior(final FactoryType factoryType) {
+        factory = createFactory(factoryType);
+
+        // Create 4 mock connections for testing deterministic edge cases
+        final ServerCnxn[] mockCnxns = new ServerCnxn[4];
+        for (int i = 0; i < 4; i++) {
+            mockCnxns[i] = mock(ServerCnxn.class);
+            factory.cnxns.add(mockCnxns[i]);
+        }
+
+        // Test 0% shedding - should shed exactly 0 connections (deterministic)
+        int shedCount = factory.shedConnections(0);
+        assertEquals(0, shedCount, "0% shedding should shed exactly 0 connections");
+
+        // Verify no connections were actually closed
+        int actualClosedCount = countConnectionsShed(mockCnxns);
+        assertEquals(0, actualClosedCount, "No connections should be closed for 0% shedding");
+
+        // Test 100% shedding - should shed exactly all connections (deterministic)
+        shedCount = factory.shedConnections(100);
+        assertEquals(4, shedCount, "100% shedding should shed exactly all 4 connections");
+
+        // Verify all connections were actually closed with correct reason
+        actualClosedCount = countConnectionsShed(mockCnxns);
+        assertEquals(4, actualClosedCount, "All 4 connections should be closed for 100% shedding");
+    }
+
+    @ParameterizedTest
+    @EnumSource(FactoryType.class)
+    public void testShedConnections_SmallPercentageRoundsToZero(final FactoryType factoryType) {
+        factory = createFactory(factoryType);
+
+        // Add single mock connection
+        final ServerCnxn mockCnxn = mock(ServerCnxn.class);
+        factory.cnxns.add(mockCnxn);
+
+        // small percentage rounds to 0
+        assertEquals(0, factory.shedConnections(1), "1% of 1 connection should round to 0");
+    }
+
+    @ParameterizedTest
+    @EnumSource(FactoryType.class)
+    public void testShedConnections_ErrorHandling(final FactoryType factoryType) {
+        factory = createFactory(factoryType);
+
+        // Create mock connections where one will fail to close
+        final ServerCnxn[] mockCnxns = new ServerCnxn[4];
+        for (int i = 0; i < 4; i++) {
+            mockCnxns[i] = mock(ServerCnxn.class);
+            factory.cnxns.add(mockCnxns[i]);
+        }
+
+        // Make the second connection throw an exception when closed
+        doThrow(new RuntimeException("Connection close failed"))
+                .when(mockCnxns[1]).close(ServerCnxn.DisconnectReason.SHED_CONNECTIONS_COMMAND);
+
+        // Test 100% shedding to ensure error handling works deterministically
+        final int shedCount = factory.shedConnections(100);
+
+        // Since one connection throws an exception, only 3 should be successfully closed
+        assertEquals(3, shedCount, "Should successfully close 3 connections, 1 should fail");
+        int actualClosedCount = countConnectionsShed(mockCnxns);
+        assertEquals(4, actualClosedCount, "All 4 connections should have close() called, even if one throws exception");
+    }
+
+    private ServerCnxnFactory createFactory(final FactoryType type) {
+        switch (type) {
+            case NIO:
+                return new NIOServerCnxnFactory();
+            case NETTY:
+                return new NettyServerCnxnFactory();
+            default:
+                throw new IllegalArgumentException("Unknown factory type: " + type);
+        }
+    }
+
+    private int countConnectionsShed(final ServerCnxn[] connections) {
+        return (int) Arrays.stream(connections)
+                .filter(cnxn -> mockingDetails(cnxn).getInvocations().stream()
+                        .anyMatch(invocation ->
+                                invocation.getMethod().getName().equals("close")
+                                        && invocation.getArguments().length == 1
+                                        && invocation.getArguments()[0].equals(ServerCnxn.DisconnectReason.SHED_CONNECTIONS_COMMAND)
+                        ))
+                .count();
+    }
+}
+
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerIdTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerIdTest.java
index 3f3f4964aa3..5505f58b61a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerIdTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerIdTest.java
@@ -18,80 +18,66 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.ArrayList;
 import java.util.List;
+import java.util.stream.Stream;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.TestableZooKeeper;
-import org.apache.zookeeper.ZKParameterized;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
 
-@RunWith(Parameterized.class)
-@Parameterized.UseParametersRunnerFactory(ZKParameterized.RunnerFactory.class)
 public class ServerIdTest extends ClientBase {
 
-    private final TestType testType;
-
-    private static class TestType {
-
-        final boolean ttlsEnabled;
-        final int serverId;
-
-        TestType(boolean ttlsEnabled, int serverId) {
-            this.ttlsEnabled = ttlsEnabled;
-            this.serverId = serverId;
-        }
-
-    }
-
-    @Parameterized.Parameters
-    public static List<TestType> data() {
-        List<TestType> testTypes = new ArrayList<>();
+    public static Stream<Arguments> data() throws Exception {
+        List<Arguments> testTypes = new ArrayList<>();
         for (boolean ttlsEnabled : new boolean[]{true, false}) {
             for (int serverId = 0; serverId <= 255; ++serverId) {
-                testTypes.add(new TestType(ttlsEnabled, serverId));
+                testTypes.add(Arguments.of(ttlsEnabled, serverId));
             }
         }
-        return testTypes;
+        return testTypes.stream();
     }
 
-    @After
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         super.tearDown();
         System.clearProperty("zookeeper.extendedTypesEnabled");
     }
 
-    public ServerIdTest(TestType testType) {
-        this.testType = testType;
-    }
-
-    @Before
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
-        System.setProperty("zookeeper.extendedTypesEnabled", Boolean.toString(testType.ttlsEnabled));
-        LOG.info("ttlsEnabled: {} - ServerId: {}", testType.ttlsEnabled, testType.serverId);
+        //since parameterized test methods need a parameterized setUp method
+        //the inherited method has to be overridden with an empty function body
+    }
+
+    public void setUp(boolean ttlsEnabled, int serverId) throws Exception {
+        System.setProperty("zookeeper.extendedTypesEnabled", Boolean.toString(ttlsEnabled));
+        LOG.info("ttlsEnabled: {} - ServerId: {}", ttlsEnabled, serverId);
         try {
-            super.setUpWithServerId(testType.serverId);
+            super.setUpWithServerId(serverId);
         } catch (RuntimeException e) {
-            if (testType.ttlsEnabled && (testType.serverId >= EphemeralType.MAX_EXTENDED_SERVER_ID)) {
+            if (ttlsEnabled && (serverId >= EphemeralType.MAX_EXTENDED_SERVER_ID)) {
                 return; // expected
             }
             throw e;
         }
     }
 
-    @Test
-    public void doTest() throws Exception {
-        if (testType.ttlsEnabled && (testType.serverId >= EphemeralType.MAX_EXTENDED_SERVER_ID)) {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void doTest(boolean ttlsEnabled, int serverId) throws Exception {
+        setUp(ttlsEnabled, serverId);
+        if (ttlsEnabled && (serverId >= EphemeralType.MAX_EXTENDED_SERVER_ID)) {
             return;
         }
 
@@ -102,7 +88,7 @@ public void doTest() throws Exception {
             zk.create("/foo", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
             zk.delete("/foo", -1);
 
-            if (testType.ttlsEnabled) {
+            if (ttlsEnabled) {
                 zk.create("/foo", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_WITH_TTL, new Stat(), 1000);  // should work
             } else {
                 try {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerMetricsOpCountTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerMetricsOpCountTest.java
new file mode 100644
index 00000000000..e12976ab9cb
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerMetricsOpCountTest.java
@@ -0,0 +1,218 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.ZooDefs.Ids;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.metrics.MetricsUtils;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.Test;
+
+public class ServerMetricsOpCountTest extends ClientBase {
+
+    // Metric name constants
+    private static final String OP_COUNT_TOTAL_METRIC_NAME = "op_count_total";
+    private static final String OP_COUNT_CREATE_METRIC_NAME = "op_count_create";
+    private static final String OP_COUNT_EXISTS_METRIC_NAME = "op_count_exists";
+    private static final String OP_COUNT_GET_DATA_METRIC_NAME = "op_count_get_data";
+    private static final String OP_COUNT_SET_DATA_METRIC_NAME = "op_count_set_data";
+    private static final String OP_COUNT_GET_ACL_METRIC_NAME = "op_count_get_acl";
+    private static final String OP_COUNT_SET_ACL_METRIC_NAME = "op_count_set_acl";
+    private static final String OP_COUNT_GET_CHILDREN_METRIC_NAME = "op_count_get_children";
+    private static final String OP_COUNT_GET_ALL_CHILDREN_NUMBER_METRIC_NAME = "op_count_get_all_children_number";
+    private static final String OP_COUNT_ADD_WATCH_METRIC_NAME = "op_count_add_watch";
+    private static final String OP_COUNT_DELETE_METRIC_NAME = "op_count_delete";
+    private static final String OP_COUNT_MULTI_METRIC_NAME = "op_count_multi";
+    private static final String OP_COUNT_MULTI_READ_METRIC_NAME = "op_count_multi_read";
+    private static final String OP_COUNT_GET_EPHEMERALS_METRIC_NAME = "op_count_get_ephemerals";
+    private static final String OP_COUNT_WHO_AM_I_METRIC_NAME = "op_count_who_am_i";
+    private static final String OP_COUNT_CREATE_SESSION_METRIC_NAME = "op_count_create_session";
+    private static final String OP_COUNT_CLOSE_SESSION_METRIC_NAME = "op_count_close_session";
+
+    @Test
+    public void testBasicOpCounts() throws Exception {
+        final Map<String, Object> initialMetrics = MetricsUtils.currentServerMetrics();
+        final long initialTotalCount = (Long) initialMetrics.getOrDefault(OP_COUNT_TOTAL_METRIC_NAME, 0L);
+
+        final Map<String, Long> initialCounts = new HashMap<>();
+        initialCounts.put(OP_COUNT_CREATE_METRIC_NAME, (Long) initialMetrics.getOrDefault(OP_COUNT_CREATE_METRIC_NAME, 0L));
+        initialCounts.put(OP_COUNT_EXISTS_METRIC_NAME, (Long) initialMetrics.getOrDefault(OP_COUNT_EXISTS_METRIC_NAME, 0L));
+        initialCounts.put(OP_COUNT_GET_DATA_METRIC_NAME, (Long) initialMetrics.getOrDefault(OP_COUNT_GET_DATA_METRIC_NAME, 0L));
+        initialCounts.put(OP_COUNT_SET_DATA_METRIC_NAME, (Long) initialMetrics.getOrDefault(OP_COUNT_SET_DATA_METRIC_NAME, 0L));
+        initialCounts.put(OP_COUNT_GET_ACL_METRIC_NAME, (Long) initialMetrics.getOrDefault(OP_COUNT_GET_ACL_METRIC_NAME, 0L));
+        initialCounts.put(OP_COUNT_SET_ACL_METRIC_NAME, (Long) initialMetrics.getOrDefault(OP_COUNT_SET_ACL_METRIC_NAME, 0L));
+        initialCounts.put(OP_COUNT_GET_CHILDREN_METRIC_NAME, (Long) initialMetrics.getOrDefault(OP_COUNT_GET_CHILDREN_METRIC_NAME, 0L));
+        initialCounts.put(OP_COUNT_GET_ALL_CHILDREN_NUMBER_METRIC_NAME, (Long) initialMetrics.getOrDefault(OP_COUNT_GET_ALL_CHILDREN_NUMBER_METRIC_NAME, 0L));
+        initialCounts.put(OP_COUNT_ADD_WATCH_METRIC_NAME, (Long) initialMetrics.getOrDefault(OP_COUNT_ADD_WATCH_METRIC_NAME, 0L));
+        initialCounts.put(OP_COUNT_DELETE_METRIC_NAME, (Long) initialMetrics.getOrDefault(OP_COUNT_DELETE_METRIC_NAME, 0L));
+
+        try (final ZooKeeper zk = createClient()) {
+            final String path = generateUniquePath("testBasicOps");
+
+            // Create node
+            zk.create(path, "test".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+            // Perform various operations
+            zk.exists(path, false);
+            zk.getData(path, false, null);
+            zk.setData(path, "updated".getBytes(), -1);
+            zk.getACL(path, null);
+
+            zk.setACL(path, Ids.READ_ACL_UNSAFE, -1);
+            zk.getChildren(path, false);
+
+            zk.getAllChildrenNumber(path);
+
+            zk.addWatch(path, event -> {}, org.apache.zookeeper.AddWatchMode.PERSISTENT);
+
+            // Delete node
+            zk.delete(path, -1);
+
+            // Verify all metrics increased
+            final Map<String, Object> finalMetrics = MetricsUtils.currentServerMetrics();
+            final long finalTotalCount = (Long) finalMetrics.getOrDefault(OP_COUNT_TOTAL_METRIC_NAME, 0L);
+
+            // Total count should have increased by at least 10 operations
+            assertTrue(finalTotalCount >= initialTotalCount + 10,
+                    "Total count should increase by at least 10 operations, initial: " + initialTotalCount
+                            + ", final: " + finalTotalCount);
+
+            // Verify each specific metric increased
+            for (final Map.Entry<String, Long> entry : initialCounts.entrySet()) {
+                final String metricName = entry.getKey();
+                final long initialCount = entry.getValue();
+                final long finalCount = (Long) finalMetrics.getOrDefault(metricName, 0L);
+
+                assertTrue(finalCount > initialCount,
+                        metricName + " should increase, initial: " + initialCount
+                                + ", final: " + finalCount);
+            }
+        }
+    }
+
+    @Test
+    public void testMultiOpCount() throws Exception {
+        testSingleOpCount(OP_COUNT_MULTI_METRIC_NAME, (zk, basePath) -> {
+            final String path1 = basePath + "_1";
+            final String path2 = basePath + "_2";
+            final List<org.apache.zookeeper.Op> ops = Arrays.asList(
+                    org.apache.zookeeper.Op.create(path1, "test".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
+                    org.apache.zookeeper.Op.create(path2, "test".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT)
+            );
+            zk.multi(ops);
+            zk.delete(path1, -1);
+            zk.delete(path2, -1);
+        });
+    }
+
+    @Test
+    public void testMultiReadOpCount() throws Exception {
+        testSingleOpCount(OP_COUNT_MULTI_READ_METRIC_NAME, (zk, basePath) -> {
+            final String path1 = basePath + "_1";
+            final String path2 = basePath + "_2";
+
+            // Create nodes first
+            zk.create(path1, "test1".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            zk.create(path2, "test2".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+            // Perform multi-read operation
+            final List<org.apache.zookeeper.Op> readOps = Arrays.asList(
+                    org.apache.zookeeper.Op.getData(path1),
+                    org.apache.zookeeper.Op.getData(path2)
+            );
+            zk.multi(readOps);
+
+            zk.delete(path1, -1);
+            zk.delete(path2, -1);
+        });
+    }
+
+    @Test
+    public void testGetEphemeralsOpCount() throws Exception {
+        testSingleOpCount(OP_COUNT_GET_EPHEMERALS_METRIC_NAME, (zk, path) -> {
+            zk.create(path, "test".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL);
+            zk.getEphemerals("/");
+        });
+    }
+
+    @Test
+    public void testWhoAmIOpCount() throws Exception {
+        testSingleOpCount(OP_COUNT_WHO_AM_I_METRIC_NAME, (zk, path) -> zk.whoAmI());
+    }
+
+    @Test
+    public void testSessionOperationCounts() throws Exception {
+        final Map<String, Object> initialMetrics = MetricsUtils.currentServerMetrics();
+        final long initialCreateCount = (Long) initialMetrics.getOrDefault(OP_COUNT_CREATE_SESSION_METRIC_NAME, 0L);
+        final long initialCloseCount = (Long) initialMetrics.getOrDefault(OP_COUNT_CLOSE_SESSION_METRIC_NAME, 0L);
+
+        // Create and close a new client to trigger session operations
+        final ZooKeeper zk = createClient();
+        zk.close();
+
+        final Map<String, Object> finalMetrics = MetricsUtils.currentServerMetrics();
+        final long finalCreateCount = (Long) finalMetrics.getOrDefault(OP_COUNT_CREATE_SESSION_METRIC_NAME, 0L);
+        final long finalCloseCount = (Long) finalMetrics.getOrDefault(OP_COUNT_CLOSE_SESSION_METRIC_NAME, 0L);
+
+        assertTrue(finalCreateCount > initialCreateCount, "Create session count should not decrease");
+        assertTrue(finalCloseCount > initialCloseCount, "Close session count should not decrease");
+    }
+
+    private void testSingleOpCount(final String metricName, final OperationExecutor executor) throws Exception {
+        final Map<String, Object> initialMetrics = MetricsUtils.currentServerMetrics();
+        final long initialOpCount = (Long) initialMetrics.getOrDefault(metricName, 0L);
+        final long initialTotalCount = (Long) initialMetrics.getOrDefault(OP_COUNT_TOTAL_METRIC_NAME, 0L);
+
+        try (final ZooKeeper zk = createClient()) {
+            final String path = generateUniquePath("test" + metricName.replace("_op_count", ""));
+
+            // Execute the operation
+            executor.execute(zk, path);
+
+            // Verify metrics increased
+            final Map<String, Object> finalMetrics = MetricsUtils.currentServerMetrics();
+            final long finalOpCount = (Long) finalMetrics.getOrDefault(metricName, 0L);
+            final long finalTotalCount = (Long) finalMetrics.getOrDefault(OP_COUNT_TOTAL_METRIC_NAME, 0L);
+
+            assertTrue(finalTotalCount > initialTotalCount,
+                    "Total count should increase after " + metricName + " operations"
+                            + " initial: " + initialTotalCount + ", final: " + finalTotalCount);
+
+            assertTrue(finalOpCount > initialOpCount,
+                    metricName + " should increase, initial: " + initialOpCount
+                            + ", final: " + finalOpCount);
+        }
+    }
+
+    @FunctionalInterface
+    private interface OperationExecutor {
+        void execute(ZooKeeper zk, String path) throws Exception;
+    }
+
+    private String generateUniquePath(final String baseName) {
+        return "/" + baseName + "_" + System.nanoTime();
+    }
+}
+
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerMetricsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerMetricsTest.java
index 29a9fd96b7b..72ee3c41967 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerMetricsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerMetricsTest.java
@@ -18,14 +18,14 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.util.Arrays;
 import java.util.Map;
 import java.util.concurrent.ThreadLocalRandom;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.server.metric.AvgMinMaxCounter;
 import org.apache.zookeeper.server.metric.SimpleCounter;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class ServerMetricsTest extends ZKTestCase {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerStatsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerStatsTest.java
index 05a35058e92..fcd55bf1260 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerStatsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ServerStatsTest.java
@@ -21,17 +21,17 @@
 
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.lessThanOrEqualTo;
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.mockito.Mockito.mock;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class ServerStatsTest extends ZKTestCase {
 
     private ServerStats.Provider providerMock;
 
-    @Before
+    @BeforeEach
     public void setUp() {
         providerMock = mock(ServerStats.Provider.class);
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/SessionTrackerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/SessionTrackerTest.java
index c0085507758..3b230407441 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/SessionTrackerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/SessionTrackerTest.java
@@ -18,12 +18,12 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.IOException;
 import java.util.concurrent.CountDownLatch;
@@ -33,7 +33,8 @@
 import org.apache.zookeeper.ZooDefs.OpCode;
 import org.apache.zookeeper.server.SessionTrackerImpl.SessionImpl;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 /**
  * Testing zk client session logic in sessiontracker
@@ -49,7 +50,8 @@ public class SessionTrackerTest extends ZKTestCase {
      * Verify the create session call in the Leader.FinalRequestProcessor after
      * the session expiration.
      */
-    @Test(timeout = 20000)
+    @Test
+    @Timeout(value = 20)
     public void testAddSessionAfterSessionExpiry() throws Exception {
         RequestThrottler.setMaxRequests(0);
         ZooKeeperServer zks = setupSessionTracker();
@@ -58,7 +60,7 @@ public void testAddSessionAfterSessionExpiry() throws Exception {
         zks.sessionTracker.trackSession(sessionId, sessionTimeout);
         SessionTrackerImpl sessionTrackerImpl = (SessionTrackerImpl) zks.sessionTracker;
         SessionImpl sessionImpl = sessionTrackerImpl.sessionsById.get(sessionId);
-        assertNotNull("Sessionid:" + sessionId + " doesn't exists in sessiontracker", sessionImpl);
+        assertNotNull(sessionImpl, "Sessionid:" + sessionId + " doesn't exists in sessiontracker");
 
         // verify the session existence
         Object sessionOwner = new Object();
@@ -77,16 +79,17 @@ public void testAddSessionAfterSessionExpiry() throws Exception {
         } catch (KeeperException.SessionExpiredException e) {
             // expected behaviour
         }
-        assertTrue("Session didn't expired", sessionImpl.isClosing());
-        assertFalse("Session didn't expired", sessionTrackerImpl.touchSession(sessionId, sessionTimeout));
-        assertEquals("Duplicate session expiry request has been generated", 1, firstProcessor.getCountOfCloseSessionReq());
+        assertTrue(sessionImpl.isClosing(), "Session didn't expired");
+        assertFalse(sessionTrackerImpl.touchSession(sessionId, sessionTimeout), "Session didn't expired");
+        assertEquals(1, firstProcessor.getCountOfCloseSessionReq(), "Duplicate session expiry request has been generated");
     }
 
     /**
      * Verify the session closure request has reached PrepRequestProcessor soon
      * after session expiration by the session tracker
      */
-    @Test(timeout = 20000)
+    @Test
+    @Timeout(value = 20)
     public void testCloseSessionRequestAfterSessionExpiry() throws Exception {
         ZooKeeperServer zks = setupSessionTracker();
 
@@ -94,7 +97,7 @@ public void testCloseSessionRequestAfterSessionExpiry() throws Exception {
         zks.sessionTracker.trackSession(sessionId, sessionTimeout);
         SessionTrackerImpl sessionTrackerImpl = (SessionTrackerImpl) zks.sessionTracker;
         SessionImpl sessionImpl = sessionTrackerImpl.sessionsById.get(sessionId);
-        assertNotNull("Sessionid:" + sessionId + " doesn't exists in sessiontracker", sessionImpl);
+        assertNotNull(sessionImpl, "Sessionid:" + sessionId + " doesn't exists in sessiontracker");
 
         // verify the session existence
         Object sessionOwner = new Object();
@@ -107,7 +110,7 @@ public void testCloseSessionRequestAfterSessionExpiry() throws Exception {
         // while OpCode.closeSession
         sessionTrackerImpl.removeSession(sessionId);
         SessionImpl actualSession = sessionTrackerImpl.sessionsById.get(sessionId);
-        assertNull("Session:" + sessionId + " still exists after removal", actualSession);
+        assertNull(actualSession, "Session:" + sessionId + " still exists after removal");
     }
 
     private ZooKeeperServer setupSessionTracker() throws IOException {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/SnapshotDigestTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/SnapshotDigestTest.java
index d40debfa7ad..fb73e1572de 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/SnapshotDigestTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/SnapshotDigestTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNull;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.concurrent.ConcurrentHashMap;
@@ -32,9 +32,9 @@
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.server.quorum.QuorumPeerMainTest;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.mockito.Mockito;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -46,14 +46,14 @@ public class SnapshotDigestTest extends ClientBase {
     private ZooKeeper zk;
     private ZooKeeperServer server;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         super.setUp();
         server = serverFactory.getZooKeeperServer();
         zk = createClient();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         // server will be closed in super.tearDown
         super.tearDown();
@@ -100,7 +100,7 @@ public void testSnapshotDigest() throws Exception {
         zk.delete(firstNode, -1);
 
         // trigger multi op
-        List<Op> subTxns = new ArrayList<Op>();
+        List<Op> subTxns = new ArrayList<>();
         for (int i = 0; i < 3; i++) {
             String path = pathPrefix + "-m" + i;
             subTxns.add(Op.create(path, path.getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT));
@@ -166,7 +166,7 @@ public void testBackwardCompatible() throws Exception {
     private void testCompatibleHelper(Boolean enabledBefore, Boolean enabledAfter) throws Exception {
 
         ZooKeeperServer.setDigestEnabled(enabledBefore);
-
+        ZooKeeperServer.setSerializeLastProcessedZxidEnabled(enabledBefore);
 
         // restart the server to cache the option change
         reloadSnapshotAndCheckDigest();
@@ -179,6 +179,7 @@ private void testCompatibleHelper(Boolean enabledBefore, Boolean enabledAfter) t
         server.takeSnapshot();
 
         ZooKeeperServer.setDigestEnabled(enabledAfter);
+        ZooKeeperServer.setSerializeLastProcessedZxidEnabled(enabledAfter);
 
         reloadSnapshotAndCheckDigest();
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ToStringTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ToStringTest.java
index e1349a3cd9d..25f3f564323 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ToStringTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ToStringTest.java
@@ -18,10 +18,14 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertNotSame;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertNotSame;
+import java.lang.reflect.Field;
 import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.proto.SetDataRequest;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 /**
  * A misc place to verify toString methods - mainly to make sure they don't
@@ -37,4 +41,18 @@ public void testJuteToString() {
         assertNotSame("ERROR", req.toString());
     }
 
+    @Test
+    public void testOpCodeToString() throws Exception {
+        Class<?> clazz = ZooDefs.OpCode.class;
+        Field[] fields = clazz.getFields();
+
+        assertNotEquals(0, fields.length);
+
+        for (Field field : fields) {
+            int opCode = field.getInt(null);
+            String opString = Request.op2String(opCode);
+            assertEquals(field.getName(), opString);
+        }
+    }
+
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/TxnLogCountTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/TxnLogCountTest.java
new file mode 100644
index 00000000000..afcb09bdbcf
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/TxnLogCountTest.java
@@ -0,0 +1,74 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.doAnswer;
+import static org.mockito.Mockito.mock;
+import java.io.File;
+import java.io.IOException;
+import org.apache.jute.OutputArchive;
+import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
+import org.apache.zookeeper.test.ClientBase;
+import org.apache.zookeeper.txn.TxnHeader;
+import org.junit.Test;
+import org.mockito.invocation.InvocationOnMock;
+import org.mockito.stubbing.Answer;
+
+public class TxnLogCountTest {
+
+    /**
+     * Test ZkDatabase's txnCount
+     */
+    @Test
+    public void testTxnLogCount() throws IOException {
+        File tmpDir = ClientBase.createTmpDir();
+        FileTxnSnapLog snapLog = new FileTxnSnapLog(tmpDir, tmpDir);
+        ZKDatabase zkDatabase = new ZKDatabase(snapLog);
+        int txnRequestCnt = 10;
+        int nonTxnRequestCnt = 10;
+        for (int i = 0; i < txnRequestCnt && zkDatabase.append(mockTxnRequest()); i++) {}
+        assertEquals(txnRequestCnt, zkDatabase.getTxnCount());
+
+        for (int i = 0; i < nonTxnRequestCnt && !zkDatabase.append(mockNonTxnRequest()); i++) {}
+        assertEquals(txnRequestCnt, zkDatabase.getTxnCount());
+    }
+
+    private Request mockTxnRequest() throws IOException {
+        TxnHeader header = mock(TxnHeader.class);
+        doAnswer(new Answer() {
+            @Override
+            public Object answer(InvocationOnMock invocation) throws Throwable {
+                Object[] args = invocation.getArguments();
+                OutputArchive oa = (OutputArchive) args[0];
+                oa.writeString("header", "test");
+                return null;
+            }
+        }).when(header).serialize(any(OutputArchive.class), anyString());
+        Request request = new Request(1, 2, 3, header, null, 4);
+        return request;
+    }
+
+    private Request mockNonTxnRequest() {
+        Request request = new Request(0, 0, 0, null, null, 0);
+        return request;
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/TxnLogDigestTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/TxnLogDigestTest.java
index ae914af5b5d..b52ea34182a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/TxnLogDigestTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/TxnLogDigestTest.java
@@ -18,8 +18,10 @@
 
 package org.apache.zookeeper.server;
 
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.greaterThan;
-import static org.junit.Assert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
 import java.io.File;
 import java.io.IOException;
 import java.util.ArrayList;
@@ -29,7 +31,6 @@
 import mockit.Invocation;
 import mockit.Mock;
 import mockit.MockUp;
-import org.apache.jute.Record;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.Op;
 import org.apache.zookeeper.ZooDefs;
@@ -42,11 +43,10 @@
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.txn.TxnDigest;
 import org.apache.zookeeper.txn.TxnHeader;
-import org.junit.After;
-import org.junit.Assert;
-import org.junit.Before;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -58,15 +58,17 @@ public class TxnLogDigestTest extends ClientBase {
     private ZooKeeper zk;
     private ZooKeeperServer server;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
+        System.setProperty("zookeeper.test.allowDiscontinuousProposals", "true");
         super.setUp();
         server = serverFactory.getZooKeeperServer();
         zk = createClient();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
+        System.clearProperty("zookeeper.test.allowDiscontinuousProposals");
         // server will be closed in super.tearDown
         super.tearDown();
 
@@ -79,14 +81,16 @@ public void tearDown() throws Exception {
     @Override
     public void setupCustomizedEnv() {
         ZooKeeperServer.setDigestEnabled(true);
+        ZooKeeperServer.setSerializeLastProcessedZxidEnabled(true);
     }
 
     @Override
     public void cleanUpCustomizedEnv() {
         ZooKeeperServer.setDigestEnabled(false);
+        ZooKeeperServer.setSerializeLastProcessedZxidEnabled(false);
     }
 
-    @BeforeClass
+    @BeforeAll
     public static void applyMockUps() {
         new MockedFileTxnLog();
     }
@@ -105,12 +109,12 @@ public void digestFromTxnLogsMatchesTree() throws Exception {
         performOperations(createClient(), "/digestFromTxnLogsMatchesTree");
 
         // make sure there is no digest mismatch
-        Assert.assertEquals(0, digestMistachesCount.get());
+        assertEquals(0, digestMistachesCount.get());
 
         // verify that the digest is wrote to disk with txn
         TxnDigest lastDigest = getLastTxnLogDigest();
-        Assert.assertNotNull(lastDigest);
-        Assert.assertEquals(server.getZKDatabase().getDataTree().getTreeDigest(),
+        assertNotNull(lastDigest);
+        assertEquals(server.getZKDatabase().getDataTree().getTreeDigest(),
                 lastDigest.getTreeDigest());
     }
 
@@ -144,7 +148,7 @@ public void checkTxnCompatibleWithAndWithoutDigest() throws Exception {
         Map<String, String> expectedNodes1 = performOperations(createClient(), "/p2");
 
         // make sure there is no digest mismatch
-        Assert.assertEquals(0, digestMistachesCount.get());
+        assertEquals(0, digestMistachesCount.get());
 
         // 3. disable the digest again and make sure everything is fine
         restartServerWithDigestFlag(false);
@@ -179,7 +183,7 @@ public void testTxnMissing() throws Exception {
         restartServerWithDigestFlag(false);
 
         // check that no digest mismatch is reported
-        Assert.assertEquals(0, digestMistachesCount.get());
+        assertEquals(0, digestMistachesCount.get());
     }
 
     private void restartServerWithDigestFlag(boolean digestEnabled)
@@ -188,6 +192,7 @@ private void restartServerWithDigestFlag(boolean digestEnabled)
         QuorumPeerMainTest.waitForOne(zk, States.CONNECTING);
 
         ZooKeeperServer.setDigestEnabled(digestEnabled);
+        ZooKeeperServer.setSerializeLastProcessedZxidEnabled(digestEnabled);
 
         startServer();
         QuorumPeerMainTest.waitForOne(zk, States.CONNECTED);
@@ -232,7 +237,7 @@ public static Map<String, String> performOperations(
         client.setData(path, updatedData.getBytes(), -1);
         nodes.put(path, updatedData);
 
-        List<Op> subTxns = new ArrayList<Op>();
+        List<Op> subTxns = new ArrayList<>();
         for (int i = 0; i < 3; i++) {
             path = prefix + "/m" + i;
             subTxns.add(Op.create(path, path.getBytes(),
@@ -249,7 +254,7 @@ private void checkNodes(Map<String, String> expectedNodes) throws Exception {
         ZooKeeper client = createClient();
         try {
             for (Map.Entry<String, String> entry: expectedNodes.entrySet()) {
-                Assert.assertEquals(entry.getValue(),
+                assertEquals(entry.getValue(),
                         new String(client.getData(entry.getKey(), false, null)));
             }
         } finally {
@@ -261,13 +266,13 @@ public static final class MockedFileTxnLog extends MockUp<FileTxnLog> {
         static long skipAppendZxid = -1;
 
         @Mock
-        public synchronized boolean append(Invocation invocation, TxnHeader hdr,
-                Record txn, TxnDigest digest) throws IOException {
+        public synchronized boolean append(Invocation invocation, Request request) throws IOException {
+            TxnHeader hdr = request.getHdr();
             if (hdr != null && hdr.getZxid() == skipAppendZxid) {
                 LOG.info("skipping txn {}", skipAppendZxid);
                 return true;
             }
-            return invocation.proceed(hdr, txn, digest);
+            return invocation.proceed(request);
         }
 
         public static void reset() {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/X509AuthFailureTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/X509AuthFailureTest.java
new file mode 100644
index 00000000000..5af4f1095dc
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/X509AuthFailureTest.java
@@ -0,0 +1,99 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p/>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p/>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.server;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.common.ClientX509Util;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class X509AuthFailureTest extends ZKTestCase {
+    protected static final Logger LOG = LoggerFactory.getLogger(X509AuthFailureTest.class);
+
+    private static ClientX509Util clientX509Util;
+    public static final int TIMEOUT = 5000;
+    public static int CONNECTION_TIMEOUT = 30000;
+
+    @BeforeEach
+    public void setup() throws Exception{
+        clientX509Util = new ClientX509Util();
+        String testDataPath = System.getProperty("test.data.dir", "src/test/resources/data");
+        System.setProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY, "org.apache.zookeeper.server.NettyServerCnxnFactory");
+        System.setProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET, "org.apache.zookeeper.ClientCnxnSocketNetty");
+        System.setProperty(ZKClientConfig.SECURE_CLIENT, "true");
+        System.setProperty(clientX509Util.getSslKeystoreLocationProperty(), testDataPath + "/ssl/testKeyStore.jks");
+        System.setProperty(clientX509Util.getSslKeystorePasswdProperty(), "testpass");
+        System.setProperty("zookeeper.admin.serverPort", "" + PortAssignment.unique());
+    }
+
+    @AfterEach
+    public void teardown() throws Exception {
+        System.clearProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY);
+        System.clearProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET);
+        System.clearProperty(ZKClientConfig.SECURE_CLIENT);
+        System.clearProperty(clientX509Util.getSslKeystoreLocationProperty());
+        System.clearProperty(clientX509Util.getSslKeystorePasswdProperty());
+        System.clearProperty(clientX509Util.getSslTruststoreLocationProperty());
+        System.clearProperty(clientX509Util.getSslTruststorePasswdProperty());
+        System.clearProperty("zookeeper.admin.serverPort");
+        clientX509Util.close();
+    }
+
+    /**
+     * Developers might use standalone mode (which is the default for one server).
+     * This test checks metrics for authz failure in standalone server
+     */
+    @Test
+    public void testSecureStandaloneServerAuthNFailure() throws Exception {
+        final Integer CLIENT_PORT = PortAssignment.unique();
+        final Integer SECURE_CLIENT_PORT = PortAssignment.unique();
+
+        ZooKeeperServerMainTest.MainThread mt = new ZooKeeperServerMainTest.MainThread(CLIENT_PORT, SECURE_CLIENT_PORT, true, null);
+        mt.start();
+        assertTrue(
+            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT));
+
+        try {
+            ZooKeeper zk = createZKClnt("127.0.0.1:" + SECURE_CLIENT_PORT);
+            fail("should not be reached");
+        } catch (Exception e){
+            //Expected
+        }
+        ServerStats serverStats = mt.getSecureCnxnFactory().getZooKeeperServer().serverStats();
+        assertTrue(serverStats.getAuthFailedCount() >= 1);
+        mt.shutdown();
+
+    }
+
+    private ZooKeeper createZKClnt(String cxnString) throws Exception {
+        ClientBase.CountdownWatcher watcher = new ClientBase.CountdownWatcher();
+        ZooKeeper zk = new ZooKeeper(cxnString, TIMEOUT, watcher);
+        watcher.waitForConnected(CONNECTION_TIMEOUT);
+        return zk;
+    }
+
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperCriticalThreadMetricsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperCriticalThreadMetricsTest.java
index 243e1778206..681e8348b07 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperCriticalThreadMetricsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperCriticalThreadMetricsTest.java
@@ -18,14 +18,13 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
-import java.nio.ByteBuffer;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.util.Map;
 import java.util.concurrent.CountDownLatch;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.metrics.MetricsUtils;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class ZooKeeperCriticalThreadMetricsTest extends ZKTestCase {
 
@@ -67,7 +66,7 @@ public void testUnrecoverableErrorCountFromRequestProcessor() throws Exception {
         PrepRequestProcessor processor = new MyPrepRequestProcessor();
         processor.start();
 
-        processor.processRequest(new Request(null, 1L, 1, ZooDefs.OpCode.setData, ByteBuffer.wrap(new byte[10]), null));
+        processor.processRequest(new Request(null, 1L, 1, ZooDefs.OpCode.setData, RequestRecord.fromBytes(new byte[10]), null));
         processed.await();
 
         processor.shutdown();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerBeanTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerBeanTest.java
index a8db9e286b7..769111bce41 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerBeanTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerBeanTest.java
@@ -18,38 +18,37 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.IOException;
 import java.net.InetSocketAddress;
 import org.apache.jute.Record;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
-import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.txn.SetDataTxn;
 import org.apache.zookeeper.txn.TxnHeader;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 
 public class ZooKeeperServerBeanTest {
 
-    @Before
+    @BeforeEach
     public void setup() {
         System.setProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY, "org.apache.zookeeper.server.NettyServerCnxnFactory");
     }
 
-    @After
+    @AfterEach
     public void teardown() throws Exception {
         System.clearProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY);
     }
 
     @Test
-    public void testTxnLogElapsedSyncTime() throws IOException {
+    public void testTxnLogElapsedSyncTime(@TempDir File tmpDir) throws IOException {
 
-        File tmpDir = ClientBase.createEmptyTestDir();
         FileTxnSnapLog fileTxnSnapLog = new FileTxnSnapLog(new File(tmpDir, "data"), new File(tmpDir, "data_txnlog"));
 
         ZooKeeperServer zks = new ZooKeeperServer();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerConfTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerConfTest.java
index 2f1c9e3bc00..b11f127840d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerConfTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerConfTest.java
@@ -17,16 +17,16 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.util.Map;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class ZooKeeperServerConfTest extends ZKTestCase {
 
     private ZooKeeperServerConf c;
-    @Before
+    @BeforeEach
     public void setUp() {
         c = new ZooKeeperServerConf(1, "a", "b", 2, 3, 4, 5, 6L, 7);
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerCreationTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerCreationTest.java
index 670feaa4832..6dd27d49438 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerCreationTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerCreationTest.java
@@ -18,14 +18,11 @@
 
 package org.apache.zookeeper.server;
 
-import java.io.ByteArrayOutputStream;
 import java.io.File;
-import java.nio.ByteBuffer;
-import org.apache.jute.BinaryOutputArchive;
 import org.apache.zookeeper.proto.ConnectRequest;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
-import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 
 public class ZooKeeperServerCreationTest {
 
@@ -34,8 +31,7 @@ public class ZooKeeperServerCreationTest {
      * that all needed fields are initialized properly, etc.
      */
     @Test
-    public void testDefaultConstructor() throws Exception {
-        File tmpDir = ClientBase.createEmptyTestDir();
+    public void testDefaultConstructor(@TempDir File tmpDir) throws Exception {
         FileTxnSnapLog fileTxnSnapLog = new FileTxnSnapLog(new File(tmpDir, "data"), new File(tmpDir, "data_txnlog"));
 
         ZooKeeperServer zks = new ZooKeeperServer() {
@@ -48,14 +44,10 @@ public void submitRequest(Request si) {
         zks.setZKDatabase(new ZKDatabase(fileTxnSnapLog));
         zks.createSessionTracker();
 
-        ServerCnxnFactory cnxnFactory = ServerCnxnFactory.createFactory();
         ServerCnxn cnxn = new MockServerCnxn();
 
         ConnectRequest connReq = new ConnectRequest();
-        ByteArrayOutputStream baos = new ByteArrayOutputStream();
-        BinaryOutputArchive boa = BinaryOutputArchive.getArchive(baos);
-        connReq.serialize(boa, "connect");
-        zks.processConnectRequest(cnxn, ByteBuffer.wrap(baos.toByteArray()));
+        zks.processConnectRequest(cnxn, connReq);
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMainTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMainTest.java
index b7df9323f87..e32c43b5cf9 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMainTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMainTest.java
@@ -19,11 +19,11 @@
 package org.apache.zookeeper.server;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.FileWriter;
 import java.io.IOException;
@@ -38,6 +38,7 @@
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.common.PathUtils;
 import org.apache.zookeeper.metrics.BaseTestMetricsProvider;
 import org.apache.zookeeper.metrics.BaseTestMetricsProvider.MetricsProviderCapturingLifecycle;
@@ -46,9 +47,9 @@
 import org.apache.zookeeper.metrics.BaseTestMetricsProvider.MetricsProviderWithErrorInStart;
 import org.apache.zookeeper.metrics.BaseTestMetricsProvider.MetricsProviderWithErrorInStop;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -71,10 +72,16 @@ public static class MainThread extends Thread {
         final File logDir;
 
         public MainThread(int clientPort, boolean preCreateDirs, String configs) throws IOException {
-            this(clientPort, preCreateDirs, ClientBase.createTmpDir(), configs);
+            this(clientPort, null, preCreateDirs, ClientBase.createTmpDir(), configs);
         }
 
-        public MainThread(int clientPort, boolean preCreateDirs, File tmpDir, String configs) throws IOException {
+        public MainThread(int clientPort, Integer secureClientPort, boolean preCreateDirs, String configs)
+                throws  IOException {
+            this(clientPort, secureClientPort,
+                    preCreateDirs, ClientBase.createTmpDir(), configs);
+        }
+
+        public MainThread(int clientPort, Integer secureClientPort, boolean preCreateDirs, File tmpDir, String configs) throws IOException {
             super("Standalone server with clientPort:" + clientPort);
             this.tmpDir = tmpDir;
             confFile = new File(tmpDir, "zoo.cfg");
@@ -104,6 +111,10 @@ public MainThread(int clientPort, boolean preCreateDirs, File tmpDir, String con
             fwriter.write("dataDir=" + normalizedDataDir + "\n");
             fwriter.write("dataLogDir=" + normalizedLogDir + "\n");
             fwriter.write("clientPort=" + clientPort + "\n");
+
+            if (secureClientPort != null) {
+                fwriter.write("secureClientPort=" + secureClientPort + "\n");
+            }
             fwriter.flush();
             fwriter.close();
 
@@ -147,6 +158,10 @@ ServerCnxnFactory getCnxnFactory() {
             return main.getCnxnFactory();
         }
 
+        public ServerCnxnFactory getSecureCnxnFactory(){
+            return main.getSecureCnxnFactory();
+        }
+
     }
 
     public static class TestZKSMain extends ZooKeeperServerMain {
@@ -162,7 +177,8 @@ public void shutdown() {
      * Test to verify that even after non recoverable error (error while
      * writing transaction log), ZooKeeper is still available.
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testNonRecoverableError() throws Exception {
         ClientBase.setupTestEnv();
 
@@ -171,9 +187,8 @@ public void testNonRecoverableError() throws Exception {
         MainThread main = new MainThread(CLIENT_PORT, true, null);
         main.start();
 
-        assertTrue(
-                "waiting for server being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT),
+                "waiting for server being up");
 
         ZooKeeper zk = new ZooKeeper("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT, this);
 
@@ -183,7 +198,7 @@ public void testNonRecoverableError() throws Exception {
         // inject problem in server
         ZooKeeperServer zooKeeperServer = main.getCnxnFactory().getZooKeeperServer();
         FileTxnSnapLog snapLog = zooKeeperServer.getTxnLogFactory();
-        FileTxnSnapLog fileTxnSnapLogWithError = new FileTxnSnapLog(snapLog.getDataDir(), snapLog.getSnapDir()) {
+        FileTxnSnapLog fileTxnSnapLogWithError = new FileTxnSnapLog(snapLog.getDataLogDir(), snapLog.getSnapDir()) {
             @Override
             public void commit() throws IOException {
                 throw new IOException("Input/output error");
@@ -195,14 +210,13 @@ public void commit() throws IOException {
         try {
             // do create operation, so that injected IOException is thrown
             zk.create("/foo2", "foobar".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-            fail("IOException is expected as error is injected in transaction log commit funtionality");
+            fail("IOException is expected as error is injected in transaction log commit functionality");
         } catch (Exception e) {
             // do nothing
         }
         zk.close();
-        assertTrue(
-                "waiting for server down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server down");
         fileTxnSnapLogWithError.close();
         main.shutdown();
         main.deleteDirs();
@@ -214,7 +228,8 @@ public void commit() throws IOException {
      *
      * This test will fail if it is executed as root user.
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testReadOnlySnapshotDir() throws Exception {
         ClientBase.setupTestEnv();
         final int CLIENT_PORT = PortAssignment.unique();
@@ -224,9 +239,8 @@ public void testReadOnlySnapshotDir() throws Exception {
         MainThread main = new MainThread(CLIENT_PORT, true, null);
         File tmpDir = main.tmpDir;
         main.start();
-        assertTrue(
-                "waiting for server being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT / 2));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT / 2),
+                "waiting for server being up");
         main.shutdown();
 
         // Make the snapshot directory read only
@@ -234,12 +248,11 @@ public void testReadOnlySnapshotDir() throws Exception {
         snapDir.setWritable(false);
 
         // Restart ZK and observe a failure
-        main = new MainThread(CLIENT_PORT, false, tmpDir, null);
+        main = new MainThread(CLIENT_PORT, null, false, tmpDir, null);
         main.start();
 
-        assertFalse(
-                "waiting for server being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT / 2));
+        assertFalse(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT / 2),
+                "waiting for server being up");
 
         main.shutdown();
 
@@ -254,7 +267,8 @@ public void testReadOnlySnapshotDir() throws Exception {
      *
      * This test will fail if it is executed as root user.
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testReadOnlyTxnLogDir() throws Exception {
         ClientBase.setupTestEnv();
         final int CLIENT_PORT = PortAssignment.unique();
@@ -264,9 +278,8 @@ public void testReadOnlyTxnLogDir() throws Exception {
         MainThread main = new MainThread(CLIENT_PORT, true, null);
         File tmpDir = main.tmpDir;
         main.start();
-        assertTrue(
-                "waiting for server being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT / 2));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT / 2),
+                "waiting for server being up");
         main.shutdown();
 
         // Make the transaction log directory read only
@@ -274,12 +287,11 @@ public void testReadOnlyTxnLogDir() throws Exception {
         logDir.setWritable(false);
 
         // Restart ZK and observe a failure
-        main = new MainThread(CLIENT_PORT, false, tmpDir, null);
+        main = new MainThread(CLIENT_PORT, null, false, tmpDir, null);
         main.start();
 
-        assertFalse(
-                "waiting for server being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT / 2));
+        assertFalse(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT / 2),
+                "waiting for server being up");
 
         main.shutdown();
 
@@ -300,13 +312,12 @@ public void testStandalone() throws Exception {
         MainThread main = new MainThread(CLIENT_PORT, true, null);
         main.start();
 
-        assertTrue(
-                "waiting for server being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT),
+                "waiting for server being up");
 
         clientConnected = new CountDownLatch(1);
         ZooKeeper zk = new ZooKeeper("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT, this);
-        assertTrue("Failed to establish zkclient connection!", clientConnected.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS));
+        assertTrue(clientConnected.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS), "Failed to establish zkclient connection!");
 
         zk.create("/foo", "foobar".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         assertEquals(new String(zk.getData("/foo", null, null)), "foobar");
@@ -316,9 +327,8 @@ public void testStandalone() throws Exception {
         main.join();
         main.deleteDirs();
 
-        assertTrue(
-                "waiting for server down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server down");
     }
 
     /**
@@ -425,13 +435,12 @@ public void testFaultyMetricsProviderOnStop() throws Exception {
         MainThread main = new MainThread(CLIENT_PORT, true, configs);
         main.start();
 
-        assertTrue(
-                "waiting for server being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT),
+                "waiting for server being up");
 
         clientConnected = new CountDownLatch(1);
         ZooKeeper zk = new ZooKeeper("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT, this);
-        assertTrue("Failed to establish zkclient connection!", clientConnected.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS));
+        assertTrue(clientConnected.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS), "Failed to establish zkclient connection!");
 
         zk.create("/foo", "foobar".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         assertEquals(new String(zk.getData("/foo", null, null)), "foobar");
@@ -441,9 +450,8 @@ public void testFaultyMetricsProviderOnStop() throws Exception {
         main.join();
         main.deleteDirs();
 
-        assertTrue(
-                "waiting for server down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server down");
         assertTrue(MetricsProviderWithErrorInStop.stopCalled.get());
     }
 
@@ -463,13 +471,12 @@ public void testMetricsProviderConfiguration() throws Exception {
         MainThread main = new MainThread(CLIENT_PORT, true, configs);
         main.start();
 
-        assertTrue(
-                "waiting for server being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT),
+                "waiting for server being up");
 
         clientConnected = new CountDownLatch(1);
         ZooKeeper zk = new ZooKeeper("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT, this);
-        assertTrue("Failed to establish zkclient connection!", clientConnected.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS));
+        assertTrue(clientConnected.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS), "Failed to establish zkclient connection!");
 
         zk.create("/foo", "foobar".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         assertEquals(new String(zk.getData("/foo", null, null)), "foobar");
@@ -479,9 +486,8 @@ public void testMetricsProviderConfiguration() throws Exception {
         main.join();
         main.deleteDirs();
 
-        assertTrue(
-                "waiting for server down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server down");
         assertEquals(1234, MetricsProviderWithConfiguration.httpPort.get());
     }
 
@@ -501,13 +507,12 @@ public void testMetricsProviderLifecycle() throws Exception {
         MainThread main = new MainThread(CLIENT_PORT, true, configs);
         main.start();
 
-        assertTrue(
-                "waiting for server being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT),
+                "waiting for server being up");
 
         clientConnected = new CountDownLatch(1);
         ZooKeeper zk = new ZooKeeper("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT, this);
-        assertTrue("Failed to establish zkclient connection!", clientConnected.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS));
+        assertTrue(clientConnected.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS), "Failed to establish zkclient connection!");
 
         zk.create("/foo", "foobar".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         assertEquals(new String(zk.getData("/foo", null, null)), "foobar");
@@ -517,11 +522,11 @@ public void testMetricsProviderLifecycle() throws Exception {
         main.join();
         main.deleteDirs();
 
-        assertTrue("waiting for server down", ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT));
-        assertTrue("metrics provider lifecycle error", BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.configureCalled.get());
-        assertTrue("metrics provider lifecycle error", BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.startCalled.get());
-        assertTrue("metrics provider lifecycle error", BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.getRootContextCalled.get());
-        assertTrue("metrics provider lifecycle error", BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.stopCalled.get());
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT), "waiting for server down");
+        assertTrue(BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.configureCalled.get(), "metrics provider lifecycle error");
+        assertTrue(BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.startCalled.get(), "metrics provider lifecycle error");
+        assertTrue(BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.getRootContextCalled.get(), "metrics provider lifecycle error");
+        assertTrue(BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.stopCalled.get(), "metrics provider lifecycle error");
     }
 
     /**
@@ -541,7 +546,7 @@ public void testWithOnlyMinSessionTimeout() throws Exception {
         main.start();
 
         String HOSTPORT = "127.0.0.1:" + CLIENT_PORT;
-        assertTrue("waiting for server being up", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up");
         // create session with min value
         verifySessionTimeOut(minSessionTimeout, minSessionTimeout, HOSTPORT);
         verifySessionTimeOut(minSessionTimeout - 2000, minSessionTimeout, HOSTPORT);
@@ -549,7 +554,7 @@ public void testWithOnlyMinSessionTimeout() throws Exception {
         verifySessionTimeOut(maxSessionTimeout, maxSessionTimeout, HOSTPORT);
         verifySessionTimeOut(maxSessionTimeout + 2000, maxSessionTimeout, HOSTPORT);
         main.shutdown();
-        assertTrue("waiting for server down", ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT), "waiting for server down");
     }
 
     /**
@@ -574,7 +579,7 @@ public void testMinMaxSessionTimeOut() throws Exception {
         main.start();
 
         String HOSTPORT = "127.0.0.1:" + CLIENT_PORT;
-        assertTrue("waiting for server being up", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up");
         // create session with min value
         verifySessionTimeOut(minSessionTimeout, minSessionTimeout, HOSTPORT);
         verifySessionTimeOut(minSessionTimeout - 2000, minSessionTimeout, HOSTPORT);
@@ -583,14 +588,14 @@ public void testMinMaxSessionTimeOut() throws Exception {
         verifySessionTimeOut(maxSessionTimeout + 2000, maxSessionTimeout, HOSTPORT);
         main.shutdown();
 
-        assertTrue("waiting for server down", ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT), "waiting for server down");
     }
 
     private void verifySessionTimeOut(int sessionTimeout, int expectedSessionTimeout, String HOSTPORT) throws IOException, KeeperException, InterruptedException {
         clientConnected = new CountDownLatch(1);
         ZooKeeper zk = new ZooKeeper(HOSTPORT, sessionTimeout, this);
-        assertTrue("Failed to establish zkclient connection!", clientConnected.await(sessionTimeout, TimeUnit.MILLISECONDS));
-        assertEquals("Not able to configure the sessionTimeout values", expectedSessionTimeout, zk.getSessionTimeout());
+        assertTrue(clientConnected.await(sessionTimeout, TimeUnit.MILLISECONDS), "Failed to establish zkclient connection!");
+        assertEquals(expectedSessionTimeout, zk.getSessionTimeout(), "Not able to configure the sessionTimeout values");
         zk.close();
     }
 
@@ -655,10 +660,9 @@ private ServerCnxnFactory startServer(File tmpDir) throws IOException, Interrupt
         ZooKeeperServer zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
         ServerCnxnFactory f = ServerCnxnFactory.createFactory(CLIENT_PORT, -1);
         f.startup(zks);
-        assertNotNull("JMX initialization failed!", zks.jmxServerBean);
-        assertTrue(
-                "waiting for server being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT));
+        assertNotNull(zks.jmxServerBean, "JMX initialization failed!");
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, CONNECTION_TIMEOUT),
+                "waiting for server being up");
         return f;
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMaxCnxnsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMaxCnxnsTest.java
index 48f5b998387..35fe62bdc30 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMaxCnxnsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerMaxCnxnsTest.java
@@ -17,8 +17,9 @@
  */
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeoutException;
 import org.apache.zookeeper.CreateMode;
@@ -30,9 +31,9 @@
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.After;
-import org.junit.Assert;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -50,13 +51,15 @@ public class ZooKeeperServerMaxCnxnsTest extends QuorumPeerTestBase {
      * </pre>
      */
 
-    @Test(timeout = 120000)
+    @Test
+    @Timeout(value = 120)
     public void testMaxZooKeeperClientsWithNIOServerCnxnFactory() throws Exception {
         String serverCnxnFactory = "org.apache.zookeeper.server.NIOServerCnxnFactory";
         testMaxZooKeeperClients(serverCnxnFactory);
     }
 
-    @Test(timeout = 120000)
+    @Test
+    @Timeout(value = 120)
     public void testMaxZooKeeperClientsWithNettyServerCnxnFactory() throws Exception {
         String serverCnxnFactory = "org.apache.zookeeper.server.NettyServerCnxnFactory";
         testMaxZooKeeperClients(serverCnxnFactory);
@@ -64,7 +67,7 @@ public void testMaxZooKeeperClientsWithNettyServerCnxnFactory() throws Exception
 
     private void testMaxZooKeeperClients(String serverCnxnFactory) throws Exception {
         final int clientPorts[] = new int[SERVER_COUNT];
-        int maxCnxns = 2;
+        final int maxCnxns = 2;
         StringBuilder sb = new StringBuilder();
         sb.append("maxCnxns=" + maxCnxns + "\n");
         sb.append("serverCnxnFactory=" + serverCnxnFactory + "\n");
@@ -87,8 +90,8 @@ private void testMaxZooKeeperClients(String serverCnxnFactory) throws Exception
 
         // ensure all servers started
         for (int i = 0; i < SERVER_COUNT; i++) {
-            Assert.assertTrue("waiting for server " + i + " being up", ClientBase
-                    .waitForServerUp("127.0.0.1:" + clientPorts[i], ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], ClientBase.CONNECTION_TIMEOUT),
+                    "waiting for server " + i + " being up");
         }
 
         int maxAllowedConnection = maxCnxns * SERVER_COUNT;
@@ -105,9 +108,13 @@ public void process(WatchedEvent event) {
                 }
             }
         };
-        for (int i = 0; i < maxAllowedConnection; i++) {
-            clients[i] = new ZooKeeper(cxnString, ClientBase.CONNECTION_TIMEOUT, watcher);
-            Thread.sleep(100);
+        // There are could be concurrent races to make maxCnxns restriction not accurate.
+        // So we connect to each server with maxCnxns connections to overcome this.
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            String addr = "127.0.0.1:" + clientPorts[i];
+            for (int j = 0; j < maxCnxns; j++) {
+                clients[i * maxCnxns + j] = new ZooKeeper(addr, ClientBase.CONNECTION_TIMEOUT, watcher);
+            }
         }
         countDownLatch.await();
         // reaching this point indicates that all maxAllowedConnection connected
@@ -151,7 +158,7 @@ private String getCxnString(int[] clientPorts) {
         return builder.toString();
     }
 
-    @After
+    @AfterEach
     public void tearDown() {
         // stop all clients
         if (clients != null) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerShutdownTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerShutdownTest.java
new file mode 100644
index 00000000000..b0dd19cb77c
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerShutdownTest.java
@@ -0,0 +1,85 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.io.File;
+import java.io.IOException;
+import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
+import org.apache.zookeeper.server.quorum.Learner;
+import org.apache.zookeeper.server.quorum.LearnerZooKeeperServer;
+import org.apache.zookeeper.server.quorum.QuorumPeer;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+public class ZooKeeperServerShutdownTest extends ZKTestCase  {
+
+    static class ShutdownTrackRequestProcessor implements RequestProcessor {
+        boolean shutdown = false;
+
+        @Override
+        public void processRequest(Request request) throws RequestProcessorException {
+        }
+
+        @Override
+        public void shutdown() {
+            shutdown = true;
+        }
+    }
+
+    public static class ShutdownTrackLearnerZooKeeperServer extends LearnerZooKeeperServer {
+        public ShutdownTrackLearnerZooKeeperServer(FileTxnSnapLog logFactory, QuorumPeer self) throws IOException {
+            super(logFactory, 2000, 2000, 2000, -1, new ZKDatabase(logFactory), self);
+        }
+
+        @Override
+        protected void setupRequestProcessors() {
+            firstProcessor = new ShutdownTrackRequestProcessor();
+            syncProcessor = new SyncRequestProcessor(this, null);
+            syncProcessor.start();
+        }
+
+        ShutdownTrackRequestProcessor getFirstProcessor() {
+            return (ShutdownTrackRequestProcessor) firstProcessor;
+        }
+
+        SyncRequestProcessor getSyncRequestProcessor() {
+            return syncProcessor;
+        }
+
+        @Override
+        public Learner getLearner() {
+            return null;
+        }
+    }
+
+    @Test
+    void testLearnerZooKeeperServerShutdown(@TempDir File tmpDir) throws Exception {
+        File tmpFile = File.createTempFile("test", ".dir", tmpDir);
+        tmpFile.delete();
+        FileTxnSnapLog logFactory = new FileTxnSnapLog(tmpFile, tmpFile);
+        ShutdownTrackLearnerZooKeeperServer zooKeeperServer = new ShutdownTrackLearnerZooKeeperServer(logFactory, new QuorumPeer());
+        zooKeeperServer.startup();
+        zooKeeperServer.shutdown(false);
+        assertTrue(zooKeeperServer.getFirstProcessor().shutdown);
+        assertFalse(zooKeeperServer.getSyncRequestProcessor().isAlive());
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerStartupTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerStartupTest.java
index b9c21e47f53..e80c4a3166a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerStartupTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerStartupTest.java
@@ -20,9 +20,9 @@
 
 import static org.apache.zookeeper.client.FourLetterWordMain.send4LetterWord;
 import static org.apache.zookeeper.server.command.AbstractFourLetterCommand.ZK_NOT_SERVING;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.IOException;
 import java.util.concurrent.CountDownLatch;
@@ -33,8 +33,9 @@
 import org.apache.zookeeper.common.X509Exception.SSLContextException;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.After;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -53,7 +54,7 @@ public class ZooKeeperServerStartupTest extends ZKTestCase {
     private File tmpDir;
     private CountDownLatch startupDelayLatch = new CountDownLatch(1);
 
-    @After
+    @AfterEach
     public void teardown() throws Exception {
         // count down to avoid infinite blocking call due to this latch, if
         // any.
@@ -75,26 +76,29 @@ public void teardown() throws Exception {
      * Test case for
      * https://issues.apache.org/jira/browse/ZOOKEEPER-2383
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testClientConnectionRequestDuringStartupWithNIOServerCnxn() throws Exception {
         tmpDir = ClientBase.createTmpDir();
         ClientBase.setupTestEnv();
 
         startSimpleZKServer(startupDelayLatch);
         SimpleZooKeeperServer simplezks = (SimpleZooKeeperServer) zks;
-        assertTrue("Failed to invoke zks#startup() method during server startup", simplezks.waitForStartupInvocation(10));
+        assertTrue(simplezks.waitForStartupInvocation(10), "Failed to invoke zks#startup() method during server startup");
 
         CountdownWatcher watcher = new CountdownWatcher();
         ZooKeeper zkClient = new ZooKeeper(HOSTPORT, ClientBase.CONNECTION_TIMEOUT, watcher);
 
-        assertFalse("Since server is not fully started, zks#createSession() shouldn't be invoked", simplezks.waitForSessionCreation(5));
+        assertFalse(simplezks.waitForSessionCreation(5),
+            "Since server is not fully started, zks#createSession() shouldn't be invoked");
 
         LOG.info("Decrements the count of the latch, so that server will proceed with startup");
         startupDelayLatch.countDown();
 
-        assertTrue("waiting for server being up ", ClientBase.waitForServerUp(HOSTPORT, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, ClientBase.CONNECTION_TIMEOUT), "waiting for server being up ");
 
-        assertTrue("Failed to invoke zks#createSession() method during client session creation", simplezks.waitForSessionCreation(5));
+        assertTrue(simplezks.waitForSessionCreation(5),
+            "Failed to invoke zks#createSession() method during client session creation");
         watcher.waitForConnected(ClientBase.CONNECTION_TIMEOUT);
         zkClient.close();
     }
@@ -103,7 +107,8 @@ public void testClientConnectionRequestDuringStartupWithNIOServerCnxn() throws E
      * Test case for
      * https://issues.apache.org/jira/browse/ZOOKEEPER-2383
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testClientConnectionRequestDuringStartupWithNettyServerCnxn() throws Exception {
         tmpDir = ClientBase.createTmpDir();
         ClientBase.setupTestEnv();
@@ -113,19 +118,19 @@ public void testClientConnectionRequestDuringStartupWithNettyServerCnxn() throws
             System.setProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY, NettyServerCnxnFactory.class.getName());
             startSimpleZKServer(startupDelayLatch);
             SimpleZooKeeperServer simplezks = (SimpleZooKeeperServer) zks;
-            assertTrue("Failed to invoke zks#startup() method during server startup", simplezks.waitForStartupInvocation(10));
+            assertTrue(simplezks.waitForStartupInvocation(10), "Failed to invoke zks#startup() method during server startup");
 
             CountdownWatcher watcher = new CountdownWatcher();
             ZooKeeper zkClient = new ZooKeeper(HOSTPORT, ClientBase.CONNECTION_TIMEOUT, watcher);
 
-            assertFalse("Since server is not fully started, zks#createSession() shouldn't be invoked", simplezks.waitForSessionCreation(5));
+            assertFalse(simplezks.waitForSessionCreation(5), "Since server is not fully started, zks#createSession() shouldn't be invoked");
 
             LOG.info("Decrements the count of the latch, so that server will proceed with startup");
             startupDelayLatch.countDown();
 
-            assertTrue("waiting for server being up ", ClientBase.waitForServerUp(HOSTPORT, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp(HOSTPORT, ClientBase.CONNECTION_TIMEOUT), "waiting for server being up ");
 
-            assertTrue("Failed to invoke zks#createSession() method during client session creation", simplezks.waitForSessionCreation(5));
+            assertTrue(simplezks.waitForSessionCreation(5), "Failed to invoke zks#createSession() method during client session creation");
             watcher.waitForConnected(ClientBase.CONNECTION_TIMEOUT);
             zkClient.close();
         } finally {
@@ -142,7 +147,8 @@ public void testClientConnectionRequestDuringStartupWithNettyServerCnxn() throws
      * Test case for
      * https://issues.apache.org/jira/browse/ZOOKEEPER-2383
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testFourLetterWords() throws Exception {
         startSimpleZKServer(startupDelayLatch);
         verify("conf", ZK_NOT_SERVING);
@@ -162,7 +168,7 @@ public void testFourLetterWords() throws Exception {
     private void verify(String cmd, String expected) throws IOException, SSLContextException {
         String resp = sendRequest(cmd);
         LOG.info("cmd {} expected {} got {}", cmd, expected, resp);
-        assertTrue("Unexpected response", resp.contains(expected));
+        assertTrue(resp.contains(expected), "Unexpected response");
     }
 
     private String sendRequest(String cmd) throws IOException, SSLContextException {
@@ -180,11 +186,11 @@ public void run() {
                 try {
                     servcnxnf.startup(zks);
                 } catch (IOException e) {
-                    LOG.error("Unexcepted exception during server startup", e);
+                    LOG.error("Unexpected exception during server startup", e);
                     // Ignoring exception. If there is an ioexception
                     // then one of the following assertion will fail
                 } catch (InterruptedException e) {
-                    LOG.error("Unexcepted exception during server startup", e);
+                    LOG.error("Unexpected exception during server startup", e);
                     // Ignoring exception. If there is an interrupted exception
                     // then one of the following assertion will fail
                 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerTest.java
index 81469a8f858..6a6cfd7ab59 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperServerTest.java
@@ -18,21 +18,70 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.Mockito.mock;
 import java.io.File;
 import java.io.IOException;
 import java.util.List;
+import java.util.Map;
+import java.util.UUID;
+import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.metrics.MetricsUtils;
+import org.apache.zookeeper.proto.ConnectRequest;
 import org.apache.zookeeper.server.persistence.FileTxnLog;
+import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.server.persistence.SnapStream;
 import org.apache.zookeeper.server.persistence.Util;
+import org.apache.zookeeper.server.util.QuotaMetricsUtils;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class ZooKeeperServerTest extends ZKTestCase {
 
+    @Test
+    public void testDirSize() throws Exception {
+        ZooKeeperServer zks = null;
+        ServerCnxnFactory cnxnFactory = null;
+
+        try {
+            final File dataDir = ClientBase.createTmpDir();
+            final File logDir = ClientBase.createTmpDir();
+
+            zks = new ZooKeeperServer(dataDir, logDir, 3000);
+
+            // validate dir size before server starts
+            assertEquals(0, zks.getDataDirSize());
+            assertEquals(0, zks.getLogDirSize());
+
+            // start server
+            final String hostPort = "127.0.0.1:" + PortAssignment.unique();
+            final int port = Integer.parseInt(hostPort.split(":")[1]);
+            cnxnFactory = ServerCnxnFactory.createFactory(port, -1);
+            cnxnFactory.startup(zks);
+            assertTrue(ClientBase.waitForServerUp(hostPort, 120000));
+
+            // validate data size is greater than 0 as snapshot has been taken when server starts
+            assertTrue(zks.getDataDirSize() > 0);
+
+            // validate log size is 0 as no txn yet
+            assertEquals(0, zks.getLogDirSize());
+        } finally {
+            if (cnxnFactory != null) {
+                cnxnFactory.shutdown();
+            }
+
+            if (zks != null) {
+                zks.shutdown();
+            }
+        }
+    }
+
+
     @Test
     public void testSortDataDirAscending() {
         File[] files = new File[5];
@@ -125,8 +174,8 @@ public void testInvalidSnapshot() {
             if (!f.exists()) {
                 f.createNewFile();
             }
-            assertFalse("Snapshot file size is greater than 9 bytes", SnapStream.isValidSnapshot(f));
-            assertTrue("Can't delete file", f.delete());
+            assertFalse(SnapStream.isValidSnapshot(f), "Snapshot file size is greater than 9 bytes");
+            assertTrue(f.delete(), "Can't delete file");
         } catch (IOException e) {
         } finally {
             if (null != tmpFileDir) {
@@ -135,4 +184,45 @@ public void testInvalidSnapshot() {
         }
     }
 
+    @Test
+    public void testClientZxidAhead() {
+        ZooKeeperServer zooKeeperServer = new ZooKeeperServer();
+        final ZKDatabase zkDatabase = new ZKDatabase(mock(FileTxnSnapLog.class));
+        zooKeeperServer.setZKDatabase(zkDatabase);
+
+        final ConnectRequest request = new ConnectRequest();
+        request.setProtocolVersion(1);
+        request.setLastZxidSeen(99L);
+        request.setTimeOut(500);
+        request.setSessionId(123L);
+        request.setPasswd(new byte[]{ 1 });
+        request.setReadOnly(true);
+
+        ServerCnxn.CloseRequestException e = assertThrows(
+                ServerCnxn.CloseRequestException.class,
+                () -> zooKeeperServer.processConnectRequest(new MockServerCnxn(), request));
+        assertEquals(e.getReason(), ServerCnxn.DisconnectReason.CLIENT_ZXID_AHEAD);
+    }
+
+    @Test
+    public void testUpdateQuotaExceededMetrics() {
+        final String name = QuotaMetricsUtils.QUOTA_EXCEEDED_ERROR_PER_NAMESPACE;
+        final String namespace = UUID.randomUUID().toString();
+        final long count = 3L;
+
+        for (int i = 0; i < count; i++) {
+            ZooKeeperServer.updateQuotaExceededMetrics(namespace);
+        }
+
+        final Map<String, Object> values = MetricsUtils.currentServerMetrics();
+        assertEquals(1, values.keySet().stream().filter(
+                key -> key.contains(String.format("%s_%s", namespace, name))).count());
+
+        assertEquals(count, values.get(String.format("%s_%s", namespace, name)));
+    }
+
+    @Test
+    public void testUpdateQuotaExceededMetrics_nullNamespace() {
+        assertDoesNotThrow(() -> ZooKeeperServer.updateQuotaExceededMetrics(null));
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperThreadTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperThreadTest.java
index fe53f4d1244..fea351f45f1 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperThreadTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZooKeeperThreadTest.java
@@ -18,11 +18,12 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 public class ZooKeeperThreadTest extends ZKTestCase {
 
@@ -51,7 +52,7 @@ public MyCriticalThread(String threadName) {
             super(threadName, new ZooKeeperServerListener() {
 
                 @Override
-                public void notifyStopping(String threadName, int erroCode) {
+                public void notifyStopping(String threadName, int errorCode) {
 
                 }
             });
@@ -71,16 +72,17 @@ protected void handleException(String thName, Throwable e) {
     /**
      * Test verifies uncaught exception handling of ZooKeeperThread
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testUncaughtException() throws Exception {
         MyThread t1 = new MyThread("Test-Thread");
         t1.start();
-        assertTrue("Uncaught exception is not properly handled.", runningLatch.await(10000, TimeUnit.MILLISECONDS));
+        assertTrue(runningLatch.await(10000, TimeUnit.MILLISECONDS), "Uncaught exception is not properly handled.");
 
         runningLatch = new CountDownLatch(1);
         MyCriticalThread t2 = new MyCriticalThread("Test-Critical-Thread");
         t2.start();
-        assertTrue("Uncaught exception is not properly handled.", runningLatch.await(10000, TimeUnit.MILLISECONDS));
+        assertTrue(runningLatch.await(10000, TimeUnit.MILLISECONDS), "Uncaught exception is not properly handled.");
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZookeeperServerRestoreTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZookeeperServerRestoreTest.java
new file mode 100644
index 00000000000..ac7a008f18d
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZookeeperServerRestoreTest.java
@@ -0,0 +1,141 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.server;
+
+import static org.apache.zookeeper.server.persistence.FileSnap.SNAPSHOT_FILE_PREFIX;
+import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.io.File;
+import java.util.Set;
+import java.util.zip.CheckedInputStream;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.server.persistence.SnapStream;
+import org.apache.zookeeper.server.persistence.Util;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+public class ZookeeperServerRestoreTest extends ZKTestCase {
+    private static final String BASE_PATH = "/restoreFromSnapshotTest";
+    private static final int NODE_COUNT = 10;
+    private static final String HOST_PORT = "127.0.0.1:" + PortAssignment.unique();
+
+    @TempDir
+    static File dataDir;
+
+    @TempDir
+    static File logDir;
+
+    @Test
+    public void testRestoreFromSnapshot() throws Exception {
+        ZooKeeperServer.setSerializeLastProcessedZxidEnabled(true);
+
+        final ZooKeeperServer zks = new ZooKeeperServer(dataDir, logDir, 3000);
+        final int port = Integer.parseInt(HOST_PORT.split(":")[1]);
+        final ServerCnxnFactory serverCnxnFactory = ServerCnxnFactory.createFactory(port, -1);
+
+        ZooKeeper zk1 = null;
+        ZooKeeper zk2 = null;
+        ZooKeeper zk3 = null;
+
+        try {
+            // start the server
+            serverCnxnFactory.startup(zks);
+            assertTrue(ClientBase.waitForServerUp(HOST_PORT, CONNECTION_TIMEOUT));
+
+            // zk1 create test data
+            zk1 = ClientBase.createZKClient(HOST_PORT);
+            for (int i = 0; i < NODE_COUNT; i++) {
+                final String path = BASE_PATH + "-" + i;
+                zk1.create(path, String.valueOf(i).getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            }
+
+            // take Snapshot
+            final File snapshotFile = zks.takeSnapshot(false, false);
+            final long lastZxidFromSnapshot = Util.getZxidFromName(snapshotFile.getName(), SNAPSHOT_FILE_PREFIX);
+
+            // zk2 create more test data after snapshotting
+            zk2 = ClientBase.createZKClient(HOST_PORT);
+            for (int i = NODE_COUNT; i < NODE_COUNT * 2; i++) {
+                final String path = BASE_PATH + "-" + i;
+                zk2.create(path, String.valueOf(i).getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            }
+
+            // restore from snapshot
+            try (final CheckedInputStream is = SnapStream.getInputStream(snapshotFile)) {
+                final long lastZxidFromRestore = zks.restoreFromSnapshot(is);
+
+                // validate the last processed zxid
+                assertEquals(lastZxidFromSnapshot, lastZxidFromRestore);
+
+                // validate restored data only contains data from snapshot
+                zk3 = ClientBase.createZKClient(HOST_PORT);
+                for (int i = 0; i < NODE_COUNT; i++) {
+                    final String path = BASE_PATH + "-" + i;
+                    final String expectedData = String.valueOf(i);
+                    assertArrayEquals(expectedData.getBytes(), zk3.getData(path, null, null));
+                }
+                assertEquals(NODE_COUNT + 3, zk3.getAllChildrenNumber("/"));
+
+                // validate sessions
+                final SessionTracker sessionTracker = zks.getSessionTracker();
+                final Set<Long> globalSessions = sessionTracker.globalSessions();
+                assertEquals(2, globalSessions.size());
+                assertTrue(globalSessions.contains(zk1.getSessionId()));
+                Assertions.assertFalse(globalSessions.contains(zk2.getSessionId()));
+                assertTrue(globalSessions.contains(zk3.getSessionId()));
+
+                // validate ZookeeperServer state
+                assertEquals(ZooKeeperServer.State.RUNNING, zks.state);
+
+                // validate being able to create more data after restore
+                zk3.create(BASE_PATH + "_" + "after", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+                assertEquals(NODE_COUNT + 4, zk3.getAllChildrenNumber("/"));
+            }
+        } finally {
+            System.clearProperty("zookeeper.serializeLastProcessedZxid.enabled");
+
+            if (zk1 != null) {
+                zk1.close();
+            }
+            if (zk2 != null) {
+                zk2.close();
+            }
+            if (zk3 != null) {
+                zk3.close();
+            }
+
+            zks.shutdown();
+            serverCnxnFactory.shutdown();
+        }
+    }
+
+    @Test
+    public void testRestoreFromSnapshot_nulInputStream() throws Exception {
+        final ZooKeeperServer zks = new ZooKeeperServer(dataDir, logDir, 3000);
+        assertThrows(IllegalArgumentException.class, () -> zks.restoreFromSnapshot(null));
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZookeeperServerSnapshotTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZookeeperServerSnapshotTest.java
new file mode 100644
index 00000000000..890cbd2bece
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZookeeperServerSnapshotTest.java
@@ -0,0 +1,94 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server;
+
+import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.io.File;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.ZooDefs.Ids;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+public class ZookeeperServerSnapshotTest extends ZKTestCase {
+    private static final String BASE_PATH = "/takeSnapshotTest";
+    private static final int NODE_COUNT = 10;
+    private static final String HOST_PORT = "127.0.0.1:" + PortAssignment.unique();
+
+    @TempDir
+    static File dataDir;
+
+    @TempDir
+    static File logDir;
+
+    @Test
+    public void testTakeSnapshot() throws Exception {
+        ZooKeeperServer zks = new ZooKeeperServer(dataDir, logDir, 3000);
+        ZooKeeperServer.setSerializeLastProcessedZxidEnabled(true);
+
+        final int port = Integer.parseInt(HOST_PORT.split(":")[1]);
+        final ServerCnxnFactory serverCnxnFactory = ServerCnxnFactory.createFactory(port, -1);
+        ZooKeeper zk = null;
+        try  {
+            serverCnxnFactory.startup(zks);
+            assertTrue(ClientBase.waitForServerUp(HOST_PORT, CONNECTION_TIMEOUT));
+
+            zk = ClientBase.createZKClient(HOST_PORT);
+            for (int i = 0; i < NODE_COUNT; i++) {
+                final String path = BASE_PATH + "-" + i;
+                zk.create(path, String.valueOf(i).getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            }
+
+            // takeSnapshot
+            zks.takeSnapshot(false, false);
+
+            // clean up
+            zk.close();
+            zks.shutdown();
+
+            // restart server and assert the data restored from snapshot
+            zks = new ZooKeeperServer(dataDir, logDir, 3000);
+            ZooKeeperServer.setSerializeLastProcessedZxidEnabled(false);
+
+            serverCnxnFactory.startup(zks);
+            assertTrue(ClientBase.waitForServerUp(HOST_PORT, CONNECTION_TIMEOUT));
+
+            zk = ClientBase.createZKClient(HOST_PORT);
+            for (int i = 0; i < NODE_COUNT; i++) {
+                final String path = BASE_PATH + "-" + i;
+                final String expectedData = String.valueOf(i);
+                assertArrayEquals(expectedData.getBytes(), zk.getData(path, null, null));
+            }
+            assertEquals(NODE_COUNT + 3, zk.getAllChildrenNumber("/"));
+        } finally {
+            if (zk != null) {
+                zk.close();
+            }
+
+            zks.shutdown();
+            serverCnxnFactory.shutdown();
+        }
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZxidRolloverTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZxidRolloverTest.java
index 42e366ec5c8..495c1507e43 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZxidRolloverTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/ZxidRolloverTest.java
@@ -18,10 +18,10 @@
 
 package org.apache.zookeeper.server;
 
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.KeeperException.ConnectionLossException;
@@ -33,9 +33,9 @@
 import org.apache.zookeeper.test.ClientTest;
 import org.apache.zookeeper.test.QuorumUtil;
 import org.apache.zookeeper.test.QuorumUtil.PeerStruct;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -57,9 +57,10 @@ private ZooKeeper getClient(int idx) {
         return zkClients[idx - 1];
     }
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         System.setProperty("zookeeper.admin.enableServer", "false");
+        System.setProperty("zookeeper.test.allowDiscontinuousProposals", "true");
 
         // set the snap count to something low so that we force log rollover
         // and verify that is working as part of the epoch rollover.
@@ -117,9 +118,8 @@ private void checkClientConnected(int idx) throws Exception {
             // in the try, this catches that case and waits for the server
             // to come back
             PeerStruct peer = qu.getPeer(idx);
-            assertTrue(
-                    "Waiting for server down",
-                    ClientBase.waitForServerUp("127.0.0.1:" + peer.clientPort, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + peer.clientPort, ClientBase.CONNECTION_TIMEOUT),
+                    "Waiting for server down");
 
             assertNull(zk.exists("/foofoofoo-connected", false));
         }
@@ -161,7 +161,7 @@ private void startAll() throws Exception {
     private void start(int idx) throws Exception {
         qu.start(idx);
         for (String hp : qu.getConnString().split(",")) {
-            assertTrue("waiting for server up", ClientBase.waitForServerUp(hp, ClientTest.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp(hp, ClientTest.CONNECTION_TIMEOUT), "waiting for server up");
         }
 
         checkLeader();
@@ -190,11 +190,10 @@ private void shutdown(int idx) throws Exception {
 
         // leader will shutdown, remaining followers will elect a new leader
         PeerStruct peer = qu.getPeer(idx);
-        assertTrue(
-                "Waiting for server down",
-                ClientBase.waitForServerDown("127.0.0.1:" + peer.clientPort, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + peer.clientPort, ClientBase.CONNECTION_TIMEOUT),
+                "Waiting for server down");
 
-        // if idx is the the leader then everyone will get disconnected,
+        // if idx is the leader then everyone will get disconnected,
         // otherwise if idx is a follower then just that client will get
         // disconnected
         if (idx == idxLeader) {
@@ -215,8 +214,9 @@ private void adjustEpochNearEnd() {
         zksLeader.setZxid((zksLeader.getZxid() & 0xffffffff00000000L) | 0xfffffffcL);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
+        System.clearProperty("zookeeper.test.allowDiscontinuousProposals");
         LOG.info("tearDown starting");
         for (int i = 0; i < zkClients.length; i++) {
             zkClients[i].close();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandAuthTest.java
new file mode 100644
index 00000000000..f576ad81b12
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandAuthTest.java
@@ -0,0 +1,441 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.admin;
+
+import static org.apache.zookeeper.ZooDefs.Ids.OPEN_ACL_UNSAFE;
+import static org.apache.zookeeper.server.admin.Commands.AUTH_INFO_SEPARATOR;
+import static org.apache.zookeeper.server.admin.Commands.ROOT_PATH;
+import static org.apache.zookeeper.server.admin.JettyAdminServerTest.HTTPS_URL_FORMAT;
+import static org.junit.Assert.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.io.File;
+import java.net.HttpURLConnection;
+import java.net.URL;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import javax.net.ssl.HttpsURLConnection;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.X509KeyManager;
+import javax.net.ssl.X509TrustManager;
+import javax.servlet.http.HttpServletResponse;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.common.ClientX509Util;
+import org.apache.zookeeper.common.QuorumX509Util;
+import org.apache.zookeeper.common.X509Exception;
+import org.apache.zookeeper.common.X509Util;
+import org.apache.zookeeper.common.ZKConfig;
+import org.apache.zookeeper.data.ACL;
+import org.apache.zookeeper.data.Id;
+import org.apache.zookeeper.server.NettyServerCnxnFactory;
+import org.apache.zookeeper.server.ServerCnxnFactory;
+import org.apache.zookeeper.server.ZooKeeperServer;
+import org.apache.zookeeper.server.auth.DigestAuthenticationProvider;
+import org.apache.zookeeper.server.auth.ProviderRegistry;
+import org.apache.zookeeper.server.auth.X509AuthenticationProvider;
+import org.apache.zookeeper.test.ClientBase;
+import org.eclipse.jetty.http.HttpHeader;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.TestInstance;
+import org.junit.jupiter.api.io.TempDir;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.EnumSource;
+
+@TestInstance(TestInstance.Lifecycle.PER_CLASS)
+public class CommandAuthTest extends ZKTestCase {
+    private static final String DIGEST_SCHEMA = "digest";
+    private static final String X509_SCHEMA = "x509";
+    private static final String IP_SCHEMA = "ip";
+    private static final String ROOT_USER = "root";
+    private static final String ROOT_PASSWORD = "root_passwd";
+    private static final String AUTH_TEST_COMMAND_NAME = "authtest";
+    private static final String X509_SUBJECT_PRINCIPAL = "CN=localhost,OU=ZooKeeper,O=Apache,L=Unknown,ST=Unknown,C=Unknown";
+
+    public enum AuthSchema {
+        DIGEST,
+        X509,
+        IP
+    }
+
+    private final int jettyAdminPort = PortAssignment.unique();
+    private final String hostPort = "127.0.0.1:" + PortAssignment.unique();
+    private final ClientX509Util clientX509Util = new ClientX509Util();
+    private final QuorumX509Util quorumX509Util = new QuorumX509Util();
+    private ZooKeeperServer zks;
+    private ServerCnxnFactory cnxnFactory;
+    private JettyAdminServer adminServer;
+    private ZooKeeper zk;
+
+    @TempDir
+    static File dataDir;
+
+    @TempDir
+    static File logDir;
+
+    @BeforeAll
+    public void setup() throws Exception {
+        Commands.registerCommand(new AuthTestCommand(true, ZooDefs.Perms.ALL, ROOT_PATH));
+
+        setupTLS();
+
+        // start ZookeeperServer
+        System.setProperty("zookeeper.4lw.commands.whitelist", "*");
+        zks = new ZooKeeperServer(dataDir, logDir, 3000);
+        final int port = Integer.parseInt(hostPort.split(":")[1]);
+        cnxnFactory = ServerCnxnFactory.createFactory(port, -1);
+        cnxnFactory.startup(zks);
+        assertTrue(ClientBase.waitForServerUp(hostPort, 120000));
+
+        // start AdminServer
+        System.setProperty("zookeeper.admin.enableServer", "true");
+        System.setProperty("zookeeper.admin.serverPort", String.valueOf(jettyAdminPort));
+        adminServer = new JettyAdminServer();
+        adminServer.setZooKeeperServer(zks);
+        adminServer.start();
+    }
+
+    @AfterAll
+    public void tearDown() throws Exception {
+        clearTLS();
+
+        System.clearProperty("zookeeper.4lw.commands.whitelist");
+        System.clearProperty("zookeeper.admin.enableServer");
+        System.clearProperty("zookeeper.admin.serverPort");
+
+        if (adminServer != null) {
+            adminServer.shutdown();
+        }
+
+        if (cnxnFactory != null) {
+            cnxnFactory.shutdown();
+        }
+
+        if (zks != null) {
+            zks.shutdown();
+        }
+    }
+
+    @BeforeEach
+    public void setupEach() throws Exception {
+        zk = ClientBase.createZKClient(hostPort);
+    }
+
+    @AfterEach
+    public void tearDownEach() throws Exception {
+        if (zk != null) {
+            zk.close();
+        }
+    }
+
+    @ParameterizedTest
+    @EnumSource(AuthSchema.class)
+    public void testAuthCheck_authorized(final AuthSchema authSchema) throws Exception {
+        setupRootACL(authSchema);
+        try {
+            final HttpURLConnection authTestConn = sendAuthTestCommandRequest(authSchema, true);
+            assertEquals(HttpURLConnection.HTTP_OK, authTestConn.getResponseCode());
+        } finally {
+            addAuthInfo(zk, authSchema);
+            resetRootACL(zk);
+        }
+    }
+
+    @ParameterizedTest
+    @EnumSource(value = AuthSchema.class, names = {"DIGEST"})
+    public void testAuthCheck_notAuthorized(final AuthSchema authSchema) throws Exception {
+        setupRootACL(authSchema);
+        try {
+            final HttpURLConnection authTestConn = sendAuthTestCommandRequest(authSchema, false);
+            assertEquals(HttpURLConnection.HTTP_FORBIDDEN, authTestConn.getResponseCode());
+        } finally {
+            addAuthInfo(zk, authSchema);
+            resetRootACL(zk);
+        }
+    }
+
+    @ParameterizedTest
+    @EnumSource(AuthSchema.class)
+    public void testAuthCheck_noACL(final AuthSchema authSchema) throws Exception {
+        final HttpURLConnection authTestConn = sendAuthTestCommandRequest(authSchema, false);
+        assertEquals(HttpURLConnection.HTTP_OK, authTestConn.getResponseCode());
+    }
+
+    @ParameterizedTest
+    @EnumSource(value = AuthSchema.class, names = {"DIGEST"})
+    public void testAuthCheck_noPerms(final AuthSchema authSchema) throws Exception {
+        // The extra ACL entry gives Perms.READ perms to the "invalid"
+        // DIGEST authInfo---but that should not permit access, as
+        // AuthTestCommand requires Perms.ADMIN.
+        setupRootACL(authSchema, ZooDefs.Ids.READ_ACL_UNSAFE);
+        try {
+            final HttpURLConnection authTestConn = sendAuthTestCommandRequest(authSchema, false);
+            assertEquals(HttpURLConnection.HTTP_FORBIDDEN, authTestConn.getResponseCode());
+        } finally {
+            addAuthInfo(zk, authSchema);
+            resetRootACL(zk);
+        }
+    }
+
+    @Test
+    public void testAuthCheck_invalidServerRequiredConfig() {
+        assertThrows("An active server is required for auth check",
+        IllegalArgumentException.class,
+        () -> new AuthTestCommand(false, ZooDefs.Perms.ALL, ROOT_PATH));
+    }
+
+    @Test
+    public void testAuthCheck_noAuthInfo() {
+        testAuthCheck_invalidAuthInfo(null);
+    }
+
+    @Test
+    public void testAuthCheck_noAuthInfoSeparator() {
+        final String invalidAuthInfo =  String.format("%s%s%s:%s", DIGEST_SCHEMA, "", ROOT_USER, ROOT_PASSWORD);
+        testAuthCheck_invalidAuthInfo(invalidAuthInfo);
+    }
+
+    @Test
+    public void testAuthCheck_invalidAuthInfoSeparator() {
+        final String invalidAuthInfo =  String.format("%s%s%s:%s", DIGEST_SCHEMA, ":", ROOT_USER, ROOT_PASSWORD);
+        testAuthCheck_invalidAuthInfo(invalidAuthInfo);
+    }
+
+    @Test
+    public void testAuthCheck_invalidAuthSchema() {
+        final String invalidAuthInfo =  String.format("%s%s%s:%s", "InvalidAuthSchema", AUTH_INFO_SEPARATOR, ROOT_USER, ROOT_PASSWORD);
+        testAuthCheck_invalidAuthInfo(invalidAuthInfo);
+    }
+
+    @Test
+    public void testAuthCheck_authProviderNotFound() {
+        final String invalidAuthInfo =  String.format("%s%s%s:%s", "sasl", AUTH_INFO_SEPARATOR, ROOT_USER, ROOT_PASSWORD);
+        testAuthCheck_invalidAuthInfo(invalidAuthInfo);
+    }
+
+    private void testAuthCheck_invalidAuthInfo(final String invalidAuthInfo) {
+        final CommandResponse commandResponse = Commands.runGetCommand(AUTH_TEST_COMMAND_NAME, zks, new HashMap<>(), invalidAuthInfo, null);
+        assertEquals(HttpServletResponse.SC_UNAUTHORIZED, commandResponse.getStatusCode());
+    }
+
+    private static class AuthTestCommand extends GetCommand {
+        public AuthTestCommand(final boolean serverRequired, final int perm, final String path) {
+            super(Arrays.asList(AUTH_TEST_COMMAND_NAME, "at"), serverRequired, new AuthRequest(perm, path));
+        }
+
+        @Override
+        public CommandResponse runGet(ZooKeeperServer zkServer, Map<String, String> kwargs) {
+            return initializeResponse();
+        }
+    }
+
+    private void setupTLS() throws Exception {
+        System.setProperty("zookeeper.authProvider.x509", "org.apache.zookeeper.server.auth.X509AuthenticationProvider");
+        String testDataPath = System.getProperty("test.data.dir", "src/test/resources/data");
+
+        System.setProperty(clientX509Util.getSslKeystoreLocationProperty(), testDataPath + "/ssl/testKeyStore.jks");
+        System.setProperty(clientX509Util.getSslKeystorePasswdProperty(), "testpass");
+        System.setProperty(clientX509Util.getSslTruststoreLocationProperty(), testDataPath + "/ssl/testTrustStore.jks");
+        System.setProperty(clientX509Util.getSslTruststorePasswdProperty(), "testpass");
+
+        // client
+        System.setProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET, "org.apache.zookeeper.ClientCnxnSocketNetty");
+        System.setProperty(ZKClientConfig.SECURE_CLIENT, "true");
+
+        // server
+        System.setProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY, "org.apache.zookeeper.server.NettyServerCnxnFactory");
+        System.setProperty(NettyServerCnxnFactory.PORT_UNIFICATION_KEY, Boolean.TRUE.toString());
+
+        // admin server
+        System.setProperty(quorumX509Util.getSslKeystoreLocationProperty(), testDataPath + "/ssl/testKeyStore.jks");
+        System.setProperty(quorumX509Util.getSslKeystorePasswdProperty(), "testpass");
+        System.setProperty(quorumX509Util.getSslTruststoreLocationProperty(), testDataPath + "/ssl/testTrustStore.jks");
+        System.setProperty(quorumX509Util.getSslTruststorePasswdProperty(), "testpass");
+        System.setProperty("zookeeper.admin.forceHttps", "true");
+        System.setProperty("zookeeper.admin.needClientAuth", "true");
+
+        // create SSLContext
+        String defaultTlsProtocol = X509Util.defaultTlsProtocol(new ZKConfig());
+        final SSLContext sslContext = SSLContext.getInstance(defaultTlsProtocol);
+        final X509AuthenticationProvider authProvider = (X509AuthenticationProvider) ProviderRegistry.getProvider("x509");
+        if (authProvider == null) {
+            throw new X509Exception.SSLContextException("Could not create SSLContext with x509 auth provider");
+        }
+        sslContext.init(new X509KeyManager[]{authProvider.getKeyManager()}, new X509TrustManager[]{authProvider.getTrustManager()}, null);
+
+        // set SSLSocketFactory
+        HttpsURLConnection.setDefaultSSLSocketFactory(sslContext.getSocketFactory());
+    }
+
+    public void clearTLS() {
+        System.clearProperty("zookeeper.authProvider.x509");
+
+        System.clearProperty(clientX509Util.getSslKeystoreLocationProperty());
+        System.clearProperty(clientX509Util.getSslKeystorePasswdProperty());
+        System.clearProperty(clientX509Util.getSslTruststoreLocationProperty());
+        System.clearProperty(clientX509Util.getSslTruststorePasswdProperty());
+
+        // client side
+        System.clearProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET);
+        System.clearProperty(ZKClientConfig.SECURE_CLIENT);
+
+        // server side
+        System.clearProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY);
+        System.clearProperty(NettyServerCnxnFactory.PORT_UNIFICATION_KEY);
+
+        // admin server
+        System.clearProperty(quorumX509Util.getSslKeystoreLocationProperty());
+        System.clearProperty(quorumX509Util.getSslKeystorePasswdProperty());
+        System.clearProperty(quorumX509Util.getSslTruststoreLocationProperty());
+        System.clearProperty(quorumX509Util.getSslTruststorePasswdProperty());
+        System.clearProperty("zookeeper.admin.forceHttps");
+        System.clearProperty("zookeeper.admin.needClientAuth");
+    }
+
+    private void setupRootACL(final AuthSchema authSchema) throws Exception {
+        setupRootACL(authSchema, Collections.<ACL>emptyList());
+    }
+
+    private void setupRootACL(final AuthSchema authSchema, final List<ACL> extraEntries) throws Exception {
+        final List<ACL> aclEntries = new ArrayList<>();
+
+        switch (authSchema) {
+            case DIGEST:
+                aclEntries.addAll(genACLForDigest());
+                break;
+            case X509:
+                aclEntries.addAll(genACLForX509());
+                break;
+            case IP:
+                aclEntries.addAll(genACLForIP());
+                break;
+            default:
+                throw new IllegalArgumentException("Unknown auth schema");
+        }
+
+        aclEntries.addAll(extraEntries);
+
+        zk.setACL(Commands.ROOT_PATH, aclEntries, -1);
+    }
+
+    private HttpURLConnection sendAuthTestCommandRequest(final AuthSchema authSchema, final boolean validAuthInfo) throws Exception  {
+        final URL authTestURL = new URL(String.format(HTTPS_URL_FORMAT + "/" + AUTH_TEST_COMMAND_NAME, jettyAdminPort));
+        final HttpURLConnection authTestConn = (HttpURLConnection) authTestURL.openConnection();
+        addAuthHeader(authTestConn, authSchema, validAuthInfo);
+        authTestConn.setRequestMethod("GET");
+        return authTestConn;
+    }
+
+    private void addAuthInfo(final ZooKeeper zk, final AuthSchema authSchema) {
+        switch (authSchema) {
+            case DIGEST:
+                addAuthInfoForDigest(zk);
+                break;
+            case X509:
+                addAuthInfoForX509(zk);
+                break;
+            case IP:
+                addAuthInfoForIP(zk);
+                break;
+            default:
+                throw new IllegalArgumentException("Unknown auth schema");
+        }
+    }
+
+    public static void resetRootACL(final ZooKeeper zk) throws Exception {
+        zk.setACL(Commands.ROOT_PATH, OPEN_ACL_UNSAFE, -1);
+    }
+
+    public static List<ACL> genACLForDigest() throws Exception  {
+        final String idPassword = String.format("%s:%s", ROOT_USER, ROOT_PASSWORD);
+        final String digest = DigestAuthenticationProvider.generateDigest(idPassword);
+
+        final ACL acl = new ACL(ZooDefs.Perms.ALL, new Id(DIGEST_SCHEMA, digest));
+        return Collections.singletonList(acl);
+    }
+
+    private static List<ACL> genACLForX509() throws Exception  {
+        final ACL acl = new ACL(ZooDefs.Perms.ALL, new Id(X509_SCHEMA, X509_SUBJECT_PRINCIPAL));
+        return Collections.singletonList(acl);
+    }
+
+    private static List<ACL> genACLForIP() throws Exception  {
+        final ACL acl = new ACL(ZooDefs.Perms.ALL, new Id(IP_SCHEMA, "127.0.0.1"));
+        return Collections.singletonList(acl);
+    }
+
+    public static void addAuthInfoForDigest(final ZooKeeper zk) {
+        final String idPassword = String.format("%s:%s", ROOT_USER, ROOT_PASSWORD);
+        zk.addAuthInfo(DIGEST_SCHEMA, idPassword.getBytes(StandardCharsets.UTF_8));
+    }
+
+    public static void addAuthInfoForX509(final ZooKeeper zk) {
+        zk.addAuthInfo(X509_SCHEMA, X509_SUBJECT_PRINCIPAL.getBytes(StandardCharsets.UTF_8));
+    }
+
+    private void addAuthInfoForIP(final ZooKeeper zk) {
+        zk.addAuthInfo(IP_SCHEMA, "127.0.0.1".getBytes(StandardCharsets.UTF_8));
+    }
+
+    public static void addAuthHeader(final HttpURLConnection conn, final AuthSchema authSchema, final boolean validAuthInfo) {
+        String authInfo;
+        switch (authSchema) {
+            case DIGEST:
+                authInfo = validAuthInfo ? buildAuthorizationForDigest() : buildInvalidAuthorizationForDigest();
+                break;
+            case X509:
+                authInfo = buildAuthorizationForX509();
+                break;
+            case IP:
+                authInfo = buildAuthorizationForIP();
+                break;
+            default:
+                throw new IllegalArgumentException("Unknown auth schema");
+        }
+        conn.setRequestProperty(HttpHeader.AUTHORIZATION.asString(), authInfo);
+    }
+
+    public static String buildAuthorizationForDigest() {
+        return  String.format("%s%s%s:%s", DIGEST_SCHEMA, Commands.AUTH_INFO_SEPARATOR, ROOT_USER, ROOT_PASSWORD);
+    }
+
+    private static String buildInvalidAuthorizationForDigest() {
+        return  String.format("%s%s%s:%s", DIGEST_SCHEMA, Commands.AUTH_INFO_SEPARATOR, "InvalidUser", "InvalidPassword");
+    }
+
+    private static String buildAuthorizationForX509() {
+        return  String.format("%s%s", X509_SCHEMA, Commands.AUTH_INFO_SEPARATOR);
+    }
+
+    private static String buildAuthorizationForIP() {
+        return  String.format("%s%s", IP_SCHEMA, Commands.AUTH_INFO_SEPARATOR);
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandResponseTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandResponseTest.java
index 20dc4079294..855acd0b591 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandResponseTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandResponseTest.java
@@ -17,32 +17,37 @@
 
 package org.apache.zookeeper.server.admin;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
 import java.util.HashMap;
 import java.util.Map;
+import javax.servlet.http.HttpServletResponse;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class CommandResponseTest extends ZKTestCase {
 
     private CommandResponse r;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
-        r = new CommandResponse("makemeasandwich", "makeityourself");
+        r = new CommandResponse("makemeasandwich", "makeityourself", HttpServletResponse.SC_OK);
     }
 
     @Test
     public void testGetters() {
         assertEquals("makemeasandwich", r.getCommand());
         assertEquals("makeityourself", r.getError());
+        assertEquals(HttpServletResponse.SC_OK, r.getStatusCode());
+        assertEquals(new HashMap(), r.getHeaders());
+        assertNull(r.getInputStream());
     }
 
     @Test
     public void testMap() {
         r.put("missing", "sudo");
-        Map<String, Object> m = new HashMap<String, Object>();
+        Map<String, Object> m = new HashMap<>();
         m.put("origin", "xkcd");
         m.put("url", "http://xkcd.com/149/");
         r.putAll(m);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java
index 5f6879e7a20..ef80e7778e4 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandsTest.java
@@ -18,18 +18,27 @@
 
 package org.apache.zookeeper.server.admin;
 
+import static org.apache.zookeeper.server.ZooKeeperServer.ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED;
+import static org.apache.zookeeper.server.admin.Commands.ADMIN_RATE_LIMITER_INTERVAL;
+import static org.apache.zookeeper.server.admin.Commands.RestoreCommand.ADMIN_RESTORE_ENABLED;
+import static org.apache.zookeeper.server.admin.Commands.SnapshotCommand.ADMIN_SNAPSHOT_ENABLED;
+import static org.apache.zookeeper.server.admin.Commands.SnapshotCommand.REQUEST_QUERY_PARAM_STREAMING;
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.core.Is.is;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertThat;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
+import java.io.ByteArrayInputStream;
 import java.io.IOException;
+import java.io.InputStream;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.HashMap;
 import java.util.Map;
+import javax.servlet.http.HttpServletResponse;
 import org.apache.zookeeper.metrics.MetricsUtils;
 import org.apache.zookeeper.server.ServerCnxnFactory;
 import org.apache.zookeeper.server.ServerStats;
@@ -37,7 +46,7 @@
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.quorum.BufferStats;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class CommandsTest extends ClientBase {
 
@@ -50,47 +59,58 @@ public class CommandsTest extends ClientBase {
      *            - the primary name of the command
      * @param kwargs
      *            - keyword arguments to the command
+     * @param inputStream
+     *            - InputStream to the command
+     * @param authInfo
+     *            - authInfo for the command
+     * @param expectedHeaders
+     *            - expected HTTP response headers
+     * @param expectedStatusCode
+     *            - expected HTTP status code
      * @param fields
      *            - the fields that are expected in the returned Map
      * @throws IOException
      * @throws InterruptedException
      */
-    public void testCommand(String cmdName, Map<String, String> kwargs, Field... fields) throws IOException, InterruptedException {
+    private void testCommand(String cmdName, Map<String, String> kwargs, InputStream inputStream,
+                             String authInfo,
+                             Map<String, String> expectedHeaders, int expectedStatusCode,
+                             Field... fields) throws IOException, InterruptedException {
         ZooKeeperServer zks = serverFactory.getZooKeeperServer();
-        Map<String, Object> result = Commands.runCommand(cmdName, zks, kwargs).toMap();
-
-        assertTrue(result.containsKey("command"));
-        // This is only true because we're setting cmdName to the primary name
-        assertEquals(cmdName, result.remove("command"));
-        assertTrue(result.containsKey("error"));
-        assertNull("error: " + result.get("error"), result.remove("error"));
-
-        for (Field field : fields) {
-            String k = field.key;
-            assertTrue("Result from command "
-                               + cmdName
-                               + " missing field \""
-                               + k
-                               + "\""
-                               + "\n"
-                               + result, result.containsKey(k));
-            Class<?> t = field.type;
-            Object v = result.remove(k);
-            assertTrue("\""
-                               + k
-                               + "\" field from command "
-                               + cmdName
-                               + " should be of type "
-                               + t
-                               + ", is actually of type "
-                               + v.getClass(), t.isAssignableFrom(v.getClass()));
+        final CommandResponse commandResponse = inputStream == null
+        ? Commands.runGetCommand(cmdName, zks, kwargs, authInfo, null) : Commands.runPostCommand(cmdName, zks, inputStream, authInfo, null);
+        assertNotNull(commandResponse);
+        assertEquals(expectedStatusCode, commandResponse.getStatusCode());
+        try (final InputStream responseStream = commandResponse.getInputStream()) {
+            if (Boolean.parseBoolean(kwargs.getOrDefault(REQUEST_QUERY_PARAM_STREAMING, "false"))) {
+                assertNotNull(responseStream, "InputStream in the response of command " + cmdName + " should not be null");
+            } else {
+                Map<String, Object> result = commandResponse.toMap();
+                assertTrue(result.containsKey("command"));
+                // This is only true because we're setting cmdName to the primary name
+                assertEquals(cmdName, result.remove("command"));
+                assertTrue(result.containsKey("error"));
+                assertNull(result.remove("error"), "error: " + result.get("error"));
+
+                for (Field field : fields) {
+                    String k = field.key;
+                    assertTrue(result.containsKey(k),
+                            "Result from command " + cmdName + " missing field \"" + k + "\"" + "\n" + result);
+                    Class<?> t = field.type;
+                    Object v = result.remove(k);
+                    assertTrue(t.isAssignableFrom(v.getClass()),
+                            "\"" + k + "\" field from command " + cmdName
+                                    + " should be of type " + t + ", is actually of type " + v.getClass());
+                }
+
+                assertTrue(result.isEmpty(), "Result from command " + cmdName + " contains extra fields: " + result);
+            }
         }
-
-        assertTrue("Result from command " + cmdName + " contains extra fields: " + result, result.isEmpty());
+        assertEquals(expectedHeaders, commandResponse.getHeaders());
     }
 
     public void testCommand(String cmdName, Field... fields) throws IOException, InterruptedException {
-        testCommand(cmdName, new HashMap<String, String>(), fields);
+        testCommand(cmdName, new HashMap<>(), null, null, new HashMap<>(), HttpServletResponse.SC_OK, fields);
     }
 
     private static class Field {
@@ -101,7 +121,6 @@ private static class Field {
             this.key = key;
             this.type = type;
         }
-
     }
 
     @Test
@@ -136,7 +155,7 @@ public void testDump() throws IOException, InterruptedException {
 
     @Test
     public void testEnvironment() throws IOException, InterruptedException {
-        testCommand("environment", new Field("zookeeper.version", String.class), new Field("host.name", String.class), new Field("java.version", String.class), new Field("java.vendor", String.class), new Field("java.home", String.class), new Field("java.class.path", String.class), new Field("java.library.path", String.class), new Field("java.io.tmpdir", String.class), new Field("java.compiler", String.class), new Field("os.name", String.class), new Field("os.arch", String.class), new Field("os.version", String.class), new Field("user.name", String.class), new Field("user.home", String.class), new Field("user.dir", String.class), new Field("os.memory.free", String.class), new Field("os.memory.max", String.class), new Field("os.memory.total", String.class));
+        testCommand("environment", new Field("zookeeper.version", String.class), new Field("host.name", String.class), new Field("java.version", String.class), new Field("java.vendor", String.class), new Field("java.home", String.class), new Field("java.class.path", String.class), new Field("java.library.path", String.class), new Field("java.io.tmpdir", String.class), new Field("java.compiler", String.class), new Field("os.name", String.class), new Field("os.arch", String.class), new Field("os.version", String.class), new Field("user.name", String.class), new Field("user.home", String.class), new Field("user.dir", String.class), new Field("jvm.memory.free", String.class), new Field("jvm.memory.max", String.class), new Field("jvm.memory.total", String.class));
     }
 
     @Test
@@ -175,6 +194,9 @@ public void testMonitor() throws IOException, InterruptedException {
                 new Field("last_client_response_size", Integer.class),
                 new Field("max_client_response_size", Integer.class),
                 new Field("min_client_response_size", Integer.class),
+                new Field("auth_failed_count", Long.class),
+                new Field("non_mtls_remote_conn_count", Long.class),
+                new Field("non_mtls_local_conn_count", Long.class),
                 new Field("uptime", Long.class),
                 new Field("global_sessions", Long.class),
                 new Field("local_sessions", Long.class),
@@ -206,6 +228,48 @@ public void testRuok() throws IOException, InterruptedException {
         testCommand("ruok");
     }
 
+    @Test
+    public void testRestore_invalidInputStream() throws IOException, InterruptedException {
+        setupForRestoreCommand();
+
+        try (final InputStream inputStream = new ByteArrayInputStream("Invalid snapshot data".getBytes())){
+            final Map<String, String> kwargs = new HashMap<>();
+            final Map<String, String> expectedHeaders = new HashMap<>();
+            final String authInfo = CommandAuthTest.buildAuthorizationForDigest();
+            testCommand("restore", kwargs, inputStream, authInfo, expectedHeaders, HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
+        } finally {
+            clearForRestoreCommand();
+        }
+    }
+
+    @Test
+    public void testRestore_nullInputStream() {
+        setupForRestoreCommand();
+        final ZooKeeperServer zks = serverFactory.getZooKeeperServer();
+        try {
+
+            final String authInfo = CommandAuthTest.buildAuthorizationForDigest();
+            final CommandResponse commandResponse = Commands.runPostCommand("restore", zks, null, authInfo, null);
+            assertNotNull(commandResponse);
+            assertEquals(HttpServletResponse.SC_BAD_REQUEST, commandResponse.getStatusCode());
+        } finally {
+          clearForRestoreCommand();
+          if (zks != null) {
+              zks.shutdown();
+          }
+        }
+    }
+
+    @Test
+    public void testSnapshot_streaming() throws IOException, InterruptedException {
+        testSnapshot(true);
+    }
+
+    @Test
+    public void testSnapshot_nonStreaming() throws IOException, InterruptedException {
+        testSnapshot(false);
+    }
+
     @Test
     public void testServerStats() throws IOException, InterruptedException {
         testCommand("server_stats", new Field("version", String.class), new Field("read_only", Boolean.class), new Field("server_stats", ServerStats.class), new Field("node_count", Integer.class), new Field("client_response", BufferStats.class));
@@ -213,9 +277,9 @@ public void testServerStats() throws IOException, InterruptedException {
 
     @Test
     public void testSetTraceMask() throws IOException, InterruptedException {
-        Map<String, String> kwargs = new HashMap<String, String>();
+        Map<String, String> kwargs = new HashMap<>();
         kwargs.put("traceMask", "1");
-        testCommand("set_trace_mask", kwargs, new Field("tracemask", Long.class));
+        testCommand("set_trace_mask", kwargs, null, null, new HashMap<>(), HttpServletResponse.SC_OK, new Field("tracemask", Long.class));
     }
 
     @Test
@@ -265,7 +329,7 @@ public void testConsCommandSecureOnly() {
         when(zkServer.getSecureServerCnxnFactory()).thenReturn(cnxnFactory);
 
         // Act
-        CommandResponse response = cmd.run(zkServer, null);
+        CommandResponse response = cmd.runGet(zkServer, null);
 
         // Assert
         assertThat(response.toMap().containsKey("connections"), is(true));
@@ -289,10 +353,50 @@ public void testStatCommandSecureOnly() {
         when(zkServer.getZKDatabase()).thenReturn(zkDatabase);
         when(zkDatabase.getNodeCount()).thenReturn(0);
 
-        CommandResponse response = cmd.run(zkServer, null);
+        CommandResponse response = cmd.runGet(zkServer, null);
 
         assertThat(response.toMap().containsKey("connections"), is(true));
         assertThat(response.toMap().containsKey("secure_connections"), is(true));
     }
 
+    @Test
+    public void testShedConnections() throws IOException, InterruptedException {
+        final Map<String, String> kwargs = new HashMap<>();
+        final InputStream inputStream = new ByteArrayInputStream("{\"percentage\": 25}".getBytes());
+        final String authInfo = CommandAuthTest.buildAuthorizationForDigest();
+        testCommand("shed_connections", kwargs, inputStream, authInfo, new HashMap<>(), HttpServletResponse.SC_OK,
+                new Field("percentage_requested", Integer.class),
+                new Field("connections_shed", Integer.class));
+    }
+
+    private void testSnapshot(final boolean streaming) throws IOException, InterruptedException {
+        System.setProperty(ADMIN_SNAPSHOT_ENABLED, "true");
+        System.setProperty(ADMIN_RATE_LIMITER_INTERVAL, "0");
+        System.setProperty(ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED, "true");
+        try {
+            final Map<String, String> kwargs = new HashMap<>();
+            kwargs.put(REQUEST_QUERY_PARAM_STREAMING, String.valueOf(streaming));
+            final String autInfo = CommandAuthTest.buildAuthorizationForDigest();
+            final Map<String, String> expectedHeaders = new HashMap<>();
+            expectedHeaders.put(Commands.SnapshotCommand.RESPONSE_HEADER_LAST_ZXID, "0x0");
+            expectedHeaders.put(Commands.SnapshotCommand.RESPONSE_HEADER_SNAPSHOT_SIZE, "478");
+            testCommand("snapshot", kwargs, null, autInfo, expectedHeaders, HttpServletResponse.SC_OK);
+        } finally {
+            System.clearProperty(ADMIN_SNAPSHOT_ENABLED);
+            System.clearProperty(ADMIN_RATE_LIMITER_INTERVAL);
+            System.clearProperty(ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED);
+        }
+    }
+
+    private void setupForRestoreCommand() {
+        System.setProperty(ADMIN_RESTORE_ENABLED, "true");
+        System.setProperty(ADMIN_RATE_LIMITER_INTERVAL, "0");
+        System.setProperty(ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED, "true");
+    }
+
+    private void clearForRestoreCommand() {
+        System.clearProperty(ADMIN_RESTORE_ENABLED);
+        System.clearProperty(ADMIN_RATE_LIMITER_INTERVAL);
+        System.clearProperty(ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED);
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java
index 525c1c971f9..2123e515b48 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java
@@ -18,24 +18,43 @@
 
 package org.apache.zookeeper.server.admin;
 
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.BufferedReader;
 import java.io.File;
+import java.io.FileInputStream;
 import java.io.IOException;
 import java.io.InputStreamReader;
+import java.net.HttpURLConnection;
+import java.net.SocketException;
 import java.net.URL;
+import java.nio.file.Path;
 import java.security.GeneralSecurityException;
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
 import java.security.Security;
+import java.security.UnrecoverableKeyException;
+import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
 import javax.net.ssl.HostnameVerifier;
 import javax.net.ssl.HttpsURLConnection;
+import javax.net.ssl.KeyManager;
+import javax.net.ssl.KeyManagerFactory;
 import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLHandshakeException;
 import javax.net.ssl.SSLSession;
+import javax.net.ssl.SSLSocket;
+import javax.net.ssl.SSLSocketFactory;
 import javax.net.ssl.TrustManager;
+import javax.net.ssl.TrustManagerFactory;
 import javax.net.ssl.X509TrustManager;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.common.KeyStoreFileType;
+import org.apache.zookeeper.common.SecretUtilsTest;
 import org.apache.zookeeper.common.X509Exception.SSLContextException;
 import org.apache.zookeeper.common.X509KeyType;
 import org.apache.zookeeper.common.X509TestContext;
@@ -44,9 +63,10 @@
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
 import org.apache.zookeeper.test.ClientBase;
 import org.bouncycastle.jce.provider.BouncyCastleProvider;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -54,31 +74,34 @@ public class JettyAdminServerTest extends ZKTestCase {
 
     protected static final Logger LOG = LoggerFactory.getLogger(JettyAdminServerTest.class);
 
-    private static final String URL_FORMAT = "http://localhost:%d/commands";
-    private static final String HTTPS_URL_FORMAT = "https://localhost:%d/commands";
-    private static final int jettyAdminPort = PortAssignment.unique();
+    static final String URL_FORMAT = "http://localhost:%d/commands";
+    static final String HTTPS_URL_FORMAT = "https://localhost:%d/commands";
+    private final int jettyAdminPort = PortAssignment.unique();
+    private static final String KEYSTORE_TYPE_JKS = "JKS";
+    private String keyStorePath;
+    private String trustStorePath;
 
-    @Before
+    @BeforeEach
     public void enableServer() {
         // Override setting in ZKTestCase
         System.setProperty("zookeeper.admin.enableServer", "true");
         System.setProperty("zookeeper.admin.serverPort", "" + jettyAdminPort);
     }
 
-    @Before
-    public void setupEncryption() {
+    @BeforeEach
+    public void setupEncryption(@TempDir File tempDir) {
         Security.addProvider(new BouncyCastleProvider());
-        File tmpDir = null;
         X509TestContext x509TestContext = null;
         try {
-            tmpDir = ClientBase.createEmptyTestDir();
             x509TestContext = X509TestContext.newBuilder()
-                                             .setTempDir(tmpDir)
+                                             .setTempDir(tempDir)
                                              .setKeyStorePassword("")
                                              .setKeyStoreKeyType(X509KeyType.EC)
                                              .setTrustStorePassword("")
                                              .setTrustStoreKeyType(X509KeyType.EC)
                                              .build();
+            keyStorePath = x509TestContext.getKeyStoreFile(KeyStoreFileType.JKS).getAbsolutePath();
+            trustStorePath = x509TestContext.getTrustStoreFile(KeyStoreFileType.JKS).getAbsolutePath();
             System.setProperty(
                 "zookeeper.ssl.quorum.keyStore.location",
                 x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM).getAbsolutePath());
@@ -127,7 +150,7 @@ public boolean verify(String hostname, SSLSession session) {
         HttpsURLConnection.setDefaultHostnameVerifier(allValid);
     }
 
-    @After
+    @AfterEach
     public void cleanUp() {
         Security.removeProvider("BC");
 
@@ -136,11 +159,16 @@ public void cleanUp() {
 
         System.clearProperty("zookeeper.ssl.quorum.keyStore.location");
         System.clearProperty("zookeeper.ssl.quorum.keyStore.password");
+        System.clearProperty("zookeeper.ssl.quorum.keyStore.passwordPath");
         System.clearProperty("zookeeper.ssl.quorum.keyStore.type");
         System.clearProperty("zookeeper.ssl.quorum.trustStore.location");
         System.clearProperty("zookeeper.ssl.quorum.trustStore.password");
+        System.clearProperty("zookeeper.ssl.quorum.trustStore.passwordPath");
         System.clearProperty("zookeeper.ssl.quorum.trustStore.type");
+        System.clearProperty("zookeeper.ssl.quorum.ciphersuites");
+        System.clearProperty("zookeeper.ssl.quorum.enabledProtocols");
         System.clearProperty("zookeeper.admin.portUnification");
+        System.clearProperty("zookeeper.admin.forceHttps");
     }
 
     /**
@@ -152,6 +180,7 @@ public void testJettyAdminServer() throws AdminServerException, IOException, SSL
         try {
             server.start();
             queryAdminServer(jettyAdminPort);
+            traceAdminServer(jettyAdminPort);
         } finally {
             server.shutdown();
         }
@@ -169,17 +198,15 @@ public void testStandalone() throws Exception {
         ZooKeeperServerMainTest.MainThread main = new ZooKeeperServerMainTest.MainThread(CLIENT_PORT, false, null);
         main.start();
 
-        assertTrue(
-            "waiting for server being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server being up");
 
         queryAdminServer(jettyAdminPort);
 
         main.shutdown();
 
-        assertTrue(
-            "waiting for server down",
-            ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT, ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server down");
     }
 
     /**
@@ -216,12 +243,10 @@ public void testQuorum() throws Exception {
 
         Thread.sleep(500);
 
-        assertTrue(
-            "waiting for server 1 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT));
-        assertTrue(
-            "waiting for server 2 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server 1 being up");
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server 2 being up");
 
         queryAdminServer(ADMIN_SERVER_PORT1);
         queryAdminServer(ADMIN_SERVER_PORT2);
@@ -229,12 +254,50 @@ public void testQuorum() throws Exception {
         q1.shutdown();
         q2.shutdown();
 
-        assertTrue(
-            "waiting for server 1 down",
-            ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT));
-        assertTrue(
-            "waiting for server 2 down",
-            ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server 1 down");
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server 2 down");
+    }
+
+    @Test
+    public void testForceHttpsPortUnificationEnabled() throws Exception {
+        testForceHttps(true);
+    }
+
+    @Test
+    public void testForceHttpsPortUnificationDisabled() throws Exception {
+        testForceHttps(false);
+    }
+
+    @Test
+    public void testForceHttps_withWrongPasswordFromFile() throws Exception {
+        final Path secretFile = SecretUtilsTest.createSecretFile("" + "wrong");
+
+        System.setProperty("zookeeper.ssl.quorum.keyStore.passwordPath", secretFile.toString());
+        System.setProperty("zookeeper.ssl.quorum.trustStore.passwordPath", secretFile.toString());
+
+        assertThrows(IOException.class, () -> testForceHttps(false));
+    }
+
+    private void testForceHttps(boolean portUnification) throws Exception {
+        System.setProperty("zookeeper.admin.forceHttps", "true");
+        System.setProperty("zookeeper.admin.portUnification", String.valueOf(portUnification));
+        boolean httpsPassed = false;
+
+        JettyAdminServer server = new JettyAdminServer();
+        try {
+            server.start();
+            queryAdminServer(String.format(HTTPS_URL_FORMAT, jettyAdminPort), true);
+            httpsPassed = true;
+            queryAdminServer(String.format(URL_FORMAT, jettyAdminPort), false);
+            fail("http call should have failed since forceHttps=true");
+        } catch (SocketException se) {
+            //good
+        } finally {
+            server.shutdown();
+        }
+        assertTrue(httpsPassed);
     }
 
     /**
@@ -262,4 +325,131 @@ private void queryAdminServer(String urlStr, boolean encrypted) throws IOExcepti
         assertTrue(line.length() > 0);
     }
 
+    @Test
+    public void testHandshakeWithSupportedProtocol() throws Exception {
+        System.setProperty("zookeeper.admin.forceHttps", "true");
+        System.setProperty("zookeeper.ssl.quorum.enabledProtocols", "TLSv1.3");
+
+        JettyAdminServer server = new JettyAdminServer();
+        try {
+            server.start();
+
+            // Use a raw SSLSocket to verify the handshake
+            SSLContext sslContext = createSSLContext(keyStorePath, "".toCharArray(), trustStorePath, "TLSv1.3");
+            SSLSocketFactory factory = sslContext.getSocketFactory();
+
+            try (SSLSocket socket = (SSLSocket) factory.createSocket("localhost", jettyAdminPort)) {
+                socket.startHandshake();
+                String negotiatedProtocol = socket.getSession().getProtocol();
+
+                // Verify that we actually landed on the protocol we expected
+                assertEquals("TLSv1.3", negotiatedProtocol,
+                        "The negotiated protocol should be TLSv1.3.");
+            }
+        } finally {
+            server.shutdown();
+        }
+    }
+
+    @Test
+    public void testHandshakeWithUnsupportedProtocolFails() throws Exception {
+        System.setProperty("zookeeper.admin.forceHttps", "true");
+        System.setProperty("zookeeper.ssl.quorum.enabledProtocols", "TLSv1.3");
+
+        JettyAdminServer server = new JettyAdminServer();
+        try {
+            server.start();
+
+            SSLContext sslContext = createSSLContext(keyStorePath, "".toCharArray(), trustStorePath, "TLSv1.1");
+            SSLSocketFactory factory = sslContext.getSocketFactory();
+
+            try (SSLSocket socket = (SSLSocket) factory.createSocket("localhost", jettyAdminPort)) {
+                SSLHandshakeException exception = assertThrows(SSLHandshakeException.class, socket::startHandshake);
+                assertEquals(
+                        "No appropriate protocol (protocol is disabled or cipher suites are inappropriate)",
+                        exception.getMessage(),
+                        "The handshake should have failed due to a protocol mismatch.");
+            }
+        } finally {
+            server.shutdown();
+        }
+    }
+
+    @Test
+    public void testCipherMismatchFails() throws Exception {
+        System.setProperty("zookeeper.admin.forceHttps", "true");
+        System.setProperty("zookeeper.ssl.quorum.ciphersuites", "TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384");
+
+        JettyAdminServer server = new JettyAdminServer();
+        try {
+            server.start();
+
+            SSLContext sslContext = createSSLContext(keyStorePath, "".toCharArray(), trustStorePath, "TLSv1.2");
+            SSLSocketFactory factory = sslContext.getSocketFactory();
+
+            try (SSLSocket socket = (SSLSocket) factory.createSocket("localhost", jettyAdminPort)) {
+                // Force the client to use a cipher NOT enabled for the AdminServer
+                String[] unsupportedCiphers = new String[]{"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"};
+                socket.setEnabledCipherSuites(unsupportedCiphers);
+
+                assertThrows(SSLHandshakeException.class, socket::startHandshake,
+                        "The handshake should have failed due to a cipher mismatch.");
+            }
+        } finally {
+            server.shutdown();
+        }
+    }
+
+    private SSLContext createSSLContext(String keystorePath, char[] password, String trustStorePath, String protocol)
+            throws Exception {
+        KeyManager[] keyManagers = getKeyManagers(keystorePath, password);
+        TrustManager[] trustManagers = getTrustManagers(trustStorePath, password);
+
+        SSLContext sslContext = SSLContext.getInstance(protocol);
+        sslContext.init(keyManagers, trustManagers, null);
+
+        return sslContext;
+    }
+
+    private static KeyManager[] getKeyManagers(String keystorePath, char[] password) throws KeyStoreException,
+            IOException, NoSuchAlgorithmException, CertificateException, UnrecoverableKeyException {
+        KeyStore keyStore = KeyStore.getInstance(KEYSTORE_TYPE_JKS);
+        try (FileInputStream fis = new FileInputStream(keystorePath)) {
+            keyStore.load(fis, password);
+        }
+
+        KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
+        kmf.init(keyStore, password);
+        return kmf.getKeyManagers();
+    }
+
+    public TrustManager[] getTrustManagers(String trustStorePath, char[] password) throws Exception {
+        KeyStore trustStore = KeyStore.getInstance(KEYSTORE_TYPE_JKS);
+        try (FileInputStream fis = new FileInputStream(trustStorePath)) {
+            trustStore.load(fis, password);
+        }
+
+        TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
+        tmf.init(trustStore);
+
+        return tmf.getTrustManagers();
+    }
+
+    /**
+     * Using TRACE method to visit admin server
+     */
+    private void traceAdminServer(int port) throws IOException {
+      traceAdminServer(String.format(URL_FORMAT, port));
+      traceAdminServer(String.format(HTTPS_URL_FORMAT, port));
+    }
+
+    /**
+     * Using TRACE method to visit admin server, the response should be 403 forbidden
+     */
+    private void traceAdminServer(String urlStr) throws IOException {
+        HttpURLConnection conn = (HttpURLConnection) new URL(urlStr).openConnection();
+        conn.setRequestMethod("TRACE");
+        conn.connect();
+        assertEquals(HttpURLConnection.HTTP_FORBIDDEN, conn.getResponseCode());
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/RestoreQuorumTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/RestoreQuorumTest.java
new file mode 100644
index 00000000000..e5d43f7c695
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/RestoreQuorumTest.java
@@ -0,0 +1,116 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.server.admin;
+
+import static org.apache.zookeeper.server.ZooKeeperServer.ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED;
+import static org.apache.zookeeper.server.admin.Commands.ADMIN_RATE_LIMITER_INTERVAL;
+import static org.apache.zookeeper.server.admin.Commands.RestoreCommand.ADMIN_RESTORE_ENABLED;
+import static org.apache.zookeeper.server.admin.Commands.SnapshotCommand.ADMIN_SNAPSHOT_ENABLED;
+import static org.apache.zookeeper.server.admin.SnapshotAndRestoreCommandTest.performRestoreAndValidate;
+import static org.apache.zookeeper.server.admin.SnapshotAndRestoreCommandTest.takeSnapshotAndValidate;
+import java.io.File;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+
+public class RestoreQuorumTest extends QuorumPeerTestBase {
+    @Test
+    public void testRestoreAfterQuorumLost() throws Exception {
+        setupAdminServerProperties();
+
+        int SERVER_COUNT = 3;
+        final int NODE_COUNT = 10;
+        final String PATH = "/testRestoreAfterQuorumLost";
+
+        try {
+            // start up servers
+            servers = LaunchServers(SERVER_COUNT);
+            int leaderId = servers.findLeader();
+
+            // create data
+            servers.zk[leaderId].create(PATH, new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            for (int i = 0; i < NODE_COUNT; i++) {
+                servers.zk[leaderId].create(PATH + "/" + i, new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            }
+
+            // take snapshot
+            final File snapshotFile = takeSnapshotAndValidate(servers.adminPorts[leaderId], ClientBase.testBaseDir);
+
+            // create more data
+            for (int i = NODE_COUNT; i < NODE_COUNT * 2; i++) {
+                servers.zk[leaderId].create(PATH + "/" + i, new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            }
+
+            // shutdown all servers to simulate quorum lost
+            servers.shutDownAllServers();
+            waitForAll(servers, ZooKeeper.States.CONNECTING);
+
+            // restart the servers
+            for (int i = 0; i < SERVER_COUNT; i++) {
+                System.setProperty("zookeeper.admin.serverPort", String.valueOf(servers.adminPorts[i]));
+                servers.mt[i].start();
+                servers.restartClient(i, this);
+            }
+            waitForAll(servers, ZooKeeper.States.CONNECTED);
+
+            // restore servers
+            for (int i = 0; i < SERVER_COUNT; i++) {
+                performRestoreAndValidate(servers.adminPorts[i], snapshotFile);
+            }
+
+            // validate all servers are restored
+            for (int i = 0; i < SERVER_COUNT; i++) {
+                servers.restartClient(i, this);
+                Assertions.assertEquals(NODE_COUNT, servers.zk[i].getAllChildrenNumber(PATH));
+            }
+
+            // create more data after restore
+            for (int i = NODE_COUNT * 2; i < NODE_COUNT * 3; i++) {
+                servers.zk[leaderId].create(PATH + "/" + i, new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            }
+
+            // validate all servers have expected data
+            for (int i = 0; i < SERVER_COUNT; i++) {
+                Assertions.assertEquals(NODE_COUNT * 2, servers.zk[i].getAllChildrenNumber(PATH));
+            }
+        } finally {
+            clearAdminServerProperties();
+        }
+    }
+
+    private void setupAdminServerProperties() {
+        System.setProperty("zookeeper.admin.enableServer", "true");
+        System.setProperty(ADMIN_RATE_LIMITER_INTERVAL, "0");
+        System.setProperty(ADMIN_SNAPSHOT_ENABLED, "true");
+        System.setProperty(ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED, "true");
+        System.setProperty(ADMIN_RESTORE_ENABLED, "true");
+    }
+
+    private void clearAdminServerProperties() {
+        System.clearProperty("zookeeper.admin.enableServer");
+        System.clearProperty("zookeeper.admin.serverPort");
+        System.clearProperty(ADMIN_RATE_LIMITER_INTERVAL);
+        System.clearProperty(ADMIN_SNAPSHOT_ENABLED);
+        System.clearProperty(ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED);
+        System.clearProperty(ADMIN_RESTORE_ENABLED);
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/ShedConnectionsCommandTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/ShedConnectionsCommandTest.java
new file mode 100644
index 00000000000..cc02d3cf8bf
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/ShedConnectionsCommandTest.java
@@ -0,0 +1,265 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.admin;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.ArgumentMatchers.anyInt;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+import java.io.ByteArrayInputStream;
+import java.io.InputStream;
+import java.util.Map;
+import javax.servlet.http.HttpServletResponse;
+import org.apache.zookeeper.server.ServerCnxnFactory;
+import org.apache.zookeeper.server.ZooKeeperServer;
+import org.junit.jupiter.api.Test;
+
+public class ShedConnectionsCommandTest {
+
+    private static final String VALID_JSON_25_PERCENT = "{\"percentage\": 25}";
+    private static final String VALID_JSON_100_PERCENT = "{\"percentage\": 100}";
+    private static final String VALID_JSON_1_PERCENT = "{\"percentage\": 1}";
+    private static final String VALID_JSON_0_PERCENT = "{\"percentage\": 0}";
+
+    private static final String INVALID_JSON_OVER_100_PERCENT = "{\"percentage\": 101}";
+
+    private static final String INVALID_JSON_MISSING_FIELD = "{\"other\": 25}";
+    private static final String INVALID_JSON_MALFORMED = "{\"percentage\": }";
+    private static final String INVALID_JSON_EMPTY = "{}";
+
+    @Test
+    public void testValidPercentage25() {
+        validateSuccessfulShedCommand(25, 50, 30, VALID_JSON_25_PERCENT, true, true);
+    }
+
+    @Test
+    public void testValidPercentage100() {
+        validateSuccessfulShedCommand(100, 20, 10, VALID_JSON_100_PERCENT, true, true);
+    }
+
+    @Test
+    public void testValidPercentage1() {
+        validateSuccessfulShedCommand(1, 100, 0, VALID_JSON_1_PERCENT, true, false);
+    }
+
+    @Test
+    public void testValidPercentage0() {
+        validateSuccessfulShedCommand(0, 100, 50, VALID_JSON_0_PERCENT, false, false);
+    }
+
+    @Test
+    public void testInvalidPercentage101() {
+        validateFailedShedCommand(INVALID_JSON_OVER_100_PERCENT, "Percentage must be between 0 and 100", true);
+    }
+
+    @Test
+    public void testInvalidNullInputStream() {
+        validateFailedShedCommand(null, "Request body is required", true);
+    }
+
+    @Test
+    public void testEmptyJson() {
+        validateFailedShedCommand(INVALID_JSON_EMPTY, "Missing required field: percentage", true);
+    }
+
+    @Test
+    public void testMissingPercentageParameter() {
+        validateFailedShedCommand(INVALID_JSON_MISSING_FIELD, "Missing required field: percentage", true);
+    }
+
+    @Test
+    public void testMalformedJson() {
+        validateFailedShedCommand(INVALID_JSON_MALFORMED, "Invalid JSON or failed to read request body", false);
+    }
+
+    @Test
+    public void testOnlyInsecureConnections() {
+        validateSuccessfulShedCommand(25, 40, 0, VALID_JSON_25_PERCENT, true, false);
+    }
+
+    @Test
+    public void testOnlySecureConnections() {
+        validateSuccessfulShedCommand(25, 0, 60, VALID_JSON_25_PERCENT, false, true);
+    }
+
+    @Test
+    public void testNoConnections() {
+        validateSuccessfulShedCommand(25, 0, 0, VALID_JSON_25_PERCENT, false, false);
+    }
+
+    @Test
+    public void testMixedConnections() {
+        validateSuccessfulShedCommand(25, 30, 20, VALID_JSON_25_PERCENT, true, true);
+    }
+
+    @Test
+    public void testCommandNames() {
+        final Commands.ShedConnectionsCommand command = new Commands.ShedConnectionsCommand();
+        assertEquals(2, command.getNames().size());
+        assertTrue(command.getNames().contains("shed"));
+        assertTrue(command.getNames().contains("shed_connections"));
+    }
+
+    @Test
+    public void testAuthorizationRequired() {
+        final Commands.ShedConnectionsCommand command = new Commands.ShedConnectionsCommand();
+        final AuthRequest authRequest = command.getAuthRequest();
+
+        assertNotNull(authRequest);
+        assertEquals(org.apache.zookeeper.ZooDefs.Perms.ALL, authRequest.getPermission());
+        assertEquals(Commands.ROOT_PATH, authRequest.getPath());
+    }
+
+    private void validateSuccessfulShedCommand(
+            final int expectedPercentage,
+            final int insecureConnections,
+            final int secureConnections,
+            final String jsonInput,
+            final boolean shouldCallInsecureFactory,
+            final boolean shouldCallSecureFactory) {
+
+        final Commands.ShedConnectionsCommand command = new Commands.ShedConnectionsCommand();
+        final ZooKeeperServer zkServer = createMockZooKeeperServer(insecureConnections, secureConnections);
+        final InputStream inputStream = new ByteArrayInputStream(jsonInput.getBytes());
+        final int totalConnections = insecureConnections + secureConnections;
+
+        final CommandResponse response = command.runPost(zkServer, inputStream);
+        assertSuccessfulResponse(response, expectedPercentage, totalConnections);
+        assertFactoryCalls(zkServer, expectedPercentage, shouldCallInsecureFactory, shouldCallSecureFactory);
+    }
+
+    private void validateFailedShedCommand(
+            final String jsonInput,
+            final String expectedError,
+            final boolean exactMatch) {
+
+        final Commands.ShedConnectionsCommand command = new Commands.ShedConnectionsCommand();
+        final ZooKeeperServer zkServer = createMockZooKeeperServer(10, 10);
+        final InputStream inputStream = jsonInput != null ? new ByteArrayInputStream(jsonInput.getBytes()) : null;
+
+        final CommandResponse response = command.runPost(zkServer, inputStream);
+
+        assertNotNull(response);
+        assertEquals(HttpServletResponse.SC_BAD_REQUEST, response.getStatusCode());
+
+        final Map<String, Object> result = response.toMap();
+        final String actualError = (String) result.get("error");
+
+        if (exactMatch) {
+            assertEquals(expectedError, actualError);
+        } else {
+            assertTrue(actualError.contains(expectedError),
+                    String.format("Expected error message to contain '%s', but was '%s'", expectedError, actualError));
+        }
+    }
+
+    private void assertSuccessfulResponse(
+            final CommandResponse response,
+            final int expectedPercentage,
+            final int totalConnections) {
+
+        assertNotNull(response);
+        assertEquals(HttpServletResponse.SC_OK, response.getStatusCode());
+
+        final Map<String, Object> result = response.toMap();
+        assertEquals(expectedPercentage, result.get("percentage_requested"));
+
+        assertTrue(result.containsKey("connections_shed"));
+        final int actualShed = (Integer) result.get("connections_shed");
+        assertTrue(actualShed >= 0, "Shed count should be non-negative");
+        assertTrue(actualShed <= totalConnections, "Cannot shed more than total connections");
+
+        // For 0% and 100%, we can make exact assertions
+        if (expectedPercentage == 0) {
+            assertEquals(0, actualShed, "0% should shed exactly 0 connections");
+        } else if (expectedPercentage == 100) {
+            assertEquals(totalConnections, actualShed, "100% should shed all connections");
+        }
+    }
+
+    private void assertFactoryCalls(
+            final ZooKeeperServer zkServer,
+            final int percentage,
+            final boolean shouldCallInsecureFactory,
+            final boolean shouldCallSecureFactory) {
+
+        final ServerCnxnFactory factory = zkServer.getServerCnxnFactory();
+        final ServerCnxnFactory secureFactory = zkServer.getSecureServerCnxnFactory();
+
+        if (factory != null) {
+            if (shouldCallInsecureFactory) {
+                verify(factory, times(1)).shedConnections(percentage);
+            } else {
+                verify(factory, never()).shedConnections(anyInt());
+            }
+        }
+
+        if (secureFactory != null) {
+            if (shouldCallSecureFactory) {
+                verify(secureFactory, times(1)).shedConnections(percentage);
+            } else {
+                verify(secureFactory, never()).shedConnections(anyInt());
+            }
+        }
+    }
+
+    private ZooKeeperServer createMockZooKeeperServer(int insecureConnections, int secureConnections) {
+        final ZooKeeperServer zkServer = mock(ZooKeeperServer.class);
+        final int totalConnections = insecureConnections + secureConnections;
+
+        when(zkServer.getNumAliveConnections()).thenReturn(totalConnections);
+
+        // Mock insecure factory
+        ServerCnxnFactory factory = null;
+        if (insecureConnections > 0) {
+            factory = createMockServerCnxnFactory(insecureConnections);
+        }
+        when(zkServer.getServerCnxnFactory()).thenReturn(factory);
+
+        // Mock secure factory
+        ServerCnxnFactory secureFactory = null;
+        if (secureConnections > 0) {
+            secureFactory = createMockServerCnxnFactory(secureConnections);
+        }
+        when(zkServer.getSecureServerCnxnFactory()).thenReturn(secureFactory);
+
+        return zkServer;
+    }
+
+    private ServerCnxnFactory createMockServerCnxnFactory(int connections) {
+        final ServerCnxnFactory factory = mock(ServerCnxnFactory.class);
+        when(factory.getNumAliveConnections()).thenReturn(connections);
+        when(factory.shedConnections(anyInt())).thenAnswer(invocation -> {
+            int percentage = invocation.getArgument(0);
+            if (percentage == 0) {
+                return 0;
+            }
+            if (percentage == 100) {
+                return connections;
+            }
+            return (int) Math.ceil(connections * percentage / 100.0);
+        });
+        return factory;
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/SnapshotAndRestoreCommandTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/SnapshotAndRestoreCommandTest.java
new file mode 100644
index 00000000000..8e189188f78
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/SnapshotAndRestoreCommandTest.java
@@ -0,0 +1,436 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.admin;
+
+import static org.apache.zookeeper.server.ZooKeeperServer.ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED;
+import static org.apache.zookeeper.server.admin.CommandAuthTest.addAuthInfoForDigest;
+import static org.apache.zookeeper.server.admin.CommandAuthTest.genACLForDigest;
+import static org.apache.zookeeper.server.admin.CommandAuthTest.resetRootACL;
+import static org.apache.zookeeper.server.admin.Commands.ADMIN_RATE_LIMITER_INTERVAL;
+import static org.apache.zookeeper.server.admin.Commands.RestoreCommand.ADMIN_RESTORE_ENABLED;
+import static org.apache.zookeeper.server.admin.Commands.SnapshotCommand.ADMIN_SNAPSHOT_ENABLED;
+import static org.apache.zookeeper.server.admin.Commands.SnapshotCommand.REQUEST_QUERY_PARAM_STREAMING;
+import static org.apache.zookeeper.server.admin.JettyAdminServerTest.URL_FORMAT;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.io.BufferedReader;
+import java.io.ByteArrayInputStream;
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.io.OutputStream;
+import java.io.UnsupportedEncodingException;
+import java.net.HttpURLConnection;
+import java.net.URL;
+import java.net.URLEncoder;
+import java.nio.file.Files;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.zip.CheckedInputStream;
+import javax.servlet.http.HttpServletResponse;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.common.IOUtils;
+import org.apache.zookeeper.metrics.MetricsUtils;
+import org.apache.zookeeper.server.ServerCnxnFactory;
+import org.apache.zookeeper.server.ServerMetrics;
+import org.apache.zookeeper.server.ZooKeeperServer;
+import org.apache.zookeeper.server.persistence.SnapStream;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.TestInstance;
+import org.junit.jupiter.api.io.TempDir;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+@TestInstance(TestInstance.Lifecycle.PER_CLASS)
+public class SnapshotAndRestoreCommandTest extends ZKTestCase {
+    private static final Logger LOG = LoggerFactory.getLogger(SnapshotAndRestoreCommandTest.class);
+
+    private static final String SNAPSHOT_TEST_PATH = "/snapshot_test";
+    private static final int NODE_COUNT = 10;
+
+    private final String hostPort = "127.0.0.1:" + PortAssignment.unique();
+    private final int jettyAdminPort = PortAssignment.unique();
+    private ServerCnxnFactory cnxnFactory;
+    private JettyAdminServer adminServer;
+    private ZooKeeperServer zks;
+    private ZooKeeper zk;
+
+    @TempDir
+    static File dataDir;
+
+    @TempDir
+    static File logDir;
+
+    @BeforeAll
+    public void setup() throws Exception {
+        // start ZookeeperServer
+        System.setProperty("zookeeper.4lw.commands.whitelist", "*");
+        zks = new ZooKeeperServer(dataDir, logDir, 3000);
+        final int port = Integer.parseInt(hostPort.split(":")[1]);
+        cnxnFactory = ServerCnxnFactory.createFactory(port, -1);
+        cnxnFactory.startup(zks);
+        assertTrue(ClientBase.waitForServerUp(hostPort, 120000));
+
+        // start AdminServer
+        System.setProperty("zookeeper.admin.enableServer", "true");
+        System.setProperty("zookeeper.admin.serverPort", String.valueOf(jettyAdminPort));
+
+        System.setProperty(ADMIN_RATE_LIMITER_INTERVAL, "0");
+        System.setProperty(ADMIN_SNAPSHOT_ENABLED, "true");
+        System.setProperty(ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED, "true");
+        System.setProperty(ADMIN_RESTORE_ENABLED, "true");
+
+        adminServer = new JettyAdminServer();
+        adminServer.setZooKeeperServer(zks);
+        adminServer.start();
+
+        // create Zookeeper client
+        zk = ClientBase.createZKClient(hostPort);
+
+        // setup root ACL
+        zk.setACL(Commands.ROOT_PATH, genACLForDigest(), -1);
+
+        // add auth
+        addAuthInfoForDigest(zk);
+
+        // create test data
+        createData(zk, SNAPSHOT_TEST_PATH, NODE_COUNT);
+    }
+
+    @AfterAll
+    public void tearDown() throws Exception {
+        System.clearProperty("zookeeper.4lw.commands.whitelist");
+        System.clearProperty("zookeeper.admin.enableServer");
+        System.clearProperty("zookeeper.admin.serverPort");
+        System.clearProperty(ADMIN_RATE_LIMITER_INTERVAL);
+        System.clearProperty(ADMIN_SNAPSHOT_ENABLED);
+        System.clearProperty(ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED);
+        System.clearProperty(ADMIN_RESTORE_ENABLED);
+
+        resetRootACL(zk);
+
+        if (zk != null) {
+            zk.close();
+        }
+
+        if (adminServer != null) {
+            adminServer.shutdown();
+        }
+
+        if (cnxnFactory != null) {
+            cnxnFactory.shutdown();
+        }
+
+        if (zks != null) {
+            zks.shutdown();
+        }
+    }
+
+    @Test
+    public void testSnapshotAndRestoreCommand_streaming() throws Exception {
+        ServerMetrics.getMetrics().resetAll();
+
+        // take snapshot with streaming and validate
+        final File snapshotFile = takeSnapshotAndValidate(jettyAdminPort, dataDir);
+
+        // validate snapshot metrics
+        validateSnapshotMetrics();
+
+        // restore from snapshot and validate
+        performRestoreAndValidate(jettyAdminPort, snapshotFile);
+
+        // validate creating data after restore
+        try (final ZooKeeper zk = ClientBase.createZKClient(hostPort)) {
+            addAuthInfoForDigest(zk);
+            createData(zk, SNAPSHOT_TEST_PATH, NODE_COUNT + 1);
+            assertEquals(NODE_COUNT + NODE_COUNT + 1, zk.getAllChildrenNumber(SNAPSHOT_TEST_PATH));
+        }
+
+        // validate restore metrics
+        validateRestoreMetrics();
+    }
+
+    @Test
+    public void testClientRequest_restoreInProgress() throws Exception {
+        final int threadCount = 2;
+        final int nodeCount = 50;
+        final String restoreTestPath = "/restore_test";
+
+        // take snapshot
+        final File snapshotFile = takeSnapshotAndValidate(jettyAdminPort, dataDir);
+
+        final ExecutorService service = Executors.newFixedThreadPool(threadCount);
+        final CountDownLatch latch = new CountDownLatch(threadCount);
+        final AtomicBoolean createSucceeded = new AtomicBoolean(false);
+        final AtomicBoolean restoreSucceeded = new AtomicBoolean(false);
+
+        // thread 1 creates data
+        service.submit(() -> {
+            try {
+                createData(zk, restoreTestPath, nodeCount);
+                createSucceeded.set(true);
+            } catch (final Exception e) {
+                LOG.error(e.getMessage());
+                e.printStackTrace();
+            } finally {
+                latch.countDown();
+            }
+        });
+
+        // thread 2 performs restore operation
+        service.submit(() -> {
+            try {
+                performRestoreAndValidate(jettyAdminPort, snapshotFile);
+                restoreSucceeded.set(true);
+            } catch (final Exception e) {
+                LOG.error(e.getMessage());
+                e.printStackTrace();
+            } finally {
+                latch.countDown();
+            }
+        });
+
+        // wait for operations completed
+        latch.await();
+
+        // validate all client requests succeeded
+        if (createSucceeded.get() && restoreSucceeded.get()) {
+            assertEquals(nodeCount, zk.getAllChildrenNumber(restoreTestPath));
+        }
+    }
+
+    @Test
+    public void testRestores() throws Exception {
+        // take snapshot
+        final File snapshotFile = takeSnapshotAndValidate(jettyAdminPort, dataDir);
+
+        // perform restores
+        for (int i = 0; i < 3; i++) {
+            performRestoreAndValidate(jettyAdminPort, snapshotFile);
+        }
+    }
+
+    @Test
+    public void testSnapshotCommand_nonStreaming() throws Exception {
+        // take snapshot without streaming
+        final HttpURLConnection snapshotConn = sendSnapshotRequest(false, jettyAdminPort);
+
+        // validate snapshot response
+        assertEquals(HttpURLConnection.HTTP_OK, snapshotConn.getResponseCode());
+        validateResponseHeaders(snapshotConn);
+        displayResponsePayload(snapshotConn);
+    }
+
+    @Test
+    public void testSnapshotCommand_disabled() throws Exception {
+        System.setProperty(ADMIN_SNAPSHOT_ENABLED, "false");
+        try {
+            // take snapshot
+            final HttpURLConnection snapshotConn = sendSnapshotRequest(true, jettyAdminPort);
+
+            // validate snapshot response
+            assertEquals(HttpServletResponse.SC_SERVICE_UNAVAILABLE, snapshotConn.getResponseCode());
+        } finally {
+            System.setProperty(ADMIN_SNAPSHOT_ENABLED, "true");
+        }
+    }
+
+    @Test
+    public void testSnapshotCommand_serializeLastZxidDisabled() throws Exception {
+        ZooKeeperServer.setSerializeLastProcessedZxidEnabled(false);
+        try {
+            // take snapshot
+            final HttpURLConnection snapshotConn = sendSnapshotRequest(true, jettyAdminPort);
+
+            // validate snapshot response
+            assertEquals(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, snapshotConn.getResponseCode());
+        } finally {
+            ZooKeeperServer.setSerializeLastProcessedZxidEnabled(true);
+        }
+    }
+
+    @Test
+    public void testRestoreCommand_disabled() throws Exception {
+        System.setProperty(ADMIN_RESTORE_ENABLED, "false");
+        try {
+            final HttpURLConnection restoreConn = sendRestoreRequest(jettyAdminPort);
+            assertEquals(HttpServletResponse.SC_SERVICE_UNAVAILABLE, restoreConn.getResponseCode());
+        } finally {
+            System.setProperty(ADMIN_RESTORE_ENABLED, "true");
+        }
+    }
+
+    @Test
+    public void testRestoreCommand_serializeLastZxidDisabled() throws Exception {
+        ZooKeeperServer.setSerializeLastProcessedZxidEnabled(false);
+        try {
+            final HttpURLConnection restoreConn = sendRestoreRequest(jettyAdminPort);
+            assertEquals(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, restoreConn.getResponseCode());
+        } finally {
+            ZooKeeperServer.setSerializeLastProcessedZxidEnabled(true);
+        }
+    }
+
+    @Test
+    public void testRestoreCommand_invalidSnapshotData() throws Exception {
+        final HttpURLConnection restoreConn = sendRestoreRequest(jettyAdminPort);
+        try (final InputStream inputStream = new ByteArrayInputStream("Invalid snapshot data".getBytes());
+             final OutputStream outputStream = restoreConn.getOutputStream()) {
+            IOUtils.copyBytes(inputStream, outputStream, 1024, true);
+        }
+        assertEquals(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, restoreConn.getResponseCode());
+    }
+
+    private void createData(final ZooKeeper zk, final String parentPath, final long count) throws Exception {
+        try {
+            zk.create(parentPath, new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        } catch (final KeeperException.NodeExistsException ignore) {
+            // ignore
+        }
+
+        for (int i = 0; i < count; i++) {
+            zk.create(String.format("%s/%s", parentPath, "n_"), new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL_SEQUENTIAL);
+        }
+    }
+
+    private static HttpURLConnection sendSnapshotRequest(final boolean streaming, final int jettyAdminPort) throws Exception  {
+        final String queryParamsStr = buildQueryStringForSnapshotCommand(streaming);
+        final URL snapshotURL = new URL(String.format(URL_FORMAT + "/snapshot", jettyAdminPort) + "?" + queryParamsStr);
+        final HttpURLConnection snapshotConn = (HttpURLConnection) snapshotURL.openConnection();
+        CommandAuthTest.addAuthHeader(snapshotConn, CommandAuthTest.AuthSchema.DIGEST, true);
+        snapshotConn.setRequestMethod("GET");
+
+        return snapshotConn;
+    }
+
+    private static HttpURLConnection sendRestoreRequest(final int jettyAdminPort) throws Exception  {
+        final URL restoreURL = new URL(String.format(URL_FORMAT + "/restore", jettyAdminPort));
+        final HttpURLConnection restoreConn = (HttpURLConnection) restoreURL.openConnection();
+        restoreConn.setDoOutput(true);
+        CommandAuthTest.addAuthHeader(restoreConn, CommandAuthTest.AuthSchema.DIGEST, true);
+        restoreConn.setRequestMethod("POST");
+
+        return restoreConn;
+    }
+
+    private static String buildQueryStringForSnapshotCommand(final boolean streaming) throws Exception {
+        final Map<String, String> parameters = new HashMap<>();
+        parameters.put(REQUEST_QUERY_PARAM_STREAMING, String.valueOf(streaming));
+        return getParamsString(parameters);
+    }
+
+    private static String getParamsString(final Map<String, String> params) throws UnsupportedEncodingException {
+        final StringBuilder result = new StringBuilder();
+
+        for (final Map.Entry<String, String> entry : params.entrySet()) {
+            result.append(URLEncoder.encode(entry.getKey(), "UTF-8"));
+            result.append("=");
+
+            result.append(URLEncoder.encode(entry.getValue(), "UTF-8"));
+            result.append("&");
+        }
+
+        final String resultString = result.toString();
+        return resultString.length() > 0
+                ? resultString.substring(0, resultString.length() - 1)
+                : resultString;
+    }
+
+    private static void validateResponseHeaders(final HttpURLConnection conn) {
+        LOG.info("Header:{}, Value:{}",
+                Commands.SnapshotCommand.RESPONSE_HEADER_LAST_ZXID,
+                conn.getHeaderField(Commands.SnapshotCommand.RESPONSE_HEADER_LAST_ZXID));
+        assertNotNull(conn.getHeaderField(Commands.SnapshotCommand.RESPONSE_HEADER_LAST_ZXID));
+
+        LOG.info("Header:{}, Value:{}",
+                Commands.SnapshotCommand.RESPONSE_HEADER_SNAPSHOT_SIZE,
+                conn.getHeaderField(Commands.SnapshotCommand.RESPONSE_HEADER_SNAPSHOT_SIZE));
+        assertNotNull(conn.getHeaderField(Commands.SnapshotCommand.RESPONSE_HEADER_SNAPSHOT_SIZE));
+        assertTrue(Integer.parseInt(conn.getHeaderField(Commands.SnapshotCommand.RESPONSE_HEADER_SNAPSHOT_SIZE)) > 0);
+    }
+
+    private static void displayResponsePayload(final HttpURLConnection conn) throws IOException {
+        final StringBuilder sb = new StringBuilder();
+        try (final BufferedReader in = new BufferedReader(new InputStreamReader(conn.getInputStream()))) {
+            String inputLine;
+            while ((inputLine = in.readLine()) != null) {
+                sb.append(inputLine);
+            }
+            LOG.info("Response payload: {}", sb);
+        }
+    }
+
+    private void validateSnapshotMetrics() {
+        Map<String, Object> metrics = MetricsUtils.currentServerMetrics();
+        assertEquals(0, (long) metrics.get("snapshot_error_count"));
+        assertEquals(0, (long) metrics.get("snapshot_rate_limited_count"));
+        assertTrue((Double) metrics.get("avg_snapshottime") > 0.0);
+    }
+
+    private void validateRestoreMetrics() {
+        Map<String, Object> metrics = MetricsUtils.currentServerMetrics();
+        assertEquals(0, (long) metrics.get("restore_error_count"));
+        assertEquals(0, (long) metrics.get("restore_rate_limited_count"));
+        assertTrue((Double) metrics.get("avg_restore_time") > 0.0);
+    }
+
+    public static  File takeSnapshotAndValidate(final int jettyAdminPort, final File dataDir) throws Exception {
+        // take snapshot with streaming
+        final HttpURLConnection snapshotConn = sendSnapshotRequest(true, jettyAdminPort);
+
+        // validate snapshot response
+        assertEquals(HttpURLConnection.HTTP_OK, snapshotConn.getResponseCode());
+        validateResponseHeaders(snapshotConn);
+        final File snapshotFile = new File(dataDir + "/snapshot." + System.currentTimeMillis());
+        try (final InputStream inputStream = snapshotConn.getInputStream();
+             final FileOutputStream outputStream = new FileOutputStream(snapshotFile)) {
+            IOUtils.copyBytes(inputStream, outputStream, 1024, true);
+            final long fileSize = Files.size(snapshotFile.toPath());
+            assertTrue(fileSize > 0);
+        }
+        return snapshotFile;
+    }
+
+    public static void performRestoreAndValidate(final int jettyAdminPort, final File snapshotFile) throws Exception {
+        // perform restore
+        final HttpURLConnection restoreConn = sendRestoreRequest(jettyAdminPort);
+        try (final CheckedInputStream is = SnapStream.getInputStream(snapshotFile);
+             final OutputStream outputStream = restoreConn.getOutputStream()) {
+            IOUtils.copyBytes(is, outputStream, 1024, true);
+        }
+        // validate restore response
+        assertEquals(HttpURLConnection.HTTP_OK, restoreConn.getResponseCode());
+        displayResponsePayload(restoreConn);
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/auth/IPAuthenticationProviderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/auth/IPAuthenticationProviderTest.java
new file mode 100644
index 00000000000..1586cac39a3
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/auth/IPAuthenticationProviderTest.java
@@ -0,0 +1,189 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.server.auth;
+
+import static org.apache.zookeeper.server.auth.IPAuthenticationProvider.USE_X_FORWARDED_FOR_KEY;
+import static org.apache.zookeeper.server.auth.IPAuthenticationProvider.X_FORWARDED_FOR_HEADER_NAME;
+import static org.hamcrest.CoreMatchers.containsString;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.mock;
+import java.util.stream.Stream;
+import javax.servlet.http.HttpServletRequest;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
+
+public class IPAuthenticationProviderTest {
+
+  private HttpServletRequest request;
+
+  @Before
+  public void setUp() throws Exception {
+    System.clearProperty(USE_X_FORWARDED_FOR_KEY);
+    request = mock(HttpServletRequest.class);
+  }
+
+  @After
+  public void tearDown() {
+    System.clearProperty(USE_X_FORWARDED_FOR_KEY);
+  }
+
+  @Test
+  public void testGetClientIPAddressSkipXForwardedFor() {
+    // Arrange
+    System.setProperty(USE_X_FORWARDED_FOR_KEY, "false");
+    doReturn("192.168.1.1").when(request).getRemoteAddr();
+    doReturn("192.168.1.2,192.168.1.3,192.168.1.4").when(request).getHeader(X_FORWARDED_FOR_HEADER_NAME);
+
+    // Act
+    String clientIp = IPAuthenticationProvider.getClientIPAddress(request);
+
+    // Assert
+    assertEquals("192.168.1.1", clientIp);
+  }
+
+  @Test
+  public void testGetClientIPAddressDefaultBehaviour() {
+    // Arrange
+    System.clearProperty(USE_X_FORWARDED_FOR_KEY);
+    doReturn("192.168.1.1").when(request).getRemoteAddr();
+    doReturn("192.168.1.2,192.168.1.3,192.168.1.4").when(request).getHeader(X_FORWARDED_FOR_HEADER_NAME);
+
+    // Act
+    String clientIp = IPAuthenticationProvider.getClientIPAddress(request);
+
+    // Assert
+    assertEquals("192.168.1.1", clientIp);
+  }
+
+  @Test
+  public void testGetClientIPAddressWithXForwardedFor() {
+    // Arrange
+    System.setProperty(USE_X_FORWARDED_FOR_KEY, "true");
+    doReturn("192.168.1.1").when(request).getRemoteAddr();
+    doReturn("192.168.1.2,192.168.1.3,192.168.1.4").when(request).getHeader(X_FORWARDED_FOR_HEADER_NAME);
+
+    // Act
+    String clientIp = IPAuthenticationProvider.getClientIPAddress(request);
+
+    // Assert
+    assertEquals("192.168.1.2", clientIp);
+  }
+
+  @Test
+  public void testGetClientIPAddressMissingXForwardedFor() {
+    // Arrange
+    System.setProperty(USE_X_FORWARDED_FOR_KEY, "false");
+    doReturn("192.168.1.1").when(request).getRemoteAddr();
+
+    // Act
+    String clientIp = IPAuthenticationProvider.getClientIPAddress(request);
+
+    // Assert
+    assertEquals("192.168.1.1", clientIp);
+  }
+
+  @Test
+  public void testParsingOfIPv6Address() {
+    //Full IPv6 address
+    String ipv6Full = "2001:0db8:85a3:0000:0000:8a2e:0370:7334";
+    byte[] expectedFull = {
+            (byte) 0x20, (byte) 0x01, (byte) 0x0d, (byte) 0xb8,
+            (byte) 0x85, (byte) 0xa3, (byte) 0x00, (byte) 0x00,
+            (byte) 0x00, (byte) 0x00, (byte) 0x8a, (byte) 0x2e,
+            (byte) 0x03, (byte) 0x70, (byte) 0x73, (byte) 0x34
+    };
+    byte[] actualFull = IPAuthenticationProvider.v6addr2Bytes(ipv6Full);
+    assertNotNull(actualFull, "Full IPv6 address should not return null");
+    assertArrayEquals(expectedFull, actualFull, "Full IPv6 address conversion mismatch");
+
+    //Compressed IPv6 address (double colon)
+    String ipv6Compressed = "2001:db8::8a2e:370:7334";
+    byte[] expectedCompressed = {
+            (byte) 0x20, (byte) 0x01, (byte) 0x0d, (byte) 0xb8,
+            (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
+            (byte) 0x00, (byte) 0x00, (byte) 0x8a, (byte) 0x2e,
+            (byte) 0x03, (byte) 0x70, (byte) 0x73, (byte) 0x34
+    };
+    byte[] actualCompressed = IPAuthenticationProvider.v6addr2Bytes(ipv6Compressed);
+    assertNotNull(actualCompressed, "Compressed IPv6 address should not return null");
+    assertArrayEquals(expectedCompressed, actualCompressed, "Compressed IPv6 address conversion mismatch");
+
+    //Shortened IPv6 address
+    String ipv6Shortened = "2001:db8::1";
+    byte[] expectedShortened = {
+            (byte) 0x20, (byte) 0x01, (byte) 0x0d, (byte) 0xb8,
+            (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
+            (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
+            (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x01
+    };
+    byte[] actualShortened = IPAuthenticationProvider.v6addr2Bytes(ipv6Shortened);
+    assertNotNull(actualShortened, "Shortened IPv6 address should not return null");
+    assertArrayEquals(expectedShortened, actualShortened, "Shortened IPv6 address conversion mismatch");
+
+    //Loopback address
+    String ipv6Loopback = "::1";
+    byte[] expectedLoopback = {
+            (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
+            (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
+            (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
+            (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x01
+    };
+    byte[] actualLoopback = IPAuthenticationProvider.v6addr2Bytes(ipv6Loopback);
+    assertNotNull(actualLoopback, "Loopback IPv6 address should not return null");
+    assertArrayEquals(expectedLoopback, actualLoopback, "Loopback IPv6 address conversion mismatch");
+  }
+
+  private static Stream<Arguments> invalidIPv6Addresses() {
+    return Stream.of(
+      Arguments.of("1", "wrong number of segments"),
+      Arguments.of("1:2", "wrong number of segments"),
+      Arguments.of("1::2:", "empty segment"),
+      Arguments.of(":1::2:", "empty segment"),
+      Arguments.of("1:2:3:4:5:6:7:8:", "wrong number of segments"),
+      Arguments.of("1:2:3:4:5:6:7:8:9", "wrong number of segments"),
+      Arguments.of("1:2::3:4:5:6:7:8", "too many segments"),
+      Arguments.of("1::2::", "too many '::'"),
+      Arguments.of("1:abcdf::", "segment too long"),
+      Arguments.of("efgh::", "invalid hexadecimal characters in segment"),
+      Arguments.of("1:: ", "invalid hexadecimal characters in segment"),
+      Arguments.of(" 1::", "invalid hexadecimal characters in segment")
+    );
+  }
+
+  @ParameterizedTest(name = "address = \"{0}\"")
+  @MethodSource("invalidIPv6Addresses")
+  public void testParsingOfInvalidIPv6Address(String ipv6Address, String expectedMessage) {
+    try {
+      IPAuthenticationProvider.parseV6addr(ipv6Address);
+      fail("expect failure");
+    } catch (IllegalArgumentException e) {
+      assertThat(e.getMessage(), containsString(expectedMessage));
+    }
+    assertNull(IPAuthenticationProvider.v6addr2Bytes(ipv6Address));
+  }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControlCommandTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControlCommandTest.java
new file mode 100644
index 00000000000..050bcef124e
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControlCommandTest.java
@@ -0,0 +1,85 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.controller;
+
+import org.junit.Assert;
+import org.junit.Test;
+
+public class ControlCommandTest {
+
+  @Test
+  public void verifyGeneratedUri() {
+    Assert.assertEquals("command/ping",
+        ControlCommand.createCommandUri(ControlCommand.Action.PING, null).toLowerCase());
+    Assert.assertEquals("command/ping",
+        ControlCommand.createCommandUri(ControlCommand.Action.PING, "").toLowerCase());
+    Assert.assertEquals("command/closeconnection/1234",
+        ControlCommand.createCommandUri(ControlCommand.Action.CLOSECONNECTION,
+            "1234").toLowerCase());
+  }
+
+  @Test
+  public void verifyParseChecksForNull() {
+    try {
+      ControlCommand.parseUri(null);
+      Assert.fail("Should have thrown for null.");
+    } catch (IllegalArgumentException ex) {
+    }
+  }
+
+  @Test
+  public void verifyParseChecksForPrefix() {
+    try {
+      ControlCommand.parseUri("ping");
+      Assert.fail("Should have thrown for missing command/ prefix.");
+    } catch (IllegalArgumentException ex) {
+    }
+  }
+
+  @Test
+  public void verifyParseCorrectlyFindsCommandWithNoParameter() {
+    Assert.assertEquals(ControlCommand.Action.PING,
+        ControlCommand.parseUri("command/ping").getAction());
+  }
+
+  @Test
+  public void verifyParseCorrectlyFindsCommandWithParameter() {
+    ControlCommand command = ControlCommand.parseUri("command/closeconnection/1234");
+    Assert.assertEquals(ControlCommand.Action.CLOSECONNECTION, command.getAction());
+    Assert.assertEquals("1234", command.getParameter());
+  }
+
+  @Test
+  public void verifyParseIllegalCommandWithNoParameter() {
+    try {
+      ControlCommand.parseUri("pings");
+      Assert.fail("Should have thrown for non existing command.");
+    } catch (IllegalArgumentException ex) {
+    }
+  }
+
+  @Test
+  public void verifyParseIllegalCommandWithParameter() {
+    try {
+      ControlCommand.parseUri("command/close_connection/1234");
+      Assert.fail("Should have thrown for non existing command.");
+    } catch (IllegalArgumentException ex) {
+    }
+  }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerClientServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerClientServerTest.java
new file mode 100644
index 00000000000..d6fd986fdcf
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerClientServerTest.java
@@ -0,0 +1,105 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.controller;
+
+import org.junit.Assert;
+import org.junit.Test;
+
+public class ControllerClientServerTest extends ControllerTestBase {
+    @Test
+    public void verifyPingCommand() {
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.PING));
+    }
+
+    @Test
+    public void verifyCloseConnectionCommand() {
+        // Valid long session ids should be accepted.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.CLOSECONNECTION, "0x1234"));
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.CLOSECONNECTION, "1234"));
+
+        // Invalid session id format should fail.
+        Assert.assertFalse(commandClient.trySendCommand(ControlCommand.Action.CLOSECONNECTION, "hanm"));
+
+        // No parameter should be accepted.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.CLOSECONNECTION));
+    }
+
+    @Test
+    public void verifyExpireSessionCommand() {
+        // Valid long session ids should be accepted.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.EXPIRESESSION, "0x1234"));
+
+        // Invalid session id format should fail.
+        Assert.assertFalse(commandClient.trySendCommand(ControlCommand.Action.EXPIRESESSION, "hanm"));
+
+        // No parameter should be accepted.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.EXPIRESESSION));
+    }
+
+    @Test
+    public void verifyAddResetDelayCommands() {
+        // Valid longs should be parsed.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.ADDDELAY, "0x1234"));
+
+        // Invalid longs should fail.
+        Assert.assertFalse(commandClient.trySendCommand(ControlCommand.Action.ADDDELAY, "hanm"));
+
+        // No parameter should be accepted.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.ADDDELAY));
+
+        // Reset delay should work.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.RESET));
+    }
+
+    @Test
+    public void verifyBadResponseCommands() {
+        // Valid longs should be parsed.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.FAILREQUESTS, "0x1234"));
+
+        // Invalid longs should fail.
+        Assert.assertFalse(commandClient.trySendCommand(ControlCommand.Action.FAILREQUESTS, "hanm"));
+
+        // No parameter should be accepted.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.FAILREQUESTS));
+
+        // Reset should work.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.RESET));
+    }
+
+    @Test
+    public void verifyEatResponseCommands() {
+        // Valid longs should be parsed.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.NORESPONSE, "0x1234"));
+
+        // Invalid longs should fail.
+        Assert.assertFalse(commandClient.trySendCommand(ControlCommand.Action.NORESPONSE, "hanm"));
+
+        // No parameter should be accepted.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.NORESPONSE));
+
+        // Reset should work.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.RESET));
+    }
+
+    @Test
+    public void verifyLeaderElectionCommand() {
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.ELECTNEWLEADER));
+    }
+
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerConfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerConfigTest.java
new file mode 100644
index 00000000000..3a0bda686e2
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerConfigTest.java
@@ -0,0 +1,154 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.controller;
+
+import java.io.File;
+import java.io.FileWriter;
+import java.io.IOException;
+import java.io.PrintWriter;
+import java.net.ServerSocket;
+import java.util.ArrayList;
+import java.util.List;
+import org.apache.zookeeper.common.ConfigException;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+public class ControllerConfigTest {
+
+    @TempDir
+    static File configDir;
+    File configFile;
+
+    private static final int AnyTickTime = 1234;
+    private static final int AnyPort = 1234;
+    private static final String AnyDataDir = "temp";
+
+    public static File createTempFile() throws IOException {
+        return File.createTempFile("temp", "cfg", configDir);
+    }
+
+    public static List<Integer> findNAvailablePorts(int n) throws IOException {
+        List<ServerSocket> openedSockets = new ArrayList<>();
+        List<Integer> ports = new ArrayList<>();
+
+        for (int i = 0; i < n; i++) {
+            ServerSocket randomSocket = new ServerSocket(0);
+            openedSockets.add(randomSocket);
+            ports.add(randomSocket.getLocalPort());
+        }
+
+        for (ServerSocket s : openedSockets) {
+            s.close();
+        }
+
+        return ports;
+    }
+
+    public static void writeRequiredControllerConfig(File file, int controllerPort, int zkServerPort, int adminServerPort) throws IOException {
+        PrintWriter writer = new PrintWriter(file);
+        writer.write("dataDir=anywhere\n");
+        writer.write("controllerPort=" + controllerPort + "\n");
+        writer.write("clientPort=" + zkServerPort + "\n");
+        writer.write("adminPort=" + adminServerPort + "\n");
+        writer.close();
+    }
+
+    @Before
+    public void init() throws IOException {
+        configFile = createTempFile();
+    }
+
+    private void writeFile(int portNumber) throws IOException {
+        FileWriter writer = new FileWriter(configFile);
+        writer.write("dataDir=somewhere\n");
+        writer.write("ignore=me\n");
+        writer.write("tickTime=" + AnyTickTime + "\n");
+        writer.write("controllerPort=" + portNumber + "\n");
+        writer.write("clientPort=" + portNumber + "\n");
+        writer.flush();
+        writer.close();
+    }
+
+    @After
+    public void cleanup() {
+        if (configFile != null) {
+            configFile.delete();
+        }
+    }
+
+    @Test
+    public void parseFileSucceeds() throws Exception {
+        writeFile(AnyPort);
+        ControllerServerConfig config = new ControllerServerConfig(configFile.getAbsolutePath());
+        Assert.assertEquals(AnyPort, config.getControllerAddress().getPort());
+        Assert.assertEquals(AnyPort, config.getClientPortAddress().getPort());
+        Assert.assertEquals(AnyTickTime, config.getTickTime());
+    }
+
+    @Test
+    public void parseFileFailsWithMissingPort() throws Exception {
+        FileWriter writer = new FileWriter(configFile);
+        writer.write("dataDir=somewhere\n");
+        writer.flush();
+        writer.close();
+        try {
+            ControllerServerConfig config = new ControllerServerConfig(configFile.getAbsolutePath());
+            Assert.fail("Should have thrown with missing server config");
+        } catch (ConfigException ex) {
+        }
+    }
+
+    @Test public void parseMissingFileThrows() {
+        try {
+            ControllerServerConfig config = new ControllerServerConfig("DontLookHere.missing");
+            Assert.fail("should have thrown");
+        } catch (ConfigException ex) {
+        }
+    }
+
+    @Test
+    public void parseInvalidPortThrows()throws ConfigException {
+        try {
+            ControllerServerConfig config = new ControllerServerConfig(configFile.getAbsolutePath());
+            Assert.fail("should have thrown");
+        } catch (ConfigException ex) {
+        }
+    }
+
+    @Test
+    public void validCtor() {
+        ControllerServerConfig config = new ControllerServerConfig(AnyPort, AnyPort, AnyDataDir);
+        Assert.assertEquals(AnyPort, config.getControllerAddress().getPort());
+        Assert.assertEquals(AnyPort, config.getClientPortAddress().getPort());
+        Assert.assertEquals(AnyDataDir, config.getDataDir().getName());
+    }
+
+    @Test
+    public void invalidCtor() {
+        try {
+            ControllerServerConfig config = new ControllerServerConfig(-10, -10, "no where");
+            Assert.fail("should have thrown");
+        } catch (IllegalArgumentException ex) {
+        }
+
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerTestBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerTestBase.java
new file mode 100644
index 00000000000..7035d54184e
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ControllerTestBase.java
@@ -0,0 +1,68 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.controller;
+
+import java.io.File;
+import java.util.List;
+import java.util.concurrent.TimeoutException;
+import org.apache.zookeeper.ZKTestCase;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.jupiter.api.io.TempDir;
+
+public class ControllerTestBase extends ZKTestCase {
+
+    protected ControllerService controllerService;
+    protected CommandClient commandClient;
+    protected ControllerServerConfig config;
+
+    @Before
+    public void init(@TempDir File tempDir) throws Exception {
+        List<Integer> openPorts = ControllerConfigTest.findNAvailablePorts(2);
+
+        config = new ControllerServerConfig(openPorts.get(0), openPorts.get(1), tempDir.getAbsolutePath());
+        controllerService = new ControllerService();
+        controllerService.start(config);
+
+        int retries = 50;
+        // The controller needs to hold an election before it is ready to process requests.
+        // Busy-wait until its ready...
+        while (!controllerService.isReady()) {
+            Thread.sleep(100);
+            retries--;
+            if (retries < 0) {
+                throw new TimeoutException("Service didn't start up and finish elections.");
+            }
+        }
+
+        // Create a client which sends requests to localhost on the configured port.
+        commandClient = new CommandClient(config.getControllerAddress().getPort());
+    }
+
+    @After
+    public void cleanup() throws InterruptedException {
+        if (controllerService != null) {
+            controllerService.shutdown();
+        }
+
+        if (commandClient != null) {
+            commandClient.close();
+        }
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ZooKeeperServerControllerEndToEndTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ZooKeeperServerControllerEndToEndTest.java
new file mode 100644
index 00000000000..06b362638e0
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/controller/ZooKeeperServerControllerEndToEndTest.java
@@ -0,0 +1,384 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.controller;
+
+import java.io.IOException;
+import java.util.LinkedList;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;
+import org.apache.zookeeper.AsyncCallback;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.WatchedEvent;
+import org.apache.zookeeper.Watcher;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.ZooKeeper;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Ignore;
+import org.junit.Test;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class ZooKeeperServerControllerEndToEndTest extends ControllerTestBase {
+    private static final Logger LOG = LoggerFactory.getLogger(ZooKeeperServerControllerEndToEndTest.class);
+    private ZooKeeper zkClient;
+    private static final String AnyPath = "/Any";
+    private static final byte[] AnyData = new byte[] {0x0, 0x1};
+
+    @After
+    @Override
+    public void cleanup() throws InterruptedException {
+        if (zkClient != null) {
+            zkClient.close();
+        }
+        super.cleanup();
+    }
+
+    private void initClient(Watcher watcher) throws IOException {
+        zkClient = new ZooKeeper("localhost:" + config.getClientPortAddress().getPort(), 10000, watcher);
+    }
+
+    @Test
+    public void verifyClientConnects() throws Exception {
+        // Basic validation: we can connect and get events.
+        BlockingStateWatcher watcher = new BlockingStateWatcher(Watcher.Event.KeeperState.SyncConnected);
+        this.initClient(watcher);
+        watcher.waitForEvent();
+    }
+
+    @Test
+    public void verifyClientDisconnectsAndReconnects() throws Exception {
+        // Setup: First connect to the server and wait for connected.
+        BlockingStateWatcher watcher = new BlockingStateWatcher(Watcher.Event.KeeperState.SyncConnected);
+        initClient(watcher);
+        watcher.waitForEvent();
+
+        // Force a disconnection through the controller and ensure we get the events in order:
+        // 1: Disconnected
+        // 2: SyncConnected
+        watcher.reset(
+                new Watcher.Event.KeeperState[] {
+                        Watcher.Event.KeeperState.Disconnected,
+                        Watcher.Event.KeeperState.SyncConnected
+                });
+        Assert.assertTrue(commandClient
+                .trySendCommand(ControlCommand.Action.CLOSECONNECTION, String.valueOf(zkClient.getSessionId())));
+        watcher.waitForEvent();
+    }
+
+    @Test
+    public void verifySessionExpiration() throws Exception {
+        // Setup: First connect to the server and wait for connected.
+        BlockingStateWatcher watcher = new BlockingStateWatcher(Watcher.Event.KeeperState.SyncConnected);
+        initClient(watcher);
+        watcher.waitForEvent();
+
+        // Force an expiration.
+        // 1: Disconnected
+        // 2: Expired
+        watcher.reset(
+                new Watcher.Event.KeeperState[] {
+                        Watcher.Event.KeeperState.Disconnected,
+                        Watcher.Event.KeeperState.Expired
+                });
+        Assert.assertTrue(commandClient
+                .trySendCommand(ControlCommand.Action.EXPIRESESSION, String.valueOf(zkClient.getSessionId())));
+        watcher.waitForEvent();
+    }
+
+    @Test
+    public void verifyGlobalSessionExpiration() throws Exception {
+        // Step 1: Connect.
+        BlockingStateWatcher stateWatcher = new BlockingStateWatcher(Watcher.Event.KeeperState.SyncConnected);
+        initClient(stateWatcher);
+        stateWatcher.waitForEvent();
+
+        // Step 2: Add an ephemeral node (upgrades session to global).
+        BlockingPathWatcher pathWatcher = new BlockingPathWatcher(AnyPath, Watcher.Event.EventType.NodeCreated);
+
+        zkClient.exists(AnyPath, pathWatcher);
+        Assert.assertEquals(AnyPath,
+                zkClient.create(AnyPath, AnyData, ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL));
+        pathWatcher.waitForEvent();
+
+        // Force expire all sessions.
+        stateWatcher.reset(Watcher.Event.KeeperState.Expired);
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.EXPIRESESSION));
+        stateWatcher.waitForEvent();
+    }
+
+    @Ignore
+    public void verifyRejectAcceptSessions() throws Exception {
+        // Tell the server to reject new requests.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.REJECTCONNECTIONS));
+        EventWaiter watcher = new BlockingStateWatcher(Watcher.Event.KeeperState.SyncConnected);
+        initClient(watcher);
+        try {
+            watcher.waitForEvent(100);
+            Assert.fail("should have failed connecting");
+        } catch (TimeoutException ex) {
+        }
+        // Now accept requests. We should get a connection quickly.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.RESET));
+        watcher.waitForEvent();
+    }
+
+    private long timedTransaction() throws Exception {
+        long startTime = System.currentTimeMillis();
+        zkClient.exists(AnyPath, false);
+        return System.currentTimeMillis() - startTime;
+    }
+
+    @Test
+    public void verifyAddDelay() throws Exception {
+        EventWaiter watcher = new BlockingStateWatcher(Watcher.Event.KeeperState.SyncConnected);
+
+        initClient(watcher);
+        watcher.waitForEvent();
+        timedTransaction();
+
+        // Add 200 ms of delay to each response.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.ADDDELAY, String.valueOf(200)));
+        long delayedDuration = timedTransaction();
+
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.RESET));
+        long resetDuration = timedTransaction();
+
+        Assert.assertTrue(delayedDuration - resetDuration > 200);
+    }
+
+    @Test
+    public void verifyFailAllRequests() throws Exception {
+        // Step 1: Connect.
+        BlockingStateWatcher stateWatcher = new BlockingStateWatcher(Watcher.Event.KeeperState.SyncConnected);
+        initClient(stateWatcher);
+        stateWatcher.waitForEvent();
+
+        // Step 2: Tell the server to fail requests.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.FAILREQUESTS));
+
+        try {
+            zkClient.exists(AnyPath, null);
+            Assert.fail("should have failed");
+        } catch (KeeperException ex) {
+        }
+
+        // 2nd should fail: we haven't reset.
+        try {
+            zkClient.exists(AnyPath, null);
+            Assert.fail("should still fail");
+        } catch (KeeperException ex) {
+        }
+
+        // Reset; future requests should succeed.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.RESET));
+
+        zkClient.exists(AnyPath, null);
+    }
+
+    @Test
+    public void verifyFailRequestCount() throws Exception {
+        // Step 1: Connect.
+        BlockingStateWatcher stateWatcher = new BlockingStateWatcher(Watcher.Event.KeeperState.SyncConnected);
+        initClient(stateWatcher);
+        stateWatcher.waitForEvent();
+
+        // Step 2: Tell the server to fail 1 request.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.FAILREQUESTS, "1"));
+
+        try {
+            zkClient.exists(AnyPath, null);
+            Assert.fail("should have failed");
+        } catch (KeeperException ex) {
+        }
+
+        // Have not reset; should succeed.
+        zkClient.exists(AnyPath, null);
+    }
+
+    @Test
+    public void verifyServerEatsAllResponses() throws Exception {
+        // Step 1: Connect.
+        BlockingStateWatcher watcher = new BlockingStateWatcher(Watcher.Event.KeeperState.SyncConnected);
+        initClient(watcher);
+        watcher.waitForEvent();
+
+        // No data yet.
+        Assert.assertNull(zkClient.exists(AnyPath, null));
+
+        // Step 2: Tell the server to eat responses...nom...nom...nom....
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.NORESPONSE));
+
+        try {
+            BlockingPathWatcher pathWatcher = new BlockingPathWatcher(AnyPath, Watcher.Event.EventType.NodeCreated);
+            // This async call should succeed in setting the data, but never send a response.
+            zkClient.create(AnyPath, AnyData, ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL, pathWatcher, null);
+            pathWatcher.waitForEvent(500);
+            Assert.fail("should time out since the event should never come");
+        } catch (TimeoutException ex) {
+        }
+
+        // Re-enable responses.
+        Assert.assertTrue(commandClient.trySendCommand(ControlCommand.Action.RESET));
+        watcher.reset(Watcher.Event.KeeperState.SyncConnected);
+
+        try {
+            // Even though we get a good response, the client doesn't know about
+            // the transaction id (xid). This should terminate the connection and
+            // throw a KeeperException.
+            zkClient.exists(AnyPath, false);
+            Assert.fail("should have failed with bad xid");
+        } catch (KeeperException ex) {
+            // The client believes it has fallen behind so deems this a connection loss.
+            Assert.assertTrue(ex instanceof KeeperException.ConnectionLossException);
+        }
+
+        // The client should reconnect and be healthy after this.
+        watcher.waitForEvent();
+        Assert.assertNotNull(zkClient.exists(AnyPath, false));
+    }
+
+    /**
+     * Our watcher interface is called back on a potentially separate thread.
+     * Tests should be logically consolidated into a single method in the following format:
+     * for each action in my test
+     *     Setup test action
+     *     Kick off async action
+     *     await state change
+     *     verify state
+     *
+     * To enable this logical pattern, the watcher has an ordered set of states to wait on.
+     * When all the states have arrived (in order), the notifier is unblocked.
+     */
+    private abstract class EventWaiter implements Watcher, AsyncCallback.StringCallback {
+        private final int DEFAULT_WAIT_DURATION = 10000;
+        private CountDownLatch eventNotification;
+
+        public EventWaiter() {
+            reset();
+        }
+
+        protected void reset() {
+            eventNotification = new CountDownLatch(1);
+        }
+
+        @Override
+        public void process(WatchedEvent event) {
+            // NO-OP. Derived classes should override if required.
+            LOG.info("WatchedEvent: {}", event);
+        }
+
+        @Override
+        public void processResult(int rc, String path, Object ctx, String name) {
+            // NO-OP. Derived classes to implement if required.
+            LOG.info("StringCallback: {}, {}, {}, {}", rc, path, ctx, name);
+        }
+
+        public void notifyListener() {
+            eventNotification.countDown();
+        }
+
+        public void waitForEvent() throws InterruptedException, TimeoutException {
+            waitForEvent(DEFAULT_WAIT_DURATION);
+        }
+
+        public void waitForEvent(int waitDurationInMs) throws InterruptedException, TimeoutException {
+            // Wait ten seconds and throw if we time out.
+            if (!eventNotification.await(waitDurationInMs, TimeUnit.MILLISECONDS)) {
+                throw new TimeoutException("Timed out waiting for event");
+            }
+        }
+    }
+
+    private class BlockingStateWatcher extends EventWaiter {
+        private Object lockMe = new Object();
+        private LinkedList<Event.KeeperState> statesToWaitFor;
+
+        public BlockingStateWatcher(Event.KeeperState stateToNotifyOn) {
+            reset(stateToNotifyOn);
+        }
+
+        @Override
+        public void process(WatchedEvent event) {
+            LOG.info("State transition: {}", event.getState());
+
+            boolean shouldNotify = false;
+            synchronized (lockMe) {
+                if (!statesToWaitFor.isEmpty() && statesToWaitFor.getFirst() == event.getState()) {
+                    statesToWaitFor.removeFirst();
+                    shouldNotify = statesToWaitFor.isEmpty();
+                }
+            }
+
+            if (shouldNotify) {
+                notifyListener();
+            }
+        }
+
+        public void reset(Event.KeeperState stateToNotifyOn) {
+            reset(new Event.KeeperState[] {stateToNotifyOn});
+        }
+
+        public void reset(Event.KeeperState[] orderedStatesToWaitOn) {
+            if (orderedStatesToWaitOn == null) {
+                throw new IllegalArgumentException("orderedStatesToWaitOn can't be null.");
+            }
+
+            if (orderedStatesToWaitOn.length <= 0) {
+                throw new IllegalArgumentException("orderedStatesToWaitOn length must be positive.");
+            }
+
+            synchronized (lockMe) {
+                super.reset();
+                statesToWaitFor = new LinkedList<>();
+
+                for (Event.KeeperState state : orderedStatesToWaitOn) {
+                    statesToWaitFor.add(state);
+                }
+            }
+        }
+    }
+
+    private class BlockingPathWatcher extends EventWaiter {
+        private String pathToNotifyOn;
+        private Event.EventType requiredEventType;
+
+        public BlockingPathWatcher(String pathToNotifyOn, Event.EventType requiredEventType) {
+            reset(pathToNotifyOn, requiredEventType);
+        }
+
+        public void reset(String pathToNotifyOn, Event.EventType requiredEventType) {
+            super.reset();
+            this.pathToNotifyOn = pathToNotifyOn;
+            this.requiredEventType = requiredEventType;
+        }
+
+        @Override
+        public void process(WatchedEvent event) {
+            LOG.info("WatchEvent {} for path {}", event.getType(), event.getPath());
+            if (pathToNotifyOn != null && event.getType() == requiredEventType
+                    && pathToNotifyOn.equalsIgnoreCase(event.getPath())) {
+                notifyListener();
+            }
+        }
+    }
+
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServeInfo.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServeInfo.java
new file mode 100644
index 00000000000..f51b8c17b6d
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServeInfo.java
@@ -0,0 +1,300 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.server.embedded;
+
+import java.lang.management.ManagementFactory;
+import java.lang.reflect.UndeclaredThrowableException;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+import java.util.Set;
+import javax.management.InstanceNotFoundException;
+import javax.management.MBeanServer;
+import javax.management.MBeanServerInvocationHandler;
+import javax.management.ObjectInstance;
+import javax.management.ObjectName;
+import org.apache.zookeeper.common.StringUtils;
+import org.apache.zookeeper.server.ConnectionMXBean;
+import org.apache.zookeeper.server.ZooKeeperServerBean;
+import org.apache.zookeeper.server.quorum.LocalPeerMXBean;
+import org.apache.zookeeper.server.quorum.QuorumBean;
+import org.apache.zookeeper.server.quorum.QuorumMXBean;
+import org.apache.zookeeper.server.quorum.RemotePeerMXBean;
+
+public final class ZookeeperServeInfo {
+
+    private static final MBeanServer localServer = ManagementFactory.getPlatformMBeanServer();
+
+    private ZookeeperServeInfo() {
+    }
+
+    public static class PeerInfo {
+
+        private final String name;
+        private final String quorumAddress;
+        private final String state;
+        private final boolean leader;
+
+        public PeerInfo(String name, String quorumAddress, String state, boolean leader) {
+            this.name = name;
+            this.quorumAddress = quorumAddress;
+            this.state = state;
+            this.leader = leader;
+        }
+
+        public String getName() {
+            return name;
+        }
+
+        public String getQuorumAddress() {
+            return quorumAddress;
+        }
+
+        public String getState() {
+            return state;
+        }
+
+        public boolean isLeader() {
+            return leader;
+        }
+
+        @Override
+        public String toString() {
+            return "PeerInfo{" + "name=" + name + ", leader=" + leader + ", quorumAddress=" + quorumAddress
+                    + ", state=" + state + '}';
+        }
+    }
+
+    public static class ConnectionInfo {
+
+        private final String sourceip;
+        private final String sessionid;
+        private final String lastoperation;
+        private final String lastResponseTime;
+        private final String avgLatency;
+        private final String lastLatency;
+        private final String nodes;
+
+        public ConnectionInfo(String sourceip, String sessionid, String lastoperation, String lastResponseTime,
+                              String avgLatency, String lastLatency, String nodes) {
+            this.sourceip = sourceip;
+            this.sessionid = sessionid;
+            this.lastoperation = lastoperation;
+            this.lastResponseTime = lastResponseTime;
+            this.avgLatency = avgLatency;
+            this.lastLatency = lastLatency;
+            this.nodes = nodes;
+        }
+
+        public String getLastLatency() {
+            return lastLatency;
+        }
+
+        public String getSourceip() {
+            return sourceip;
+        }
+
+        public String getSessionid() {
+            return sessionid;
+        }
+
+        public String getLastoperation() {
+            return lastoperation;
+        }
+
+        public String getLastResponseTime() {
+            return lastResponseTime;
+        }
+
+        public String getAvgLatency() {
+            return avgLatency;
+        }
+
+        public String getNodes() {
+            return nodes;
+        }
+
+        @Override
+        public String toString() {
+            return "ConnectionInfo{" + "sourceip=" + sourceip + ", sessionid=" + sessionid + ", lastoperation="
+                    + lastoperation + ", lastResponseTime=" + lastResponseTime + ", avgLatency=" + avgLatency
+                    + ", nodes=" + nodes + '}';
+        }
+    }
+
+    public static class ServerInfo {
+
+        private final List<ConnectionInfo> connections = new ArrayList<>();
+        private boolean leader;
+        private boolean standaloneMode;
+        public List<PeerInfo> peers = new ArrayList<>();
+
+        public boolean isStandaloneMode() {
+            return standaloneMode;
+        }
+
+        public List<ConnectionInfo> getConnections() {
+            return connections;
+        }
+
+        public boolean isLeader() {
+            return leader;
+        }
+
+        public List<PeerInfo> getPeers() {
+            return Collections.unmodifiableList(peers);
+        }
+
+        public void addPeer(PeerInfo peer) {
+            peers.add(peer);
+        }
+
+        @Override
+        public String toString() {
+            return "ServerInfo{" + "connections=" + connections + ", leader=" + leader + ", standaloneMode="
+                    + standaloneMode + ", peers=" + peers + '}';
+        }
+
+    }
+
+    public static ServerInfo getStatus() throws Exception {
+        return getStatus("*");
+    }
+
+    public static ServerInfo getStatus(String beanName) throws Exception {
+
+        ServerInfo info = new ServerInfo();
+        boolean standalonemode = false;
+        // org.apache.ZooKeeperService:name0=ReplicatedServer_id1,name1=replica.1,name2=Follower,name3=Connections,
+        // name4=10.168.10.119,name5=0x13e83353764005a
+        // org.apache.ZooKeeperService:name0=ReplicatedServer_id2,name1=replica.2,name2=Leader
+        if (StringUtils.isBlank(beanName)) {
+            beanName = "*";
+        }
+        ObjectName objectName = new ObjectName("org.apache.ZooKeeperService:name0=" + beanName);
+        Set<ObjectInstance> first_level_beans = localServer.queryMBeans(objectName, null);
+        if (first_level_beans.isEmpty()) {
+            throw new IllegalStateException("No ZooKeeper server found in this JVM with name " + objectName);
+        }
+        String myName = "";
+        for (ObjectInstance o : first_level_beans) {
+            if (o.getClassName().equalsIgnoreCase(ZooKeeperServerBean.class.getName())) {
+                standalonemode = true;
+                info.leader = true;
+                info.addPeer(new PeerInfo("local", "local", "STANDALONE", true));
+            } else if (o.getClassName().equalsIgnoreCase(QuorumBean.class.getName())) {
+                standalonemode = false;
+                try {
+                    QuorumMXBean quorum = MBeanServerInvocationHandler.newProxyInstance(localServer, o.getObjectName(),
+                            QuorumMXBean.class, false);
+                    myName = quorum.getName();
+                } catch (UndeclaredThrowableException err) {
+                    if (err.getCause() instanceof javax.management.InstanceNotFoundException) {
+                        // maybe server not yet started or already stopped ?
+                    } else {
+                        throw err;
+                    }
+                }
+            }
+        }
+        info.standaloneMode = standalonemode;
+        if (standalonemode) {
+            Set<ObjectInstance> connectionsbeans = localServer.queryMBeans(new ObjectName(
+                    "org.apache.ZooKeeperService:name0=*,name1=Connections,name2=*,name3=*"), null);
+            for (ObjectInstance conbean : connectionsbeans) {
+                ConnectionMXBean cc = MBeanServerInvocationHandler.
+                        newProxyInstance(localServer, conbean.getObjectName(), ConnectionMXBean.class, false);
+                try {
+                    String nodes = "";
+                    if (cc.getEphemeralNodes() != null) {
+                        nodes = Arrays.asList(cc.getEphemeralNodes()) + "";
+                    }
+                    info.connections.add(new ConnectionInfo(cc.getSourceIP(), cc.getSessionId(), cc.getLastOperation(),
+                            cc.getLastResponseTime(), cc.getAvgLatency() + "", cc.getLastLatency() + "", nodes));
+                } catch (Exception ex) {
+                    if (ex instanceof InstanceNotFoundException && ex.getCause() instanceof InstanceNotFoundException) {
+                        // SKIP
+                    } else {
+                        throw ex;
+                    }
+                }
+            }
+        } else {
+            if (myName.isEmpty()) {
+                throw new IllegalStateException(
+                        "Cannot find local JMX name for current node, in quorum mode, scanned " + first_level_beans);
+            }
+            boolean leader = false;
+            Set<ObjectInstance> replicas = localServer.queryMBeans(new ObjectName(
+                    "org.apache.ZooKeeperService:name0=" + myName + ",name1=*"), null);
+            for (ObjectInstance o : replicas) {
+                if (o.getClassName().toLowerCase().contains("local")) {
+                    LocalPeerMXBean local = MBeanServerInvocationHandler.
+                            newProxyInstance(localServer, o.getObjectName(), LocalPeerMXBean.class, false);
+                    info.addPeer(new PeerInfo(local.getName(), local.getQuorumAddress(), local.getState() + "",
+                            local.isLeader()));
+
+                    ObjectName asfollowername = new ObjectName(o.getObjectName() + ",name2=Follower");
+                    ObjectName asleadername = new ObjectName(o.getObjectName() + ",name2=Leader");
+                    boolean isleader = localServer.isRegistered(asleadername);
+                    Set<ObjectInstance> connectionsbeans = null;
+                    if (isleader) {
+                        leader = true;
+                        ObjectName asleaderconnections = new ObjectName(
+                                asleadername + ",name3=Connections,name4=*,name5=*");
+                        connectionsbeans = localServer.queryMBeans(asleaderconnections, null);
+                    } else {
+                        leader = false;
+                        ObjectName asfollowernameconnections = new ObjectName(
+                                asfollowername + ",name3=Connections,name4=*,name5=*");
+                        connectionsbeans = localServer.queryMBeans(asfollowernameconnections, null);
+                    }
+
+                    for (ObjectInstance conbean : connectionsbeans) {
+                        ConnectionMXBean cc = MBeanServerInvocationHandler.newProxyInstance(localServer,
+                                conbean.getObjectName(), ConnectionMXBean.class, false);
+                        try {
+                            String nodes = "";
+                            if (cc.getEphemeralNodes() != null) {
+                                nodes = Arrays.asList(cc.getEphemeralNodes()) + "";
+                            }
+                            info.connections.add(new ConnectionInfo(cc.getSourceIP(), cc.getSessionId(), cc.
+                                    getLastOperation(), cc.getLastResponseTime(), cc.getAvgLatency() + "", cc.
+                                    getLastLatency() + "", nodes));
+                        } catch (Exception ex) {
+                            if (ex instanceof InstanceNotFoundException && ex.getCause() instanceof InstanceNotFoundException) {
+                                // SKIP
+                            } else {
+                                throw ex;
+                            }
+                        }
+                    }
+                } else {
+                    RemotePeerMXBean remote = MBeanServerInvocationHandler.newProxyInstance(localServer, o.
+                            getObjectName(), RemotePeerMXBean.class, false);
+                    info.addPeer(new PeerInfo(remote.getName(), remote.getQuorumAddress(),
+                            "REMOTE", remote.isLeader()));
+                }
+
+            }
+            info.leader = leader;
+        }
+        return info;
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerClusterMutualAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerClusterMutualAuthTest.java
new file mode 100644
index 00000000000..a66e476ce54
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerClusterMutualAuthTest.java
@@ -0,0 +1,145 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.server.embedded;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import java.io.File;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Properties;
+import javax.security.auth.login.Configuration;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.common.X509Util;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+/**
+ * Test Quorum Mutual Auth with ZooKeeperEmbedded.
+ */
+public class ZookeeperServerClusterMutualAuthTest {
+
+    @BeforeAll
+    public static void setUpEnvironment() {
+        // Need to disable Fips-mode, because we use DIGEST-MD5 mech for Sasl
+        System.setProperty(X509Util.FIPS_MODE_PROPERTY, "false");
+        System.setProperty("java.security.auth.login.config", new File("src/test/resources/embedded/test_jaas_server_auth.conf")
+                .getAbsolutePath());
+        Configuration.getConfiguration().refresh();
+        System.setProperty("zookeeper.admin.enableServer", "false");
+        System.setProperty("zookeeper.4lw.commands.whitelist", "*");
+    }
+
+    @AfterAll
+    public static void cleanUpEnvironment() throws InterruptedException, IOException {
+        System.clearProperty("zookeeper.admin.enableServer");
+        System.clearProperty("zookeeper.4lw.commands.whitelist");
+        System.clearProperty("java.security.auth.login.config");
+        Configuration.getConfiguration().refresh();
+        System.clearProperty(X509Util.FIPS_MODE_PROPERTY);
+    }
+
+    @TempDir
+    public Path baseDir;
+
+    @Test
+    public void testStart() throws Exception {
+        Path baseDir1 = baseDir.resolve("server1");
+        Path baseDir2 = baseDir.resolve("server2");
+        Path baseDir3 = baseDir.resolve("server3");
+
+        int clientport1 = PortAssignment.unique();
+        int clientport2 = PortAssignment.unique();
+        int clientport3 = PortAssignment.unique();
+
+        int port4 = PortAssignment.unique();
+        int port5 = PortAssignment.unique();
+        int port6 = PortAssignment.unique();
+
+        int port7 = PortAssignment.unique();
+        int port8 = PortAssignment.unique();
+        int port9 = PortAssignment.unique();
+
+        Properties config = new Properties();
+        config.put("host", "localhost");
+        config.put("ticktime", "10");
+        config.put("initLimit", "4000");
+        config.put("syncLimit", "5");
+
+        config.put("server.1", "localhost:" + port4 + ":" + port7);
+        config.put("server.2", "localhost:" + port5 + ":" + port8);
+        config.put("server.3", "localhost:" + port6 + ":" + port9);
+
+        config.put("quorum.auth.enableSasl", "true");
+        config.put("quorum.auth.learnerRequireSasl", "true");
+        config.put("quorum.auth.serverRequireSasl", "true");
+        config.put("quorum.auth.learner.loginContext", "QuorumLearner");
+        config.put("quorum.auth.server.loginContext", "QuorumServer");
+        config.put("quorum.auth.kerberos.servicePrincipal", "servicename/_HOST");
+        config.put("quorum.cnxn.threads.size", "20");
+
+        final Properties configZookeeper1 = new Properties();
+        configZookeeper1.putAll(config);
+        configZookeeper1.put("clientPort", clientport1 + "");
+
+        final Properties configZookeeper2 = new Properties();
+        configZookeeper2.putAll(config);
+        configZookeeper2.put("clientPort", clientport2 + "");
+
+        final Properties configZookeeper3 = new Properties();
+        configZookeeper3.putAll(config);
+        configZookeeper3.put("clientPort", clientport3 + "");
+
+        Files.createDirectories(baseDir1.resolve("data"));
+        Files.write(baseDir1.resolve("data").resolve("myid"), "1".getBytes("ASCII"));
+        Files.createDirectories(baseDir2.resolve("data"));
+        Files.write(baseDir2.resolve("data").resolve("myid"), "2".getBytes("ASCII"));
+        Files.createDirectories(baseDir3.resolve("data"));
+        Files.write(baseDir3.resolve("data").resolve("myid"), "3".getBytes("ASCII"));
+
+        try (ZooKeeperServerEmbedded zkServer1 = ZooKeeperServerEmbedded.builder().configuration(configZookeeper1).baseDir(baseDir1).exitHandler(ExitHandler.LOG_ONLY).build();
+                ZooKeeperServerEmbedded zkServer2 = ZooKeeperServerEmbedded.builder().configuration(configZookeeper2).baseDir(baseDir2).exitHandler(ExitHandler.LOG_ONLY).build();
+                ZooKeeperServerEmbedded zkServer3 = ZooKeeperServerEmbedded.builder().configuration(configZookeeper3).baseDir(baseDir3).exitHandler(ExitHandler.LOG_ONLY).build();) {
+            zkServer1.start();
+            zkServer2.start();
+            zkServer3.start();
+
+            assertTrue(ClientBase.waitForServerUp(zkServer1.getConnectionString(), 60000));
+            assertTrue(ClientBase.waitForServerUp(zkServer2.getConnectionString(), 60000));
+            assertTrue(ClientBase.waitForServerUp(zkServer3.getConnectionString(), 60000));
+
+            for (int i = 0; i < 100; i++) {
+                ZookeeperServeInfo.ServerInfo status = ZookeeperServeInfo.getStatus("ReplicatedServer*");
+                System.out.println("status:" + status);
+                if (status.isLeader() && !status.isStandaloneMode() && status.getPeers().size() == 3) {
+                    break;
+                }
+                Thread.sleep(100);
+            }
+            ZookeeperServeInfo.ServerInfo status = ZookeeperServeInfo.getStatus("ReplicatedServer*");
+            assertTrue(status.isLeader());
+            assertTrue(!status.isStandaloneMode());
+            assertEquals(3, status.getPeers().size());
+        }
+    }
+
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerClusterTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerClusterTest.java
new file mode 100644
index 00000000000..dfbdfc3611f
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerClusterTest.java
@@ -0,0 +1,123 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.server.embedded;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Properties;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+public class ZookeeperServerClusterTest {
+
+    @BeforeAll
+    public static void setUpEnvironment() {
+        System.setProperty("zookeeper.admin.enableServer", "false");
+        System.setProperty("zookeeper.4lw.commands.whitelist", "*");
+    }
+
+    @AfterAll
+    public static void cleanUpEnvironment() throws InterruptedException, IOException {
+        System.clearProperty("zookeeper.admin.enableServer");
+        System.clearProperty("zookeeper.4lw.commands.whitelist");
+    }
+
+    @TempDir
+    public Path baseDir;
+
+    @Test
+    public void testStart() throws Exception {
+        Path baseDir1 = baseDir.resolve("server1");
+        Path baseDir2 = baseDir.resolve("server2");
+        Path baseDir3 = baseDir.resolve("server3");
+
+        int clientport1 = PortAssignment.unique();
+        int clientport2 = PortAssignment.unique();
+        int clientport3 = PortAssignment.unique();
+
+        int port4 = PortAssignment.unique();
+        int port5 = PortAssignment.unique();
+        int port6 = PortAssignment.unique();
+
+        int port7 = PortAssignment.unique();
+        int port8 = PortAssignment.unique();
+        int port9 = PortAssignment.unique();
+
+        Properties config = new Properties();
+        config.put("host", "localhost");
+        config.put("ticktime", "10");
+        config.put("initLimit", "4000");
+        config.put("syncLimit", "5");
+        config.put("server.1", "localhost:" + port4 + ":" + port7);
+        config.put("server.2", "localhost:" + port5 + ":" + port8);
+        config.put("server.3", "localhost:" + port6 + ":" + port9);
+
+
+        final Properties configZookeeper1 = new Properties();
+        configZookeeper1.putAll(config);
+        configZookeeper1.put("clientPort", clientport1 + "");
+
+        final Properties configZookeeper2 = new Properties();
+        configZookeeper2.putAll(config);
+        configZookeeper2.put("clientPort", clientport2 + "");
+
+        final Properties configZookeeper3 =  new Properties();
+        configZookeeper3.putAll(config);
+        configZookeeper3.put("clientPort", clientport3 + "");
+
+        Files.createDirectories(baseDir1.resolve("data"));
+        Files.write(baseDir1.resolve("data").resolve("myid"), "1".getBytes("ASCII"));
+        Files.createDirectories(baseDir2.resolve("data"));
+        Files.write(baseDir2.resolve("data").resolve("myid"), "2".getBytes("ASCII"));
+        Files.createDirectories(baseDir3.resolve("data"));
+        Files.write(baseDir3.resolve("data").resolve("myid"), "3".getBytes("ASCII"));
+
+        try (ZooKeeperServerEmbedded zkServer1 = ZooKeeperServerEmbedded.builder().configuration(configZookeeper1).baseDir(baseDir1).exitHandler(ExitHandler.LOG_ONLY).build();
+                ZooKeeperServerEmbedded zkServer2 = ZooKeeperServerEmbedded.builder().configuration(configZookeeper2).baseDir(baseDir2).exitHandler(ExitHandler.LOG_ONLY).build();
+                ZooKeeperServerEmbedded zkServer3 = ZooKeeperServerEmbedded.builder().configuration(configZookeeper3).baseDir(baseDir3).exitHandler(ExitHandler.LOG_ONLY).build();) {
+            zkServer1.start();
+            zkServer2.start();
+            zkServer3.start();
+
+            assertTrue(ClientBase.waitForServerUp(zkServer1.getConnectionString(), 60000));
+            assertTrue(ClientBase.waitForServerUp(zkServer2.getConnectionString(), 60000));
+            assertTrue(ClientBase.waitForServerUp(zkServer3.getConnectionString(), 60000));
+            for (int i = 0; i < 100; i++) {
+                ZookeeperServeInfo.ServerInfo status = ZookeeperServeInfo.getStatus("ReplicatedServer*");
+                System.out.println("status:" + status);
+                if (status.isLeader() && !status.isStandaloneMode() && status.getPeers().size() == 3) {
+                    break;
+                }
+                Thread.sleep(100);
+            }
+            ZookeeperServeInfo.ServerInfo status = ZookeeperServeInfo.getStatus("ReplicatedServer*");
+            assertTrue(status.isLeader());
+            assertTrue(!status.isStandaloneMode());
+            assertEquals(3, status.getPeers().size());
+
+        }
+    }
+
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerEmbeddedTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerEmbeddedTest.java
new file mode 100644
index 00000000000..00bfced0cd4
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerEmbeddedTest.java
@@ -0,0 +1,130 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.server.embedded;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.endsWith;
+import static org.hamcrest.Matchers.not;
+import static org.junit.Assert.assertThrows;
+import static org.junit.Assert.assertTrue;
+import java.io.IOException;
+import java.nio.file.Path;
+import java.util.Properties;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.function.ThrowingRunnable;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+public class ZookeeperServerEmbeddedTest {
+
+    @BeforeAll
+    public static void setUpEnvironment() {
+        System.setProperty("zookeeper.admin.enableServer", "false");
+        System.setProperty("zookeeper.4lw.commands.whitelist", "*");
+    }
+
+    @AfterAll
+    public static void cleanUpEnvironment() throws InterruptedException, IOException {
+        System.clearProperty("zookeeper.admin.enableServer");
+        System.clearProperty("zookeeper.4lw.commands.whitelist");
+    }
+
+    @TempDir
+    public Path baseDir;
+
+    @Test
+    public void testStart() throws Exception {
+        int clientPort = PortAssignment.unique();
+        final Properties configZookeeper = new Properties();
+        configZookeeper.put("clientPort", clientPort + "");
+        configZookeeper.put("host", "localhost");
+        configZookeeper.put("ticktime", "4000");
+        try (ZooKeeperServerEmbedded zkServer = ZooKeeperServerEmbedded
+                .builder()
+                .baseDir(baseDir)
+                .configuration(configZookeeper)
+                .exitHandler(ExitHandler.LOG_ONLY)
+                .build()) {
+            zkServer.start();
+            assertTrue(ClientBase.waitForServerUp(zkServer.getConnectionString(), 60000));
+            for (int i = 0; i < 100; i++) {
+                ZookeeperServeInfo.ServerInfo status = ZookeeperServeInfo.getStatus("StandaloneServer*");
+                if (status.isLeader() && status.isStandaloneMode()) {
+                    break;
+                }
+                Thread.sleep(100);
+            }
+            ZookeeperServeInfo.ServerInfo status = ZookeeperServeInfo.getStatus("StandaloneServer*");
+            assertTrue(status.isLeader());
+            assertTrue(status.isStandaloneMode());
+        }
+
+        // restart (all ports should be closed and the restart should always work)
+        try (ZooKeeperServerEmbedded zkServer = ZooKeeperServerEmbedded
+                .builder()
+                .baseDir(baseDir)
+                .configuration(configZookeeper)
+                .exitHandler(ExitHandler.LOG_ONLY)
+                .build()) {
+            zkServer.start();
+            assertTrue(ClientBase.waitForServerUp(zkServer.getConnectionString(), 60000));
+            for (int i = 0; i < 100; i++) {
+                ZookeeperServeInfo.ServerInfo status = ZookeeperServeInfo.getStatus("StandaloneServer*");
+                if (status.isLeader() && status.isStandaloneMode()) {
+                    break;
+                }
+                Thread.sleep(100);
+            }
+            ZookeeperServeInfo.ServerInfo status = ZookeeperServeInfo.getStatus("StandaloneServer*");
+            assertTrue(status.isLeader());
+            assertTrue(status.isStandaloneMode());
+        }
+
+    }
+
+    @Test
+    public void testBindPortZero() throws Exception {
+        final Properties configZookeeper = new Properties();
+        final ZooKeeperServerEmbedded.ZookKeeperServerEmbeddedBuilder builder = ZooKeeperServerEmbedded.builder()
+            .baseDir(baseDir)
+            .configuration(configZookeeper)
+            .exitHandler(ExitHandler.LOG_ONLY);
+
+        // Unconfigured client port will still fail
+        try (ZooKeeperServerEmbedded zkServer = builder.build()) {
+            zkServer.start();
+            assertThrows(IllegalStateException.class, new ThrowingRunnable() {
+                @Override
+                public void run() throws Throwable {
+                    zkServer.getConnectionString();
+                }
+            });
+        }
+
+        // Explicit port zero should work
+        configZookeeper.put("clientPort", "0");
+        try (ZooKeeperServerEmbedded zkServer = builder.build()) {
+            zkServer.start();
+            assertThat(zkServer.getConnectionString(), not(endsWith(":0")));
+            assertTrue(ClientBase.waitForServerUp(zkServer.getConnectionString(), 60000));
+        }
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerSslEmbeddedTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerSslEmbeddedTest.java
new file mode 100644
index 00000000000..4611e4ceee3
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/embedded/ZookeeperServerSslEmbeddedTest.java
@@ -0,0 +1,121 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.server.embedded;
+
+import static org.junit.Assert.assertTrue;
+import java.io.File;
+import java.io.IOException;
+import java.nio.file.Path;
+import java.util.Properties;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.TimeUnit;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.WatchedEvent;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+public class ZookeeperServerSslEmbeddedTest {
+
+    @BeforeAll
+    public static void setUpEnvironment() {
+        System.setProperty("zookeeper.admin.enableServer", "false");
+        System.setProperty("zookeeper.4lw.commands.whitelist", "*");
+    }
+
+    @AfterAll
+    public static void cleanUpEnvironment() throws InterruptedException, IOException {
+        System.clearProperty("zookeeper.admin.enableServer");
+        System.clearProperty("zookeeper.4lw.commands.whitelist");
+        System.clearProperty("zookeeper.ssl.trustStore.location");
+        System.clearProperty("zookeeper.ssl.trustStore.password");
+        System.clearProperty("zookeeper.ssl.trustStore.type");
+    }
+
+    @TempDir
+    public Path baseDir;
+
+    @Test
+    public void testStart() throws Exception {
+
+        int clientPort = PortAssignment.unique();
+        int clientSecurePort = PortAssignment.unique();
+
+        final Properties configZookeeper = new Properties();
+        configZookeeper.put("clientPort", clientPort + "");
+        configZookeeper.put("secureClientPort", clientSecurePort + "");
+        configZookeeper.put("host", "localhost");
+        configZookeeper.put("ticktime", "4000");
+        // Netty is required for TLS
+        configZookeeper.put("serverCnxnFactory", org.apache.zookeeper.server.NettyServerCnxnFactory.class.getName());
+
+        File testKeyStore = new File("src/test/resources/embedded/testKeyStore.jks");
+        File testTrustStore = new File("src/test/resources/embedded/testTrustStore.jks");
+        assertTrue(testKeyStore.isFile());
+        assertTrue(testTrustStore.isFile());
+        configZookeeper.put("ssl.keyStore.location", testKeyStore.getAbsolutePath());
+        configZookeeper.put("ssl.keyStore.password", "testpass");
+        configZookeeper.put("ssl.keyStore.type", "JKS");
+
+        System.setProperty("zookeeper.ssl.trustStore.location", testTrustStore.getAbsolutePath());
+        System.setProperty("zookeeper.ssl.trustStore.password", "testpass");
+        System.setProperty("zookeeper.ssl.trustStore.type", "JKS");
+
+        try (ZooKeeperServerEmbedded zkServer = ZooKeeperServerEmbedded
+                .builder()
+                .baseDir(baseDir)
+                .configuration(configZookeeper)
+                .exitHandler(ExitHandler.LOG_ONLY)
+                .build()) {
+            zkServer.start();
+            assertTrue(ClientBase.waitForServerUp(zkServer.getConnectionString(), 60000));
+            for (int i = 0; i < 100; i++) {
+                ZookeeperServeInfo.ServerInfo status = ZookeeperServeInfo.getStatus("StandaloneServer*");
+                if (status.isLeader() && status.isStandaloneMode()) {
+                    break;
+                }
+                Thread.sleep(100);
+            }
+            ZookeeperServeInfo.ServerInfo status = ZookeeperServeInfo.getStatus("StandaloneServer*");
+            assertTrue(status.isLeader());
+            assertTrue(status.isStandaloneMode());
+
+            CountDownLatch l = new CountDownLatch(1);
+            ZKClientConfig zKClientConfig = new ZKClientConfig();
+            zKClientConfig.setProperty("zookeeper.client.secure", "true");
+            // only netty supports TLS
+            zKClientConfig.setProperty("zookeeper.clientCnxnSocket", org.apache.zookeeper.ClientCnxnSocketNetty.class.getName());
+            try (ZooKeeper zk = new ZooKeeper(zkServer.getSecureConnectionString(), 60000, (WatchedEvent event) -> {
+                switch (event.getState()) {
+                    case SyncConnected:
+                        l.countDown();
+                        break;
+                }
+            }, zKClientConfig)) {
+                assertTrue(zk.getClientConfig().getBoolean(ZKClientConfig.SECURE_CLIENT));
+                assertTrue(l.await(10, TimeUnit.SECONDS));
+            }
+
+        }
+    }
+
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/metric/AvgMinMaxCounterSetTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/metric/AvgMinMaxCounterSetTest.java
index 50e3788ccb9..7201ca9c20d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/metric/AvgMinMaxCounterSetTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/metric/AvgMinMaxCounterSetTest.java
@@ -18,17 +18,17 @@
 
 package org.apache.zookeeper.server.metric;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.util.Map;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class AvgMinMaxCounterSetTest extends ZKTestCase {
 
     private AvgMinMaxCounterSet testCounterSet;
 
-    @Before
+    @BeforeEach
     public void initCounter() {
         testCounterSet = new AvgMinMaxCounterSet("test");
     }
@@ -49,19 +49,19 @@ public void testReset() {
 
         Map<String, Object> values = testCounterSet.values();
 
-        assertEquals("There should be 10 values in the set", 10, values.size());
+        assertEquals(10, values.size(), "There should be 10 values in the set");
 
-        assertEquals("avg_key1_test should =0", 0D, values.get("avg_key1_test"));
-        assertEquals("min_key1_test should =0", 0L, values.get("min_key1_test"));
-        assertEquals("max_key1_test should =0", 0L, values.get("max_key1_test"));
-        assertEquals("cnt_key1_test should =0", 0L, values.get("cnt_key1_test"));
-        assertEquals("sum_key1_test should =0", 0L, values.get("sum_key1_test"));
+        assertEquals(0D, values.get("avg_key1_test"), "avg_key1_test should =0");
+        assertEquals(0L, values.get("min_key1_test"), "min_key1_test should =0");
+        assertEquals(0L, values.get("max_key1_test"), "max_key1_test should =0");
+        assertEquals(0L, values.get("cnt_key1_test"), "cnt_key1_test should =0");
+        assertEquals(0L, values.get("sum_key1_test"), "sum_key1_test should =0");
 
-        assertEquals("avg_key2_test should =0", 0D, values.get("avg_key2_test"));
-        assertEquals("min_key2_test should =0", 0L, values.get("min_key2_test"));
-        assertEquals("max_key2_test should =0", 0L, values.get("max_key2_test"));
-        assertEquals("cnt_key2_test should =0", 0L, values.get("cnt_key2_test"));
-        assertEquals("sum_key2_test should =0", 0L, values.get("sum_key2_test"));
+        assertEquals(0D, values.get("avg_key2_test"), "avg_key2_test should =0");
+        assertEquals(0L, values.get("min_key2_test"), "min_key2_test should =0");
+        assertEquals(0L, values.get("max_key2_test"), "max_key2_test should =0");
+        assertEquals(0L, values.get("cnt_key2_test"), "cnt_key2_test should =0");
+        assertEquals(0L, values.get("sum_key2_test"), "sum_key2_test should =0");
 
     }
 
@@ -70,18 +70,18 @@ public void testValues() {
         addDataPoints();
         Map<String, Object> values = testCounterSet.values();
 
-        assertEquals("There should be 10 values in the set", 10, values.size());
-        assertEquals("avg_key1_test should =0.5", 0.5D, values.get("avg_key1_test"));
-        assertEquals("min_key1_test should =0", 0L, values.get("min_key1_test"));
-        assertEquals("max_key1_test should =1", 1L, values.get("max_key1_test"));
-        assertEquals("cnt_key1_test should =2", 2L, values.get("cnt_key1_test"));
-        assertEquals("sum_key1_test should =1", 1L, values.get("sum_key1_test"));
-
-        assertEquals("avg_key2_test should =3.5", 3.5, values.get("avg_key2_test"));
-        assertEquals("min_key2_test should =2", 2L, values.get("min_key2_test"));
-        assertEquals("max_key2_test should =5", 5L, values.get("max_key2_test"));
-        assertEquals("cnt_key2_test should =4", 4L, values.get("cnt_key2_test"));
-        assertEquals("sum_key2_test should =14", 14L, values.get("sum_key2_test"));
+        assertEquals(10, values.size(), "There should be 10 values in the set");
+        assertEquals(0.5D, values.get("avg_key1_test"), "avg_key1_test should =0.5");
+        assertEquals(0L, values.get("min_key1_test"), "min_key1_test should =0");
+        assertEquals(1L, values.get("max_key1_test"), "max_key1_test should =1");
+        assertEquals(2L, values.get("cnt_key1_test"), "cnt_key1_test should =2");
+        assertEquals(1L, values.get("sum_key1_test"), "sum_key1_test should =1");
+
+        assertEquals(3.5, values.get("avg_key2_test"), "avg_key2_test should =3.5");
+        assertEquals(2L, values.get("min_key2_test"), "min_key2_test should =2");
+        assertEquals(5L, values.get("max_key2_test"), "max_key2_test should =5");
+        assertEquals(4L, values.get("cnt_key2_test"), "cnt_key2_test should =4");
+        assertEquals(14L, values.get("sum_key2_test"), "sum_key2_test should =14");
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/metric/AvgMinMaxPercentileCounterSetTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/metric/AvgMinMaxPercentileCounterSetTest.java
index e120ac51ab5..dafa085e636 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/metric/AvgMinMaxPercentileCounterSetTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/metric/AvgMinMaxPercentileCounterSetTest.java
@@ -18,17 +18,17 @@
 
 package org.apache.zookeeper.server.metric;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.util.Map;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class AvgMinMaxPercentileCounterSetTest extends ZKTestCase {
 
     private AvgMinMaxPercentileCounterSet testCounterSet;
 
-    @Before
+    @BeforeEach
     public void initCounter() {
         testCounterSet = new AvgMinMaxPercentileCounterSet("test");
     }
@@ -50,25 +50,25 @@ public void testReset() {
 
         Map<String, Object> values = testCounterSet.values();
 
-        assertEquals("avg_key1_test should =0", 0D, values.get("avg_key1_test"));
-        assertEquals("min_key1_test should =0", 0L, values.get("min_key1_test"));
-        assertEquals("max_key1_test should =0", 0L, values.get("max_key1_test"));
-        assertEquals("cnt_key1_test should =0", 0L, values.get("cnt_key1_test"));
-        assertEquals("sum_key1_test should =0", 0L, values.get("sum_key1_test"));
-        assertEquals("p50_key1_test should have p50=0", 0L, values.get("p50_key1_test"));
-        assertEquals("p95_key1_test should have p95=0", 0L, values.get("p95_key1_test"));
-        assertEquals("p99_key1_test should have p99=0", 0L, values.get("p99_key1_test"));
-        assertEquals("p999_key1_test should have p999=0", 0L, values.get("p999_key1_test"));
-
-        assertEquals("avg_key2_test should =0", 0D, values.get("avg_key2_test"));
-        assertEquals("min_key2_test should =0", 0L, values.get("min_key2_test"));
-        assertEquals("max_key2_test should =0", 0L, values.get("max_key2_test"));
-        assertEquals("cnt_key2_test should =0", 0L, values.get("cnt_key2_test"));
-        assertEquals("sum_key2_test should =0", 0L, values.get("sum_key2_test"));
-        assertEquals("p50_key2_test should have p50=0", 0L, values.get("p50_key2_test"));
-        assertEquals("p95_key2_test should have p95=0", 0L, values.get("p95_key2_test"));
-        assertEquals("p99_key2_test should have p99=0", 0L, values.get("p99_key2_test"));
-        assertEquals("p999_key2_test should have p999=0", 0L, values.get("p999_key2_test"));
+        assertEquals(0D, values.get("avg_key1_test"), "avg_key1_test should =0");
+        assertEquals(0L, values.get("min_key1_test"), "min_key1_test should =0");
+        assertEquals(0L, values.get("max_key1_test"), "max_key1_test should =0");
+        assertEquals(0L, values.get("cnt_key1_test"), "cnt_key1_test should =0");
+        assertEquals(0L, values.get("sum_key1_test"), "sum_key1_test should =0");
+        assertEquals(0L, values.get("p50_key1_test"), "p50_key1_test should have p50=0");
+        assertEquals(0L, values.get("p95_key1_test"), "p95_key1_test should have p95=0");
+        assertEquals(0L, values.get("p99_key1_test"), "p99_key1_test should have p99=0");
+        assertEquals(0L, values.get("p999_key1_test"), "p999_key1_test should have p999=0");
+
+        assertEquals(0D, values.get("avg_key2_test"), "avg_key2_test should =0");
+        assertEquals(0L, values.get("min_key2_test"), "min_key2_test should =0");
+        assertEquals(0L, values.get("max_key2_test"), "max_key2_test should =0");
+        assertEquals(0L, values.get("cnt_key2_test"), "cnt_key2_test should =0");
+        assertEquals(0L, values.get("sum_key2_test"), "sum_key2_test should =0");
+        assertEquals(0L, values.get("p50_key2_test"), "p50_key2_test should have p50=0");
+        assertEquals(0L, values.get("p95_key2_test"), "p95_key2_test should have p95=0");
+        assertEquals(0L, values.get("p99_key2_test"), "p99_key2_test should have p99=0");
+        assertEquals(0L, values.get("p999_key2_test"), "p999_key2_test should have p999=0");
     }
 
     @Test
@@ -76,27 +76,27 @@ public void testValues() {
         addDataPoints();
         Map<String, Object> values = testCounterSet.values();
 
-        assertEquals("There should be 18 values in the set", 18, values.size());
-
-        assertEquals("avg_key1_test should =499.5", 999D / 2, values.get("avg_key1_test"));
-        assertEquals("min_key1_test should =0", 0L, values.get("min_key1_test"));
-        assertEquals("max_key1_test should =999", 999L, values.get("max_key1_test"));
-        assertEquals("cnt_key1_test should =1000", 1000L, values.get("cnt_key1_test"));
-        assertEquals("sum_key1_test should =999*500", 999 * 500L, values.get("sum_key1_test"));
-        assertEquals("p50_key1_test should have p50=500", 500L, values.get("p50_key1_test"));
-        assertEquals("p95_key1_test should have p95=950", 950L, values.get("p95_key1_test"));
-        assertEquals("p99_key1_test should have p99=990", 990L, values.get("p99_key1_test"));
-        assertEquals("p999_key1_test should have p999=999", 999L, values.get("p999_key1_test"));
-
-        assertEquals("avg_key2_test should =3.5", 1000 + 999D / 2, values.get("avg_key2_test"));
-        assertEquals("min_key2_test should =2", 1000L, values.get("min_key2_test"));
-        assertEquals("max_key2_test should =5", 1999L, values.get("max_key2_test"));
-        assertEquals("cnt_key2_test should =4", 1000L, values.get("cnt_key2_test"));
-        assertEquals("sum_key2_test should =14", 2999 * 500L, values.get("sum_key2_test"));
-        assertEquals("p50_key2_test should have p50=1500", 1500L, values.get("p50_key2_test"));
-        assertEquals("p95_key2_test should have p95=1950", 1950L, values.get("p95_key2_test"));
-        assertEquals("p99_key2_test should have p99=1990", 1990L, values.get("p99_key2_test"));
-        assertEquals("p999_key2_test should have p999=1999", 1999L, values.get("p999_key2_test"));
+        assertEquals(18, values.size(), "There should be 18 values in the set");
+
+        assertEquals(999D / 2, values.get("avg_key1_test"), "avg_key1_test should =499.5");
+        assertEquals(0L, values.get("min_key1_test"), "min_key1_test should =0");
+        assertEquals(999L, values.get("max_key1_test"), "max_key1_test should =999");
+        assertEquals(1000L, values.get("cnt_key1_test"), "cnt_key1_test should =1000");
+        assertEquals(999 * 500L, values.get("sum_key1_test"), "sum_key1_test should =999*500");
+        assertEquals(500L, values.get("p50_key1_test"), "p50_key1_test should have p50=500");
+        assertEquals(950L, values.get("p95_key1_test"), "p95_key1_test should have p95=950");
+        assertEquals(990L, values.get("p99_key1_test"), "p99_key1_test should have p99=990");
+        assertEquals(999L, values.get("p999_key1_test"), "p999_key1_test should have p999=999");
+
+        assertEquals(1000 + 999D / 2, values.get("avg_key2_test"), "avg_key2_test should =3.5");
+        assertEquals(1000L, values.get("min_key2_test"), "min_key2_test should =2");
+        assertEquals(1999L, values.get("max_key2_test"), "max_key2_test should =5");
+        assertEquals(1000L, values.get("cnt_key2_test"), "cnt_key2_test should =4");
+        assertEquals(2999 * 500L, values.get("sum_key2_test"), "sum_key2_test should =14");
+        assertEquals(1500L, values.get("p50_key2_test"), "p50_key2_test should have p50=1500");
+        assertEquals(1950L, values.get("p95_key2_test"), "p95_key2_test should have p95=1950");
+        assertEquals(1990L, values.get("p99_key2_test"), "p99_key2_test should have p99=1990");
+        assertEquals(1999L, values.get("p999_key2_test"), "p999_key2_test should have p999=1999");
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/metric/AvgMinMaxPercentileCounterTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/metric/AvgMinMaxPercentileCounterTest.java
index ecfdbbcfb5b..4b482c97ac7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/metric/AvgMinMaxPercentileCounterTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/metric/AvgMinMaxPercentileCounterTest.java
@@ -18,17 +18,17 @@
 
 package org.apache.zookeeper.server.metric;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.util.Map;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class AvgMinMaxPercentileCounterTest extends ZKTestCase {
 
     private AvgMinMaxPercentileCounter testCounter;
 
-    @Before
+    @BeforeEach
     public void initCounter() {
         testCounter = new AvgMinMaxPercentileCounter("test");
     }
@@ -46,17 +46,17 @@ public void testReset() {
 
         Map<String, Object> values = testCounter.values();
 
-        assertEquals("There should be 9 values in the set", 9, values.size());
+        assertEquals(9, values.size(), "There should be 9 values in the set");
 
-        assertEquals("should avg=0", 0D, values.get("avg_test"));
-        assertEquals("should have min=0", 0L, values.get("min_test"));
-        assertEquals("should have max=0", 0L, values.get("max_test"));
-        assertEquals("should have cnt=0", 0L, values.get("cnt_test"));
-        assertEquals("should have sum=0", 0L, values.get("sum_test"));
-        assertEquals("should have p50=0", 0L, values.get("p50_test"));
-        assertEquals("should have p95=0", 0L, values.get("p95_test"));
-        assertEquals("should have p99=0", 0L, values.get("p99_test"));
-        assertEquals("should have p999=0", 0L, values.get("p999_test"));
+        assertEquals(0D, values.get("avg_test"), "should avg=0");
+        assertEquals(0L, values.get("min_test"), "should have min=0");
+        assertEquals(0L, values.get("max_test"), "should have max=0");
+        assertEquals(0L, values.get("cnt_test"), "should have cnt=0");
+        assertEquals(0L, values.get("sum_test"), "should have sum=0");
+        assertEquals(0L, values.get("p50_test"), "should have p50=0");
+        assertEquals(0L, values.get("p95_test"), "should have p95=0");
+        assertEquals(0L, values.get("p99_test"), "should have p99=0");
+        assertEquals(0L, values.get("p999_test"), "should have p999=0");
     }
 
     @Test
@@ -64,17 +64,17 @@ public void testValues() {
         addDataPoints();
         Map<String, Object> values = testCounter.values();
 
-        assertEquals("There should be 9 values in the set", 9, values.size());
+        assertEquals(9, values.size(), "There should be 9 values in the set");
 
-        assertEquals("should avg=499.5", 999D / 2, values.get("avg_test"));
-        assertEquals("should have min=0", 0L, values.get("min_test"));
-        assertEquals("should have max=999", 999L, values.get("max_test"));
-        assertEquals("should have cnt=1000", 1000L, values.get("cnt_test"));
-        assertEquals("should have sum=999*500", 999 * 500L, values.get("sum_test"));
-        assertEquals("should have p50=500", 500L, values.get("p50_test"));
-        assertEquals("should have p95=950", 950L, values.get("p95_test"));
-        assertEquals("should have p99=990", 990L, values.get("p99_test"));
-        assertEquals("should have p999=999", 999L, values.get("p999_test"));
+        assertEquals(999D / 2, values.get("avg_test"), "should avg=499.5");
+        assertEquals(0L, values.get("min_test"), "should have min=0");
+        assertEquals(999L, values.get("max_test"), "should have max=999");
+        assertEquals(1000L, values.get("cnt_test"), "should have cnt=1000");
+        assertEquals(999 * 500L, values.get("sum_test"), "should have sum=999*500");
+        assertEquals(500L, values.get("p50_test"), "should have p50=500");
+        assertEquals(950L, values.get("p95_test"), "should have p95=950");
+        assertEquals(990L, values.get("p99_test"), "should have p99=990");
+        assertEquals(999L, values.get("p999_test"), "should have p999=999");
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/metric/SimpleCounterSetTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/metric/SimpleCounterSetTest.java
new file mode 100644
index 00000000000..3260475459c
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/metric/SimpleCounterSetTest.java
@@ -0,0 +1,61 @@
+ /*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.metric;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import java.util.Map;
+import org.apache.zookeeper.ZKTestCase;
+import org.junit.jupiter.api.Test;
+
+
+public class SimpleCounterSetTest extends ZKTestCase {
+    @Test
+    public void testValues() {
+        final SimpleCounterSet simpleCounterSet = createSimpleCounterSetAddData("test1");
+        final Map<String, Object> values = simpleCounterSet.values();
+
+        assertEquals(2, values.size());
+        assertEquals(30L , values.get("key1_test1"));
+        assertEquals(70L , values.get("key2_test1"));
+    }
+
+    @Test
+    public void testReset() {
+        final SimpleCounterSet simpleCounterSet = createSimpleCounterSetAddData("test2");
+        simpleCounterSet.reset();
+
+        final Map<String, Object> values = simpleCounterSet.values();
+
+        assertEquals(2, values.size());
+        assertEquals(0L , values.get("key1_test2"));
+        assertEquals(0L , values.get("key2_test2"));
+    }
+
+    private SimpleCounterSet createSimpleCounterSetAddData(final String name) {
+        final SimpleCounterSet simpleCounterSet = new SimpleCounterSet(name);
+
+        simpleCounterSet.add("key1", 10);
+        simpleCounterSet.add("key1", 20);
+
+        simpleCounterSet.add("key2", 30);
+        simpleCounterSet.add("key2", 40);
+
+        return simpleCounterSet;
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/EmptySnapshotTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/EmptySnapshotTest.java
index 7eb6f6003ff..8d2dba45180 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/EmptySnapshotTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/EmptySnapshotTest.java
@@ -18,16 +18,17 @@
 
 package org.apache.zookeeper.server.persistence;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.IOException;
 import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
 import org.apache.zookeeper.server.DataTree;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 
 /**
  * This test checks that the server does not create empty snapshot files if the
@@ -35,6 +36,9 @@
  */
 public class EmptySnapshotTest {
 
+    @TempDir
+    public static File testDir;
+
     static class MockFileSnap extends FileSnap {
 
         MockFileSnap(File snapDir) {
@@ -51,7 +55,7 @@ public synchronized void serialize(DataTree dt, Map<Long, Integer> sessions, Fil
 
     @Test
     public void testNoEmptySnapshot() throws Exception {
-        File tmpFile = File.createTempFile("empty-snapshot-test", ".junit", new File(System.getProperty("build.test.dir", "build")));
+        File tmpFile = File.createTempFile("empty-snapshot-test", ".junit", testDir);
         File tmpDataDir = new File(tmpFile + ".dir");
         assertFalse(tmpDataDir.exists());
         assertTrue(tmpDataDir.mkdirs());
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnLogTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnLogTest.java
index 52a734f42a2..5a8cb02f10a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnLogTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnLogTest.java
@@ -18,18 +18,25 @@
 
 package org.apache.zookeeper.server.persistence;
 
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.core.Is.is;
 import static org.hamcrest.core.IsEqual.equalTo;
-import static org.junit.Assert.assertArrayEquals;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertThat;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.Mockito.mock;
+import java.io.EOFException;
 import java.io.File;
 import java.io.IOException;
+import java.io.PrintWriter;
 import java.util.Arrays;
+import java.util.Comparator;
 import java.util.HashSet;
+import java.util.List;
+import java.util.Objects;
 import java.util.Random;
+import java.util.stream.Collectors;
+import org.apache.jute.Record;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.DummyWatcher;
 import org.apache.zookeeper.PortAssignment;
@@ -38,6 +45,7 @@
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.proto.CreateRequest;
+import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.ServerCnxnFactory;
 import org.apache.zookeeper.server.ServerStats;
 import org.apache.zookeeper.server.ZKDatabase;
@@ -45,7 +53,8 @@
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.txn.CreateTxn;
 import org.apache.zookeeper.txn.TxnHeader;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -57,43 +66,32 @@ public class FileTxnLogTest extends ZKTestCase {
 
     @Test
     public void testInvalidPreallocSize() {
-        assertEquals(
-            "file should not be padded",
-            10 * KB,
-            FilePadding.calculateFileSizeWithPadding(7 * KB, 10 * KB, 0));
-        assertEquals(
-            "file should not be padded",
-            10 * KB,
-            FilePadding.calculateFileSizeWithPadding(7 * KB, 10 * KB, -1));
+        assertEquals(10 * KB, FilePadding.calculateFileSizeWithPadding(7 * KB, 10 * KB, 0),
+                "file should not be padded");
+        assertEquals(10 * KB, FilePadding.calculateFileSizeWithPadding(7 * KB, 10 * KB, -1),
+                "file should not be padded");
     }
 
     @Test
     public void testCalculateFileSizeWithPaddingWhenNotToCurrentSize() {
-        assertEquals(
-            "file should not be padded",
-            10 * KB,
-            FilePadding.calculateFileSizeWithPadding(5 * KB, 10 * KB, 10 * KB));
+        assertEquals(10 * KB, FilePadding.calculateFileSizeWithPadding(5 * KB, 10 * KB, 10 * KB),
+                "file should not be padded");
     }
 
     @Test
     public void testCalculateFileSizeWithPaddingWhenCloseToCurrentSize() {
-        assertEquals(
-            "file should be padded an additional 10 KB",
-            20 * KB,
-            FilePadding.calculateFileSizeWithPadding(7 * KB, 10 * KB, 10 * KB));
+        assertEquals(20 * KB, FilePadding.calculateFileSizeWithPadding(7 * KB, 10 * KB, 10 * KB),
+                "file should be padded an additional 10 KB");
     }
 
     @Test
     public void testFileSizeGreaterThanPosition() {
-        assertEquals(
-            "file should be padded to 40 KB",
-            40 * KB,
-            FilePadding.calculateFileSizeWithPadding(31 * KB, 10 * KB, 10 * KB));
+        assertEquals(40 * KB, FilePadding.calculateFileSizeWithPadding(31 * KB, 10 * KB, 10 * KB),
+                "file should be padded to 40 KB");
     }
 
     @Test
-    public void testPreAllocSizeSmallerThanTxnData() throws IOException {
-        File logDir = ClientBase.createTmpDir();
+    public void testPreAllocSizeSmallerThanTxnData(@TempDir File logDir) throws IOException {
         FileTxnLog fileTxnLog = new FileTxnLog(logDir);
 
         // Set a small preAllocSize (.5 MB)
@@ -107,13 +105,19 @@ public void testPreAllocSizeSmallerThanTxnData() throws IOException {
 
         // Append and commit 2 transactions to the log
         // Prior to ZOOKEEPER-2249, attempting to pad in association with the second transaction will corrupt the first
-        fileTxnLog.append(
-            new TxnHeader(1, 1, 1, 1, ZooDefs.OpCode.create),
-            new CreateTxn("/testPreAllocSizeSmallerThanTxnData1", data, ZooDefs.Ids.OPEN_ACL_UNSAFE, false, 0));
+
+
+        fileTxnLog.append(new Request(0, 0, 0,
+                new TxnHeader(1, 1, 1, 1, ZooDefs.OpCode.create),
+                new CreateTxn("/testPreAllocSizeSmallerThanTxnData1", data, ZooDefs.Ids.OPEN_ACL_UNSAFE, false, 0),
+                0));
         fileTxnLog.commit();
-        fileTxnLog.append(
-            new TxnHeader(1, 1, 2, 2, ZooDefs.OpCode.create),
-            new CreateTxn("/testPreAllocSizeSmallerThanTxnData2", new byte[]{}, ZooDefs.Ids.OPEN_ACL_UNSAFE, false, 0));
+
+        fileTxnLog.append(new Request(0, 0, 0,
+                new TxnHeader(1, 1, 2, 2, ZooDefs.OpCode.create),
+                new CreateTxn("/testPreAllocSizeSmallerThanTxnData2", new byte[]{},
+                        ZooDefs.Ids.OPEN_ACL_UNSAFE, false, 0),
+                0));
         fileTxnLog.commit();
         fileTxnLog.close();
 
@@ -152,11 +156,14 @@ public void testSyncThresholdExceedCount() throws IOException {
         // Verify serverStats is 0 before any commit
         assertEquals(0L, serverStats.getFsyncThresholdExceedCount());
 
+
         // When ...
         for (int i = 0; i < 50; i++) {
-            fileTxnLog.append(
-                new TxnHeader(1, 1, 1, 1, ZooDefs.OpCode.create),
-                new CreateTxn("/testFsyncThresholdCountIncreased", new byte[]{}, ZooDefs.Ids.OPEN_ACL_UNSAFE, false, 0));
+            fileTxnLog.append(new Request(0, 0, 0,
+                    new TxnHeader(1, 1, 1, 1, ZooDefs.OpCode.create),
+                    new CreateTxn("/testFsyncThresholdCountIncreased", new byte[]{},
+                            ZooDefs.Ids.OPEN_ACL_UNSAFE, false, 0),
+                    0));
             fileTxnLog.commit(); // only 1 commit, otherwise it will be flaky
             // Then ... verify serverStats is updated to the number of commits (as threshold is set to 0)
             assertEquals((long) i + 1, serverStats.getFsyncThresholdExceedCount());
@@ -175,26 +182,49 @@ public void testSyncThresholdExceedCount() throws IOException {
      * Test that log size get update correctly
      */
     @Test
-    public void testGetCurrentLogSize() throws Exception {
+    public void testGetCurrentLogSize(@TempDir File tmpDir) throws Exception {
         FileTxnLog.setTxnLogSizeLimit(-1);
-        File tmpDir = ClientBase.createTmpDir();
         FileTxnLog log = new FileTxnLog(tmpDir);
         FileTxnLog.setPreallocSize(PREALLOCATE);
         CreateRequest record = new CreateRequest(null, new byte[NODE_SIZE], ZooDefs.Ids.OPEN_ACL_UNSAFE, 0);
+        long logSize = 0;
+        long position = 0;
+        int fileHeaderSize = 16;
         int zxid = 1;
         for (int i = 0; i < 4; i++) {
-            log.append(new TxnHeader(0, 0, zxid++, 0, 0), record);
-            LOG.debug("Current log size: {}", log.getCurrentLogSize());
+            if (i == 0) {
+                logSize += fileHeaderSize;
+                position += fileHeaderSize;
+            }
+
+            log.append(new Request(0, 0, 0, new TxnHeader(0, 0, zxid++, 0, 0), record, 0));
+            logSize += PREALLOCATE;
+            assertEquals(logSize, log.getCurrentLogSize());
+            assertEquals(position, log.filePosition);
         }
         log.commit();
-        LOG.info("Current log size: {}", log.getCurrentLogSize());
+        TxnHeader mockHeader = new TxnHeader(0, 0, 0, 0, 0);
+        int totalSize =  fileHeaderSize + calculateSingleRecordLength(mockHeader, record) * 4;
+        assertEquals(totalSize, log.getCurrentLogSize());
+        assertEquals(totalSize, log.filePosition);
         assertTrue(log.getCurrentLogSize() > (zxid - 1) * NODE_SIZE);
+        logSize = FilePadding.calculateFileSizeWithPadding(log.filePosition, PREALLOCATE * 4, PREALLOCATE);
+        position = totalSize;
+        boolean recalculate = true;
         for (int i = 0; i < 4; i++) {
-            log.append(new TxnHeader(0, 0, zxid++, 0, 0), record);
-            LOG.debug("Current log size: {}", log.getCurrentLogSize());
+            log.append(new Request(0, 0, 0, new TxnHeader(0, 0, zxid++, 0, 0), record, 0));
+            if (recalculate) {
+                recalculate = false;
+            } else {
+                logSize += PREALLOCATE;
+            }
+            assertEquals(logSize, log.getCurrentLogSize());
+            assertEquals(position, log.filePosition);
         }
         log.commit();
-        LOG.info("Current log size: " + log.getCurrentLogSize());
+        totalSize += calculateSingleRecordLength(mockHeader, record) * 4;
+        assertEquals(totalSize, log.getCurrentLogSize());
+        assertEquals(totalSize, log.filePosition);
         assertTrue(log.getCurrentLogSize() > (zxid - 1) * NODE_SIZE);
     }
 
@@ -203,8 +233,7 @@ public void testGetCurrentLogSize() throws Exception {
      * txnlogs per snapshot
      */
     @Test
-    public void testLogSizeLimit() throws Exception {
-        File tmpDir = ClientBase.createTmpDir();
+    public void testLogSizeLimit(@TempDir File tmpDir) throws Exception {
         ClientBase.setupTestEnv();
 
         // Need to override preallocate set by setupTestEnv()
@@ -217,7 +246,7 @@ public void testLogSizeLimit() throws Exception {
         final int PORT = Integer.parseInt(HOSTPORT.split(":")[1]);
         ServerCnxnFactory f = ServerCnxnFactory.createFactory(PORT, -1);
         f.startup(zks);
-        assertTrue("waiting for server being up ", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up ");
         ZooKeeper zk = new ZooKeeper(HOSTPORT, CONNECTION_TIMEOUT, DummyWatcher.INSTANCE);
 
         // Generate transactions
@@ -245,25 +274,19 @@ public void testLogSizeLimit() throws Exception {
 
         // shutdown
         f.shutdown();
-        assertTrue(
-            "waiting for server to shutdown",
-            ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server to shutdown");
 
         File logDir = new File(tmpDir, FileTxnSnapLog.version + FileTxnSnapLog.VERSION);
         File[] txnLogs = FileTxnLog.getLogFiles(logDir.listFiles(), 0);
 
-        assertEquals("Unexpected number of logs", 3, txnLogs.length);
+        assertEquals(3, txnLogs.length, "Unexpected number of logs");
 
         // Log size should not exceed limit by more than one node size;
         long threshold = LOG_SIZE_LIMIT + NODE_SIZE;
         LOG.info(txnLogs[0].getAbsolutePath());
-        assertTrue(
-            "Exceed log size limit: " + txnLogs[0].length(),
-            threshold > txnLogs[0].length());
+        assertTrue(threshold > txnLogs[0].length(), "Exceed log size limit: " + txnLogs[0].length());
         LOG.info(txnLogs[1].getAbsolutePath());
-        assertTrue(
-            "Exceed log size limit " + txnLogs[1].length(),
-            threshold > txnLogs[1].length());
+        assertTrue(threshold > txnLogs[1].length(), "Exceed log size limit " + txnLogs[1].length());
 
         // Start database only
         zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
@@ -274,9 +297,95 @@ public void testLogSizeLimit() throws Exception {
         for (long i = 0; i < txnCount; i++) {
             Stat stat = new Stat();
             byte[] data = db.getData("/node-" + i, stat, null);
-            assertArrayEquals("Missmatch data", bytes, data);
-            assertTrue("Unknown zxid ", zxids.contains(stat.getMzxid()));
+            assertArrayEquals(bytes, data, "Mismatch data");
+            assertTrue(zxids.contains(stat.getMzxid()), "Unknown zxid ");
+        }
+    }
+
+    private void prepareTxnLogs(File dir, int n) throws IOException {
+        FileTxnLog.setTxnLogSizeLimit(1);
+        FileTxnLog log = new FileTxnLog(dir);
+        CreateRequest record = new CreateRequest(null, new byte[NODE_SIZE],
+                ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT.toFlag());
+        int zxid = 1;
+        for (int i = 0; i < n; i++) {
+            log.append(new Request(0, 0, 0, new TxnHeader(0, 0, zxid, 0, -1), record, zxid));
+            zxid++;
+            log.commit();
         }
+        log.close();
+    }
+
+    @Test
+    public void testEmptyTailTxnLog() throws IOException {
+        long limit = FileTxnLog.getTxnLogSizeLimit();
+
+        // prepare a database with logs
+        File tmpDir = ClientBase.createTmpDir();
+        ClientBase.setupTestEnv();
+        prepareTxnLogs(tmpDir, 4);
+
+        // find the tail log and clear
+        List<File> files = Arrays.
+                stream(Objects.requireNonNull(tmpDir.listFiles((File f, String name) -> name.startsWith("log.")))).
+                sorted(Comparator.comparing(File::getName)).
+                collect(Collectors.toList());
+        File toClear = files.get(files.size() - 1);
+        PrintWriter writer = new PrintWriter(toClear);
+        writer.close();
+        LOG.info("Clear the tail log file {}", toClear.getName());
+
+        // open txn log and iterate
+        try {
+            FileTxnLog.FileTxnIterator itr = new FileTxnLog.FileTxnIterator(tmpDir, 0x0, false);
+            while (itr.next()) {}
+        } catch (EOFException ex) {}
+
+        FileTxnLog.FileTxnIterator itr = new FileTxnLog.FileTxnIterator(tmpDir, 0x0, false);
+        while (itr.next()) {}
+
+        FileTxnLog.setTxnLogSizeLimit(limit);
+    }
+
+    @Test
+    public void testEmptyMedianTxnLog() throws IOException {
+        long limit = FileTxnLog.getTxnLogSizeLimit();
+
+        // prepare a database with logs
+        File tmpDir = ClientBase.createTmpDir();
+        ClientBase.setupTestEnv();
+        prepareTxnLogs(tmpDir, 4);
+
+        // find the median log and clear
+        List<File> files = Arrays.
+                stream(Objects.requireNonNull(tmpDir.listFiles((File f, String name) -> name.startsWith("log.")))).
+                sorted(Comparator.comparing(File::getName)).
+                collect(Collectors.toList());
+        File toClear = files.get(files.size() - 2);
+
+        PrintWriter writer = new PrintWriter(toClear);
+        writer.close();
+        LOG.info("Clear the median log file {}", toClear.getName());
+
+        // open txn log and iterate, should throw EOFException
+        boolean isEof = false;
+        try {
+            FileTxnLog.FileTxnIterator itr = new FileTxnLog.FileTxnIterator(tmpDir, 0x0, false);
+            while (itr.next()) {}
+        } catch (EOFException ex) {
+            isEof = true;
+        }
+        assertTrue(isEof, "Median txn log file empty should throw Exception");
+
+        FileTxnLog.setTxnLogSizeLimit(limit);
+    }
+
+    private int calculateSingleRecordLength(TxnHeader txnHeader, Record record) throws IOException {
+        int crcLength = 8;
+        int dataLength = 4;
+        int recordLength = Util.marshallTxnEntry(txnHeader, record, null).length;
+        int endFlagLength = 1;
+        return crcLength + dataLength + recordLength + endFlagLength;
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnSnapLogMetricsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnSnapLogMetricsTest.java
index fe075fb4981..1a569e4d47e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnSnapLogMetricsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnSnapLogMetricsTest.java
@@ -18,24 +18,25 @@
 
 package org.apache.zookeeper.server.persistence;
 
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.number.OrderingComparison.greaterThan;
 import static org.hamcrest.number.OrderingComparison.greaterThanOrEqualTo;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import java.io.File;
 import java.util.Map;
-import java.util.concurrent.CountDownLatch;
 import org.apache.zookeeper.CreateMode;
-import org.apache.zookeeper.WatchedEvent;
-import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.metrics.MetricsUtils;
+import org.apache.zookeeper.server.ServerCnxnFactory;
 import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.server.SyncRequestProcessor;
+import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.test.ClientBase;
-import org.apache.zookeeper.test.QuorumUtil;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -43,43 +44,52 @@ public class FileTxnSnapLogMetricsTest extends ZKTestCase {
 
     private static final Logger LOG = LoggerFactory.getLogger(FileTxnSnapLogMetricsTest.class);
 
-    CountDownLatch allCreatedLatch;
+    @TempDir
+    File logDir;
 
-    private class MockWatcher implements Watcher {
+    @TempDir
+    File snapDir;
 
-        @Override
-        public void process(WatchedEvent e) {
-            LOG.info("all nodes created");
-            allCreatedLatch.countDown();
-        }
+    private ServerCnxnFactory startServer() throws Exception {
+        ZooKeeperServer zkServer = new ZooKeeperServer(snapDir, logDir, 3000);
+        ServerCnxnFactory cnxnFactory = ServerCnxnFactory.createFactory(0, -1);
+        cnxnFactory.startup(zkServer);
+        return cnxnFactory;
+    }
 
+    @AfterEach
+    public void cleanup() throws Exception {
+        SyncRequestProcessor.setSnapCount(ZooKeeperServer.getSnapCount());
     }
 
     @Test
     public void testFileTxnSnapLogMetrics() throws Exception {
         SyncRequestProcessor.setSnapCount(100);
 
-        QuorumUtil util = new QuorumUtil(1);
-        util.startAll();
+        ServerCnxnFactory cnxnFactory = startServer();
+        String connectString = "127.0.0.1:" + cnxnFactory.getLocalPort();
 
-        allCreatedLatch = new CountDownLatch(1);
+        // Snapshot in load data.
+        assertEquals(1L, MetricsUtils.currentServerMetrics().get("cnt_snapshottime"));
 
         byte[] data = new byte[500];
-        // make sure a snapshot is taken and some txns are not in a snapshot
-        ZooKeeper zk = ClientBase.createZKClient(util.getConnString());
+        ZooKeeper zk = ClientBase.createZKClient(connectString);
         for (int i = 0; i < 150; i++) {
             zk.create("/path" + i, data, ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         }
 
-        if (null == zk.exists("/path149", new MockWatcher())) {
-            allCreatedLatch.await();
-        }
+        // It is possible that above writes will trigger more than one snapshot due to randomization.
+        waitForMetric("cnt_snapshottime", greaterThanOrEqualTo(2L), 10);
+
+        // Pauses snapshot and logs more txns.
+        cnxnFactory.getZooKeeperServer().getTxnLogFactory().snapLog.close();
+        zk.create("/" + 1000, data, ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk.create("/" + 1001, data, ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
+        // Restart server to count startup metrics.
+        cnxnFactory.shutdown();
         ServerMetrics.getMetrics().resetAll();
-        int leader = util.getLeaderServer();
-        // restart a server so it will read the snapshot and the txn logs
-        util.shutdown(leader);
-        util.start(leader);
+        cnxnFactory = startServer();
 
         Map<String, Object> values = MetricsUtils.currentServerMetrics();
         LOG.info("txn loaded during start up {}", values.get("max_startup_txns_loaded"));
@@ -90,7 +100,7 @@ public void testFileTxnSnapLogMetrics() throws Exception {
         assertEquals(1L, values.get("cnt_startup_snap_load_time"));
         assertThat((long) values.get("max_startup_snap_load_time"), greaterThan(0L));
 
-        util.shutdownAll();
+        cnxnFactory.shutdown();
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnSnapLogTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnSnapLogTest.java
index 34d57f415dd..656eeb8a0aa 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnSnapLogTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/FileTxnSnapLogTest.java
@@ -18,13 +18,14 @@
 
 package org.apache.zookeeper.server.persistence;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.FileOutputStream;
@@ -47,9 +48,9 @@
 import org.apache.zookeeper.txn.SetDataTxn;
 import org.apache.zookeeper.txn.TxnDigest;
 import org.apache.zookeeper.txn.TxnHeader;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class FileTxnSnapLogTest {
 
@@ -63,14 +64,14 @@ public class FileTxnSnapLogTest {
 
     private File snapVersionDir;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         tmpDir = ClientBase.createEmptyTestDir();
         logDir = new File(tmpDir, "logdir");
         snapDir = new File(tmpDir, "snapdir");
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         if (tmpDir != null) {
             TestUtils.deleteFileRecursively(tmpDir);
@@ -169,14 +170,14 @@ private FileTxnSnapLog createFileTxnSnapLogWithAutoCreateDB(
      */
     @Test
     public void testWithAutoCreateDataDir() throws IOException {
-        assertFalse("log directory already exists", logDir.exists());
-        assertFalse("snapshot directory already exists", snapDir.exists());
+        assertFalse(logDir.exists(), "log directory already exists");
+        assertFalse(snapDir.exists(), "snapshot directory already exists");
 
         FileTxnSnapLog fileTxnSnapLog = createFileTxnSnapLogWithAutoCreateDataDir(logDir, snapDir, "true");
 
         assertTrue(logDir.exists());
         assertTrue(snapDir.exists());
-        assertTrue(fileTxnSnapLog.getDataDir().exists());
+        assertTrue(fileTxnSnapLog.getDataLogDir().exists());
         assertTrue(fileTxnSnapLog.getSnapDir().exists());
     }
 
@@ -184,20 +185,22 @@ public void testWithAutoCreateDataDir() throws IOException {
      * Test verifies server should fail when log dir or snap dir doesn't exist.
      * Sets "zookeeper.datadir.autocreate" to false.
      */
-    @Test(expected = FileTxnSnapLog.DatadirException.class)
+    @Test
     public void testWithoutAutoCreateDataDir() throws Exception {
-        assertFalse("log directory already exists", logDir.exists());
-        assertFalse("snapshot directory already exists", snapDir.exists());
-
-        try {
-            createFileTxnSnapLogWithAutoCreateDataDir(logDir, snapDir, "false");
-        } catch (FileTxnSnapLog.DatadirException e) {
-            assertFalse(logDir.exists());
-            assertFalse(snapDir.exists());
-            // rethrow exception
-            throw e;
-        }
-        fail("Expected exception from FileTxnSnapLog");
+        assertThrows(FileTxnSnapLog.DatadirException.class, () -> {
+            assertFalse(logDir.exists(), "log directory already exists");
+            assertFalse(snapDir.exists(), "snapshot directory already exists");
+
+            try {
+                createFileTxnSnapLogWithAutoCreateDataDir(logDir, snapDir, "false");
+            } catch (FileTxnSnapLog.DatadirException e) {
+                assertFalse(logDir.exists());
+                assertFalse(snapDir.exists());
+                // rethrow exception
+                throw e;
+            }
+            fail("Expected exception from FileTxnSnapLog");
+        });
     }
 
     private void attemptAutoCreateDB(
@@ -216,22 +219,22 @@ public void onTxnLoaded(TxnHeader hdr, Record rec, TxnDigest digest) {
                 // empty by default
             }
         });
-        assertEquals("unexpected zxid", expectedValue, zxid);
+        assertEquals(expectedValue, zxid, "unexpected zxid");
     }
 
     @Test
     public void testAutoCreateDB() throws IOException {
-        assertTrue("cannot create log directory", logDir.mkdir());
-        assertTrue("cannot create snapshot directory", snapDir.mkdir());
+        assertTrue(logDir.mkdir(), "cannot create log directory");
+        assertTrue(snapDir.mkdir(), "cannot create snapshot directory");
         File initFile = new File(logDir, "initialize");
-        assertFalse("initialize file already exists", initFile.exists());
+        assertFalse(initFile.exists(), "initialize file already exists");
 
         Map<Long, Integer> sessions = new ConcurrentHashMap<>();
 
         attemptAutoCreateDB(logDir, snapDir, sessions, "false", -1L);
         attemptAutoCreateDB(logDir, snapDir, sessions, "true", 0L);
 
-        assertTrue("cannot create initialize file", initFile.createNewFile());
+        assertTrue(initFile.createNewFile(), "cannot create initialize file");
         attemptAutoCreateDB(logDir, snapDir, sessions, "false", 0L);
     }
 
@@ -247,7 +250,7 @@ public void testGetTxnLogSyncElapsedTime() throws IOException {
             fileTxnSnapLog.append(req);
             fileTxnSnapLog.commit();
             long syncElapsedTime = fileTxnSnapLog.getTxnLogElapsedSyncTime();
-            assertNotEquals("Did not update syncElapsedTime!", -1L, syncElapsedTime);
+            assertNotEquals(-1L, syncElapsedTime, "Did not update syncElapsedTime!");
         } finally {
             fileTxnSnapLog.close();
         }
@@ -275,26 +278,30 @@ public void testDirCheckWithSingleDirSetup() throws IOException {
         }
     }
 
-    @Test(expected = FileTxnSnapLog.LogDirContentCheckException.class)
+    @Test
     public void testDirCheckWithSnapFilesInLogDir() throws IOException {
-        twoDirSetupWithCorrectFiles();
+        assertThrows(FileTxnSnapLog.LogDirContentCheckException.class, () -> {
+            twoDirSetupWithCorrectFiles();
 
-        // add snapshot files to the log version dir
-        createSnapshotFile(logVersionDir, 3);
-        createSnapshotFile(logVersionDir, 4);
+            // add snapshot files to the log version dir
+            createSnapshotFile(logVersionDir, 3);
+            createSnapshotFile(logVersionDir, 4);
 
-        createFileTxnSnapLogWithNoAutoCreateDataDir(logDir, snapDir);
+            createFileTxnSnapLogWithNoAutoCreateDataDir(logDir, snapDir);
+        });
     }
 
-    @Test(expected = FileTxnSnapLog.SnapDirContentCheckException.class)
+    @Test
     public void testDirCheckWithLogFilesInSnapDir() throws IOException {
-        twoDirSetupWithCorrectFiles();
+        assertThrows(FileTxnSnapLog.SnapDirContentCheckException.class, () -> {
+            twoDirSetupWithCorrectFiles();
 
-        // add transaction log files to the snap version dir
-        createLogFile(snapVersionDir, 3);
-        createLogFile(snapVersionDir, 4);
+            // add transaction log files to the snap version dir
+            createLogFile(snapVersionDir, 3);
+            createLogFile(snapVersionDir, 4);
 
-        createFileTxnSnapLogWithNoAutoCreateDataDir(logDir, snapDir);
+            createFileTxnSnapLogWithNoAutoCreateDataDir(logDir, snapDir);
+        });
     }
 
     /**
@@ -386,6 +393,10 @@ void testSnapshotSerializationCompatibility(Boolean digestEnabled, Boolean snapp
         SnapStream.setStreamMode(snappyEnabled ? SnapStream.StreamMode.SNAPPY : SnapStream.StreamMode.DEFAULT_MODE);
 
         ZooKeeperServer.setDigestEnabled(digestEnabled);
+        // set the flag to be the same as digestEnabled to make sure the last serialized data
+        // (for example, datatree, digest, lastProcessedZxid) is setup as expected for backward
+        // compatibility test.
+        ZooKeeperServer.setSerializeLastProcessedZxidEnabled(digestEnabled);
         TxnHeader txnHeader = new TxnHeader(1, 1, 1, 1 + 1, ZooDefs.OpCode.create);
         CreateTxn txn = new CreateTxn("/" + 1, "data".getBytes(), null, false, 1);
         Request request = new Request(1, 1, 1, txnHeader, txn, 1);
@@ -394,6 +405,10 @@ void testSnapshotSerializationCompatibility(Boolean digestEnabled, Boolean snapp
 
         int expectedNodeCount = dataTree.getNodeCount();
         ZooKeeperServer.setDigestEnabled(!digestEnabled);
+        // set the flag to be the same as digestEnabled to make sure the last serialized data
+        // (for example, datatree, digest, lastProcessedZxid) is setup as expected for backward
+        // compatibility test.
+        ZooKeeperServer.setSerializeLastProcessedZxidEnabled(!digestEnabled);
         snaplog.restore(dataTree, sessions, (hdr, rec, digest) -> {  });
         assertEquals(expectedNodeCount, dataTree.getNodeCount());
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/SnapStreamTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/SnapStreamTest.java
index 65457803679..f56dcfab296 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/SnapStreamTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/SnapStreamTest.java
@@ -18,10 +18,9 @@
 
 package org.apache.zookeeper.server.persistence;
 
-import static org.apache.zookeeper.test.ClientBase.createTmpDir;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.IOException;
 import java.io.OutputStream;
@@ -32,12 +31,13 @@
 import org.apache.jute.InputArchive;
 import org.apache.jute.OutputArchive;
 import org.apache.zookeeper.server.persistence.SnapStream.StreamMode;
-import org.junit.After;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 
 public class SnapStreamTest {
 
-    @After
+    @AfterEach
     public void tearDown() {
         System.clearProperty(SnapStream.ZOOKEEPER_SHAPSHOT_STREAM_MODE);
         SnapStream.setStreamMode(StreamMode.DEFAULT_MODE);
@@ -58,36 +58,35 @@ public void testStreamMode() {
 
     @Test
     public void testGetStreamMode() {
-        assertEquals("expected to return un-compressed stream", StreamMode.CHECKED, SnapStream.getStreamMode("snapshot.180000e3a2"));
-        assertEquals("expected to return snappy stream", StreamMode.SNAPPY, SnapStream.getStreamMode("snapshot.180000e3a2.snappy"));
-        assertEquals("expected to return gzip stream", StreamMode.GZIP, SnapStream.getStreamMode("snapshot.180000e3a2.gz"));
+        assertEquals(StreamMode.CHECKED, SnapStream.getStreamMode("snapshot.180000e3a2"), "expected to return un-compressed stream");
+        assertEquals(StreamMode.SNAPPY, SnapStream.getStreamMode("snapshot.180000e3a2.snappy"), "expected to return snappy stream");
+        assertEquals(StreamMode.GZIP, SnapStream.getStreamMode("snapshot.180000e3a2.gz"), "expected to return gzip stream");
     }
 
     @Test
-    public void testSerializeDeserializeWithChecked() throws IOException {
-        testSerializeDeserialize(StreamMode.CHECKED, "");
+    public void testSerializeDeserializeWithChecked(@TempDir File tmpDir) throws IOException {
+        testSerializeDeserialize(StreamMode.CHECKED, "", tmpDir);
     }
 
     @Test
-    public void testSerializeDeserializeWithSNAPPY() throws IOException {
-        testSerializeDeserialize(StreamMode.SNAPPY, ".snappy");
+    public void testSerializeDeserializeWithSNAPPY(@TempDir File tmpDir) throws IOException {
+        testSerializeDeserialize(StreamMode.SNAPPY, ".snappy", tmpDir);
     }
 
     @Test
-    public void testSerializeDeserializeWithGZIP() throws IOException {
-        testSerializeDeserialize(StreamMode.GZIP, ".gz");
+    public void testSerializeDeserializeWithGZIP(@TempDir File tmpDir) throws IOException {
+        testSerializeDeserialize(StreamMode.GZIP, ".gz", tmpDir);
     }
 
-    private void testSerializeDeserialize(StreamMode mode, String fileSuffix) throws IOException {
-        testSerializeDeserialize(mode, fileSuffix, false);
-        testSerializeDeserialize(mode, fileSuffix, true);
+    private void testSerializeDeserialize(StreamMode mode, String fileSuffix, File tmpDir) throws IOException {
+        testSerializeDeserialize(mode, fileSuffix, false, tmpDir);
+        testSerializeDeserialize(mode, fileSuffix, true, tmpDir);
     }
 
-    private void testSerializeDeserialize(StreamMode mode, String fileSuffix, boolean fsync) throws IOException {
+    private void testSerializeDeserialize(StreamMode mode, String fileSuffix, boolean fsync, File tmpDir) throws IOException {
         SnapStream.setStreamMode(mode);
 
         // serialize with gzip stream
-        File tmpDir = createTmpDir();
         File file = new File(tmpDir, "snapshot.180000e3a2" + fileSuffix);
         CheckedOutputStream os = SnapStream.getOutputStream(file, fsync);
         OutputArchive oa = BinaryOutputArchive.getArchive(os);
@@ -104,16 +103,15 @@ private void testSerializeDeserialize(StreamMode mode, String fileSuffix, boolea
         InputArchive ia = BinaryInputArchive.getArchive(is);
         FileHeader restoredHeader = new FileHeader();
         restoredHeader.deserialize(ia, "fileheader");
-        assertEquals("magic not the same", restoredHeader, header);
+        assertEquals(restoredHeader, header, "magic not the same");
         SnapStream.checkSealIntegrity(is, ia);
     }
 
-    private void checkInvalidSnapshot(String filename, boolean fsync) throws IOException {
+    private void checkInvalidSnapshot(String filename, boolean fsync, File tmpDir) throws IOException {
         // set the output stream mode to CHECKED
         SnapStream.setStreamMode(StreamMode.CHECKED);
 
         // serialize to CHECKED file without magic header
-        File tmpDir = createTmpDir();
         File file = new File(tmpDir, filename);
         OutputStream os = SnapStream.getOutputStream(file, fsync);
         os.write(1);
@@ -122,18 +120,22 @@ private void checkInvalidSnapshot(String filename, boolean fsync) throws IOExcep
         assertFalse(SnapStream.isValidSnapshot(file));
     }
 
-    private void checkInvalidSnapshot(String filename) throws IOException {
-        checkInvalidSnapshot(filename, false);
-        checkInvalidSnapshot(filename, true);
+    private void checkInvalidSnapshot(String filename, File tmpDir) throws IOException {
+        checkInvalidSnapshot(filename, false, tmpDir);
+        checkInvalidSnapshot(filename, true, tmpDir);
     }
 
+    /*
+        For this test a single tempDirectory will be created but the checkInvalidsnapshot will create
+        multiple files within the directory for the tests.
+     */
     @Test
-    public void testInvalidSnapshot() throws IOException {
+    public void testInvalidSnapshot(@TempDir File tmpDir) throws IOException {
         assertFalse(SnapStream.isValidSnapshot(null));
 
-        checkInvalidSnapshot("snapshot.180000e3a2");
-        checkInvalidSnapshot("snapshot.180000e3a2.gz");
-        checkInvalidSnapshot("snapshot.180000e3a2.snappy");
+        checkInvalidSnapshot("snapshot.180000e3a2", tmpDir);
+        checkInvalidSnapshot("snapshot.180000e3a2.gz", tmpDir);
+        checkInvalidSnapshot("snapshot.180000e3a2.snappy", tmpDir);
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/TxnLogToolkitTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/TxnLogToolkitTest.java
index 20d6fe8a96b..361666709f4 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/TxnLogToolkitTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/persistence/TxnLogToolkitTest.java
@@ -19,22 +19,41 @@
 package org.apache.zookeeper.server.persistence;
 
 import static org.hamcrest.CoreMatchers.containsString;
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.core.IsNot.not;
-import static org.junit.Assert.assertThat;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.FileNotFoundException;
 import java.io.IOException;
 import java.io.PrintStream;
+import java.nio.ByteBuffer;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.List;
 import java.util.Scanner;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 import org.apache.commons.io.FileUtils;
+import org.apache.jute.BinaryOutputArchive;
+import org.apache.jute.Record;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.apache.zookeeper.txn.CheckVersionTxn;
+import org.apache.zookeeper.txn.CreateContainerTxn;
+import org.apache.zookeeper.txn.CreateTTLTxn;
+import org.apache.zookeeper.txn.CreateTxn;
+import org.apache.zookeeper.txn.DeleteTxn;
+import org.apache.zookeeper.txn.ErrorTxn;
+import org.apache.zookeeper.txn.MultiTxn;
+import org.apache.zookeeper.txn.SetDataTxn;
+import org.apache.zookeeper.txn.Txn;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class TxnLogToolkitTest {
 
@@ -44,7 +63,7 @@ public class TxnLogToolkitTest {
     private final ByteArrayOutputStream errContent = new ByteArrayOutputStream();
     private File mySnapDir;
 
-    @Before
+    @BeforeEach
     public void setUp() throws IOException {
         System.setOut(new PrintStream(outContent));
         System.setErr(new PrintStream(errContent));
@@ -53,7 +72,7 @@ public void setUp() throws IOException {
         FileUtils.copyDirectory(snapDir, mySnapDir);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws IOException {
         System.setOut(System.out);
         System.setErr(System.err);
@@ -74,20 +93,53 @@ public void testDumpMode() throws Exception {
         // no exception thrown
     }
 
-    @Test(expected = TxnLogToolkit.TxnLogToolkitException.class)
+    @Test
     public void testInitMissingFile() throws FileNotFoundException, TxnLogToolkit.TxnLogToolkitException {
-        // Arrange & Act
-        File logfile = new File("this_file_should_not_exists");
-        TxnLogToolkit lt = new TxnLogToolkit(false, false, logfile.toString(), true);
+        assertThrows(TxnLogToolkit.TxnLogToolkitException.class, () -> {
+            // Arrange & Act
+            File logfile = new File("this_file_should_not_exists");
+            TxnLogToolkit lt = new TxnLogToolkit(false, false, logfile.toString(), true);
+        });
     }
 
-    @Test(expected = TxnLogToolkit.TxnLogToolkitException.class)
-    public void testInitWithRecoveryFileExists() throws IOException, TxnLogToolkit.TxnLogToolkitException {
-        // Arrange & Act
-        File logfile = new File(new File(mySnapDir, "version-2"), "log.274");
-        File recoveryFile = new File(new File(mySnapDir, "version-2"), "log.274.fixed");
-        recoveryFile.createNewFile();
-        TxnLogToolkit lt = new TxnLogToolkit(true, false, logfile.toString(), true);
+    @Test
+    public void testMultiTxnDecode() throws IOException {
+        // MultiTxn with multi ops including errors
+        List<Txn> txns = new ArrayList<>();
+        txns.add(newSubTxn(ZooDefs.OpCode.error, new ErrorTxn(KeeperException.Code.NONODE.intValue())));
+        txns.add(newSubTxn(ZooDefs.OpCode.error, new ErrorTxn(KeeperException.Code.RUNTIMEINCONSISTENCY.intValue())));
+        txns.add(newSubTxn(ZooDefs.OpCode.create, new CreateTxn("/test", "test-data".getBytes(StandardCharsets.UTF_8), ZooDefs.Ids.OPEN_ACL_UNSAFE, true, 1)));
+        txns.add(newSubTxn(ZooDefs.OpCode.createContainer, new CreateContainerTxn("/test_container", "test-data".getBytes(StandardCharsets.UTF_8), ZooDefs.Ids.OPEN_ACL_UNSAFE, 2)));
+        txns.add(newSubTxn(ZooDefs.OpCode.createTTL, new CreateTTLTxn("/test_container", "test-data".getBytes(StandardCharsets.UTF_8), ZooDefs.Ids.OPEN_ACL_UNSAFE, 2, 20)));
+        txns.add(newSubTxn(ZooDefs.OpCode.setData, new SetDataTxn("/test_set_data", "test-data".getBytes(StandardCharsets.UTF_8), 4)));
+        txns.add(newSubTxn(ZooDefs.OpCode.delete, new DeleteTxn("/test_delete")));
+        txns.add(newSubTxn(ZooDefs.OpCode.check, new CheckVersionTxn("/test_check_version", 5)));
+        MultiTxn multiTxn = new MultiTxn(txns);
+        String formattedTxnStr = TxnLogToolkit.getFormattedTxnStr(multiTxn);
+        assertEquals("error:-101;error:-2;create:/test,test-data,[31,s{'world,'anyone}\n"
+                    + "],true,1;createContainer:/test_container,test-data,[31,s{'world,'anyone}\n"
+                    + "],2;createTTL:/test_container,test-data,[31,s{'world,'anyone}\n"
+                    + "],2,20;setData:/test_set_data,test-data,4;delete:/test_delete;check:/test_check_version,5", formattedTxnStr);
+    }
+
+    private static Txn newSubTxn(int type, Record record) throws IOException {
+        try (ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
+            BinaryOutputArchive boa = BinaryOutputArchive.getArchive(baos);
+            record.serialize(boa, "request");
+            ByteBuffer bb = ByteBuffer.wrap(baos.toByteArray());
+            return new Txn(type, bb.array());
+        }
+    }
+
+    @Test
+    public void testInitWithRecoveryFileExists() {
+        assertThrows(TxnLogToolkit.TxnLogToolkitException.class, () -> {
+            // Arrange & Act
+            File logfile = new File(new File(mySnapDir, "version-2"), "log.274");
+            File recoveryFile = new File(new File(mySnapDir, "version-2"), "log.274.fixed");
+            recoveryFile.createNewFile();
+            TxnLogToolkit lt = new TxnLogToolkit(true, false, logfile.toString(), true);
+        });
     }
 
     @Test
@@ -103,7 +155,7 @@ public void testDumpWithCrcError() throws Exception {
         String output = outContent.toString();
         Pattern p = Pattern.compile("^CRC ERROR.*session 0x8061fac5ddeb0000 cxid 0x0 zxid 0x8800000002 createSession 30000$", Pattern.MULTILINE);
         Matcher m = p.matcher(output);
-        assertTrue("Output doesn't indicate CRC error for the broken session id: " + output, m.find());
+        assertTrue(m.find(), "Output doesn't indicate CRC error for the broken session id: " + output);
     }
 
     @Test
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/BufferStatsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/BufferStatsTest.java
index 9fb9cfb2bdb..abe9764dfc6 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/BufferStatsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/BufferStatsTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertEquals;
-import org.junit.Test;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import org.junit.jupiter.api.Test;
 
 public class BufferStatsTest {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CloseSessionTxnTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CloseSessionTxnTest.java
index 6727d0053a9..646668abdb8 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CloseSessionTxnTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CloseSessionTxnTest.java
@@ -18,14 +18,15 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper.States;
 import org.apache.zookeeper.server.ZooKeeperServer;
-import org.junit.Assert;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class CloseSessionTxnTest extends QuorumPeerTestBase {
 
@@ -89,8 +90,8 @@ private void testCloseSessionWithDifferentConfig(
         for (int i = 0; i < numServers; i++) {
             final CountDownLatch syncedLatch = new CountDownLatch(1);
             servers.zk[i].sync(path, (rc, path1, ctx) -> syncedLatch.countDown(), null);
-            Assert.assertTrue(syncedLatch.await(3, TimeUnit.SECONDS));
-            Assert.assertNull(servers.zk[i].exists(path, false));
+            assertTrue(syncedLatch.await(3, TimeUnit.SECONDS));
+            assertNull(servers.zk[i].exists(path, false));
         }
     }
  }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CnxManagerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CnxManagerTest.java
index a99e33678f0..f4160b3c28f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CnxManagerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CnxManagerTest.java
@@ -18,12 +18,12 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.DataInputStream;
@@ -58,8 +58,8 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.FLENewEpochTest;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -74,11 +74,11 @@ public class CnxManagerTest extends ZKTestCase {
     File[] peerTmpdir;
     int[] peerQuorumPort;
     int[] peerClientPort;
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
 
         this.count = 3;
-        this.peers = new HashMap<Long, QuorumServer>(count);
+        this.peers = new HashMap<>(count);
         peerTmpdir = new File[count];
         peerQuorumPort = new int[count];
         peerClientPort = new int[count];
@@ -183,7 +183,7 @@ public void testCnxManager() throws Exception {
             }
         }
 
-        assertTrue("Exceeded number of retries", numRetries <= THRESHOLD);
+        assertTrue(numRetries <= THRESHOLD, "Exceeded number of retries");
 
         thread.join(5000);
         if (thread.isAlive()) {
@@ -251,7 +251,7 @@ public void testCnxManagerSpinLock() throws Exception {
             LOG.error("Null listener when initializing cnx manager");
         }
 
-        InetSocketAddress address = peers.get(peer.getId()).electionAddr.getReachableOrOne();
+        InetSocketAddress address = peers.get(peer.getMyId()).electionAddr.getReachableOrOne();
         LOG.info("Election port: {}", address.getPort());
 
         Thread.sleep(1000);
@@ -309,17 +309,15 @@ public void testCnxManagerListenerThreadConfigurableRetry() throws Exception {
         final QuorumPeer peer = new QuorumPeer(unresolvablePeers, ClientBase.createTmpDir(), ClientBase.createTmpDir(), 2181, 3, myid, 1000, 2, 2, 2);
         final QuorumCnxManager cnxManager = peer.createCnxnManager();
         final QuorumCnxManager.Listener listener = cnxManager.listener;
-        final AtomicBoolean errorHappend = new AtomicBoolean(false);
-        listener.setSocketBindErrorHandler(() -> errorHappend.set(true));
+        final AtomicBoolean errorHappened = new AtomicBoolean(false);
+        listener.setSocketBindErrorHandler(() -> errorHappened.set(true));
         listener.start();
         // listener thread should stop and throws error which notify QuorumPeer about error.
         // QuorumPeer should start shutdown process
         listener.join(15000); // set wait time, if listener contains bug and thread not stops.
         assertFalse(listener.isAlive());
-        assertTrue(errorHappend.get());
-        assertFalse(QuorumPeer.class.getSimpleName()
-                                   + " not stopped after "
-                                   + "listener thread death", listener.isAlive());
+        assertTrue(errorHappened.get());
+        assertFalse(listener.isAlive(), QuorumPeer.class.getSimpleName() + " not stopped after " + "listener thread death");
     }
 
     /**
@@ -341,7 +339,7 @@ public void testCnxManagerNPE() throws Exception {
         } else {
             LOG.error("Null listener when initializing cnx manager");
         }
-        InetSocketAddress address = peers.get(peer.getId()).electionAddr.getReachableOrOne();
+        InetSocketAddress address = peers.get(peer.getMyId()).electionAddr.getReachableOrOne();
         LOG.info("Election port: {}", address.getPort());
 
         Thread.sleep(1000);
@@ -388,7 +386,7 @@ public void testSocketTimeout() throws Exception {
         } else {
             LOG.error("Null listener when initializing cnx manager");
         }
-        InetSocketAddress address = peers.get(peer.getId()).electionAddr.getReachableOrOne();
+        InetSocketAddress address = peers.get(peer.getMyId()).electionAddr.getReachableOrOne();
         LOG.info("Election port: {}", address.getPort());
         Thread.sleep(1000);
 
@@ -501,11 +499,11 @@ public QuorumX509Util createX509Util() {
      */
     @Test
     public void testWorkerThreads() throws Exception {
-        ArrayList<QuorumPeer> peerList = new ArrayList<QuorumPeer>();
+        ArrayList<QuorumPeer> peerList = new ArrayList<>();
         try {
             for (int sid = 0; sid < 3; sid++) {
                 QuorumPeer peer = new QuorumPeer(peers, peerTmpdir[sid], peerTmpdir[sid], peerClientPort[sid], 3, sid, 1000, 2, 2, 2);
-                LOG.info("Starting peer {}", peer.getId());
+                LOG.info("Starting peer {}", peer.getMyId());
                 peer.start();
                 peerList.add(sid, peer);
             }
@@ -515,14 +513,14 @@ public void testWorkerThreads() throws Exception {
                 for (int i = 0; i < 5; i++) {
                     // halt one of the listeners and verify count
                     QuorumPeer peer = peerList.get(myid);
-                    LOG.info("Round {}, halting peer {}", i, peer.getId());
+                    LOG.info("Round {}, halting peer {}", i, peer.getMyId());
                     peer.shutdown();
                     peerList.remove(myid);
                     failure = verifyThreadCount(peerList, 2);
                     assertNull(failure, failure);
                     // Restart halted node and verify count
                     peer = new QuorumPeer(peers, peerTmpdir[myid], peerTmpdir[myid], peerClientPort[myid], 3, myid, 1000, 2, 2, 2);
-                    LOG.info("Round {}, restarting peer {}", i, peer.getId());
+                    LOG.info("Round {}, restarting peer {}", i, peer.getMyId());
                     peer.start();
                     peerList.add(myid, peer);
                     failure = verifyThreadCount(peerList, 4);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorConcurrencyTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorConcurrencyTest.java
index 9cd49859cb0..5f5449d240e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorConcurrencyTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorConcurrencyTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.nio.ByteBuffer;
@@ -43,11 +43,13 @@
 import org.apache.zookeeper.proto.SetDataRequest;
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.RequestProcessor;
+import org.apache.zookeeper.server.RequestRecord;
 import org.apache.zookeeper.server.WorkerService;
 import org.apache.zookeeper.server.ZooKeeperServerListener;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -59,15 +61,15 @@ public class CommitProcessorConcurrencyTest extends ZKTestCase {
     MockCommitProcessor processor;
     int defaultSizeOfThreadPool = 16;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
-        processedRequests = new LinkedBlockingQueue<Request>();
+        processedRequests = new LinkedBlockingQueue<>();
         processor = new MockCommitProcessor();
         CommitProcessor.setMaxReadBatchSize(-1);
         CommitProcessor.setMaxCommitBatchSize(1);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         processor.shutdown();
     }
@@ -128,7 +130,7 @@ private Request newRequest(Record rec, int type, int sessionId, int xid) throws
         BinaryOutputArchive boa = BinaryOutputArchive.getArchive(boas);
         rec.serialize(boa, "request");
         ByteBuffer bb = ByteBuffer.wrap(boas.toByteArray());
-        return new Request(null, sessionId, xid, type, bb, new ArrayList<Id>());
+        return new Request(null, sessionId, xid, type, RequestRecord.fromBytes(bb), new ArrayList<Id>());
     }
 
     /**
@@ -153,12 +155,12 @@ public void committedAndUncommittedOfTheSameSessionRaceTest() throws Exception {
         processor.run();
 
         assertTrue(
-            "Request was not processed " + readReq + " instead " + processedRequests.peek(),
-            processedRequests.peek() != null && processedRequests.peek().equals(readReq));
+            processedRequests.peek() != null && processedRequests.peek().equals(readReq),
+            "Request was not processed " + readReq + " instead " + processedRequests.peek());
         processedRequests.poll();
         assertTrue(
-            "Request was not processed " + writeReq + " instead " + processedRequests.peek(),
-            processedRequests.peek() != null && processedRequests.peek().equals(writeReq));
+            processedRequests.peek() != null && processedRequests.peek().equals(writeReq),
+            "Request was not processed " + writeReq + " instead " + processedRequests.peek());
     }
 
     /**
@@ -167,13 +169,13 @@ public void committedAndUncommittedOfTheSameSessionRaceTest() throws Exception {
      * i.e., 5 sessions, each has different amount or read requests, followed by
      * single write and afterwards single read. The idea is to check that all of
      * the reads that can be processed concurrently do so, and that none of the
-     * uncommited requests, followed by the reads are processed.
+     * uncommitted requests, followed by the reads are processed.
      */
     @Test
     public void processAsMuchUncommittedRequestsAsPossibleTest() throws Exception {
         final String path = "/testAsMuchAsPossible";
-        List<Request> shouldBeProcessed = new LinkedList<Request>();
-        Set<Request> shouldNotBeProcessed = new HashSet<Request>();
+        List<Request> shouldBeProcessed = new LinkedList<>();
+        Set<Request> shouldNotBeProcessed = new HashSet<>();
         for (int sessionId = 1; sessionId <= 5; ++sessionId) {
             for (int readReqId = 1; readReqId <= sessionId; ++readReqId) {
                 Request readReq = newRequest(new GetDataRequest(path, false), OpCode.getData, sessionId, readReqId);
@@ -209,8 +211,8 @@ public void processAsMuchUncommittedRequestsAsPossibleTest() throws Exception {
         for (Request r : shouldBeProcessed) {
             LOG.error("Did not process {}", r);
         }
-        assertTrue("Not all requests were processed", shouldBeProcessed.isEmpty());
-        assertFalse("Processed a wrong request", shouldNotBeProcessed.removeAll(processedRequests));
+        assertTrue(shouldBeProcessed.isEmpty(), "Not all requests were processed");
+        assertFalse(shouldNotBeProcessed.removeAll(processedRequests), "Processed a wrong request");
     }
 
     /**
@@ -222,9 +224,9 @@ public void processAsMuchUncommittedRequestsAsPossibleTest() throws Exception {
      */
     @Test
     public void processAllFollowingUncommittedAfterFirstCommitTest() throws Exception {
-        final String path = "/testUncommittedFollowingCommited";
-        Set<Request> shouldBeInPending = new HashSet<Request>();
-        Set<Request> shouldBeProcessedAfterPending = new HashSet<Request>();
+        final String path = "/testUncommittedFollowingCommitted";
+        Set<Request> shouldBeInPending = new HashSet<>();
+        Set<Request> shouldBeProcessedAfterPending = new HashSet<>();
 
         Request writeReq = newRequest(
             new CreateRequest(path, new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_SEQUENTIAL.toFlag()),
@@ -245,15 +247,15 @@ public void processAllFollowingUncommittedAfterFirstCommitTest() throws Exceptio
 
         processor.stoppedMainLoop = true;
         processor.run();
-        assertTrue("Processed without waiting for commit", processedRequests.isEmpty());
-        assertTrue("Did not handled all of queuedRequests' requests", processor.queuedRequests.isEmpty());
-        assertTrue("Removed from blockedQueuedRequests before commit", !processor.queuedWriteRequests.isEmpty());
+        assertTrue(processedRequests.isEmpty(), "Processed without waiting for commit");
+        assertTrue(processor.queuedRequests.isEmpty(), "Did not handled all of queuedRequests' requests");
+        assertTrue(!processor.queuedWriteRequests.isEmpty(), "Removed from blockedQueuedRequests before commit");
 
         shouldBeInPending.removeAll(processor.pendingRequests.get(writeReq.sessionId));
         for (Request r : shouldBeInPending) {
             LOG.error("Should be in pending {}", r);
         }
-        assertTrue("Not all requests moved to pending from queuedRequests", shouldBeInPending.isEmpty());
+        assertTrue(shouldBeInPending.isEmpty(), "Not all requests moved to pending from queuedRequests");
 
         processor.committedRequests.add(writeReq);
         processor.stoppedMainLoop = true;
@@ -261,11 +263,11 @@ public void processAllFollowingUncommittedAfterFirstCommitTest() throws Exceptio
         processor.initThreads(defaultSizeOfThreadPool);
 
         Thread.sleep(500);
-        assertTrue("Did not process committed request", processedRequests.peek() == writeReq);
-        assertTrue("Did not process following read request", processedRequests.containsAll(shouldBeProcessedAfterPending));
-        assertTrue("Did not process committed request", processor.committedRequests.isEmpty());
-        assertTrue("Did not process committed request", processor.pendingRequests.isEmpty());
-        assertTrue("Did not remove from blockedQueuedRequests", processor.queuedWriteRequests.isEmpty());
+        assertTrue(processedRequests.peek() == writeReq, "Did not process committed request");
+        assertTrue(processedRequests.containsAll(shouldBeProcessedAfterPending), "Did not process following read request");
+        assertTrue(processor.committedRequests.isEmpty(), "Did not process committed request");
+        assertTrue(processor.pendingRequests.isEmpty(), "Did not process committed request");
+        assertTrue(processor.queuedWriteRequests.isEmpty(), "Did not remove from blockedQueuedRequests");
     }
 
     /**
@@ -285,7 +287,7 @@ public void processAllFollowingUncommittedAfterFirstCommitTest() throws Exceptio
     @Test
     public void processAllWritesMaxBatchSize() throws Exception {
         final String path = "/processAllWritesMaxBatchSize";
-        HashSet<Request> shouldBeProcessedAfterPending = new HashSet<Request>();
+        HashSet<Request> shouldBeProcessedAfterPending = new HashSet<>();
 
         Request writeReq = newRequest(
             new CreateRequest(
@@ -337,11 +339,11 @@ public void processAllWritesMaxBatchSize() throws Exception {
         processor.stoppedMainLoop = true;
         CommitProcessor.setMaxCommitBatchSize(2);
         processor.run();
-        assertTrue("Processed without waiting for commit", processedRequests.isEmpty());
-        assertTrue("Did not handled all of queuedRequests' requests", processor.queuedRequests.isEmpty());
-        assertTrue("Removed from blockedQueuedRequests before commit", !processor.queuedWriteRequests.isEmpty());
-        assertTrue("Missing session 1 in pending queue", processor.pendingRequests.containsKey(writeReq.sessionId));
-        assertTrue("Missing session 2 in pending queue", processor.pendingRequests.containsKey(writeReq2.sessionId));
+        assertTrue(processedRequests.isEmpty(), "Processed without waiting for commit");
+        assertTrue(processor.queuedRequests.isEmpty(), "Did not handled all of queuedRequests' requests");
+        assertTrue(!processor.queuedWriteRequests.isEmpty(), "Removed from blockedQueuedRequests before commit");
+        assertTrue(processor.pendingRequests.containsKey(writeReq.sessionId), "Missing session 1 in pending queue");
+        assertTrue(processor.pendingRequests.containsKey(writeReq2.sessionId), "Missing session 2 in pending queue");
 
         processor.committedRequests.add(writeReq);
         processor.committedRequests.add(writeReq2);
@@ -352,21 +354,18 @@ public void processAllWritesMaxBatchSize() throws Exception {
         processor.initThreads(defaultSizeOfThreadPool);
 
         Thread.sleep(500);
-        assertTrue("Did not process committed request", processedRequests.peek() == writeReq);
-        assertTrue("Did not process following read request", processedRequests.containsAll(shouldBeProcessedAfterPending));
-        assertTrue("Processed committed request", !processor.committedRequests.isEmpty());
-        assertTrue("Removed commit for write req 3", processor.committedRequests.peek() == writeReq3);
-        assertTrue("Processed committed request", !processor.pendingRequests.isEmpty());
-        assertTrue("Missing session 2 in pending queue", processor.pendingRequests.containsKey(writeReq3.sessionId));
-        assertTrue(
-            "Missing write 3 in pending queue",
-            processor.pendingRequests.get(writeReq3.sessionId).peek() == writeReq3);
-        assertTrue(
-            "Removed from blockedQueuedRequests",
-            !processor.queuedWriteRequests.isEmpty());
-        assertTrue(
-            "Removed write req 3 from blockedQueuedRequests",
-            processor.queuedWriteRequests.peek() == writeReq3);
+        assertTrue(processedRequests.peek() == writeReq, "Did not process committed request");
+        assertTrue(processedRequests.containsAll(shouldBeProcessedAfterPending), "Did not process following read request");
+        assertTrue(!processor.committedRequests.isEmpty(), "Processed committed request");
+        assertTrue(processor.committedRequests.peek() == writeReq3, "Removed commit for write req 3");
+        assertTrue(!processor.pendingRequests.isEmpty(), "Processed committed request");
+        assertTrue(processor.pendingRequests.containsKey(writeReq3.sessionId), "Missing session 2 in pending queue");
+        assertTrue(processor.pendingRequests.get(writeReq3.sessionId).peek() == writeReq3,
+            "Missing write 3 in pending queue");
+        assertTrue(!processor.queuedWriteRequests.isEmpty(),
+            "Removed from blockedQueuedRequests");
+        assertTrue(processor.queuedWriteRequests.peek() == writeReq3,
+            "Removed write req 3 from blockedQueuedRequests");
 
         Request readReq3 = newRequest(new GetDataRequest(path, false), OpCode.getData, 0x1, 7);
         processor.queuedRequests.add(readReq3);
@@ -391,14 +390,13 @@ public void processAllWritesMaxBatchSize() throws Exception {
         processor.initThreads(defaultSizeOfThreadPool);
 
         Thread.sleep(500);
-        assertTrue("Did not process committed request", processedRequests.peek() == writeReq);
-        assertTrue("Did not process following read request", processedRequests.containsAll(shouldBeProcessedAfterPending));
-        assertTrue("Processed unexpected committed request", !processor.committedRequests.isEmpty());
-        assertTrue("Unexpected pending request", processor.pendingRequests.isEmpty());
-        assertTrue("Removed from blockedQueuedRequests", !processor.queuedWriteRequests.isEmpty());
-        assertTrue(
-            "Removed write req 4 from blockedQueuedRequests",
-            processor.queuedWriteRequests.peek() == writeReq4);
+        assertTrue(processedRequests.peek() == writeReq, "Did not process committed request");
+        assertTrue(processedRequests.containsAll(shouldBeProcessedAfterPending), "Did not process following read request");
+        assertTrue(!processor.committedRequests.isEmpty(), "Processed unexpected committed request");
+        assertTrue(processor.pendingRequests.isEmpty(), "Unexpected pending request");
+        assertTrue(!processor.queuedWriteRequests.isEmpty(), "Removed from blockedQueuedRequests");
+        assertTrue(processor.queuedWriteRequests.peek() == writeReq4,
+            "Removed write req 4 from blockedQueuedRequests");
 
         processor.stoppedMainLoop = true;
         CommitProcessor.setMaxCommitBatchSize(3);
@@ -406,11 +404,11 @@ public void processAllWritesMaxBatchSize() throws Exception {
         processor.initThreads(defaultSizeOfThreadPool);
 
         Thread.sleep(500);
-        assertTrue("Did not process committed request", processedRequests.peek() == writeReq);
-        assertTrue("Did not process following read request", processedRequests.containsAll(shouldBeProcessedAfterPending));
-        assertTrue("Did not process committed request", processor.committedRequests.isEmpty());
-        assertTrue("Did not process committed request", processor.pendingRequests.isEmpty());
-        assertTrue("Did not remove from blockedQueuedRequests", processor.queuedWriteRequests.isEmpty());
+        assertTrue(processedRequests.peek() == writeReq, "Did not process committed request");
+        assertTrue(processedRequests.containsAll(shouldBeProcessedAfterPending), "Did not process following read request");
+        assertTrue(processor.committedRequests.isEmpty(), "Did not process committed request");
+        assertTrue(processor.pendingRequests.isEmpty(), "Did not process committed request");
+        assertTrue(processor.queuedWriteRequests.isEmpty(), "Did not remove from blockedQueuedRequests");
 
     }
 
@@ -420,17 +418,16 @@ public void processAllWritesMaxBatchSize() throws Exception {
      * and use infinite queuedRequests. We verify that the committed request was
      * processed.
      */
-    @Test(timeout = 1000)
+    @Test
+    @Timeout(value = 1)
     public void noStarvationOfNonLocalCommittedRequestsTest() throws Exception {
         final String path = "/noStarvationOfCommittedRequests";
         processor.queuedRequests = new MockRequestsQueue();
-        Set<Request> nonLocalCommits = new HashSet<Request>();
+        Set<Request> nonLocalCommits = new HashSet<>();
         for (int i = 0; i < 10; i++) {
             Request nonLocalCommitReq = newRequest(
                 new CreateRequest(path, new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_SEQUENTIAL.toFlag()),
-                OpCode.create,
-                51,
-                i + 1);
+                OpCode.create, 51, i + 1);
             processor.committedRequests.add(nonLocalCommitReq);
             nonLocalCommits.add(nonLocalCommitReq);
         }
@@ -439,7 +436,7 @@ public void noStarvationOfNonLocalCommittedRequestsTest() throws Exception {
             processor.stoppedMainLoop = true;
             processor.run();
         }
-        assertTrue("commit request was not processed", processedRequests.containsAll(nonLocalCommits));
+        assertTrue(processedRequests.containsAll(nonLocalCommits), "commit request was not processed");
     }
 
     /**
@@ -464,7 +461,7 @@ public void noStarvationOfReadRequestsTest() throws Exception {
         processor.queuedRequests.add(firstCommittedReq);
         processor.queuedWriteRequests.add(firstCommittedReq);
         processor.committedRequests.add(firstCommittedReq);
-        Set<Request> allReads = new HashSet<Request>();
+        Set<Request> allReads = new HashSet<>();
 
         // +1 read request to queuedRequests
         Request firstRead = newRequest(new GetDataRequest(path, false), OpCode.getData, 0x1, 0);
@@ -479,7 +476,7 @@ public void noStarvationOfReadRequestsTest() throws Exception {
             2);
         processor.committedRequests.add(secondCommittedReq);
 
-        Set<Request> waitingCommittedRequests = new HashSet<Request>();
+        Set<Request> waitingCommittedRequests = new HashSet<>();
         // +99 non local committed requests
         for (int writeReqId = 3; writeReqId < 102; ++writeReqId) {
             Request writeReq = newRequest(
@@ -506,15 +503,15 @@ public void noStarvationOfReadRequestsTest() throws Exception {
 
         processor.stoppedMainLoop = true;
         processor.run();
-        assertTrue("Did not process the first write request", processedRequests.contains(firstCommittedReq));
+        assertTrue(processedRequests.contains(firstCommittedReq), "Did not process the first write request");
         for (Request r : allReads) {
-            assertTrue("Processed read request", !processedRequests.contains(r));
+            assertTrue(!processedRequests.contains(r), "Processed read request");
         }
         processor.run();
-        assertTrue("did not processed all reads", processedRequests.containsAll(allReads));
-        assertTrue("Did not process the second write request", processedRequests.contains(secondCommittedReq));
+        assertTrue(processedRequests.containsAll(allReads), "did not processed all reads");
+        assertTrue(processedRequests.contains(secondCommittedReq), "Did not process the second write request");
         for (Request r : waitingCommittedRequests) {
-            assertTrue("Processed additional committed request", !processedRequests.contains(r));
+            assertTrue(!processedRequests.contains(r), "Processed additional committed request");
         }
     }
 
@@ -524,7 +521,8 @@ public void noStarvationOfReadRequestsTest() throws Exception {
      * when a session is just established and there is request waiting to be committed in the
      * session queue but it sees a commit for a request that belongs to the previous connection.
      */
-    @Test(timeout = 5000)
+    @Test
+    @Timeout(value = 5)
     public void noCrashOnCommittedRequestsOfUnseenRequestTest() throws Exception {
         final String path = "/noCrash/OnCommittedRequests/OfUnseenRequestTest";
         final int numberofReads = 10;
@@ -532,13 +530,11 @@ public void noCrashOnCommittedRequestsOfUnseenRequestTest() throws Exception {
         final int firstCXid = 0x100;
         int readReqId = firstCXid;
         processor.stoppedMainLoop = true;
-        HashSet<Request> localRequests = new HashSet<Request>();
+        HashSet<Request> localRequests = new HashSet<>();
         // queue the blocking write request to queuedRequests
         Request firstCommittedReq = newRequest(
             new CreateRequest(path, new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_SEQUENTIAL.toFlag()),
-            OpCode.create,
-            sessionid,
-            readReqId++);
+            OpCode.create, sessionid, readReqId++);
         processor.queuedRequests.add(firstCommittedReq);
         processor.queuedWriteRequests.add(firstCommittedReq);
         localRequests.add(firstCommittedReq);
@@ -563,9 +559,7 @@ public void noCrashOnCommittedRequestsOfUnseenRequestTest() throws Exception {
         // i.e., commit of an update from previous connection of this session.
         Request preSessionCommittedReq = newRequest(
             new CreateRequest(path, new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_SEQUENTIAL.toFlag()),
-            OpCode.create,
-            sessionid,
-            firstCXid - 2);
+            OpCode.create, sessionid, firstCXid - 2);
         processor.committedRequests.add(preSessionCommittedReq);
         processor.committedRequests.add(firstCommittedReq);
         processor.run();
@@ -589,7 +583,8 @@ public void noCrashOnCommittedRequestsOfUnseenRequestTest() throws Exception {
      * the leader out of order. Hence, the commits can also arrive "out of order" w.r.t. cxid.
      * We should commit the requests according to the order we receive from the leader, i.e., wait for the relevant commit.
      */
-    @Test(timeout = 5000)
+    @Test
+    @Timeout(value = 5)
     public void noCrashOnOutofOrderCommittedRequestTest() throws Exception {
         final String path = "/noCrash/OnCommittedRequests/OfUnSeenRequestTest";
         final int sessionid = 0x123456;
@@ -597,14 +592,12 @@ public void noCrashOnOutofOrderCommittedRequestTest() throws Exception {
         final int numberofReads = 10;
         int readReqId = lastCXid;
         processor.stoppedMainLoop = true;
-        HashSet<Request> localRequests = new HashSet<Request>();
+        HashSet<Request> localRequests = new HashSet<>();
 
         // queue the blocking write request to queuedRequests
         Request orphanCommittedReq = newRequest(
             new CreateRequest(path, new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_SEQUENTIAL.toFlag()),
-            OpCode.create,
-            sessionid,
-            lastCXid);
+            OpCode.create, sessionid, lastCXid);
         processor.queuedRequests.add(orphanCommittedReq);
         processor.queuedWriteRequests.add(orphanCommittedReq);
         localRequests.add(orphanCommittedReq);
@@ -627,14 +620,8 @@ public void noCrashOnOutofOrderCommittedRequestTest() throws Exception {
         // We add a commit that belongs to the same session but with larger cxid,
         // i.e., commit of an update from the next connection of this session.
         Request otherSessionCommittedReq = newRequest(
-            new CreateRequest(
-                path,
-                new byte[0],
-                Ids.OPEN_ACL_UNSAFE,
-                CreateMode.PERSISTENT_SEQUENTIAL.toFlag()),
-            OpCode.create,
-            sessionid,
-            lastCXid + 10);
+            new CreateRequest(path, new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_SEQUENTIAL.toFlag()),
+            OpCode.create, sessionid, lastCXid + 10);
         processor.committedRequests.add(otherSessionCommittedReq);
         processor.committedRequests.add(orphanCommittedReq);
         processor.run();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorMetricsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorMetricsTest.java
index 29fe94b81d0..f4ba976de3a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorMetricsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorMetricsTest.java
@@ -18,11 +18,10 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.greaterThanOrEqualTo;
 import static org.hamcrest.Matchers.lessThanOrEqualTo;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertThat;
-import java.nio.ByteBuffer;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.util.Map;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
@@ -31,11 +30,12 @@
 import org.apache.zookeeper.metrics.MetricsUtils;
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.RequestProcessor;
+import org.apache.zookeeper.server.RequestRecord;
 import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.server.WorkerService;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -48,9 +48,9 @@ public class CommitProcessorMetricsTest extends ZKTestCase {
     CountDownLatch requestScheduled = null;
     CountDownLatch requestProcessed = null;
     CountDownLatch commitSeen = null;
-    CountDownLatch poolEmpytied = null;
+    CountDownLatch poolEmptied = null;
 
-    @Before
+    @BeforeEach
     public void setup() {
         LOG.info("setup");
         ServerMetrics.getMetrics().resetAll();
@@ -66,7 +66,7 @@ public void setupProcessors(int commitWorkers, int finalProcTime) {
         commitProcessor.start();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         LOG.info("tearDown starting");
 
@@ -126,8 +126,8 @@ protected void waitForEmptyPool() throws InterruptedException {
                 commitSeen.countDown();
             }
             super.waitForEmptyPool();
-            if (poolEmpytied != null) {
-                poolEmpytied.countDown();
+            if (poolEmptied != null) {
+                poolEmptied.countDown();
             }
         }
 
@@ -179,24 +179,24 @@ public void shutdown() {
     private void checkMetrics(String metricName, long min, long max, double avg, long cnt, long sum) {
         Map<String, Object> values = MetricsUtils.currentServerMetrics();
 
-        assertEquals("expected min is " + min, min, values.get("min_" + metricName));
-        assertEquals("expected max is: " + max, max, values.get("max_" + metricName));
-        assertEquals("expected avg is: " + avg, avg, (Double) values.get("avg_" + metricName), 0.001);
-        assertEquals("expected cnt is: " + cnt, cnt, values.get("cnt_" + metricName));
-        assertEquals("expected sum is: " + sum, sum, values.get("sum_" + metricName));
+        assertEquals(min, values.get("min_" + metricName), "expected min is " + min);
+        assertEquals(max, values.get("max_" + metricName), "expected max is: " + max);
+        assertEquals(avg, (Double) values.get("avg_" + metricName), 0.001, "expected avg is: " + avg);
+        assertEquals(cnt, values.get("cnt_" + metricName), "expected cnt is: " + cnt);
+        assertEquals(sum, values.get("sum_" + metricName), "expected sum is: " + sum);
     }
 
-    private void checkTimeMetric(long actual, long lBoundrary, long hBoundrary) {
-        assertThat(actual, greaterThanOrEqualTo(lBoundrary));
-        assertThat(actual, lessThanOrEqualTo(hBoundrary));
+    private void checkTimeMetric(long actual, long lBoundary, long hBoundary) {
+        assertThat(actual, greaterThanOrEqualTo(lBoundary));
+        assertThat(actual, lessThanOrEqualTo(hBoundary));
     }
 
     private Request createReadRequest(long sessionId, int xid) {
-        return new Request(null, sessionId, xid, ZooDefs.OpCode.getData, ByteBuffer.wrap(new byte[10]), null);
+        return new Request(null, sessionId, xid, ZooDefs.OpCode.getData, RequestRecord.fromBytes(new byte[10]), null);
     }
 
     private Request createWriteRequest(long sessionId, int xid) {
-        return new Request(null, sessionId, xid, ZooDefs.OpCode.setData, ByteBuffer.wrap(new byte[10]), null);
+        return new Request(null, sessionId, xid, ZooDefs.OpCode.setData, RequestRecord.fromBytes(new byte[10]), null);
     }
 
     private void processRequestWithWait(Request request) throws Exception {
@@ -365,9 +365,9 @@ public void testTimeWaitingEmptyPoolInCommitProcessorRead() throws Exception {
         requestScheduled.await(5, TimeUnit.SECONDS);
 
         //add a commit request to trigger waitForEmptyPool
-        poolEmpytied = new CountDownLatch(1);
+        poolEmptied = new CountDownLatch(1);
         commitProcessor.commit(createWriteRequest(1L, 1));
-        poolEmpytied.await(5, TimeUnit.SECONDS);
+        poolEmptied.await(5, TimeUnit.SECONDS);
 
         long actual = (long) MetricsUtils.currentServerMetrics().get("max_time_waiting_empty_pool_in_commit_processor_read_ms");
         //since each request takes 1000ms to process, so the waiting shouldn't be more than three times of that
@@ -386,10 +386,10 @@ public void testConcurrentRequestProcessingInCommitProcessor() throws Exception
         commitProcessor.processRequest(createReadRequest(1L, 4));
         requestScheduled.await(5, TimeUnit.SECONDS);
 
-        //add a commit request to trigger waitForEmptyPool, which will record number of requests being proccessed
-        poolEmpytied = new CountDownLatch(1);
+        //add a commit request to trigger waitForEmptyPool, which will record number of requests being processed
+        poolEmptied = new CountDownLatch(1);
         commitProcessor.commit(createWriteRequest(1L, 1));
-        poolEmpytied.await(5, TimeUnit.SECONDS);
+        poolEmptied.await(5, TimeUnit.SECONDS);
 
         //this will change after we upstream batch write in CommitProcessor
         Map<String, Object> values = MetricsUtils.currentServerMetrics();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorTest.java
index d939dc0eb86..2377dc77fae 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CommitProcessorTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.IOException;
@@ -42,10 +42,12 @@
 import org.apache.zookeeper.server.PrepRequestProcessor;
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.RequestProcessor;
+import org.apache.zookeeper.server.RequestRecord;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -79,14 +81,12 @@ public class CommitProcessorTest extends ZKTestCase {
 
     boolean stopped;
     TestZooKeeperServer zks;
-    File tmpDir;
-    ArrayList<TestClientThread> testClients = new ArrayList<TestClientThread>();
+    ArrayList<TestClientThread> testClients = new ArrayList<>();
     CommitProcessor commitProcessor;
 
-    public void setUp(int numCommitThreads, int numClientThreads, int writePercent) throws Exception {
+    public void setUp(int numCommitThreads, int numClientThreads, int writePercent, File tmpDir) throws Exception {
         stopped = false;
         System.setProperty(CommitProcessor.ZOOKEEPER_COMMIT_PROC_NUM_WORKER_THREADS, Integer.toString(numCommitThreads));
-        tmpDir = ClientBase.createTmpDir();
         ClientBase.setupTestEnv();
         zks = new TestZooKeeperServer(tmpDir, tmpDir, 4000);
         zks.startup();
@@ -101,10 +101,10 @@ public void setUp(
         int numCommitThreads,
         int numReadOnlyClientThreads,
         int mixWorkloadClientThreads,
-        int writePercent) throws Exception {
+        int writePercent,
+        File tmpDir) throws Exception {
         stopped = false;
         System.setProperty(CommitProcessor.ZOOKEEPER_COMMIT_PROC_NUM_WORKER_THREADS, Integer.toString(numCommitThreads));
-        tmpDir = ClientBase.createTmpDir();
         ClientBase.setupTestEnv();
         zks = new TestZooKeeperServer(tmpDir, tmpDir, 4000);
         zks.startup();
@@ -120,7 +120,7 @@ public void setUp(
         }
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         LOG.info("tearDown starting");
         stopped = true;
@@ -130,9 +130,6 @@ public void tearDown() throws Exception {
             client.interrupt();
             client.join();
         }
-        if (tmpDir != null) {
-            assertTrue("delete " + tmpDir.toString(), ClientBase.recursiveDelete(tmpDir));
-        }
         processedReadRequests.set(0);
         processedWriteRequests.set(0);
         testClients.clear();
@@ -160,7 +157,7 @@ public void sendWriteRequest() throws Exception {
                                                         + (++nodeId), new byte[0], Ids.OPEN_ACL_UNSAFE, 1);
             createReq.serialize(boa, "request");
             ByteBuffer bb = ByteBuffer.wrap(boas.toByteArray());
-            Request req = new Request(null, sessionId, ++cxid, OpCode.create, bb, new ArrayList<Id>());
+            Request req = new Request(null, sessionId, ++cxid, OpCode.create, RequestRecord.fromBytes(bb), new ArrayList<Id>());
             zks.getFirstProcessor().processRequest(req);
 
         }
@@ -174,7 +171,7 @@ public void sendReadRequest() throws Exception {
                                                                + nodeId, false);
             getDataRequest.serialize(boa, "request");
             ByteBuffer bb = ByteBuffer.wrap(boas.toByteArray());
-            Request req = new Request(null, sessionId, ++cxid, OpCode.getData, bb, new ArrayList<Id>());
+            Request req = new Request(null, sessionId, ++cxid, OpCode.getData, RequestRecord.fromBytes(bb), new ArrayList<Id>());
             zks.getFirstProcessor().processRequest(req);
         }
 
@@ -198,24 +195,24 @@ public void run() {
     }
 
     @Test
-    public void testNoCommitWorkersReadOnlyWorkload() throws Exception {
+    public void testNoCommitWorkersReadOnlyWorkload(@TempDir File tmpDir) throws Exception {
         int numClients = 10;
         LOG.info("testNoCommitWorkersReadOnlyWorkload");
-        setUp(0, numClients, 0);
+        setUp(0, numClients, 0, tmpDir);
         synchronized (this) {
             wait(TEST_RUN_TIME_IN_MS);
         }
         assertFalse(fail);
-        assertTrue("No read requests processed", processedReadRequests.get() > 0);
+        assertTrue(processedReadRequests.get() > 0, "No read requests processed");
         // processedWriteRequests.get() == numClients since each client performs one write at the beginning (creates a znode)
-        assertTrue("Write requests processed", processedWriteRequests.get() == numClients);
+        assertTrue(processedWriteRequests.get() == numClients, "Write requests processed");
     }
 
     @Test
-    public void testNoCommitWorkersMixedWorkload() throws Exception {
+    public void testNoCommitWorkersMixedWorkload(@TempDir File tmpDir) throws Exception {
         int numClients = 10;
         LOG.info("testNoCommitWorkersMixedWorkload 25w/75r workload test");
-        setUp(0, numClients, 25);
+        setUp(0, numClients, 25, tmpDir);
         synchronized (this) {
             wait(TEST_RUN_TIME_IN_MS);
         }
@@ -224,22 +221,22 @@ public void testNoCommitWorkersMixedWorkload() throws Exception {
     }
 
     @Test
-    public void testOneCommitWorkerReadOnlyWorkload() throws Exception {
+    public void testOneCommitWorkerReadOnlyWorkload(@TempDir File tmpDir) throws Exception {
         int numClients = 10;
         LOG.info("testOneCommitWorkerReadOnlyWorkload");
-        setUp(1, numClients, 0);
+        setUp(1, numClients, 0, tmpDir);
         synchronized (this) {
             wait(TEST_RUN_TIME_IN_MS);
         }
         assertFalse(fail);
-        assertTrue("No read requests processed", processedReadRequests.get() > 0);
+        assertTrue(processedReadRequests.get() > 0, "No read requests processed");
         // processedWriteRequests.get() == numClients since each client performs one write at the beginning (creates a znode)
-        assertTrue("Write requests processed", processedWriteRequests.get() == numClients);
+        assertTrue(processedWriteRequests.get() == numClients, "Write requests processed");
     }
 
     @Test
-    public void testOneCommitWorkerMixedWorkload() throws Exception {
-        setUp(1, 10, 25);
+    public void testOneCommitWorkerMixedWorkload(@TempDir File tmpDir) throws Exception {
+        setUp(1, 10, 25, tmpDir);
         LOG.info("testOneCommitWorkerMixedWorkload 25w/75r workload test");
         synchronized (this) {
             wait(TEST_RUN_TIME_IN_MS);
@@ -249,22 +246,22 @@ public void testOneCommitWorkerMixedWorkload() throws Exception {
     }
 
     @Test
-    public void testManyCommitWorkersReadOnly() throws Exception {
+    public void testManyCommitWorkersReadOnly(@TempDir File tmpDir) throws Exception {
         int numClients = 10;
         LOG.info("testManyCommitWorkersReadOnly");
-        setUp(10, numClients, 0);
+        setUp(10, numClients, 0, tmpDir);
         synchronized (this) {
             wait(TEST_RUN_TIME_IN_MS);
         }
         assertFalse(fail);
-        assertTrue("No read requests processed", processedReadRequests.get() > 0);
+        assertTrue(processedReadRequests.get() > 0, "No read requests processed");
         // processedWriteRequests.get() == numClients since each client performs one write at the beginning (creates a znode)
-        assertTrue("Write requests processed", processedWriteRequests.get() == numClients);
+        assertTrue(processedWriteRequests.get() == numClients, "Write requests processed");
     }
 
     @Test
-    public void testManyCommitWorkersMixedWorkload() throws Exception {
-        setUp(16, 8, 8, 25);
+    public void testManyCommitWorkersMixedWorkload(@TempDir File tmpDir) throws Exception {
+        setUp(16, 8, 8, 25, tmpDir);
         LOG.info("testManyCommitWorkersMixedWorkload 8X0w/100r + 8X25w/75r workload test");
         synchronized (this) {
             wait(TEST_RUN_TIME_IN_MS);
@@ -274,8 +271,8 @@ public void testManyCommitWorkersMixedWorkload() throws Exception {
     }
 
     private void checkProcessedRequest() {
-        assertTrue("No read requests processed", processedReadRequests.get() > 0);
-        assertTrue("No write requests processed", processedWriteRequests.get() > 0);
+        assertTrue(processedReadRequests.get() > 0, "No read requests processed");
+        assertTrue(processedWriteRequests.get() > 0, "No write requests processed");
     }
 
     volatile boolean fail = false;
@@ -317,7 +314,7 @@ protected void setupRequestProcessors() {
     private class MockProposalRequestProcessor extends Thread implements RequestProcessor {
 
         private final CommitProcessor commitProcessor;
-        private final LinkedBlockingQueue<Request> proposals = new LinkedBlockingQueue<Request>();
+        private final LinkedBlockingQueue<Request> proposals = new LinkedBlockingQueue<>();
 
         public MockProposalRequestProcessor(CommitProcessor commitProcessor) {
             this.commitProcessor = commitProcessor;
@@ -366,7 +363,7 @@ private class ValidateProcessor implements RequestProcessor {
         RequestProcessor nextProcessor;
         CommitProcessor commitProcessor;
         AtomicLong expectedZxid = new AtomicLong(1);
-        ConcurrentHashMap<Long, AtomicInteger> cxidMap = new ConcurrentHashMap<Long, AtomicInteger>();
+        ConcurrentHashMap<Long, AtomicInteger> cxidMap = new ConcurrentHashMap<>();
 
         AtomicInteger outstandingReadRequests = new AtomicInteger(0);
         AtomicInteger outstandingWriteRequests = new AtomicInteger(0);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CurrentEpochWriteFailureTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CurrentEpochWriteFailureTest.java
new file mode 100644
index 00000000000..ccd4d4961fb
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/CurrentEpochWriteFailureTest.java
@@ -0,0 +1,118 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.server.quorum;
+
+import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.io.File;
+import java.io.IOException;
+import org.apache.commons.io.FileUtils;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.ZooDefs.Ids;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.common.AtomicFileOutputStream;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class CurrentEpochWriteFailureTest extends QuorumPeerTestBase {
+    protected static final Logger LOG = LoggerFactory.getLogger(CurrentEpochWriteFailureTest.class);
+    private Servers servers;
+    private int clientPort;
+
+    @AfterEach
+    public void tearDown() throws InterruptedException {
+        if (servers != null) {
+            servers.shutDownAllServers();
+        }
+    }
+
+    /*
+     * ZOOKEEPER-4269:
+     * accepted epoch is first written to temporary file acceptedEpoch.tmp then this file is
+     * renamed to acceptedEpoch.
+     * Failure, either because of exception or power-off, in renaming the acceptedEpoch.tmp file
+     * will cause server startup error with message "The current epoch, x, is older than the last
+     * zxid y"
+     * To handle this scenario we should read accepted epoch from this temp file as well.
+     */
+    @Test
+    public void testReadCurrentEpochFromAcceptedEpochTmpFile() throws Exception {
+        startServers();
+        writeSomeData();
+
+        restartServers();
+        writeSomeData();
+
+        MainThread firstServer = servers.mt[0];
+
+        // As started servers two times, current epoch must be two
+        long currentEpoch = firstServer.getQuorumPeer().getCurrentEpoch();
+        assertEquals(2, currentEpoch);
+
+        // Initialize files for later use
+        File snapDir = firstServer.getQuorumPeer().getTxnFactory().getSnapDir();
+        File currentEpochFile = new File(snapDir, QuorumPeer.CURRENT_EPOCH_FILENAME);
+        File currentEpochTempFile = new File(snapDir,
+            QuorumPeer.CURRENT_EPOCH_FILENAME + AtomicFileOutputStream.TMP_EXTENSION);
+
+        // Shutdown servers
+        servers.shutDownAllServers();
+        waitForAll(servers, ZooKeeper.States.CONNECTING);
+
+        // Create scenario of file currentEpoch.tmp rename to currentEpoch failure.
+        // In this case currentEpoch file will have old epoch and currentEpoch.tmp will have the latest epoch
+        FileUtils.write(currentEpochFile, Long.toString(currentEpoch - 1), "UTF-8");
+        FileUtils.write(currentEpochTempFile, Long.toString(currentEpoch), "UTF-8");
+
+        // Restart the serves, all serves should restart successfully.
+        servers.restartAllServersAndClients(this);
+
+        // Check the first server where problem was injected.
+        assertTrue(ClientBase
+                .waitForServerUp("127.0.0.1:" + firstServer.getClientPort(), CONNECTION_TIMEOUT),
+            "server " + firstServer.getMyid()
+                + " is not up as file currentEpoch.tmp rename to currentEpoch file was failed"
+                + " which lead current epoch inconsistent state.");
+    }
+
+    private void restartServers() throws InterruptedException, IOException {
+        servers.shutDownAllServers();
+        waitForAll(servers, ZooKeeper.States.CONNECTING);
+        servers.restartAllServersAndClients(this);
+        waitForAll(servers, ZooKeeper.States.CONNECTED);
+    }
+
+    private void writeSomeData() throws Exception {
+        ZooKeeper client = ClientBase.createZKClient("127.0.0.1:" + clientPort);
+        String path = "/somePath" + System.currentTimeMillis();
+        String data = "someData";
+        client.create(path, data.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        byte[] data1 = client.getData(path, false, null);
+        assertEquals(data, new String(data1));
+        client.close();
+    }
+
+    private void startServers() throws Exception {
+        servers = LaunchServers(3);
+        clientPort = servers.clientPorts[0];
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/DIFFSyncConsistencyTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/DIFFSyncConsistencyTest.java
new file mode 100644
index 00000000000..9b9ea55f3f6
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/DIFFSyncConsistencyTest.java
@@ -0,0 +1,294 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.quorum;
+
+import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+import java.io.IOException;
+import java.net.SocketTimeoutException;
+import java.util.Map;
+import javax.security.sasl.SaslException;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.ZooDefs.Ids;
+import org.apache.zookeeper.ZooDefs.OpCode;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.ZooKeeper.States;
+import org.apache.zookeeper.data.Stat;
+import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
+import org.apache.zookeeper.server.quorum.Leader.Proposal;
+import org.apache.zookeeper.test.ClientBase;
+import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
+
+public class DIFFSyncConsistencyTest extends QuorumPeerTestBase {
+
+    private static int SERVER_COUNT = 3;
+    private MainThread[] mt = new MainThread[SERVER_COUNT];
+
+    @Test
+    @Timeout(value = 120)
+    public void testInconsistentDueToUncommittedLog() throws Exception {
+        final int LEADER_TIMEOUT_MS = 10_000;
+        final int[] clientPorts = new int[SERVER_COUNT];
+
+        StringBuilder sb = new StringBuilder();
+        String server;
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            clientPorts[i] = PortAssignment.unique();
+            server = "server." + i + "=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique()
+                    + ":participant;127.0.0.1:" + clientPorts[i];
+            sb.append(server + "\n");
+        }
+        String currentQuorumCfgSection = sb.toString();
+
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            mt[i] = new MainThread(i, clientPorts[i], currentQuorumCfgSection, false) {
+                @Override
+                public TestQPMain getTestQPMain() {
+                    return new MockTestQPMain();
+                }
+            };
+            mt[i].start();
+        }
+
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                    "waiting for server " + i + " being up");
+        }
+
+        int leader = findLeader(mt);
+        CountdownWatcher watch = new CountdownWatcher();
+        ZooKeeper zk = new ZooKeeper("127.0.0.1:" + clientPorts[leader], ClientBase.CONNECTION_TIMEOUT, watch);
+        watch.waitForConnected(ClientBase.CONNECTION_TIMEOUT);
+
+        Map<Long, Proposal> outstanding = mt[leader].main.quorumPeer.leader.outstandingProposals;
+        // Increase the tick time to delay the leader going to looking to allow us proposal a transaction while other
+        // followers are offline.
+        int previousTick = mt[leader].main.quorumPeer.tickTime;
+        mt[leader].main.quorumPeer.tickTime = LEADER_TIMEOUT_MS;
+        // Let the previous tick on the leader exhaust itself so the new tick time takes effect
+        Thread.sleep(previousTick);
+
+        LOG.info("LEADER ELECTED {}", leader);
+
+        // Shutdown followers to make sure we don't accidentally send the proposal we are going to make to follower.
+        // In other words, we want to make sure the followers get the proposal later through DIFF sync.
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            if (i != leader) {
+                mt[i].shutdown();
+            }
+        }
+
+        // Send a create request to old leader and make sure it's synced to disk.
+        try {
+            zk.create("/zk" + leader, "zk".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            fail("create /zk" + leader + " should have failed");
+        } catch (KeeperException e) {
+        }
+
+        // Make sure that we actually did get it in process at the leader; there can be extra sessionClose proposals.
+        assertTrue(outstanding.size() > 0);
+        Proposal p = findProposalOfType(outstanding, OpCode.create);
+        LOG.info("Old leader id: {}. All proposals: {}", leader, outstanding);
+        assertNotNull(p, "Old leader doesn't have 'create' proposal");
+
+        // Make sure leader sync the proposal to disk.
+        int sleepTime = 0;
+        Long longLeader = (long) leader;
+        while (!p.qvAcksetPairs.get(0).getAckset().contains(longLeader)) {
+            if (sleepTime > 2000) {
+                fail("Transaction not synced to disk within 1 second " + p.qvAcksetPairs.get(0).getAckset() + " expected " + leader);
+            }
+            Thread.sleep(100);
+            sleepTime += 100;
+        }
+
+        // Start controlled followers where we deliberately make the follower fail once follower receive the UPTODATE
+        // message from leader. Because followers only persist proposals from DIFF sync after UPTODATE, this can
+        // deterministically simulate the situation where followers ACK NEWLEADER (which makes leader think she has the
+        // quorum support, but actually not afterwards) but immediately fail afterwards without persisting the proposals
+        // from DIFF sync.
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            if (i == leader) {
+                continue;
+            }
+
+            mt[i].start();
+            int sleepCount = 0;
+            while (mt[i].getQuorumPeer() == null) {
+                ++sleepCount;
+                if (sleepCount > 100) {
+                    fail("Can't start follower " + i + " !");
+                }
+                Thread.sleep(100);
+            }
+
+            ((CustomQuorumPeer) mt[i].getQuorumPeer()).setInjectError(true);
+            LOG.info("Follower {} started.", i);
+        }
+
+        // Verify leader can see it. The fact that leader can see it implies that
+        // leader should, at this point in time, get a quorum of ACK of NEWLEADER
+        // from two followers so leader can start serving requests; this also implies
+        // that DIFF sync from leader to followers are finished at this point in time.
+        // We then verify later that followers should have the same view after we shutdown
+        // this leader, otherwise it's a violation of ZAB / sequential consistency.
+        int c = 0;
+        while (c < 100) {
+            ++c;
+            try {
+                Stat stat = zk.exists("/zk" + leader, false);
+                assertNotNull(stat, "server " + leader + " should have /zk");
+                break;
+            } catch (KeeperException.ConnectionLossException e) {
+
+            }
+            Thread.sleep(100);
+        }
+
+        // Shutdown all servers
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            mt[i].shutdown();
+        }
+        waitForOne(zk, States.CONNECTING);
+
+        // Now restart all servers except the old leader. Only old leader has the transaction sync to disk.
+        // The old followers only had in memory view of the transaction, and they didn't have a chance
+        // to sync to disk because we made them fail at UPTODATE.
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            if (i == leader) {
+                continue;
+            }
+            mt[i].start();
+            int sleepCount = 0;
+            while (mt[i].getQuorumPeer() == null) {
+                ++sleepCount;
+                if (sleepCount > 100) {
+                    fail("Can't start follower " + i + " !");
+                }
+                Thread.sleep(100);
+            }
+
+            ((CustomQuorumPeer) mt[i].getQuorumPeer()).setInjectError(false);
+            LOG.info("Follower {} started again.", i);
+        }
+
+        int newLeader = findLeader(mt);
+        assertNotEquals(newLeader, leader, "new leader is still the old leader " + leader + " !!");
+
+        // This simulates the case where clients connected to the old leader had a view of the data
+        // "/zkX", but clients connect to the new leader does not have the same view of data (missing "/zkX").
+        // This inconsistent view of the quorum exposed from leaders is a violation of ZAB.
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            if (i != newLeader) {
+                continue;
+            }
+            zk.close();
+            zk = new ZooKeeper("127.0.0.1:" + clientPorts[i], ClientBase.CONNECTION_TIMEOUT, watch);
+            watch.waitForConnected(ClientBase.CONNECTION_TIMEOUT);
+            Stat val = zk.exists("/zk" + leader, false);
+            assertNotNull(val, "Data inconsistency detected! "
+                    + "Server " + i + " should have a view of /zk" + leader + "!");
+        }
+
+        zk.close();
+    }
+
+    @AfterEach
+    public void tearDown() {
+        for (int i = 0; i < mt.length; i++) {
+            try {
+                mt[i].shutdown();
+            } catch (InterruptedException e) {
+                LOG.warn("Quorum Peer interrupted while shutting it down", e);
+            }
+        }
+    }
+
+    static class CustomQuorumPeer extends QuorumPeer {
+
+        private volatile boolean injectError = false;
+
+        public CustomQuorumPeer() throws SaslException {
+
+        }
+
+        @Override
+        protected Follower makeFollower(FileTxnSnapLog logFactory) throws IOException {
+            return new Follower(this, new FollowerZooKeeperServer(logFactory, this, this.getZkDb())) {
+
+                @Override
+                void readPacket(QuorumPacket pp) throws IOException {
+                    /**
+                     * In real scenario got SocketTimeoutException while reading
+                     * the packet from leader because of network problem, but
+                     * here throwing SocketTimeoutException based on whether
+                     * error is injected or not
+                     */
+                    super.readPacket(pp);
+                    if (injectError && pp.getType() == Leader.UPTODATE) {
+                        String type = LearnerHandler.packetToString(pp);
+                        throw new SocketTimeoutException("Socket timeout while reading the packet for operation "
+                                + type);
+                    }
+                }
+
+            };
+        }
+
+        public void setInjectError(boolean injectError) {
+            this.injectError = injectError;
+        }
+
+    }
+
+    static class MockTestQPMain extends TestQPMain {
+
+        @Override
+        protected QuorumPeer getQuorumPeer() throws SaslException {
+            return new CustomQuorumPeer();
+        }
+
+    }
+
+    private Proposal findProposalOfType(Map<Long, Proposal> proposals, int type) {
+        for (Proposal proposal : proposals.values()) {
+            if (proposal.request.getHdr().getType() == type) {
+                return proposal;
+            }
+        }
+        return null;
+    }
+
+    private int findLeader(MainThread[] mt) {
+        for (int i = 0; i < mt.length; i++) {
+            if (mt[i].main.quorumPeer.leader != null) {
+                return i;
+            }
+        }
+        return -1;
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/DIFFSyncTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/DIFFSyncTest.java
new file mode 100644
index 00000000000..a9be09f3973
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/DIFFSyncTest.java
@@ -0,0 +1,316 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.quorum;
+
+import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+import javax.security.sasl.SaslException;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.server.FinalRequestProcessor;
+import org.apache.zookeeper.server.Request;
+import org.apache.zookeeper.server.RequestProcessor;
+import org.apache.zookeeper.server.SyncRequestProcessor;
+import org.apache.zookeeper.server.ZooKeeperServer;
+import org.apache.zookeeper.server.ZooKeeperServerListener;
+import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
+
+public class DIFFSyncTest extends QuorumPeerTestBase {
+    private static final int SERVER_COUNT = 3;
+    private static final String PATH_PREFIX = "/test_";
+
+    private int[] clientPorts;
+    private MainThread[] mt;
+    private ZooKeeper[] zkClients;
+
+    @BeforeEach
+    public void start() throws Exception {
+        clientPorts = new int[SERVER_COUNT];
+        mt = startQuorum(clientPorts);
+        zkClients = new ZooKeeper[SERVER_COUNT];
+    }
+
+    @AfterEach
+    public void tearDown() throws Exception{
+        for (final ZooKeeper zk : zkClients) {
+            try {
+                if (zk != null) {
+                    zk.close();
+                }
+            } catch (final InterruptedException e) {
+                LOG.warn("ZooKeeper interrupted while shutting it down", e);
+            }
+        }
+
+        for (final MainThread mainThread : mt) {
+            try {
+                mainThread.shutdown();
+            } catch (final InterruptedException e) {
+                LOG.warn("Quorum Peer interrupted while shutting it down", e);
+            }
+        }
+    }
+
+    @Test
+    @Timeout(value = 120)
+    public void testTxnLoss_FailToPersistAndCommitTxns() throws Exception {
+        final List<String> paths = new ArrayList<>();
+        assertEquals(2, mt[2].getQuorumPeer().getLeaderId());
+
+        // create a ZK client to the leader (currentEpoch=1, lastLoggedZxid=<1, 1>)
+        createZKClient(2);
+
+        // create a znode (currentEpoch=1, lastLoggedZxid=<1, 2>)
+        paths.add(createNode(zkClients[2], PATH_PREFIX + "0"));
+
+        // shut down S0
+        mt[0].shutdown();
+        LOG.info("S0 shutdown.");
+
+        // create a znode (currentEpoch=1, lastLoggedZxid=<1, 3>), so S0 is 1 txn behind
+        paths.add(createNode(zkClients[2], PATH_PREFIX + "1"));
+        logEpochsAndLastLoggedTxnForAllServers();
+
+        // shut down S1
+        mt[1].shutdown();
+        LOG.info("S1 shutdown.");
+
+        // restart S0 and trigger a new leader election (currentEpoch=2)
+        // S0 starts with MockSyncRequestProcessor and MockCommitProcessor to simulate it writes the
+        // currentEpoch and sends NEWLEADER ACK but fails to persist and commit txns afterwards
+        // in DIFF sync
+        mt[0].start(new MockTestQPMain());
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[0], CONNECTION_TIMEOUT),
+                "waiting for server 0 being up");
+        LOG.info("S0 restarted.");
+        logEpochsAndLastLoggedTxnForAllServers();
+
+        // validate S2 is still the leader
+        assertEquals(2, mt[2].getQuorumPeer().getLeaderId());
+
+        // shut down the leader (i.e. S2). This causes S0 disconnects from leader, performs partial
+        // shutdown, fast forwards its database to the latest persisted tnx (i.e. <1, 3>) and change
+        // its state to LOOKING
+        mt[2].shutdown();
+        LOG.info("S2 shutdown.");
+
+        // start S1 and trigger a leader election (currentEpoch=3)
+        mt[1].start();
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[1], CONNECTION_TIMEOUT),
+                "waiting for server 1 being up");
+        LOG.info("S1 restarted.");
+        logEpochsAndLastLoggedTxnForAllServers();
+
+        // validate S0 is the new leader because of it has higher epoch
+        assertEquals(0, mt[0].getQuorumPeer().getLeaderId());
+
+        // connect to the new leader (i.e. S0) (currentEpoch=3, lastLoggedZxid=<3, 1>
+        createZKClient(0);
+
+        // create a znode (currentEpoch=3, lastLoggedZxid=<3, 2>)
+        paths.add(createNode(zkClients[0], PATH_PREFIX + "3"));
+
+        // start S2 which is the old leader
+        mt[2].start();
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[2], CONNECTION_TIMEOUT),
+                "waiting for server " + 2 + " being up");
+        LOG.info("S2 restarted.");
+        logEpochsAndLastLoggedTxnForAllServers();
+
+        // validate all the znodes exist from all the clients
+        validateDataFromAllClients(paths);
+    }
+
+    @Test
+    @Timeout(value = 120)
+    public void testLeaderShutdown_AckProposalBeforeAckNewLeader() throws Exception {
+        assertEquals(2, mt[2].getQuorumPeer().getLeaderId());
+
+        // create a ZK client to the leader (currentEpoch=1, lastLoggedZxid=<1, 1>)
+        createZKClient(2);
+
+        // create a znode (currentEpoch=1, lastLoggedZxid=<1, 2>)
+        createNode(zkClients[2], PATH_PREFIX + "0");
+
+        // shut down S0
+        mt[0].shutdown();
+        LOG.info("S0 shutdown.");
+
+        // create a znode (currentEpoch=1, lastLoggedZxid=<1, 3>), so S0 is 1 txn behind
+        createNode(zkClients[2], PATH_PREFIX + "1");
+        logEpochsAndLastLoggedTxnForAllServers();
+
+        // shut down S1
+        mt[1].shutdown();
+        LOG.info("S1 shutdown.");
+
+        // restart S0 and trigger a new leader election and DIFF sync (currentEpoch=2)
+        mt[0].start();
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[0], CONNECTION_TIMEOUT),
+                "waiting for server 0 being up");
+        LOG.info("S0 restarted.");
+
+        // create a znode (currentEpoch=2, lastLoggedZxid=<2, 1>)
+        createNode(zkClients[2], PATH_PREFIX + "2");
+
+        // validate quorum is up without additional round of leader election
+        for (int  i = 0; i < SERVER_COUNT; i++) {
+            if (i != 1) {
+                final QuorumPeer qp = mt[i].getQuorumPeer();
+                assertNotNull(qp);
+                assertEquals(2, qp.getCurrentEpoch());
+                assertEquals(2, qp.getAcceptedEpoch());
+                assertEquals("200000001", Long.toHexString(qp.getLastLoggedZxid()));
+            }
+        }
+    }
+
+    private MainThread[] startQuorum(final int[] clientPorts) throws IOException {
+        final StringBuilder sb = new StringBuilder();
+        String server;
+
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            clientPorts[i] = PortAssignment.unique();
+            server = "server." + i + "=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique()
+                    + ":participant;127.0.0.1:" + clientPorts[i];
+            sb.append(server);
+            sb.append("\n");
+        }
+
+        final MainThread[] mt = new MainThread[SERVER_COUNT];
+
+        // start all the servers
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            mt[i] = new MainThread(i, clientPorts[i], sb.toString(), false);
+            mt[i].start();
+        }
+
+        // ensure all servers started
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            assertTrue(
+                    ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                    "waiting for server " + i + " being up");
+        }
+        return mt;
+    }
+
+    private void createZKClient(final int idx) throws Exception {
+        zkClients[idx] = null;
+        final ClientBase.CountdownWatcher watch = new ClientBase.CountdownWatcher();
+        zkClients[idx] = new ZooKeeper("127.0.0.1:" + clientPorts[idx], ClientBase.CONNECTION_TIMEOUT, watch);
+        watch.waitForConnected(ClientBase.CONNECTION_TIMEOUT);
+    }
+
+    private String createNode(final ZooKeeper zk, final String path) throws Exception {
+        final String fullPath = zk.create(path, new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        assertNotNull(zk.exists(path, false));
+        return fullPath;
+    }
+
+    private static class MockTestQPMain extends TestQPMain {
+        @Override
+        protected QuorumPeer getQuorumPeer() throws SaslException {
+            return new TestQuorumPeer();
+        }
+    }
+
+    private static class TestQuorumPeer extends QuorumPeer {
+        public TestQuorumPeer() throws SaslException {
+        }
+
+        @Override
+        protected Follower makeFollower(FileTxnSnapLog logFactory) throws IOException {
+            final FollowerZooKeeperServer followerZookeeperServer = new FollowerZooKeeperServer(logFactory, this, this.getZkDb()) {
+                @Override
+                protected void setupRequestProcessors() {
+                    RequestProcessor finalProcessor = new FinalRequestProcessor(this);
+                    commitProcessor = new MockCommitProcessor(finalProcessor, Long.toString(getServerId()), true, getZooKeeperServerListener());
+                    commitProcessor.start();
+
+                    firstProcessor = new FollowerRequestProcessor(this, commitProcessor);
+                    ((FollowerRequestProcessor) firstProcessor).start();
+                    syncProcessor = new MockSyncRequestProcessor(this, new SendAckRequestProcessor(getFollower()));
+
+                    syncProcessor.start();
+                }
+            };
+            return new Follower(this, followerZookeeperServer);
+        }
+    }
+
+    private static class MockSyncRequestProcessor extends SyncRequestProcessor {
+        public MockSyncRequestProcessor(final ZooKeeperServer zks, final RequestProcessor nextProcessor) {
+            super(zks, nextProcessor);
+        }
+
+        @Override
+        public void processRequest(final Request request) {
+            LOG.info("Sync request for zxid {} is dropped", Long.toHexString(request.getHdr().getZxid()));
+        }
+    }
+
+    private static class MockCommitProcessor extends CommitProcessor {
+        public MockCommitProcessor(final RequestProcessor nextProcessor, final String id,
+                                   final boolean matchSyncs, final ZooKeeperServerListener listener) {
+
+            super(nextProcessor, id, matchSyncs, listener);
+        }
+
+        @Override
+        public void commit(final Request request) {
+            LOG.info("Commit request for zxid {} is dropped", Long.toHexString(request.getHdr().getZxid()));
+        }
+    }
+
+    private void logEpochsAndLastLoggedTxnForAllServers() throws Exception {
+        for (int  i = 0; i < SERVER_COUNT; i++) {
+            final QuorumPeer qp = mt[i].getQuorumPeer();
+            if (qp != null) {
+                LOG.info(String.format("server id=%d, acceptedEpoch=%d, currentEpoch=%d, lastLoggedTxn=%s",
+                        qp.getMyId(), qp.getAcceptedEpoch(),
+                        qp.getCurrentEpoch(), Long.toHexString(qp.getLastLoggedZxid())));
+            }
+        }
+    }
+
+    private void validateDataFromAllClients(final List<String> paths) throws Exception{
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            if (zkClients[i] == null) {
+                createZKClient(i);
+            }
+
+            for (final String path : paths) {
+                assertNotNull(zkClients[i].exists(path, false), "znode " + path + " is missing");
+            }
+            assertEquals(3, paths.size());
+        }
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EagerACLFilterTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EagerACLFilterTest.java
index fa18bf0e213..1af669fb511 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EagerACLFilterTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EagerACLFilterTest.java
@@ -18,12 +18,11 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotSame;
-import static org.junit.Assert.fail;
-import java.util.Arrays;
-import java.util.Collection;
-import java.util.concurrent.CountDownLatch;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+import java.util.stream.Stream;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.TestableZooKeeper;
@@ -31,18 +30,14 @@
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.test.QuorumBase;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
 
-@RunWith(Parameterized.class)
 public class EagerACLFilterTest extends QuorumBase {
 
-    protected boolean checkEnabled;
-    protected ServerState serverState;
-    protected final CountDownLatch callComplete = new CountDownLatch(1);
     protected boolean complete = false;
     protected static final String PARENT_PATH = "/foo";
     protected static final String CHILD_PATH = "/foo/bar";
@@ -52,41 +47,53 @@ public class EagerACLFilterTest extends QuorumBase {
     protected static final byte[] DATA = "Hint Water".getBytes();
     protected TestableZooKeeper zkClient;
     protected TestableZooKeeper zkClientB;
+    protected TestableZooKeeper zkLeaderClient;
     protected QuorumPeer zkLeader;
+    protected QuorumPeer zkConnected;
     protected ZooKeeperServer connectedServer;
 
-    @Parameterized.Parameters
-    public static Collection<Object[]> data() {
-        return Arrays.asList(new Object[][]{{ServerState.LEADING, true}, {ServerState.LEADING, false}, {ServerState.FOLLOWING, true}, {ServerState.FOLLOWING, false}, {ServerState.OBSERVING, true}, {ServerState.OBSERVING, false}});
+    public static Stream<Arguments> data() {
+        return Stream.of(
+                Arguments.of(ServerState.LEADING, true),
+                Arguments.of(ServerState.LEADING, false),
+                Arguments.of(ServerState.FOLLOWING, true),
+                Arguments.of(ServerState.FOLLOWING, false),
+                Arguments.of(ServerState.OBSERVING, true),
+                Arguments.of(ServerState.OBSERVING, false));
     }
 
-    public EagerACLFilterTest(ServerState state, boolean checkEnabled) {
-        this.serverState = state;
-        this.checkEnabled = checkEnabled;
+    @BeforeEach
+    @Override
+    public void setUp() {
+        //since parameterized test methods need a parameterized setUp method
+        //the inherited method has to be overridden with an empty function body
     }
 
-    @Before
-    public void setUp() throws Exception {
+    public void setUp(ServerState serverState, boolean checkEnabled) throws Exception {
         ensureCheck(checkEnabled);
+        CountdownWatcher leaderWatch = new CountdownWatcher();
         CountdownWatcher clientWatch = new CountdownWatcher();
         CountdownWatcher clientWatchB = new CountdownWatcher();
-        super.setUp(true);
+        super.setUp(true, true);
 
         String hostPort = getPeersMatching(serverState).split(",")[0];
         int clientPort = Integer.parseInt(hostPort.split(":")[1]);
 
         zkLeader = getPeerList().get(getLeaderIndex());
-        connectedServer = getPeerByClientPort(clientPort).getActiveServer();
+        zkConnected = getPeerByClientPort(clientPort);
+        connectedServer = zkConnected.getActiveServer();
 
+        zkLeaderClient = createClient(leaderWatch, getPeersMatching(ServerState.LEADING));
         zkClient = createClient(clientWatch, hostPort);
         zkClientB = createClient(clientWatchB, hostPort);
         zkClient.addAuthInfo(AUTH_PROVIDER, AUTH);
         zkClientB.addAuthInfo(AUTH_PROVIDER, AUTHB);
+        leaderWatch.waitForConnected(CONNECTION_TIMEOUT);
         clientWatch.waitForConnected(CONNECTION_TIMEOUT);
         clientWatchB.waitForConnected(CONNECTION_TIMEOUT);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         if (zkClient != null) {
             zkClient.close();
@@ -100,141 +107,183 @@ public void tearDown() throws Exception {
     }
 
     private void ensureCheck(boolean enabled) {
-        if (enabled) {
-            System.setProperty(ZooKeeperServer.ENABLE_EAGER_ACL_CHECK, "true");
-        } else {
-            System.clearProperty(ZooKeeperServer.ENABLE_EAGER_ACL_CHECK);
-        }
+        ZooKeeperServer.setEnableEagerACLCheck(enabled);
     }
 
-    private void assertTransactionState(String condition, long lastxid) {
-        String assertion = String.format("Server State: %s Check Enabled: %s %s", serverState, checkEnabled, condition);
-        if (checkEnabled) {
-            assertEquals(assertion, lastxid, zkLeader.getLastLoggedZxid());
+    private void assertTransactionState(String operation, QuorumPeer peer, long lastxid) throws Exception {
+        if (peer == zkLeader && peer != zkConnected) {
+            // The operation is performed on no leader, but we are asserting on leader.
+            // There is no happen-before between `zkLeader.getLastLoggedZxid()` and
+            // successful response from other server. The commit and response are routed
+            // to different servers and performed asynchronous in each server. So we have
+            // to sync leader client to go through commit and response path in leader to
+            // build happen-before between `zkLeader.getLastLoggedZxid()` and side effect
+            // of previous operation.
+            syncClient(zkLeaderClient, false);
+        }
+        assertTrue(peer == zkLeader || peer == zkConnected);
+        boolean eagerACL = ZooKeeperServer.isEnableEagerACLCheck();
+        String assertion = String.format(
+                "Connecting: %s Checking: %s EagerACL: %s Operation: %s",
+                zkConnected.getPeerState(), peer.getPeerState(), eagerACL, operation);
+        if (eagerACL) {
+            assertEquals(lastxid, peer.getLastLoggedZxid(), assertion);
         } else {
-            assertNotSame(assertion, lastxid, zkLeader.getLastLoggedZxid());
+            assertNotEquals(lastxid, peer.getLastLoggedZxid(), assertion);
         }
     }
 
-    @Test
-    public void testCreateOK() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testCreateOK(ServerState serverState, boolean checkEnabled) throws Exception {
+        setUp(serverState, checkEnabled);
         ensureCheck(true);
         zkClient.create(PARENT_PATH, DATA, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         zkClientB.create(CHILD_PATH, DATA, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
-        assertEquals("OutstandingRequests not decremented", 0, connectedServer.getInProcess());
+        assertEquals(0, connectedServer.getInProcess(), "OutstandingRequests not decremented");
     }
 
-    @Test
-    public void testCreate2OK() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testCreate2OK(ServerState serverState, boolean checkEnabled) throws Exception {
+        setUp(serverState, checkEnabled);
         zkClient.create(PARENT_PATH, DATA, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, null);
         zkClientB.create(CHILD_PATH, DATA, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, null);
 
-        assertEquals("OutstandingRequests not decremented", 0, connectedServer.getInProcess());
+        assertEquals(0, connectedServer.getInProcess(), "OutstandingRequests not decremented");
     }
 
-    @Test
-    public void testCreateFail() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testCreateFail(ServerState serverState, boolean checkEnabled) throws Exception {
+        setUp(serverState, checkEnabled);
         zkClient.create(PARENT_PATH, DATA, Ids.CREATOR_ALL_ACL, CreateMode.PERSISTENT);
-        long lastxid = zkLeader.getLastLoggedZxid();
+        long lastxid = zkConnected.getLastLoggedZxid();
         try {
             zkClientB.create(CHILD_PATH, DATA, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            fail("expect no auth");
         } catch (KeeperException.NoAuthException e) {
         }
 
-        assertEquals("OutstandingRequests not decremented", 0, connectedServer.getInProcess());
+        assertEquals(0, connectedServer.getInProcess(), "OutstandingRequests not decremented");
 
-        assertTransactionState("Transaction state on Leader after failed create", lastxid);
+        assertTransactionState("failed create", zkConnected, lastxid);
+        assertTransactionState("failed create", zkLeader, lastxid);
     }
 
-    @Test
-    public void testCreate2Fail() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testCreate2Fail(ServerState serverState, boolean checkEnabled) throws Exception {
+        setUp(serverState, checkEnabled);
         zkClient.create(PARENT_PATH, DATA, Ids.CREATOR_ALL_ACL, CreateMode.PERSISTENT, null);
-        long lastxid = zkLeader.getLastLoggedZxid();
+        long lastxid = zkConnected.getLastLoggedZxid();
         try {
             zkClientB.create(CHILD_PATH, DATA, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, null);
+            fail("expect no auth");
         } catch (KeeperException.NoAuthException e) {
         }
 
-        assertEquals("OutstandingRequests not decremented", 0, connectedServer.getInProcess());
+        assertEquals(0, connectedServer.getInProcess(), "OutstandingRequests not decremented");
 
-        assertTransactionState("Transaction state on Leader after failed create2", lastxid);
+        assertTransactionState("failed create2", zkConnected, lastxid);
+        assertTransactionState("failed create2", zkLeader, lastxid);
     }
 
-    @Test
-    public void testDeleteOK() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testDeleteOK(ServerState serverState, boolean checkEnabled) throws Exception {
+        setUp(serverState, checkEnabled);
         zkClient.create(PARENT_PATH, DATA, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         zkClientB.delete(PARENT_PATH, -1);
 
-        assertEquals("OutstandingRequests not decremented", 0, connectedServer.getInProcess());
+        assertEquals(0, connectedServer.getInProcess(), "OutstandingRequests not decremented");
     }
 
-    @Test
-    public void testDeleteFail() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testDeleteFail(ServerState serverState, boolean checkEnabled) throws Exception {
+        setUp(serverState, checkEnabled);
         zkClient.create(PARENT_PATH, DATA, Ids.CREATOR_ALL_ACL, CreateMode.PERSISTENT, null);
         zkClient.create(CHILD_PATH, DATA, Ids.CREATOR_ALL_ACL, CreateMode.PERSISTENT, null);
-        long lastxid = zkLeader.getLastLoggedZxid();
+        long lastxid = zkConnected.getLastLoggedZxid();
         try {
             zkClientB.delete(CHILD_PATH, -1);
+            fail("expect no auth");
         } catch (KeeperException.NoAuthException e) {
         }
 
-        assertEquals("OutstandingRequests not decremented", 0, connectedServer.getInProcess());
+        assertEquals(0, connectedServer.getInProcess(), "OutstandingRequests not decremented");
 
-        assertTransactionState("Transaction state on Leader after failed delete", lastxid);
+        assertTransactionState("failed delete", zkConnected, lastxid);
+        assertTransactionState("failed delete", zkLeader, lastxid);
     }
 
-    @Test
-    public void testSetDataOK() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testSetDataOK(ServerState serverState, boolean checkEnabled) throws Exception {
+        setUp(serverState, checkEnabled);
         zkClient.create(PARENT_PATH, null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, null);
         zkClientB.setData(PARENT_PATH, DATA, -1);
     }
 
-    @Test
-    public void testSetDataFail() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testSetDataFail(ServerState serverState, boolean checkEnabled) throws Exception {
+        setUp(serverState, checkEnabled);
         zkClient.create(PARENT_PATH, null, Ids.CREATOR_ALL_ACL, CreateMode.PERSISTENT, null);
-        long lastxid = zkLeader.getLastLoggedZxid();
+        long lastxid = zkConnected.getLastLoggedZxid();
         try {
             zkClientB.setData(PARENT_PATH, DATA, -1);
+            fail("expect no auth");
         } catch (KeeperException.NoAuthException e) {
         }
 
-        assertEquals("OutstandingRequests not decremented", 0, connectedServer.getInProcess());
+        assertEquals(0, connectedServer.getInProcess(), "OutstandingRequests not decremented");
 
-        assertTransactionState("Transaction state on Leader after failed setData", lastxid);
+        assertTransactionState("failed setData", zkConnected, lastxid);
+        assertTransactionState("failed setData", zkLeader, lastxid);
     }
 
-    @Test
-    public void testSetACLOK() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testSetACLOK(ServerState serverState, boolean checkEnabled) throws Exception {
+        setUp(serverState, checkEnabled);
         zkClient.create(PARENT_PATH, null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, null);
         zkClientB.setACL(PARENT_PATH, Ids.READ_ACL_UNSAFE, -1);
 
-        assertEquals("OutstandingRequests not decremented", 0, connectedServer.getInProcess());
+        assertEquals(0, connectedServer.getInProcess(), "OutstandingRequests not decremented");
     }
 
-    @Test
-    public void testSetACLFail() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testSetACLFail(ServerState serverState, boolean checkEnabled) throws Exception {
+        setUp(serverState, checkEnabled);
         zkClient.create(PARENT_PATH, null, Ids.CREATOR_ALL_ACL, CreateMode.PERSISTENT, null);
-        long lastxid = zkLeader.getLastLoggedZxid();
+        long lastxid = zkConnected.getLastLoggedZxid();
         try {
             zkClientB.setACL(PARENT_PATH, Ids.READ_ACL_UNSAFE, -1);
-        } catch (KeeperException.NoAuthException e) {
+            fail("expect no auth");
+        } catch (KeeperException.NoAuthException ignored) {
         }
 
-        assertEquals("OutstandingRequests not decremented", 0, connectedServer.getInProcess());
+        assertEquals(0, connectedServer.getInProcess(), "OutstandingRequests not decremented");
 
-        assertTransactionState("Transaction state on Leader after failed setACL", lastxid);
+        assertTransactionState("failed setACL", zkConnected, lastxid);
+        assertTransactionState("failed setACL", zkLeader, lastxid);
     }
 
-    @Test
-    public void testBadACL() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testBadACL(ServerState serverState, boolean checkEnabled) throws Exception {
+        setUp(serverState, checkEnabled);
         CountdownWatcher cw = new CountdownWatcher();
-        TestableZooKeeper zk = createClient(cw, getPeersMatching(serverState));
-        long lastxid;
+        String addr = String.format("%s:%d", LOCALADDR, zkConnected.getClientPort());
+        TestableZooKeeper zk = createClient(cw, addr);
 
         cw.waitForConnected(CONNECTION_TIMEOUT);
 
-        lastxid = zkLeader.getLastLoggedZxid();
+        long lastxid = zkConnected.getLastLoggedZxid();
 
         try {
             zk.create("/acltest", new byte[0], Ids.CREATOR_ALL_ACL, CreateMode.PERSISTENT);
@@ -242,9 +291,10 @@ public void testBadACL() throws Exception {
         } catch (KeeperException.InvalidACLException e) {
         }
 
-        assertEquals("OutstandingRequests not decremented", 0, connectedServer.getInProcess());
+        assertEquals(0, connectedServer.getInProcess(), "OutstandingRequests not decremented");
 
-        assertTransactionState("zxid after invalid ACL", lastxid);
+        assertTransactionState("invalid ACL", zkConnected, lastxid);
+        assertTransactionState("invalid ACL", zkLeader, lastxid);
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EphemeralNodeDeletionTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EphemeralNodeDeletionTest.java
index 749eb804733..15e6b768468 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EphemeralNodeDeletionTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EphemeralNodeDeletionTest.java
@@ -19,10 +19,10 @@
 package org.apache.zookeeper.server.quorum;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
 import java.net.SocketTimeoutException;
 import java.util.concurrent.CountDownLatch;
@@ -38,8 +38,9 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.After;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 public class EphemeralNodeDeletionTest extends QuorumPeerTestBase {
 
@@ -52,7 +53,8 @@ public class EphemeralNodeDeletionTest extends QuorumPeerTestBase {
      * the proposal packet.
      */
 
-    @Test(timeout = 120000)
+    @Test
+    @Timeout(value = 120)
     public void testEphemeralNodeDeletion() throws Exception {
         final int[] clientPorts = new int[SERVER_COUNT];
         StringBuilder sb = new StringBuilder();
@@ -61,7 +63,7 @@ public void testEphemeralNodeDeletion() throws Exception {
         for (int i = 0; i < SERVER_COUNT; i++) {
             clientPorts[i] = PortAssignment.unique();
             server = "server." + i + "=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique()
-                     + ":participant;127.0.0.1:" + clientPorts[i];
+                    + ":participant;127.0.0.1:" + clientPorts[i];
             sb.append(server + "\n");
         }
         String currentQuorumCfgSection = sb.toString();
@@ -78,9 +80,8 @@ public TestQPMain getTestQPMain() {
 
         // ensure all servers started
         for (int i = 0; i < SERVER_COUNT; i++) {
-            assertTrue(
-                "waiting for server " + i + " being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                    "waiting for server " + i + " being up");
         }
 
         CountdownWatcher watch = new CountdownWatcher();
@@ -96,10 +97,8 @@ public TestQPMain getTestQPMain() {
         // 1: create ephemeral node
         String nodePath = "/e1";
         zk.create(nodePath, "1".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL, firstEphemeralNode);
-        assertEquals(
-            "Current session and ephemeral owner should be same",
-            zk.getSessionId(),
-            firstEphemeralNode.getEphemeralOwner());
+        assertEquals(zk.getSessionId(), firstEphemeralNode.getEphemeralOwner(),
+                "Current session and ephemeral owner should be same");
 
         // 2: inject network problem in one of the follower
         CustomQuorumPeer follower = (CustomQuorumPeer) getByServerState(mt, ServerState.FOLLOWING);
@@ -111,33 +110,31 @@ public TestQPMain getTestQPMain() {
         // remove the error
         follower.setInjectError(false);
 
-        assertTrue(
-                "Faulted Follower should have joined quorum by now",
-                ClientBase.waitForServerUp("127.0.0.1:" + follower.getClientPort(), CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + follower.getClientPort(), CONNECTION_TIMEOUT),
+                "Faulted Follower should have joined quorum by now");
 
         QuorumPeer leader = getByServerState(mt, ServerState.LEADING);
-        assertNotNull("Leader should not be null", leader);
-        assertTrue(
-            "Leader must be running",
-            ClientBase.waitForServerUp("127.0.0.1:" + leader.getClientPort(), CONNECTION_TIMEOUT));
+        assertNotNull(leader, "Leader should not be null");
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + leader.getClientPort(), CONNECTION_TIMEOUT),
+                "Leader must be running");
 
         watch = new CountdownWatcher();
         zk = new ZooKeeper("127.0.0.1:" + leader.getClientPort(), ClientBase.CONNECTION_TIMEOUT, watch);
         watch.waitForConnected(ClientBase.CONNECTION_TIMEOUT);
 
         Stat exists = zk.exists(nodePath, false);
-        assertNull("Node must have been deleted from leader", exists);
+        assertNull(exists, "Node must have been deleted from leader");
 
         CountdownWatcher followerWatch = new CountdownWatcher();
         ZooKeeper followerZK = new ZooKeeper(
-            "127.0.0.1:" + follower.getClientPort(),
-            ClientBase.CONNECTION_TIMEOUT,
-            followerWatch);
+                "127.0.0.1:" + follower.getClientPort(),
+                ClientBase.CONNECTION_TIMEOUT,
+                followerWatch);
         followerWatch.waitForConnected(ClientBase.CONNECTION_TIMEOUT);
         Stat nodeAtFollower = followerZK.exists(nodePath, false);
 
         // Problem 1: Follower had one extra ephemeral node /e1
-        assertNull("ephemeral node must not exist", nodeAtFollower);
+        assertNull(nodeAtFollower, "ephemeral node must not exist");
 
         // Create the node with another session
         Stat currentEphemeralNode = new Stat();
@@ -155,11 +152,11 @@ public TestQPMain getTestQPMain() {
         // Problem 2: Before fix, after session close the ephemeral node
         // was not getting deleted. But now after the fix after session close
         // ephemeral node is getting deleted.
-        assertNull("After session close ephemeral node must be deleted", nodeAtFollower);
+        assertNull(nodeAtFollower, "After session close ephemeral node must be deleted");
         followerZK.close();
     }
 
-    @After
+    @AfterEach
     public void tearDown() {
         // stop all severs
         for (int i = 0; i < mt.length; i++) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EpochWriteFailureTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EpochWriteFailureTest.java
index 526dc0be2ca..cea96bff0f3 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EpochWriteFailureTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/EpochWriteFailureTest.java
@@ -18,6 +18,9 @@
 package org.apache.zookeeper.server.quorum;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.IOException;
 import java.util.Map;
@@ -27,9 +30,9 @@
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.AfterClass;
-import org.junit.Assert;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 public class EpochWriteFailureTest extends QuorumPeerTestBase {
     private static int SERVER_COUNT = 3;
@@ -43,7 +46,8 @@ public class EpochWriteFailureTest extends QuorumPeerTestBase {
      * fails, it should not complete leader election, also it should not update
      * run time values of acceptedEpoch,
      */
-    @Test(timeout = 120000)
+    @Test
+    @Timeout(value = 120)
     public void testAcceptedEpochWriteFailure() throws Exception {
         StringBuilder sb = new StringBuilder();
         sb.append("admin.enableServer=false");
@@ -64,8 +68,8 @@ public void testAcceptedEpochWriteFailure() throws Exception {
 
         // ensure two servers started
         for (int i = 0; i < SERVER_COUNT - 1; i++) {
-            Assert.assertTrue("waiting for server " + i + " being up",
-                    ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                    "waiting for server " + i + " being up");
         }
 
         CountdownWatcher watch1 = new CountdownWatcher();
@@ -93,15 +97,13 @@ public TestQPMain getTestQPMain() {
          * failure is injected and it keeps on trying to join the quorum
          */
 
-        Assert.assertFalse("verify server 2 not started",
-                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[2], CONNECTION_TIMEOUT / 2));
+        assertFalse(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[2], CONNECTION_TIMEOUT / 2),
+                "verify server 2 not started");
 
         QuorumPeer quorumPeer = mt[2].getQuorumPeer();
 
-        Assert.assertEquals("acceptedEpoch must not have changed", 0,
-                quorumPeer.getAcceptedEpoch());
-        Assert.assertEquals("currentEpoch must not have changed", 0,
-                quorumPeer.getCurrentEpoch());
+        assertEquals(0, quorumPeer.getAcceptedEpoch(), "acceptedEpoch must not have changed");
+        assertEquals(0, quorumPeer.getCurrentEpoch(), "currentEpoch must not have changed");
     }
 
     static class CustomQuorumPeer extends QuorumPeer {
@@ -138,7 +140,7 @@ public void runFromConfig(QuorumPeerConfig config)
         }
     }
 
-    @AfterClass
+    @AfterAll
     public static void tearDownAfterClass() throws InterruptedException {
         for (int i = 0; i < SERVER_COUNT; i++) {
             if (mt[i] != null) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEBackwardElectionRoundTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEBackwardElectionRoundTest.java
index 84e20311f04..67d646c9787 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEBackwardElectionRoundTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEBackwardElectionRoundTest.java
@@ -17,7 +17,7 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.net.InetSocketAddress;
 import java.nio.ByteBuffer;
@@ -28,9 +28,9 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -45,17 +45,17 @@ public class FLEBackwardElectionRoundTest extends ZKTestCase {
 
     QuorumCnxManager[] cnxManagers;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         count = 3;
 
-        peers = new HashMap<Long, QuorumServer>(count);
+        peers = new HashMap<>(count);
         tmpdir = new File[count];
         port = new int[count];
         cnxManagers = new QuorumCnxManager[count - 1];
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         for (int i = 0; i < (count - 1); i++) {
             if (cnxManagers[i] != null) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLELostMessageTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLELostMessageTest.java
index 5c6ffb5b7b9..d84396ed57e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLELostMessageTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLELostMessageTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.IOException;
 import java.net.InetSocketAddress;
@@ -28,9 +28,9 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -45,16 +45,16 @@ public class FLELostMessageTest extends ZKTestCase {
 
     QuorumCnxManager cnxManager;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         count = 3;
 
-        peers = new HashMap<Long, QuorumServer>(count);
+        peers = new HashMap<>(count);
         tmpdir = new File[count];
         port = new int[count];
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         cnxManager.halt();
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEMalformedNotificationMessageTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEMalformedNotificationMessageTest.java
new file mode 100644
index 00000000000..30187644a87
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEMalformedNotificationMessageTest.java
@@ -0,0 +1,248 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.quorum;
+
+import static org.junit.jupiter.api.Assertions.fail;
+import java.io.File;
+import java.io.IOException;
+import java.net.InetSocketAddress;
+import java.nio.ByteBuffer;
+import java.util.HashMap;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
+import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
+import org.apache.zookeeper.test.ClientBase;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class FLEMalformedNotificationMessageTest extends ZKTestCase {
+    private static final Logger LOG = LoggerFactory.getLogger(FLEMalformedNotificationMessageTest.class);
+    private static final byte[] CONFIG_BYTES = "my very invalid config string".getBytes();
+    private static final int CONFIG_BYTES_LENGTH = CONFIG_BYTES.length;
+
+    int count;
+    HashMap<Long, QuorumServer> peers;
+    File tmpdir[];
+    int port[];
+
+    QuorumCnxManager mockCnxManager;
+    FLETestUtils.LEThread leaderElectionThread;
+    QuorumPeer peerRunningLeaderElection;
+
+
+    @BeforeEach
+    public void setUp() throws Exception {
+        count = 3;
+
+        peers = new HashMap<>(count);
+        tmpdir = new File[count];
+        port = new int[count];
+
+        LOG.info("FLEMalformedNotificationMessageTest: {}, {}", getTestName(), count);
+        for (int i = 0; i < count; i++) {
+            int clientport = PortAssignment.unique();
+            peers.put((long) i,
+                      new QuorumServer(i,
+                                       new InetSocketAddress(clientport),
+                                       new InetSocketAddress(PortAssignment.unique())));
+            tmpdir[i] = ClientBase.createTmpDir();
+            port[i] = clientport;
+        }
+
+        /*
+         * Start server 0
+         */
+        peerRunningLeaderElection = new QuorumPeer(peers, tmpdir[0], tmpdir[0], port[0], 3, 0, 1000, 2, 2, 2);
+        peerRunningLeaderElection.startLeaderElection();
+        leaderElectionThread = new FLETestUtils.LEThread(peerRunningLeaderElection, 0);
+        leaderElectionThread.start();
+    }
+
+
+    @AfterEach
+    public void tearDown() throws Exception {
+        peerRunningLeaderElection.shutdown();
+        mockCnxManager.halt();
+    }
+
+
+    @Test
+    public void testTooShortPartialNotificationMessage() throws Exception {
+
+        /*
+         * Start mock server 1, send a message too short to be compatible with any protocol version
+         * This simulates the case when only some parts of the whole message is received.
+         */
+        startMockServer(1);
+        byte requestBytes[] = new byte[12];
+        ByteBuffer requestBuffer = ByteBuffer.wrap(requestBytes);
+        requestBuffer.clear();
+        requestBuffer.putInt(ServerState.LOOKING.ordinal());   // state
+        requestBuffer.putLong(0);                              // leader
+        mockCnxManager.toSend(0L, requestBuffer);
+
+        /*
+         * Assert that the message receiver thread in leader election is still healthy:
+         * we are sending valid votes and waiting for the leader election to be finished.
+         */
+        sendValidNotifications(1, 0);
+        leaderElectionThread.join(5000);
+        if (leaderElectionThread.isAlive()) {
+            fail("Leader election thread didn't join, something went wrong.");
+        }
+    }
+
+
+    @Test
+    public void testNotificationMessageWithNegativeConfigLength() throws Exception {
+
+        /*
+         * Start mock server 1, send a message with negative configLength field
+         */
+        startMockServer(1);
+        byte requestBytes[] = new byte[48];
+        ByteBuffer requestBuffer = ByteBuffer.wrap(requestBytes);
+        requestBuffer.clear();
+        requestBuffer.putInt(ServerState.LOOKING.ordinal());   // state
+        requestBuffer.putLong(0);                              // leader
+        requestBuffer.putLong(0);                              // zxid
+        requestBuffer.putLong(0);                              // electionEpoch
+        requestBuffer.putLong(0);                              // epoch
+        requestBuffer.putInt(FastLeaderElection.Notification.CURRENTVERSION);   // version
+        requestBuffer.putInt(-123);                            // configData.length
+        mockCnxManager.toSend(0L, requestBuffer);
+
+        /*
+         * Assert that the message receiver thread in leader election is still healthy:
+         * we are sending valid votes and waiting for the leader election to be finished.
+         */
+        sendValidNotifications(1, 0);
+        leaderElectionThread.join(5000);
+        if (leaderElectionThread.isAlive()) {
+            fail("Leader election thread didn't join, something went wrong.");
+        }
+    }
+
+
+    @Test
+    public void testNotificationMessageWithInvalidConfigLength() throws Exception {
+
+        /*
+         * Start mock server 1, send a message with an invalid configLength field
+         * (instead of sending CONFIG_BYTES_LENGTH, we send 10000)
+         */
+        startMockServer(1);
+        byte requestBytes[] = new byte[48 + CONFIG_BYTES_LENGTH];
+        ByteBuffer requestBuffer = ByteBuffer.wrap(requestBytes);
+        requestBuffer.clear();
+        requestBuffer.putInt(ServerState.LOOKING.ordinal());   // state
+        requestBuffer.putLong(0);                              // leader
+        requestBuffer.putLong(0);                              // zxid
+        requestBuffer.putLong(0);                              // electionEpoch
+        requestBuffer.putLong(0);                              // epoch
+        requestBuffer.putInt(FastLeaderElection.Notification.CURRENTVERSION);   // version
+        requestBuffer.putInt(10000);                           // configData.length
+        requestBuffer.put(CONFIG_BYTES);                       // configData
+        mockCnxManager.toSend(0L, requestBuffer);
+
+        /*
+         * Assert that the message receiver thread in leader election is still healthy:
+         * we are sending valid votes and waiting for the leader election to be finished.
+         */
+        sendValidNotifications(1, 0);
+        leaderElectionThread.join(5000);
+        if (leaderElectionThread.isAlive()) {
+            fail("Leader election thread didn't join, something went wrong.");
+        }
+    }
+
+
+    @Test
+    public void testNotificationMessageWithInvalidConfig() throws Exception {
+
+        /*
+         * Start mock server 1, send a message with an invalid config field
+         * (the receiver should not be able to parse the config part of the message)
+         */
+        startMockServer(1);
+        ByteBuffer requestBuffer = FastLeaderElection.buildMsg(ServerState.LOOKING.ordinal(), 1, 0, 0, 0, CONFIG_BYTES);
+        mockCnxManager.toSend(0L, requestBuffer);
+
+        /*
+         * Assert that the message receiver thread in leader election is still healthy:
+         * we are sending valid votes and waiting for the leader election to be finished.
+         */
+        sendValidNotifications(1, 0);
+        leaderElectionThread.join(5000);
+        if (leaderElectionThread.isAlive()) {
+            fail("Leader election thread didn't join, something went wrong.");
+        }
+    }
+
+
+    @Test
+    public void testNotificationMessageWithBadProtocol() throws Exception {
+
+        /*
+         * Start mock server 1, send an invalid 30 bytes long message
+         * (the receiver should not be able to parse the message and should skip it)
+         * This simulates the case when only some parts of the whole message is received.
+         */
+        startMockServer(1);
+        byte requestBytes[] = new byte[30];
+        ByteBuffer requestBuffer = ByteBuffer.wrap(requestBytes);
+        requestBuffer.clear();
+        requestBuffer.putInt(ServerState.LOOKING.ordinal());   // state
+        requestBuffer.putLong(1);                              // leader
+        requestBuffer.putLong(0);                              // zxid
+        requestBuffer.putLong(0);                              // electionEpoch
+        requestBuffer.putShort((short) 0);                      // this is the first two bytes of a proper
+                                                               // 8 bytes Long we should send here
+        mockCnxManager.toSend(0L, requestBuffer);
+
+        /*
+         * Assert that the message receiver thread in leader election is still healthy:
+         * we are sending valid votes and waiting for the leader election to be finished.
+         */
+        sendValidNotifications(1, 0);
+        leaderElectionThread.join(5000);
+        if (leaderElectionThread.isAlive()) {
+            fail("Leader election thread didn't join, something went wrong.");
+        }
+    }
+
+
+    void startMockServer(int sid) throws IOException {
+        QuorumPeer peer = new QuorumPeer(peers, tmpdir[sid], tmpdir[sid], port[sid], 3, sid, 1000, 2, 2, 2);
+        mockCnxManager = peer.createCnxnManager();
+        mockCnxManager.listener.start();
+    }
+
+
+    void sendValidNotifications(int fromSid, int toSid) throws InterruptedException {
+        mockCnxManager.toSend((long) toSid, FLETestUtils.createMsg(ServerState.LOOKING.ordinal(), fromSid, 0, 0));
+        mockCnxManager.recvQueue.take();
+        mockCnxManager.toSend((long) toSid, FLETestUtils.createMsg(ServerState.FOLLOWING.ordinal(), toSid, 0, 0));
+    }
+
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEOutOfElectionTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEOutOfElectionTest.java
index b1b66627868..7feed9c0524 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEOutOfElectionTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLEOutOfElectionTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.net.InetSocketAddress;
 import java.util.HashMap;
@@ -30,8 +30,8 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.server.util.ZxidUtils;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 /**
  * Test FastLeaderElection with out of election servers.
@@ -40,10 +40,10 @@ public class FLEOutOfElectionTest {
 
     private FastLeaderElection fle;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         File tmpdir = ClientBase.createTmpDir();
-        Map<Long, QuorumServer> peers = new HashMap<Long, QuorumServer>();
+        Map<Long, QuorumServer> peers = new HashMap<>();
         for (int i = 0; i < 5; i++) {
             peers.put(Long.valueOf(i), new QuorumServer(Long.valueOf(i), new InetSocketAddress("127.0.0.1", PortAssignment.unique())));
         }
@@ -53,7 +53,7 @@ public void setUp() throws Exception {
 
     @Test
     public void testIgnoringZxidElectionEpoch() {
-        Map<Long, Vote> votes = new HashMap<Long, Vote>();
+        Map<Long, Vote> votes = new HashMap<>();
         votes.put(0L, new Vote(0x1, 4L, ZxidUtils.makeZxid(1, 1), 1, 2, ServerState.FOLLOWING));
         votes.put(1L, new Vote(0x1, 4L, ZxidUtils.makeZxid(1, 2), 1, 2, ServerState.FOLLOWING));
         votes.put(3L, new Vote(0x1, 4L, ZxidUtils.makeZxid(2, 1), 2, 2, ServerState.FOLLOWING));
@@ -64,7 +64,7 @@ public void testIgnoringZxidElectionEpoch() {
 
     @Test
     public void testElectionWIthDifferentVersion() {
-        Map<Long, Vote> votes = new HashMap<Long, Vote>();
+        Map<Long, Vote> votes = new HashMap<>();
         votes.put(0L, new Vote(0x1, 4L, ZxidUtils.makeZxid(1, 1), 1, 1, ServerState.FOLLOWING));
         votes.put(1L, new Vote(0x1, 4L, ZxidUtils.makeZxid(1, 1), 1, 1, ServerState.FOLLOWING));
         votes.put(3L, new Vote(4L, ZxidUtils.makeZxid(2, 1), 2, 2, ServerState.FOLLOWING));
@@ -75,7 +75,7 @@ public void testElectionWIthDifferentVersion() {
 
     @Test
     public void testLookingNormal() {
-        Map<Long, Vote> votes = new HashMap<Long, Vote>();
+        Map<Long, Vote> votes = new HashMap<>();
         votes.put(0L, new Vote(4L, ZxidUtils.makeZxid(2, 1), 1, 1, ServerState.LOOKING));
         votes.put(1L, new Vote(4L, ZxidUtils.makeZxid(2, 1), 1, 1, ServerState.LOOKING));
         votes.put(3L, new Vote(4L, ZxidUtils.makeZxid(2, 1), 1, 1, ServerState.LOOKING));
@@ -86,7 +86,7 @@ public void testLookingNormal() {
 
     @Test
     public void testLookingDiffRounds() {
-        HashMap<Long, Vote> votes = new HashMap<Long, Vote>();
+        HashMap<Long, Vote> votes = new HashMap<>();
         votes.put(0L, new Vote(4L, ZxidUtils.makeZxid(1, 1), 1, 1, ServerState.LOOKING));
         votes.put(1L, new Vote(4L, ZxidUtils.makeZxid(2, 1), 2, 2, ServerState.LOOKING));
         votes.put(3L, new Vote(4L, ZxidUtils.makeZxid(2, 1), 3, 2, ServerState.LOOKING));
@@ -97,7 +97,7 @@ public void testLookingDiffRounds() {
 
     @Test
     public void testOutofElection() {
-        HashMap<Long, Vote> outofelection = new HashMap<Long, Vote>();
+        HashMap<Long, Vote> outofelection = new HashMap<>();
 
         outofelection.put(1L, new Vote(0x0, 5, ZxidUtils.makeZxid(15, 0), 0xa, 0x17, ServerState.FOLLOWING));
         outofelection.put(2L, new Vote(0x0, 5, ZxidUtils.makeZxid(15, 0), 0xa, 0x17, ServerState.FOLLOWING));
@@ -117,9 +117,9 @@ public void testOutofElection() {
         // Set the logical clock to 1 on fle instance of server 3.
         fle.logicalclock.set(0x1);
 
-        assertTrue("Quorum check failed", fle.getVoteTracker(outofelection, new Vote(n.version, n.leader, n.zxid, n.electionEpoch, n.peerEpoch, n.state)).hasAllQuorums());
+        assertTrue(fle.getVoteTracker(outofelection, new Vote(n.version, n.leader, n.zxid, n.electionEpoch, n.peerEpoch, n.state)).hasAllQuorums(), "Quorum check failed");
 
-        assertTrue("Leader check failed", fle.checkLeader(outofelection, n.leader, n.electionEpoch));
+        assertTrue(fle.checkLeader(outofelection, n.leader, n.electionEpoch), "Leader check failed");
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLETestUtils.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLETestUtils.java
index 45ce2baea5a..b27580c3e34 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLETestUtils.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FLETestUtils.java
@@ -17,8 +17,8 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.nio.ByteBuffer;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
@@ -64,7 +64,7 @@ public void run() {
 
                 LOG.info("Finished election: {}, {}", i, v.getId());
 
-                assertTrue("State is not leading.", peer.getPeerState() == ServerState.LEADING);
+                assertTrue(peer.getPeerState() == ServerState.LEADING, "State is not leading.");
             } catch (Exception e) {
                 e.printStackTrace();
             }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessorTest.java
new file mode 100644
index 00000000000..1d46debccda
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FollowerRequestProcessorTest.java
@@ -0,0 +1,88 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.quorum;
+
+import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.ZooDefs.Ids;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.ZooKeeper.States;
+import org.apache.zookeeper.server.ServerMetrics;
+import org.apache.zookeeper.server.util.PortForwarder;
+import org.apache.zookeeper.test.ClientBase;
+import org.apache.zookeeper.test.ObserverMasterTestBase;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+
+public class FollowerRequestProcessorTest extends ObserverMasterTestBase {
+
+    private PortForwarder forwarder;
+
+    @Test
+    public void testFollowerRequestProcessorSkipsLearnerRequestToNextProcessor() throws Exception {
+        setupTestObserverServer("true");
+
+        zk.create("/testFollowerSkipNextAProcessor", "test".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+        assertEquals("test", new String(zk.getData("/testFollowerSkipNextAProcessor", null, null)));
+        assertEquals(1L, ServerMetrics.getMetrics().SKIP_LEARNER_REQUEST_TO_NEXT_PROCESSOR_COUNT.get());
+    }
+
+    @Test
+    public void testFollowerRequestProcessorSendsLearnerRequestToNextProcessor() throws Exception {
+        setupTestObserverServer("false");
+
+        zk.create("/testFollowerSkipNextAProcessor", "test".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+        assertEquals("test", new String(zk.getData("/testFollowerSkipNextAProcessor", null, null)));
+        assertEquals(0L, ServerMetrics.getMetrics().SKIP_LEARNER_REQUEST_TO_NEXT_PROCESSOR_COUNT.get());
+    }
+
+    private void setupTestObserverServer(String skipLearnerRequestToNextProcessor) throws Exception {
+        System.setProperty(FollowerRequestProcessor.SKIP_LEARNER_REQUEST_TO_NEXT_PROCESSOR, skipLearnerRequestToNextProcessor);
+
+        // Setup Ensemble with observer master port so that observer connects with Observer master and not the leader
+        final int OM_PROXY_PORT = PortAssignment.unique();
+        forwarder = setUp(OM_PROXY_PORT, true);
+
+        q3.start();
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT),
+                "waiting for server 3 being up");
+
+        // Connect with observer zookeeper
+        zk = new ZooKeeper("127.0.0.1:" + CLIENT_PORT_OBS, ClientBase.CONNECTION_TIMEOUT, this);
+        waitForOne(zk, States.CONNECTED);
+
+        // Clear all service metrics collected so far
+        ServerMetrics.getMetrics().resetAll();
+    }
+
+    @AfterEach
+    public void cleanup() throws Exception {
+        System.setProperty(FollowerRequestProcessor.SKIP_LEARNER_REQUEST_TO_NEXT_PROCESSOR, "false");
+
+        shutdown();
+        if (forwarder != null) {
+            forwarder.shutdown();
+        }
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FuzzySnapshotRelatedTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FuzzySnapshotRelatedTest.java
index fd3374ded3b..d7bb1a0679d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FuzzySnapshotRelatedTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/FuzzySnapshotRelatedTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
 import java.util.Arrays;
 import java.util.HashMap;
@@ -51,9 +51,9 @@
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -70,7 +70,7 @@ public class FuzzySnapshotRelatedTest extends QuorumPeerTestBase {
     int leaderId;
     int followerA;
 
-    @Before
+    @BeforeEach
     public void setup() throws Exception {
         ZooKeeperServer.setDigestEnabled(true);
 
@@ -115,7 +115,7 @@ public TestQPMain getTestQPMain() {
         }
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         ZooKeeperServer.setDigestEnabled(false);
 
@@ -150,7 +150,11 @@ public void testMultiOpConsistency() throws Exception {
             @Override
             public void process(String path) {
                 LOG.info("Take a snapshot");
-                zkServer.takeSnapshot(true);
+                try {
+                    zkServer.takeSnapshot(true);
+                } catch (final IOException e) {
+                    // ignored as it should never reach here because of System.exit() call
+                }
             }
         });
 
@@ -173,7 +177,7 @@ public void process(String path) {
     }
 
     /**
-     * It's possibel during SNAP sync, the parent is serialized before the
+     * It's possible during SNAP sync, the parent is serialized before the
      * child get deleted during sending the snapshot over.
      *
      * In which case, we need to make sure the pzxid get correctly updated
@@ -317,7 +321,7 @@ public void process() {
     private void checkNoMismatchReported() {
         long mismatch = (long) MetricsUtils.currentServerMetrics().get("digest_mismatches_count");
 
-        assertFalse("The mismatch count should be zero but is: " + mismatch, mismatch > 0);
+        assertFalse(mismatch > 0, "The mismatch count should be zero but is: " + mismatch);
     }
 
     private void addSerializeListener(int sid, String parent, String child) {
@@ -373,7 +377,11 @@ public void testGlobalSessionConsistency() throws Exception {
             public void process(long sessionId) {
                 LOG.info("Take snapshot");
                 if (shouldTakeSnapshot.getAndSet(false)) {
-                    zkServer.takeSnapshot(true);
+                    try {
+                        zkServer.takeSnapshot(true);
+                    } catch (IOException e) {
+                        // ignored as it should never reach here because of System.exit() call
+                    }
                 }
             }
         });
@@ -422,8 +430,8 @@ interface SetDataTxnListener {
 
     static class CustomDataTree extends DataTree {
 
-        Map<String, NodeCreateListener> nodeCreateListeners = new HashMap<String, NodeCreateListener>();
-        Map<String, NodeSerializeListener> listeners = new HashMap<String, NodeSerializeListener>();
+        Map<String, NodeCreateListener> nodeCreateListeners = new HashMap<>();
+        Map<String, NodeSerializeListener> listeners = new HashMap<>();
         DigestSerializeListener digestListener;
         SetDataTxnListener setListener;
 
@@ -533,7 +541,7 @@ public void createSessionTracker() {
                                     this,
                                     getZKDatabase().getSessionWithTimeOuts(),
                                     this.tickTime,
-                                    self.getId(),
+                                    self.getMyId(),
                                     self.areLocalSessionsEnabled(),
                                     getZooKeeperServerListener()) {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderBeanTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderBeanTest.java
index 0c6938be401..9c4e5214d4c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderBeanTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderBeanTest.java
@@ -18,19 +18,26 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.Mockito.doAnswer;
+import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 import java.io.File;
 import java.io.IOException;
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
+import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.HashMap;
+import java.util.HashSet;
 import java.util.Map;
 import org.apache.jute.OutputArchive;
 import org.apache.jute.Record;
@@ -41,13 +48,14 @@
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.server.quorum.QuorumPeer.LearnerType;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
+import org.apache.zookeeper.server.quorum.flexible.QuorumMaj;
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
-import org.apache.zookeeper.server.util.SerializeUtils;
-import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.txn.TxnHeader;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+import org.mockito.Mockito;
 import org.mockito.invocation.InvocationOnMock;
 import org.mockito.stubbing.Answer;
 
@@ -59,10 +67,12 @@ public class LeaderBeanTest {
     private LeaderZooKeeperServer zks;
     private QuorumPeer qp;
     private QuorumVerifier quorumVerifierMock;
+    @TempDir
+    File tmpDir;
 
     public static Map<Long, QuorumServer> getMockedPeerViews(long myId) {
         int clientPort = PortAssignment.unique();
-        Map<Long, QuorumServer> peersView = new HashMap<Long, QuorumServer>();
+        Map<Long, QuorumServer> peersView = new HashMap<>();
         InetAddress clientIP = InetAddress.getLoopbackAddress();
 
         peersView.put(Long.valueOf(myId),
@@ -72,14 +82,13 @@ public static Map<Long, QuorumServer> getMockedPeerViews(long myId) {
         return peersView;
     }
 
-    @Before
+    @BeforeEach
     public void setUp() throws IOException, X509Exception {
         qp = new QuorumPeer();
         quorumVerifierMock = mock(QuorumVerifier.class);
-        when(quorumVerifierMock.getAllMembers()).thenReturn(getMockedPeerViews(qp.getId()));
+        when(quorumVerifierMock.getAllMembers()).thenReturn(getMockedPeerViews(qp.getMyId()));
 
         qp.setQuorumVerifier(quorumVerifierMock, false);
-        File tmpDir = ClientBase.createEmptyTestDir();
         fileTxnSnapLog = new FileTxnSnapLog(new File(tmpDir, "data"), new File(tmpDir, "data_txnlog"));
         ZKDatabase zkDb = new ZKDatabase(fileTxnSnapLog);
 
@@ -88,11 +97,20 @@ public void setUp() throws IOException, X509Exception {
         leaderBean = new LeaderBean(leader, zks);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws IOException {
         fileTxnSnapLog.close();
     }
 
+    @Test
+    public void testCreateServerSocketWillRecreateInetSocketAddr() {
+        Leader spyLeader = Mockito.spy(leader);
+        InetSocketAddress addr = new InetSocketAddress("localhost", PortAssignment.unique());
+        spyLeader.createServerSocket(addr, false, false);
+        // make sure the address to be bound will be recreated with expected hostString and port
+        Mockito.verify(spyLeader, times(1)).recreateInetSocketAddr(addr.getHostString(), addr.getPort());
+    }
+
     @Test
     public void testGetName() {
         assertEquals("Leader", leaderBean.getName());
@@ -125,7 +143,7 @@ public void testGetProposalSize() throws IOException, Leader.XidRolloverExceptio
         leader.propose(req);
 
         // Assert
-        byte[] data = SerializeUtils.serializeRequest(req);
+        byte[] data = req.getSerializeData();
         assertEquals(data.length, leaderBean.getLastProposalSize());
         assertEquals(data.length, leaderBean.getMinProposalSize());
         assertEquals(data.length, leaderBean.getMaxProposalSize());
@@ -174,7 +192,7 @@ public Object answer(InvocationOnMock invocation) throws Throwable {
 
     @Test
     public void testFollowerInfo() throws IOException {
-        Map<Long, QuorumServer> votingMembers = new HashMap<Long, QuorumServer>();
+        Map<Long, QuorumServer> votingMembers = new HashMap<>();
         votingMembers.put(1L, null);
         votingMembers.put(2L, null);
         votingMembers.put(3L, null);
@@ -211,4 +229,64 @@ public void testFollowerInfo() throws IOException {
         assertEquals("5\n", leaderBean.nonVotingFollowerInfo());
     }
 
+    @Test
+    public void testGetDesignatedLeaderShouldRecreateSocketAddresses() {
+        Leader.Proposal p = new Leader.Proposal();
+        Map<Long, QuorumServer> peersView = new HashMap<>();
+        QuorumServer qs = Mockito.mock(QuorumServer.class);
+        MultipleAddresses multipleAddresses = new MultipleAddresses();
+        qs.type = LearnerType.PARTICIPANT;
+        qs.addr = multipleAddresses;
+        peersView.put(0L, qs);
+        QuorumVerifier qv = new QuorumMaj(peersView);
+        HashSet<Long> ackset = new HashSet<>();
+        ackset.add(0L);
+        ArrayList<Leader.Proposal.QuorumVerifierAcksetPair> qvAcksetPairs = new ArrayList<>();
+        qvAcksetPairs.add(new Leader.Proposal.QuorumVerifierAcksetPair(qv, ackset));
+        p.qvAcksetPairs = qvAcksetPairs;
+        Leader spyLeader = spy(leader);
+        doReturn(multipleAddresses, multipleAddresses).when(spyLeader).recreateSocketAddresses(any(MultipleAddresses.class));
+
+        spyLeader.getDesignatedLeader(p, 0L);
+        // Verify `recreateSocketAddresses` method should be invoked twice for the address in proposal and self one
+        verify(spyLeader, times(2)).recreateSocketAddresses(any(MultipleAddresses.class));
+    }
+
+    @Test
+    public void testRecreateSocketAddresses() {
+        InetAddress loopback = InetAddress.getLoopbackAddress();
+        String oldIP = loopback.getHostAddress();
+        String newIP = "1.1.1.1";
+
+        // test case 1: empty MultipleAddresses instance will still be empty after recreateSocketAddresses
+        MultipleAddresses multipleAddresses = new MultipleAddresses();
+        assertEquals(multipleAddresses, leader.recreateSocketAddresses(multipleAddresses));
+
+        // test case 2: The content of MultipleAddresses instance will still be the same after recreateSocketAddresses if address no change
+        InetSocketAddress addr1 = new InetSocketAddress(loopback, PortAssignment.unique());
+        InetSocketAddress addr2 = new InetSocketAddress(loopback, PortAssignment.unique());
+        multipleAddresses = new MultipleAddresses(Arrays.asList(addr1, addr2));
+        // Verify after recreateSocketAddresses, the multipleAddresses should be the same (i.e. under no DNS's interaction)
+        assertEquals(multipleAddresses, leader.recreateSocketAddresses(multipleAddresses));
+
+        // test case 3: Simulating the DNS returning different IP address for the same hostname during recreation.
+        // After recreateSocketAddresses, the MultipleAddresses should contain the updated IP address instance while other fields unchanged.
+        InetAddress spyInetAddr = Mockito.spy(loopback);
+        InetSocketAddress addr3 = new InetSocketAddress(spyInetAddr, PortAssignment.unique());
+        // Verify the address is the old IP before recreateSocketAddresses.
+        assertEquals(oldIP, addr3.getAddress().getHostAddress());
+        multipleAddresses = new MultipleAddresses(Arrays.asList(addr3));
+        // simulating the DNS returning different IP address
+        when(spyInetAddr.getHostAddress()).thenReturn(newIP);
+
+        // Verify after recreateSocketAddresses, the multipleAddresses should have different IP address result
+        MultipleAddresses newMultipleAddress = leader.recreateSocketAddresses(multipleAddresses);
+        assertNotEquals(multipleAddresses, newMultipleAddress);
+        assertEquals(1, multipleAddresses.getAllAddresses().size());
+        InetSocketAddress newAddr = multipleAddresses.getAllAddresses().iterator().next();
+        // Verify the hostName should still be the same
+        assertEquals(loopback.getHostName(), newAddr.getAddress().getHostName());
+        // Verify the IP address has changed.
+        assertEquals(newIP, newAddr.getAddress().getHostAddress());
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderMetricsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderMetricsTest.java
index 40ddfe6f365..db2a066d50b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderMetricsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderMetricsTest.java
@@ -18,10 +18,10 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.number.OrderingComparison.greaterThan;
 import static org.hamcrest.number.OrderingComparison.greaterThanOrEqualTo;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.util.Map;
 import java.util.concurrent.CountDownLatch;
 import org.apache.zookeeper.CreateMode;
@@ -34,9 +34,9 @@
 import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.QuorumUtil;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class LeaderMetricsTest extends ZKTestCase {
 
@@ -52,12 +52,12 @@ public void process(WatchedEvent e) {
 
     }
 
-    @Before
+    @BeforeEach
     public void setup() {
         oldLoggingFeq = Leader.getAckLoggingFrequency();
     }
 
-    @After
+    @AfterEach
     public void teardown() {
         Leader.setAckLoggingFrequency(oldLoggingFeq);
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderWithObserverTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderWithObserverTest.java
index 91292de7726..518dcef0f6c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderWithObserverTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LeaderWithObserverTest.java
@@ -20,31 +20,32 @@
 
 import static org.apache.zookeeper.server.quorum.ZabUtils.createLeader;
 import static org.apache.zookeeper.server.quorum.ZabUtils.createQuorumPeer;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
+import java.lang.reflect.Field;
 import java.net.InetSocketAddress;
 import java.util.Map;
 import java.util.Set;
 import org.apache.zookeeper.PortAssignment;
-import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 
 public class LeaderWithObserverTest {
 
     QuorumPeer peer;
     Leader leader;
+    @TempDir
     File tmpDir;
     long participantId;
     long observerId;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
-        tmpDir = ClientBase.createTmpDir();
         peer = createQuorumPeer(tmpDir);
         participantId = 1;
         Map<Long, QuorumPeer.QuorumServer> peers = peer.getQuorumVerifier().getAllMembers();
@@ -57,10 +58,9 @@ public void setUp() throws Exception {
         peer.tickTime = 1;
     }
 
-    @After
+    @AfterEach
     public void tearDown() {
         leader.shutdown("end of test");
-        tmpDir.delete();
     }
 
     @Test
@@ -68,18 +68,18 @@ public void testGetEpochToPropose() throws Exception {
         long lastAcceptedEpoch = 5;
         peer.setAcceptedEpoch(5);
 
-        assertEquals("Unexpected vote in connectingFollowers", 0, leader.connectingFollowers.size());
+        assertEquals(0, leader.connectingFollowers.size(), "Unexpected vote in connectingFollowers");
         assertTrue(leader.waitingForNewEpoch);
         try {
             // Leader asks for epoch (mocking Leader.lead behavior)
             // First add to connectingFollowers
-            leader.getEpochToPropose(peer.getId(), lastAcceptedEpoch);
+            leader.getEpochToPropose(peer.getMyId(), lastAcceptedEpoch);
         } catch (InterruptedException e) {
             // ignore timeout
         }
 
-        assertEquals("Unexpected vote in connectingFollowers", 1, leader.connectingFollowers.size());
-        assertEquals("Leader shouldn't set new epoch until quorum of participants is in connectingFollowers", lastAcceptedEpoch, peer.getAcceptedEpoch());
+        assertEquals(1, leader.connectingFollowers.size(), "Unexpected vote in connectingFollowers");
+        assertEquals(lastAcceptedEpoch, peer.getAcceptedEpoch(), "Leader shouldn't set new epoch until quorum of participants is in connectingFollowers");
         assertTrue(leader.waitingForNewEpoch);
         try {
             // Observer asks for epoch (mocking LearnerHandler behavior)
@@ -88,8 +88,8 @@ public void testGetEpochToPropose() throws Exception {
             // ignore timeout
         }
 
-        assertEquals("Unexpected vote in connectingFollowers", 1, leader.connectingFollowers.size());
-        assertEquals("Leader shouldn't set new epoch after observer asks for epoch", lastAcceptedEpoch, peer.getAcceptedEpoch());
+        assertEquals(1, leader.connectingFollowers.size(), "Unexpected vote in connectingFollowers");
+        assertEquals(lastAcceptedEpoch, peer.getAcceptedEpoch(), "Leader shouldn't set new epoch after observer asks for epoch");
         assertTrue(leader.waitingForNewEpoch);
         try {
             // Now participant asks for epoch (mocking LearnerHandler behavior). Second add to connectingFollowers.
@@ -99,8 +99,8 @@ public void testGetEpochToPropose() throws Exception {
             fail("Timed out in getEpochToPropose");
         }
 
-        assertEquals("Unexpected vote in connectingFollowers", 2, leader.connectingFollowers.size());
-        assertEquals("Leader should record next epoch", lastAcceptedEpoch + 1, peer.getAcceptedEpoch());
+        assertEquals(2, leader.connectingFollowers.size(), "Unexpected vote in connectingFollowers");
+        assertEquals(lastAcceptedEpoch + 1, peer.getAcceptedEpoch(), "Leader should record next epoch");
         assertFalse(leader.waitingForNewEpoch);
     }
 
@@ -109,16 +109,16 @@ public void testWaitForEpochAck() throws Exception {
         // things needed for waitForEpochAck to run (usually in leader.lead(), but we're not running leader here)
         leader.leaderStateSummary = new StateSummary(leader.self.getCurrentEpoch(), leader.zk.getLastProcessedZxid());
 
-        assertEquals("Unexpected vote in electingFollowers", 0, leader.electingFollowers.size());
+        assertEquals(0, leader.electingFollowers.size(), "Unexpected vote in electingFollowers");
         assertFalse(leader.electionFinished);
         try {
             // leader calls waitForEpochAck, first add to electingFollowers
-            leader.waitForEpochAck(peer.getId(), new StateSummary(0, 0));
+            leader.waitForEpochAck(peer.getMyId(), new StateSummary(0, 0));
         } catch (InterruptedException e) {
             // ignore timeout
         }
 
-        assertEquals("Unexpected vote in electingFollowers", 1, leader.electingFollowers.size());
+        assertEquals(1, leader.electingFollowers.size(), "Unexpected vote in electingFollowers");
         assertFalse(leader.electionFinished);
         try {
             // observer calls waitForEpochAck, should fail verifier.containsQuorum
@@ -127,12 +127,12 @@ public void testWaitForEpochAck() throws Exception {
             // ignore timeout
         }
 
-        assertEquals("Unexpected vote in electingFollowers", 1, leader.electingFollowers.size());
+        assertEquals(1, leader.electingFollowers.size(), "Unexpected vote in electingFollowers");
         assertFalse(leader.electionFinished);
         try {
             // second add to electingFollowers, verifier.containsQuorum=true, waitForEpochAck returns without exceptions
             leader.waitForEpochAck(participantId, new StateSummary(0, 0));
-            assertEquals("Unexpected vote in electingFollowers", 2, leader.electingFollowers.size());
+            assertEquals(2, leader.electingFollowers.size(), "Unexpected vote in electingFollowers");
             assertTrue(leader.electionFinished);
         } catch (Exception e) {
             fail("Timed out in waitForEpochAck");
@@ -144,20 +144,22 @@ public void testWaitForNewLeaderAck() throws Exception {
         long zxid = leader.zk.getZxid();
 
         // things needed for waitForNewLeaderAck to run (usually in leader.lead(), but we're not running leader here)
-        leader.newLeaderProposal.packet = new QuorumPacket(0, zxid, null, null);
+        Field field = Leader.Proposal.class.getDeclaredField("packet");
+        field.setAccessible(true);
+        field.set(leader.newLeaderProposal, new QuorumPacket(0, zxid, null, null));
         leader.newLeaderProposal.addQuorumVerifier(peer.getQuorumVerifier());
 
         Set<Long> ackSet = leader.newLeaderProposal.qvAcksetPairs.get(0).getAckset();
-        assertEquals("Unexpected vote in ackSet", 0, ackSet.size());
+        assertEquals(0, ackSet.size(), "Unexpected vote in ackSet");
         assertFalse(leader.quorumFormed);
         try {
             // leader calls waitForNewLeaderAck, first add to ackSet
-            leader.waitForNewLeaderAck(peer.getId(), zxid);
+            leader.waitForNewLeaderAck(peer.getMyId(), zxid);
         } catch (InterruptedException e) {
             // ignore timeout
         }
 
-        assertEquals("Unexpected vote in ackSet", 1, ackSet.size());
+        assertEquals(1, ackSet.size(), "Unexpected vote in ackSet");
         assertFalse(leader.quorumFormed);
         try {
             // observer calls waitForNewLeaderAck, should fail verifier.containsQuorum
@@ -166,12 +168,12 @@ public void testWaitForNewLeaderAck() throws Exception {
             // ignore timeout
         }
 
-        assertEquals("Unexpected vote in ackSet", 1, ackSet.size());
+        assertEquals(1, ackSet.size(), "Unexpected vote in ackSet");
         assertFalse(leader.quorumFormed);
         try {
             // second add to ackSet, verifier.containsQuorum=true, waitForNewLeaderAck returns without exceptions
             leader.waitForNewLeaderAck(participantId, zxid);
-            assertEquals("Unexpected vote in ackSet", 2, ackSet.size());
+            assertEquals(2, ackSet.size(), "Unexpected vote in ackSet");
             assertTrue(leader.quorumFormed);
         } catch (Exception e) {
             fail("Timed out in waitForEpochAck");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerHandlerMetricsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerHandlerMetricsTest.java
index b6699d806fb..3b15e0cca35 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerHandlerMetricsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerHandlerMetricsTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.number.OrderingComparison.greaterThan;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.Mockito.doAnswer;
@@ -36,8 +36,8 @@
 import org.apache.jute.BinaryOutputArchive;
 import org.apache.zookeeper.metrics.MetricsUtils;
 import org.apache.zookeeper.server.ServerMetrics;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class LearnerHandlerMetricsTest {
 
@@ -53,7 +53,7 @@ class MockLearnerHandler extends LearnerHandler {
 
     }
 
-    @Before
+    @BeforeEach
     public void setup() throws IOException {
         Leader leader = mock(Leader.class);
         when(leader.getQuorumAuthServer()).thenReturn(null);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerHandlerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerHandlerTest.java
index 79b454a66e8..e38c82ea9f7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerHandlerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerHandlerTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 import java.io.BufferedInputStream;
@@ -38,8 +38,8 @@
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.server.quorum.Leader.Proposal;
 import org.apache.zookeeper.server.util.ZxidUtils;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.mockito.ArgumentMatchers;
 import org.mockito.invocation.InvocationOnMock;
 import org.mockito.stubbing.Answer;
@@ -73,8 +73,8 @@ class MockZKDatabase extends ZKDatabase {
 
         long lastProcessedZxid;
         ReentrantReadWriteLock lock = new ReentrantReadWriteLock();
-        LinkedList<Proposal> committedLog = new LinkedList<Leader.Proposal>();
-        LinkedList<Proposal> txnLog = new LinkedList<Leader.Proposal>();
+        LinkedList<Proposal> committedLog = new LinkedList<>();
+        LinkedList<Proposal> txnLog = new LinkedList<>();
 
         public MockZKDatabase(FileTxnSnapLog snapLog) {
             super(snapLog);
@@ -86,14 +86,14 @@ public long getDataTreeLastProcessedZxid() {
 
         public long getmaxCommittedLog() {
             if (!committedLog.isEmpty()) {
-                return committedLog.getLast().packet.getZxid();
+                return committedLog.getLast().getZxid();
             }
             return 0;
         }
 
         public long getminCommittedLog() {
             if (!committedLog.isEmpty()) {
-                return committedLog.getFirst().packet.getZxid();
+                return committedLog.getFirst().getZxid();
             }
             return 0;
         }
@@ -107,7 +107,7 @@ public ReentrantReadWriteLock getLogLock() {
         }
 
         public Iterator<Proposal> getProposalsFromTxnLog(long peerZxid, long limit) {
-            if (peerZxid >= txnLog.peekFirst().packet.getZxid()) {
+            if (peerZxid >= txnLog.peekFirst().getZxid()) {
                 return txnLog.iterator();
             } else {
                 return Collections.emptyIterator();
@@ -131,7 +131,7 @@ public long calculateTxnLogSizeLimit() {
     // Member variables for mocking ZkDatabase
     private MockZKDatabase db;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         db = new MockZKDatabase(null);
         sock = mock(Socket.class);
@@ -150,10 +150,10 @@ public Long answer(InvocationOnMock invocation) {
     }
 
     Proposal createProposal(long zxid) {
-        Proposal p = new Proposal();
-        p.packet = new QuorumPacket();
-        p.packet.setZxid(zxid);
-        p.packet.setType(Leader.PROPOSAL);
+        QuorumPacket packet = new QuorumPacket();
+        packet.setZxid(zxid);
+        packet.setType(Leader.PROPOSAL);
+        Proposal p = new Proposal(packet);
         return p;
     }
 
@@ -194,14 +194,11 @@ public void assertOpType(int type, long zxid, long currentZxid) {
     }
 
     void assertZxidEquals(long expected, long value) {
-        assertEquals("Expected 0x"
-                             + Long.toHexString(expected)
-                             + " but was 0x"
-                             + Long.toHexString(value), expected, value);
+        assertEquals(expected, value, "Expected 0x" + Long.toHexString(expected) + " but was 0x" + Long.toHexString(value));
     }
 
     /**
-     * Test cases when leader has empty commitedLog
+     * Test cases when leader has empty committedLog
      */
     @Test
     public void testEmptyCommittedLog() throws Exception {
@@ -330,7 +327,7 @@ public void testTxnLog() throws Exception {
     public void testTxnLogProposalIteratorClosure() throws Exception {
         long peerZxid;
 
-        // CommmitedLog is empty, we will use txnlog up to lastProcessZxid
+        // CommittedLog is empty, we will use txnlog up to lastProcessZxid
         db = new MockZKDatabase(null) {
             @Override
             public Iterator<Proposal> getProposalsFromTxnLog(long peerZxid, long limit) {
@@ -344,18 +341,18 @@ public Iterator<Proposal> getProposalsFromTxnLog(long peerZxid, long limit) {
 
         // Peer zxid
         peerZxid = 4;
-        assertTrue("Couldn't identify snapshot transfer!", learnerHandler.syncFollower(peerZxid, leader));
+        assertTrue(learnerHandler.syncFollower(peerZxid, leader), "Couldn't identify snapshot transfer!");
         reset();
     }
 
     /**
-     * Test cases when txnlog is enabled and commitedLog is empty
+     * Test cases when txnlog is enabled and committedLog is empty
      */
     @Test
     public void testTxnLogOnly() throws Exception {
         long peerZxid;
 
-        // CommmitedLog is empty, we will use txnlog up to lastProcessZxid
+        // CommittedLog is empty, we will use txnlog up to lastProcessZxid
         db.lastProcessedZxid = 7;
         db.txnLog.add(createProposal(2));
         db.txnLog.add(createProposal(3));
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerMetricsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerMetricsTest.java
index 659ba31f8a2..aa3ba3622ad 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerMetricsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerMetricsTest.java
@@ -20,62 +20,41 @@
 
 import static org.hamcrest.core.Is.is;
 import static org.hamcrest.number.OrderingComparison.greaterThanOrEqualTo;
-import java.util.Arrays;
-import java.util.Collection;
 import java.util.HashMap;
 import java.util.Map;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
-import org.apache.zookeeper.metrics.MetricsUtils;
 import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.test.ClientBase;
-import org.hamcrest.Matcher;
-import org.junit.After;
-import org.junit.AfterClass;
-import org.junit.Before;
-import org.junit.BeforeClass;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
-
-@RunWith(Parameterized.class)
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+
 public class LearnerMetricsTest extends QuorumPeerTestBase {
 
-    private static final int TIMEOUT_SECONDS = 30;
     private static final int SERVER_COUNT = 4; // 1 observer, 3 participants
     private final QuorumPeerTestBase.MainThread[] mt = new QuorumPeerTestBase.MainThread[SERVER_COUNT];
     private ZooKeeper zk_client;
-    private boolean asyncSending;
     private static boolean bakAsyncSending;
 
-    public LearnerMetricsTest(boolean asyncSending) {
-        this.asyncSending = asyncSending;
-    }
-
-    @Parameterized.Parameters
-    public static Collection sendingModes() {
-        return Arrays.asList(new Object[][]{{true}, {false}});
-    }
-
-    @Before
-    public void setAsyncSendingFlag() {
-        Learner.setAsyncSending(asyncSending);
-    }
-
-    @BeforeClass
+    @BeforeAll
     public static void saveAsyncSendingFlag() {
         bakAsyncSending = Learner.getAsyncSending();
     }
 
-    @AfterClass
+    @AfterAll
     public static void resetAsyncSendingFlag() {
         Learner.setAsyncSending(bakAsyncSending);
     }
 
-    @Test
-    public void testLearnerMetricsTest() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testLearnerMetricsTest(boolean asyncSending) throws Exception {
+        Learner.setAsyncSending(asyncSending);
         ServerMetrics.getMetrics().resetAll();
         ClientBase.setupTestEnv();
 
@@ -131,19 +110,7 @@ public void testLearnerMetricsTest() throws Exception {
         waitForMetric("min_commit_propagation_latency", greaterThanOrEqualTo(0L));
     }
 
-    private void waitForMetric(final String metricKey, final Matcher<Long> matcher) throws InterruptedException {
-        final String errorMessage = String.format("unable to match on metric: %s", metricKey);
-        waitFor(errorMessage, () -> {
-            long actual = (long) MetricsUtils.currentServerMetrics().get(metricKey);
-            if (!matcher.matches(actual)) {
-                LOG.info("match failed on {}, actual value: {}", metricKey, actual);
-                return false;
-            }
-            return true;
-        }, TIMEOUT_SECONDS);
-    }
-
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         zk_client.close();
         for (int i = 0; i < SERVER_COUNT; i++) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerSyncThrottlerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerSyncThrottlerTest.java
index 9c6385e4184..51d80c2c219 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerSyncThrottlerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerSyncThrottlerTest.java
@@ -18,12 +18,11 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collection;
 import java.util.List;
 import java.util.concurrent.Callable;
 import java.util.concurrent.CountDownLatch;
@@ -31,50 +30,46 @@
 import java.util.concurrent.Executors;
 import java.util.concurrent.Future;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.EnumSource;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-@RunWith(Parameterized.class)
 public class LearnerSyncThrottlerTest extends ZKTestCase {
 
     private static final Logger LOG = LoggerFactory.getLogger(LearnerSyncThrottlerTest.class);
 
-    private LearnerSyncThrottler.SyncType syncType;
-    public LearnerSyncThrottlerTest(LearnerSyncThrottler.SyncType syncType) {
-        this.syncType = syncType;
-    }
-
-    @Parameterized.Parameters
-    public static Collection syncTypes() {
-        return Arrays.asList(new Object[][]{{LearnerSyncThrottler.SyncType.DIFF}, {LearnerSyncThrottler.SyncType.SNAP}});
-    }
-    @Test(expected = SyncThrottleException.class)
-    public void testTooManySyncsNonessential() throws Exception {
-        LearnerSyncThrottler throttler = new LearnerSyncThrottler(5, syncType);
-        for (int i = 0; i < 6; i++) {
-            throttler.beginSync(false);
-        }
+    @ParameterizedTest
+    @EnumSource(LearnerSyncThrottler.SyncType.class)
+    public void testTooManySyncsNonessential(LearnerSyncThrottler.SyncType syncType) {
+        assertThrows(SyncThrottleException.class, () -> {
+            LearnerSyncThrottler throttler = new LearnerSyncThrottler(5, syncType);
+            for (int i = 0; i < 6; i++) {
+                throttler.beginSync(false);
+            }
+        });
     }
 
-    @Test(expected = SyncThrottleException.class)
-    public void testTooManySyncsEssential() throws Exception {
-        LearnerSyncThrottler throttler = new LearnerSyncThrottler(5, syncType);
-        try {
-            for (int i = 0; i < 6; i++) {
-                throttler.beginSync(true);
+    @ParameterizedTest
+    @EnumSource(LearnerSyncThrottler.SyncType.class)
+    public void testTooManySyncsEssential(LearnerSyncThrottler.SyncType syncType) {
+        assertThrows(SyncThrottleException.class, () -> {
+            LearnerSyncThrottler throttler = new LearnerSyncThrottler(5, syncType);
+            try {
+                for (int i = 0; i < 6; i++) {
+                    throttler.beginSync(true);
+                }
+            } catch (SyncThrottleException ex) {
+                fail("essential syncs should not be throttled");
             }
-        } catch (SyncThrottleException ex) {
-            fail("essential syncs should not be throttled");
-        }
-        throttler.endSync();
-        throttler.beginSync(false);
+            throttler.endSync();
+            throttler.beginSync(false);
+        });
     }
 
-    @Test
-    public void testNoThrottle() throws Exception {
+    @ParameterizedTest
+    @EnumSource(LearnerSyncThrottler.SyncType.class)
+    public void testNoThrottle(LearnerSyncThrottler.SyncType syncType) throws Exception {
         LearnerSyncThrottler throttler = new LearnerSyncThrottler(5, syncType);
         try {
             for (int i = 0; i < 6; i++) {
@@ -88,11 +83,12 @@ public void testNoThrottle() throws Exception {
             throttler.endSync();
             throttler.beginSync(false);
         }
-        assertTrue("should get here without exception", true);
+        assertTrue(true, "should get here without exception");
     }
 
-    @Test
-    public void testTryWithResourceNoThrottle() throws Exception {
+    @ParameterizedTest
+    @EnumSource(LearnerSyncThrottler.SyncType.class)
+    public void testTryWithResourceNoThrottle(LearnerSyncThrottler.SyncType syncType) throws Exception {
         LearnerSyncThrottler throttler = new LearnerSyncThrottler(1, syncType);
         for (int i = 0; i < 3; i++) {
             throttler.beginSync(false);
@@ -104,8 +100,9 @@ public void testTryWithResourceNoThrottle() throws Exception {
         }
     }
 
-    @Test
-    public void testTryWithResourceThrottle() throws Exception {
+    @ParameterizedTest
+    @EnumSource(LearnerSyncThrottler.SyncType.class)
+    public void testTryWithResourceThrottle(LearnerSyncThrottler.SyncType syncType) throws Exception {
         LearnerSyncThrottler throttler = new LearnerSyncThrottler(1, syncType);
         try {
             throttler.beginSync(true);
@@ -120,8 +117,9 @@ public void testTryWithResourceThrottle() throws Exception {
         }
     }
 
-    @Test
-    public void testParallelNoThrottle() {
+    @ParameterizedTest
+    @EnumSource(LearnerSyncThrottler.SyncType.class)
+    public void testParallelNoThrottle(LearnerSyncThrottler.SyncType syncType) {
         final int numThreads = 50;
 
         final LearnerSyncThrottler throttler = new LearnerSyncThrottler(numThreads, syncType);
@@ -129,7 +127,7 @@ public void testParallelNoThrottle() {
         final CountDownLatch threadStartLatch = new CountDownLatch(numThreads);
         final CountDownLatch syncProgressLatch = new CountDownLatch(numThreads);
 
-        List<Future<Boolean>> results = new ArrayList<Future<Boolean>>(numThreads);
+        List<Future<Boolean>> results = new ArrayList<>(numThreads);
         for (int i = 0; i < numThreads; i++) {
             results.add(threadPool.submit(new Callable<Boolean>() {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerTest.java
index 97ab5a26f97..d64d051b093 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LearnerTest.java
@@ -22,10 +22,11 @@
 import static java.util.Collections.emptySet;
 import static org.hamcrest.CoreMatchers.equalTo;
 import static org.hamcrest.CoreMatchers.is;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertThat;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 import java.io.BufferedOutputStream;
@@ -49,12 +50,12 @@
 import org.apache.zookeeper.server.ExitCode;
 import org.apache.zookeeper.server.ZKDatabase;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
-import org.apache.zookeeper.test.TestUtils;
 import org.apache.zookeeper.txn.CreateTxn;
 import org.apache.zookeeper.txn.TxnHeader;
 import org.apache.zookeeper.util.ServiceUtils;
-import org.junit.After;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 
 public class LearnerTest extends ZKTestCase {
 
@@ -135,24 +136,26 @@ protected Socket createSocket() throws X509Exception, IOException {
         }
     }
 
-    @After
+    @AfterEach
     public void cleanup() {
         System.clearProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_ENABLED);
     }
 
-    @Test(expected = IOException.class)
+    @Test
     public void connectionRetryTimeoutTest() throws Exception {
-        Learner learner = new TestLearner();
-        learner.self = new QuorumPeer();
-        learner.self.setTickTime(2000);
-        learner.self.setInitLimit(5);
-        learner.self.setSyncLimit(2);
+        assertThrows(IOException.class, () -> {
+            Learner learner = new TestLearner();
+            learner.self = new QuorumPeer();
+            learner.self.setTickTime(2000);
+            learner.self.setInitLimit(5);
+            learner.self.setSyncLimit(2);
 
-        // this addr won't even be used since we fake the Socket.connect
-        InetSocketAddress addr = new InetSocketAddress(1111);
+            // this addr won't even be used since we fake the Socket.connect
+            InetSocketAddress addr = new InetSocketAddress(1111);
 
-        // we expect this to throw an IOException since we're faking socket connect errors every time
-        learner.connectToLeader(new MultipleAddresses(addr), "");
+            // we expect this to throw an IOException since we're faking socket connect errors every time
+            learner.connectToLeader(new MultipleAddresses(addr), "");
+        });
     }
 
     @Test
@@ -240,7 +243,7 @@ public void multipleAddressesSomeAreFailing() throws Exception {
         // we expect this to not throw an IOException since there is a single working address
         learner.connectToLeader(new MultipleAddresses(asList(addrBadA, addrBadB, addrBadC, addrWorking)), "");
 
-        assertEquals("Learner connected to the wrong address", learner.getSocket(), mockSocket);
+        assertEquals(learner.getSocket(), mockSocket, "Learner connected to the wrong address");
     }
 
     @Test
@@ -266,56 +269,52 @@ public void connectToLearnerMasterLimitTest() throws Exception {
     }
 
     @Test
-    public void syncTest() throws Exception {
-        File tmpFile = File.createTempFile("test", ".dir", testData);
+    public void syncTest(@TempDir File tmpDir) throws Exception {
+        File tmpFile = File.createTempFile("test", ".dir", tmpDir);
         tmpFile.delete();
-        try {
-            FileTxnSnapLog ftsl = new FileTxnSnapLog(tmpFile, tmpFile);
-            SimpleLearner sl = new SimpleLearner(ftsl);
-            long startZxid = sl.zk.getLastProcessedZxid();
-
-            // Set up bogus streams
-            ByteArrayOutputStream baos = new ByteArrayOutputStream();
-            BinaryOutputArchive oa = BinaryOutputArchive.getArchive(baos);
-            sl.leaderOs = BinaryOutputArchive.getArchive(new ByteArrayOutputStream());
-
-            // make streams and socket do something innocuous
-            sl.bufferedOutput = new BufferedOutputStream(System.out);
-            sl.sock = new Socket();
-
-            // fake messages from the server
-            QuorumPacket qp = new QuorumPacket(Leader.SNAP, 0, null, null);
-            oa.writeRecord(qp, null);
-            sl.zk.getZKDatabase().serializeSnapshot(oa);
-            oa.writeString("BenWasHere", "signature");
-            TxnHeader hdr = new TxnHeader(0, 0, 0, 0, ZooDefs.OpCode.create);
-            CreateTxn txn = new CreateTxn("/foo", new byte[0], new ArrayList<ACL>(), false, sl.zk.getZKDatabase().getNode("/").stat.getCversion());
-            ByteArrayOutputStream tbaos = new ByteArrayOutputStream();
-            BinaryOutputArchive boa = BinaryOutputArchive.getArchive(tbaos);
-            hdr.serialize(boa, "hdr");
-            txn.serialize(boa, "txn");
-            tbaos.close();
-            qp = new QuorumPacket(Leader.PROPOSAL, 1, tbaos.toByteArray(), null);
-            oa.writeRecord(qp, null);
-
-            // setup the messages to be streamed to follower
-            sl.leaderIs = BinaryInputArchive.getArchive(new ByteArrayInputStream(baos.toByteArray()));
-
-            try {
-                sl.syncWithLeader(3);
-            } catch (EOFException e) {
-            }
+        FileTxnSnapLog ftsl = new FileTxnSnapLog(tmpFile, tmpFile);
+        SimpleLearner sl = new SimpleLearner(ftsl);
+        long startZxid = sl.zk.getLastProcessedZxid();
+
+        // Set up bogus streams
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        BinaryOutputArchive oa = BinaryOutputArchive.getArchive(baos);
+        sl.leaderOs = BinaryOutputArchive.getArchive(new ByteArrayOutputStream());
+
+        // make streams and socket do something innocuous
+        sl.bufferedOutput = new BufferedOutputStream(System.out);
+        sl.sock = new Socket();
+
+        // fake messages from the server
+        QuorumPacket qp = new QuorumPacket(Leader.SNAP, 0, null, null);
+        oa.writeRecord(qp, null);
+        sl.zk.getZKDatabase().serializeSnapshot(oa);
+        oa.writeString("BenWasHere", "signature");
+        TxnHeader hdr = new TxnHeader(0, 0, 0, 0, ZooDefs.OpCode.create);
+        CreateTxn txn = new CreateTxn("/foo", new byte[0], new ArrayList<ACL>(), false, sl.zk.getZKDatabase().getNode("/").stat.getCversion());
+        ByteArrayOutputStream tbaos = new ByteArrayOutputStream();
+        BinaryOutputArchive boa = BinaryOutputArchive.getArchive(tbaos);
+        hdr.serialize(boa, "hdr");
+        txn.serialize(boa, "txn");
+        tbaos.close();
+        qp = new QuorumPacket(Leader.PROPOSAL, 1, tbaos.toByteArray(), null);
+        oa.writeRecord(qp, null);
+
+        // setup the messages to be streamed to follower
+        sl.leaderIs = BinaryInputArchive.getArchive(new ByteArrayInputStream(baos.toByteArray()));
 
-            sl.zk.shutdown();
-            sl = new SimpleLearner(ftsl);
-            assertEquals(startZxid, sl.zk.getLastProcessedZxid());
-        } finally {
-            TestUtils.deleteFileRecursively(tmpFile);
+        try {
+            sl.syncWithLeader(3);
+        } catch (EOFException e) {
         }
+
+        sl.zk.shutdown();
+        sl = new SimpleLearner(ftsl);
+        assertEquals(startZxid, sl.zk.getLastProcessedZxid());
     }
 
     @Test
-    public void truncFailTest() throws Exception {
+    public void truncFailTest(@TempDir File tmpDir) throws Exception {
         final boolean[] exitProcCalled = {false};
 
         ServiceUtils.setSystemExitProcedure(new Consumer<Integer>() {
@@ -326,39 +325,35 @@ public void accept(Integer exitCode) {
             }
         });
 
-        File tmpFile = File.createTempFile("test", ".dir", testData);
+        File tmpFile = File.createTempFile("test", ".dir", tmpDir);
         tmpFile.delete();
-        try {
-            FileTxnSnapLog txnSnapLog = new FileTxnSnapLog(tmpFile, tmpFile);
-            SimpleLearner sl = new SimpleLearner(txnSnapLog);
-            long startZxid = sl.zk.getLastProcessedZxid();
+        FileTxnSnapLog txnSnapLog = new FileTxnSnapLog(tmpFile, tmpFile);
+        SimpleLearner sl = new SimpleLearner(txnSnapLog);
+        long startZxid = sl.zk.getLastProcessedZxid();
 
-            // Set up bogus streams
-            ByteArrayOutputStream baos = new ByteArrayOutputStream();
-            BinaryOutputArchive oa = BinaryOutputArchive.getArchive(baos);
-            sl.leaderOs = BinaryOutputArchive.getArchive(new ByteArrayOutputStream());
+        // Set up bogus streams
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        BinaryOutputArchive oa = BinaryOutputArchive.getArchive(baos);
+        sl.leaderOs = BinaryOutputArchive.getArchive(new ByteArrayOutputStream());
 
-            // make streams and socket do something innocuous
-            sl.bufferedOutput = new BufferedOutputStream(System.out);
-            sl.sock = new Socket();
+        // make streams and socket do something innocuous
+        sl.bufferedOutput = new BufferedOutputStream(System.out);
+        sl.sock = new Socket();
 
-            // fake messages from the server
-            QuorumPacket qp = new QuorumPacket(Leader.TRUNC, 0, null, null);
-            oa.writeRecord(qp, null);
+        // fake messages from the server
+        QuorumPacket qp = new QuorumPacket(Leader.TRUNC, 0, null, null);
+        oa.writeRecord(qp, null);
 
-            // setup the messages to be streamed to follower
-            sl.leaderIs = BinaryInputArchive.getArchive(new ByteArrayInputStream(baos.toByteArray()));
+        // setup the messages to be streamed to follower
+        sl.leaderIs = BinaryInputArchive.getArchive(new ByteArrayInputStream(baos.toByteArray()));
 
-            try {
-                sl.syncWithLeader(3);
-            } catch (EOFException e) {
-            }
+        try {
+            sl.syncWithLeader(3);
+        } catch (EOFException e) {
+        }
 
-            sl.zk.shutdown();
+        sl.zk.shutdown();
 
-            assertThat("System.exit() should have been called", exitProcCalled[0], is(true));
-        } finally {
-            TestUtils.deleteFileRecursively(tmpFile);
-        }
+        assertThat("System.exit() should have been called", exitProcCalled[0], is(true));
     }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LocalPeerBeanTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LocalPeerBeanTest.java
index c15fd5b9ec5..74d4370732e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LocalPeerBeanTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/LocalPeerBeanTest.java
@@ -18,10 +18,10 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
@@ -29,7 +29,7 @@
 import java.net.InetSocketAddress;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.server.ServerCnxnFactory;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class LocalPeerBeanTest {
 
@@ -85,7 +85,7 @@ public void testClientAddress() throws Exception {
     public void testLocalPeerIsLeader() throws Exception {
         long localPeerId = 7;
         QuorumPeer peer = mock(QuorumPeer.class);
-        when(peer.getId()).thenReturn(localPeerId);
+        when(peer.getMyId()).thenReturn(localPeerId);
         when(peer.isLeader(eq(localPeerId))).thenReturn(true);
         LocalPeerBean localPeerBean = new LocalPeerBean(peer);
         assertTrue(localPeerBean.isLeader());
@@ -95,7 +95,7 @@ public void testLocalPeerIsLeader() throws Exception {
     public void testLocalPeerIsNotLeader() throws Exception {
         long localPeerId = 7;
         QuorumPeer peer = mock(QuorumPeer.class);
-        when(peer.getId()).thenReturn(localPeerId);
+        when(peer.getMyId()).thenReturn(localPeerId);
         when(peer.isLeader(eq(localPeerId))).thenReturn(false);
         LocalPeerBean localPeerBean = new LocalPeerBean(peer);
         assertFalse(localPeerBean.isLeader());
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/MultipleAddressesTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/MultipleAddressesTest.java
index 0e1615df9f5..61c753f7789 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/MultipleAddressesTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/MultipleAddressesTest.java
@@ -18,6 +18,11 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
 import java.net.NoRouteToHostException;
@@ -30,10 +35,9 @@
 import java.util.Set;
 import java.util.stream.Collectors;
 import java.util.stream.IntStream;
-import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.collections4.CollectionUtils;
 import org.apache.zookeeper.PortAssignment;
-import org.junit.Assert;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class MultipleAddressesTest {
 
@@ -42,21 +46,20 @@ public class MultipleAddressesTest {
     @Test
     public void testIsEmpty() {
         MultipleAddresses multipleAddresses = new MultipleAddresses();
-        Assert.assertTrue(multipleAddresses.isEmpty());
+        assertTrue(multipleAddresses.isEmpty());
 
         multipleAddresses.addAddress(new InetSocketAddress(22));
-        Assert.assertFalse(multipleAddresses.isEmpty());
+        assertFalse(multipleAddresses.isEmpty());
     }
 
     @Test
     public void testGetAllAddresses() {
         List<InetSocketAddress> addresses = getAddressList();
         MultipleAddresses multipleAddresses = new MultipleAddresses(addresses);
-
-        Assert.assertTrue(CollectionUtils.isEqualCollection(addresses, multipleAddresses.getAllAddresses()));
+        assertTrue(CollectionUtils.isEqualCollection(addresses, multipleAddresses.getAllAddresses()));
 
         multipleAddresses.addAddress(addresses.get(1));
-        Assert.assertTrue(CollectionUtils.isEqualCollection(addresses, multipleAddresses.getAllAddresses()));
+        assertTrue(CollectionUtils.isEqualCollection(addresses, multipleAddresses.getAllAddresses()));
     }
 
     @Test
@@ -65,10 +68,10 @@ public void testGetAllHostStrings() {
         List<String> hostStrings = getHostStrings(addresses);
         MultipleAddresses multipleAddresses = new MultipleAddresses(addresses);
 
-        Assert.assertTrue(CollectionUtils.isEqualCollection(hostStrings, multipleAddresses.getAllHostStrings()));
+        assertTrue(CollectionUtils.isEqualCollection(hostStrings, multipleAddresses.getAllHostStrings()));
 
         multipleAddresses.addAddress(addresses.get(addresses.size() - 1));
-        Assert.assertTrue(CollectionUtils.isEqualCollection(hostStrings, multipleAddresses.getAllHostStrings()));
+        assertTrue(CollectionUtils.isEqualCollection(hostStrings, multipleAddresses.getAllHostStrings()));
     }
 
     @Test
@@ -76,10 +79,10 @@ public void testGetAllPorts() {
         List<Integer> ports = getPortList();
         MultipleAddresses multipleAddresses = new MultipleAddresses(getAddressList(ports));
 
-        Assert.assertTrue(CollectionUtils.isEqualCollection(ports, multipleAddresses.getAllPorts()));
+        assertTrue(CollectionUtils.isEqualCollection(ports, multipleAddresses.getAllPorts()));
 
         multipleAddresses.addAddress(new InetSocketAddress("localhost", ports.get(ports.size() - 1)));
-        Assert.assertTrue(CollectionUtils.isEqualCollection(ports, multipleAddresses.getAllPorts()));
+        assertTrue(CollectionUtils.isEqualCollection(ports, multipleAddresses.getAllPorts()));
     }
 
     @Test
@@ -89,10 +92,10 @@ public void testGetWildcardAddresses() {
         MultipleAddresses multipleAddresses = new MultipleAddresses(addresses);
         List<InetSocketAddress> allAddresses = ports.stream().map(InetSocketAddress::new).collect(Collectors.toList());
 
-        Assert.assertTrue(CollectionUtils.isEqualCollection(allAddresses, multipleAddresses.getWildcardAddresses()));
+        assertTrue(CollectionUtils.isEqualCollection(allAddresses, multipleAddresses.getWildcardAddresses()));
 
         multipleAddresses.addAddress(new InetSocketAddress("localhost", ports.get(ports.size() - 1)));
-        Assert.assertTrue(CollectionUtils.isEqualCollection(allAddresses, multipleAddresses.getWildcardAddresses()));
+        assertTrue(CollectionUtils.isEqualCollection(allAddresses, multipleAddresses.getWildcardAddresses()));
     }
 
     @Test
@@ -100,13 +103,16 @@ public void testGetValidAddress() throws NoRouteToHostException {
         List<InetSocketAddress> addresses = getAddressList();
         MultipleAddresses multipleAddresses = new MultipleAddresses(addresses);
 
-        Assert.assertTrue(addresses.contains(multipleAddresses.getReachableAddress()));
+        assertTrue(addresses.contains(multipleAddresses.getReachableAddress()));
     }
 
-    @Test(expected = NoRouteToHostException.class)
-    public void testGetValidAddressWithNotValid() throws NoRouteToHostException {
-        MultipleAddresses multipleAddresses = new MultipleAddresses(new InetSocketAddress("10.0.0.1", 22));
-        multipleAddresses.getReachableAddress();
+    @Test
+    public void testGetValidAddressWithNotValid() {
+        assertThrows(NoRouteToHostException.class, () -> {
+            // IP chosen because it is reserved for documentation/examples and should be unreachable (RFC 5737)
+            MultipleAddresses multipleAddresses = new MultipleAddresses(new InetSocketAddress("203.0.113.1", 22));
+            multipleAddresses.getReachableAddress();
+        });
     }
 
     @Test
@@ -116,7 +122,7 @@ public void testGetReachableOrOneWithSingleReachableAddress() {
         MultipleAddresses multipleAddresses = new MultipleAddresses(Collections.singletonList(reachableAddress));
         InetSocketAddress actualReturnedAddress = multipleAddresses.getReachableOrOne();
 
-        Assert.assertEquals(reachableAddress, actualReturnedAddress);
+        assertEquals(reachableAddress, actualReturnedAddress);
     }
 
     @Test
@@ -126,7 +132,7 @@ public void testGetReachableOrOneWithSingleUnreachableAddress() {
         MultipleAddresses multipleAddresses = new MultipleAddresses(Collections.singletonList(unreachableAddress));
         InetSocketAddress actualReturnedAddress = multipleAddresses.getReachableOrOne();
 
-        Assert.assertEquals(unreachableAddress, actualReturnedAddress);
+        assertEquals(unreachableAddress, actualReturnedAddress);
     }
 
     @Test
@@ -137,14 +143,14 @@ public void testRecreateSocketAddresses() throws UnknownHostException {
         MultipleAddresses multipleAddresses = new MultipleAddresses(searchedAddresses.get(searchedAddresses.size() - 1));
         List<InetSocketAddress> addresses = new ArrayList<>(multipleAddresses.getAllAddresses());
 
-        Assert.assertEquals(1, addresses.size());
-        Assert.assertEquals(searchedAddresses.get(searchedAddresses.size() - 1), addresses.get(0));
+        assertEquals(1, addresses.size());
+        assertEquals(searchedAddresses.get(searchedAddresses.size() - 1), addresses.get(0));
 
         multipleAddresses.recreateSocketAddresses();
 
         addresses = new ArrayList<>(multipleAddresses.getAllAddresses());
-        Assert.assertEquals(1, addresses.size());
-        Assert.assertEquals(searchedAddresses.get(0), addresses.get(0));
+        assertEquals(1, addresses.size());
+        assertEquals(searchedAddresses.get(0), addresses.get(0));
     }
 
     @Test
@@ -153,7 +159,7 @@ public void testRecreateSocketAddressesWithWrongAddresses() {
         MultipleAddresses multipleAddresses = new MultipleAddresses(address);
         multipleAddresses.recreateSocketAddresses();
 
-        Assert.assertEquals(address, multipleAddresses.getOne());
+        assertEquals(address, multipleAddresses.getOne());
     }
 
     @Test
@@ -169,7 +175,7 @@ public void testAlwaysGetReachableAddress() throws Exception{
         // we call the getReachableAddress() function multiple times, to make sure we
         // always got back a reachable address and not just a random one
         for (int i = 0; i < 10; i++) {
-            Assert.assertEquals(reachableHost, multipleAddresses.getReachableAddress());
+            assertEquals(reachableHost, multipleAddresses.getReachableAddress());
         }
     }
 
@@ -184,7 +190,7 @@ public void testGetAllReachableAddresses() throws Exception {
           Arrays.asList(unreachableHost1, unreachableHost2, reachableHost1, reachableHost2));
 
         Set<InetSocketAddress> reachableHosts = new HashSet<>(Arrays.asList(reachableHost1, reachableHost2));
-        Assert.assertEquals(reachableHosts, multipleAddresses.getAllReachableAddresses());
+        assertEquals(reachableHosts, multipleAddresses.getAllReachableAddresses());
     }
 
     @Test
@@ -198,7 +204,7 @@ public void testGetAllReachableAddressesOrAllWhenSomeReachable() throws Exceptio
           Arrays.asList(unreachableHost1, unreachableHost2, reachableHost1, reachableHost2));
 
         Set<InetSocketAddress> reachableHosts = new HashSet<>(Arrays.asList(reachableHost1, reachableHost2));
-        Assert.assertEquals(reachableHosts, multipleAddresses.getAllReachableAddressesOrAll());
+        assertEquals(reachableHosts, multipleAddresses.getAllReachableAddressesOrAll());
     }
 
     @Test
@@ -210,7 +216,7 @@ public void testGetAllReachableAddressesOrAllWhenNoneReachable() throws Exceptio
 
         MultipleAddresses multipleAddresses = new MultipleAddresses(allUnreachableAddresses);
 
-        Assert.assertEquals(new HashSet<>(allUnreachableAddresses), multipleAddresses.getAllReachableAddressesOrAll());
+        assertEquals(new HashSet<>(allUnreachableAddresses), multipleAddresses.getAllReachableAddressesOrAll());
     }
 
     @Test
@@ -220,11 +226,11 @@ public void testEquals() {
         MultipleAddresses multipleAddresses = new MultipleAddresses(addresses);
         MultipleAddresses multipleAddressesEquals = new MultipleAddresses(addresses);
 
-        Assert.assertEquals(multipleAddresses, multipleAddressesEquals);
+        assertEquals(multipleAddresses, multipleAddressesEquals);
 
         MultipleAddresses multipleAddressesNotEquals = new MultipleAddresses(getAddressList());
 
-        Assert.assertNotEquals(multipleAddresses, multipleAddressesNotEquals);
+        assertNotEquals(multipleAddresses, multipleAddressesNotEquals);
     }
 
     @Test
@@ -232,7 +238,7 @@ public void testSize() {
         List<InetSocketAddress> addresses = getAddressList();
         MultipleAddresses multipleAddresses = new MultipleAddresses(addresses);
 
-        Assert.assertEquals(PORTS_AMOUNT, multipleAddresses.size());
+        assertEquals(PORTS_AMOUNT, multipleAddresses.size());
     }
 
     public List<Integer> getPortList() {
@@ -253,4 +259,4 @@ private List<String> getHostStrings(List<InetSocketAddress> addresses) {
                 .mapToObj(i -> "127.0.0." + i).collect(Collectors.toList());
     }
 
-}
\ No newline at end of file
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumBeanTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumBeanTest.java
index 0f9a8accb1b..62847461d16 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumBeanTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumBeanTest.java
@@ -22,14 +22,14 @@
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class QuorumBeanTest {
 
     @Test
     public void testGetNameProperty() {
         QuorumPeer qpMock = mock(QuorumPeer.class);
-        when(qpMock.getId()).thenReturn(1L);
+        when(qpMock.getMyId()).thenReturn(1L);
         QuorumBean qb = new QuorumBean(qpMock);
 
         assertThat("getName property should return Bean name in the right format", qb.getName(), equalTo("ReplicatedServer_id1"));
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumCanonicalizeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumCanonicalizeTest.java
new file mode 100644
index 00000000000..346a2baeddc
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumCanonicalizeTest.java
@@ -0,0 +1,119 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.quorum;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import java.net.InetAddress;
+import java.net.InetSocketAddress;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.common.ConfigException;
+import org.burningwave.tools.net.DefaultHostResolver;
+import org.burningwave.tools.net.HostResolutionRequestInterceptor;
+import org.burningwave.tools.net.MappedHostResolver;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+
+public class QuorumCanonicalizeTest extends ZKTestCase {
+
+    private static final InetSocketAddress SA_DONT_CARE = InetSocketAddress.createUnresolved("dont.care.invalid", 80);
+
+    private static final String ZK1_ALIAS = "zookeeper.invalid";
+    private static final String ZK1_FQDN = "zk1.invalid";
+    private static final String ZK1_IP = "169.254.0.42";
+    private static InetAddress IA_MOCK_ZK1;
+
+    @BeforeAll
+    public static void setupDNSMocks() throws Exception {
+        Map<String, String> hostAliases = new LinkedHashMap<>();
+        hostAliases.put(ZK1_FQDN, ZK1_IP);
+        hostAliases.put(ZK1_ALIAS, ZK1_IP);
+
+        HostResolutionRequestInterceptor.INSTANCE.install(
+                new MappedHostResolver(hostAliases),
+                DefaultHostResolver.INSTANCE
+        );
+
+        InetAddress ia = InetAddress.getByName(ZK1_FQDN);
+        IA_MOCK_ZK1 = ia;
+    }
+
+    @AfterAll
+    public static void clearDNSMocks() {
+        HostResolutionRequestInterceptor.INSTANCE.uninstall();
+    }
+
+    private static InetAddress getInetAddress(InetSocketAddress addr) {
+        if (addr.getHostName().equals(ZK1_ALIAS) || addr.getHostName().equals(ZK1_IP)) {
+            return IA_MOCK_ZK1;
+        }
+
+        return addr.getAddress();
+    };
+
+    @AfterEach
+    public void cleanUpEnvironment() {
+        System.clearProperty(QuorumPeer.CONFIG_KEY_KERBEROS_CANONICALIZE_HOST_NAMES);
+    }
+
+    private QuorumPeer.QuorumServer createQuorumServer(String hostName) throws ConfigException {
+        return new QuorumPeer.QuorumServer(0, hostName + ":1234:5678", QuorumCanonicalizeTest::getInetAddress);
+    }
+
+    @Test
+    public void testQuorumDefaultCanonicalization() throws ConfigException {
+        QuorumPeer.QuorumServer qps = createQuorumServer(ZK1_ALIAS);
+
+        assertEquals(ZK1_ALIAS, qps.hostname,
+           "The host name has been \"changed\" (canonicalized?) despite default settings");
+    }
+
+    @Test
+    public void testQuorumNoCanonicalization() throws ConfigException {
+        System.setProperty(QuorumPeer.CONFIG_KEY_KERBEROS_CANONICALIZE_HOST_NAMES, Boolean.FALSE.toString());
+
+        QuorumPeer.QuorumServer qps = createQuorumServer(ZK1_ALIAS);
+
+        assertEquals(ZK1_ALIAS, qps.hostname,
+           "The host name has been \"changed\" (canonicalized?) despite default settings");
+    }
+
+    @Test
+    public void testQuorumCanonicalization() throws ConfigException {
+        System.setProperty(QuorumPeer.CONFIG_KEY_KERBEROS_CANONICALIZE_HOST_NAMES, Boolean.TRUE.toString());
+
+        QuorumPeer.QuorumServer qps = createQuorumServer(ZK1_ALIAS);
+
+        assertEquals(ZK1_FQDN, qps.hostname,
+            "The host name hasn't been correctly canonicalized");
+    }
+
+    @Test
+    public void testQuorumCanonicalizationFromIp() throws ConfigException {
+        System.setProperty(QuorumPeer.CONFIG_KEY_KERBEROS_CANONICALIZE_HOST_NAMES, Boolean.TRUE.toString());
+
+        QuorumPeer.QuorumServer qps = createQuorumServer(ZK1_IP);
+
+        assertEquals(ZK1_FQDN, qps.hostname,
+            "The host name hasn't been correctly canonicalized");
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumCnxManagerSocketConnectionTimeoutTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumCnxManagerSocketConnectionTimeoutTest.java
new file mode 100644
index 00000000000..b907bbe1036
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumCnxManagerSocketConnectionTimeoutTest.java
@@ -0,0 +1,111 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.quorum;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.io.IOException;
+import java.net.InetSocketAddress;
+import java.net.Socket;
+import java.net.SocketAddress;
+import java.net.SocketTimeoutException;
+import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.test.ClientBase;
+import org.apache.zookeeper.test.QuorumUtil;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class QuorumCnxManagerSocketConnectionTimeoutTest extends ZKTestCase {
+
+    private static final Logger LOG = LoggerFactory.getLogger(QuorumCnxManagerSocketConnectionTimeoutTest.class);
+    private QuorumUtil qu;
+
+    @BeforeEach
+    public void setUp() throws Exception {
+        // starting a 3 node ensemble without observers
+        qu = new QuorumUtil(1, 2);
+        qu.startAll();
+    }
+
+    /**
+     * Testing an error case reported in ZOOKEEPER-3756:
+     *
+     * When a new leader election happens after a ZooKeeper server restarted, in Kubernetes
+     * the rest of the servers can not initiate connection to the restarted one. But they
+     * get SocketTimeoutException instead of immediate IOException. The Leader Election was
+     * time-outing quicker than the socket.connect call, so we ended up with cycles of broken
+     * leader elections.
+     *
+     * The fix was to make the connection initiation asynchronous, so one 'broken' connection
+     * doesn't make the whole leader election to be blocked, even in case of SocketTimeoutException.
+     *
+     * @throws Exception
+     */
+    @Test
+    public void testSocketConnectionTimeoutDuringConnectingToElectionAddress() throws Exception {
+
+        int leaderId = qu.getLeaderServer();
+
+        // use a custom socket factory that will cause timeout instead of connecting to the
+        // leader election port of the current leader
+        final InetSocketAddress leaderElectionAddress =
+            qu.getLeaderQuorumPeer().getElectionAddress().getOne();
+        QuorumCnxManager.setSocketFactory(() -> new SocketStub(leaderElectionAddress));
+
+        qu.shutdown(leaderId);
+
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + qu.getPeer(leaderId).clientPort, ClientBase.CONNECTION_TIMEOUT),
+                "Timeout during waiting for current leader to go down");
+
+        String errorMessage = "No new leader was elected";
+        waitFor(errorMessage, () -> qu.leaderExists() && qu.getLeaderServer() != leaderId, 15);
+    }
+
+    final class SocketStub extends Socket {
+
+        private final InetSocketAddress addressToTimeout;
+
+        SocketStub(InetSocketAddress addressToTimeout) {
+            this.addressToTimeout = addressToTimeout;
+        }
+
+        @Override
+        public void connect(SocketAddress endpoint, int timeout) throws IOException {
+            if (addressToTimeout.equals(endpoint)) {
+                try {
+                    Thread.sleep(timeout);
+                } catch (InterruptedException e) {
+                    LOG.warn("interrupted SocketStub.connect", e);
+                }
+                throw new SocketTimeoutException("timeout reached in SocketStub.connect()");
+            }
+
+            super.connect(endpoint, timeout);
+        }
+    }
+
+    @AfterEach
+    public void tearDown() throws Exception {
+        qu.shutdownAll();
+        QuorumCnxManager.setSocketFactory(QuorumCnxManager.DEFAULT_SOCKET_FACTORY);
+    }
+
+}
\ No newline at end of file
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumDigestTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumDigestTest.java
index 691b45513a7..dd219e1643b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumDigestTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumDigestTest.java
@@ -18,6 +18,8 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
@@ -40,11 +42,10 @@
 import org.apache.zookeeper.server.metric.SimpleCounter;
 import org.apache.zookeeper.txn.TxnDigest;
 import org.apache.zookeeper.txn.TxnHeader;
-import org.junit.After;
-import org.junit.Assert;
-import org.junit.Before;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -56,12 +57,12 @@ public class QuorumDigestTest extends QuorumPeerTestBase {
     private Servers servers;
     private String forceSnapSyncValue;
 
-    @BeforeClass
+    @BeforeAll
     public static void applyMockUps() {
         new DataTreeMock();
     }
 
-    @Before
+    @BeforeEach
     public void setup() throws Exception {
         forceSnapSyncValue = System.getProperty(LearnerHandler.FORCE_SNAP_SYNC);
         ZooKeeperServer.setDigestEnabled(true);
@@ -69,7 +70,7 @@ public void setup() throws Exception {
         servers = LaunchServers(3, 1, null);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         if (servers != null) {
             servers.shutDownAllServers();
@@ -98,7 +99,7 @@ public void testDigestMatchesDuringSnapSync() throws Exception {
         int leader = servers.findLeader();
         TxnLogDigestTest.performOperations(servers.zk[leader],
                 "/testDigestMatchesDuringSnapSync");
-        Assert.assertEquals(0L, getMismatchDigestCount());
+        assertEquals(0L, getMismatchDigestCount());
     }
 
     @Test
@@ -142,7 +143,7 @@ public void processResult(int rc, String path,
         startServers(targets);
 
         // make sure there is no digest mismatch
-        Assert.assertEquals(0L, getMismatchDigestCount());
+        assertEquals(0L, getMismatchDigestCount());
 
         // stop the leader
         targets = Arrays.asList(leader);
@@ -150,7 +151,7 @@ public void processResult(int rc, String path,
         startServers(targets);
 
         // make sure there is no digest mismatch
-        Assert.assertEquals(0L, getMismatchDigestCount());
+        assertEquals(0L, getMismatchDigestCount());
 
         stopped.set(true);
     }
@@ -161,7 +162,7 @@ public void processResult(int rc, String path,
     @Test
     public void testDigestMismatchesWhenTxnLost() throws Exception {
         // make sure there is no mismatch after all servers start up
-        Assert.assertEquals(0L, getMismatchDigestCount());
+        assertEquals(0L, getMismatchDigestCount());
 
         // shutdown a follower and observer
         List<Integer> targets = Arrays.asList(
@@ -171,18 +172,18 @@ public void testDigestMismatchesWhenTxnLost() throws Exception {
         int leader = servers.findLeader();
         triggerOps(leader, "/p1");
 
-        Assert.assertEquals(0L, getMismatchDigestCount());
+        assertEquals(0L, getMismatchDigestCount());
 
         DataTreeMock.skipTxnZxid = "100000006";
 
         // start the follower and observer to have a diff sync
         startServers(targets);
 
-        long misMatchCount = getMismatchDigestCount();
-        Assert.assertNotEquals(0L, misMatchCount);
+        long mismatchCount = getMismatchDigestCount();
+        assertNotEquals(0L, mismatchCount);
 
         triggerOps(leader, "/p2");
-        Assert.assertNotEquals(misMatchCount, getMismatchDigestCount());
+        assertNotEquals(mismatchCount, getMismatchDigestCount());
     }
 
     private void stopServers(List<Integer> sids) throws InterruptedException {
@@ -213,12 +214,12 @@ private void triggerSync(boolean snapSync) throws Exception {
         }
 
         // make sure there is no mismatch after all servers start up
-        Assert.assertEquals(0L, getMismatchDigestCount());
+        assertEquals(0L, getMismatchDigestCount());
 
         int leader = servers.findLeader();
         triggerOps(leader, "/p1");
 
-        Assert.assertEquals(0L, getMismatchDigestCount());
+        assertEquals(0L, getMismatchDigestCount());
 
         // shutdown a follower and observer
         List<Integer> targets = Arrays.asList(
@@ -231,7 +232,7 @@ private void triggerSync(boolean snapSync) throws Exception {
         // start the follower and observer to have a diff sync
         startServers(targets);
 
-        Assert.assertEquals(0L, getMismatchDigestCount());
+        assertEquals(0L, getMismatchDigestCount());
     }
 
     public static long getMismatchDigestCount() {
@@ -250,7 +251,7 @@ public ProcessTxnResult processTxn(Invocation invocation,
                 ProcessTxnResult rc = new ProcessTxnResult();
                 rc.path = "";
                 rc.stat = new Stat();
-                rc.multiResult = new ArrayList<ProcessTxnResult>();
+                rc.multiResult = new ArrayList<>();
                 return rc;
             }
             return invocation.proceed(header, txn, digest);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerConfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerConfigTest.java
index 0d7e7cce015..0f752e0221d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerConfigTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerConfigTest.java
@@ -18,18 +18,19 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.IOException;
 import java.net.InetSocketAddress;
 import java.util.Properties;
 import org.apache.zookeeper.common.ClientX509Util;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class QuorumPeerConfigTest {
 
@@ -105,12 +106,14 @@ public void testCustomSSLAuth() throws IOException {
     /**
      * Test case for https://issues.apache.org/jira/browse/ZOOKEEPER-2873
      */
-    @Test(expected = ConfigException.class)
-    public void testSamePortConfiguredForClientAndElection() throws IOException, ConfigException {
-        QuorumPeerConfig quorumPeerConfig = new QuorumPeerConfig();
-        Properties zkProp = getDefaultZKProperties();
-        zkProp.setProperty("server.1", "localhost:2888:2888");
-        quorumPeerConfig.parseProperties(zkProp);
+    @Test
+    public void testSamePortConfiguredForClientAndElection() {
+        assertThrows(ConfigException.class, () -> {
+            QuorumPeerConfig quorumPeerConfig = new QuorumPeerConfig();
+            Properties zkProp = getDefaultZKProperties();
+            zkProp.setProperty("server.1", "localhost:2888:2888");
+            quorumPeerConfig.parseProperties(zkProp);
+        });
     }
 
     /**
@@ -164,9 +167,43 @@ public void testJvmPauseMonitorConfigured() throws IOException, ConfigException
         assertTrue(quorumPeerConfig.isJvmPauseMonitorToRun());
     }
 
+    /**
+     * Test case for https://issues.apache.org/jira/browse/ZOOKEEPER-3721
+     */
+    @Test
+    public void testParseBoolean() throws IOException, ConfigException {
+        QuorumPeerConfig quorumPeerConfig = new QuorumPeerConfig();
+        Properties zkProp = getDefaultZKProperties();
+
+        zkProp.setProperty("localSessionsEnabled", "true");
+        quorumPeerConfig.parseProperties(zkProp);
+        assertEquals(true, quorumPeerConfig.areLocalSessionsEnabled());
+
+        zkProp.setProperty("localSessionsEnabled", "false");
+        quorumPeerConfig.parseProperties(zkProp);
+        assertEquals(false, quorumPeerConfig.areLocalSessionsEnabled());
+
+        zkProp.setProperty("localSessionsEnabled", "True");
+        quorumPeerConfig.parseProperties(zkProp);
+        assertEquals(true, quorumPeerConfig.areLocalSessionsEnabled());
+
+        zkProp.setProperty("localSessionsEnabled", "False");
+        quorumPeerConfig.parseProperties(zkProp);
+        assertEquals(false, quorumPeerConfig.areLocalSessionsEnabled());
+
+        zkProp.setProperty("localSessionsEnabled", "yes");
+        try {
+            quorumPeerConfig.parseProperties(zkProp);
+            fail("Must throw exception as 'yes' is not acceptable for parseBoolean!");
+        } catch (ConfigException e) {
+            // expected
+        }
+    }
+
     private Properties getDefaultZKProperties() {
         Properties zkProp = new Properties();
         zkProp.setProperty("dataDir", new File("myDataDir").getAbsolutePath());
+        zkProp.setProperty("oraclePath", new File("mastership").getAbsolutePath());
         return zkProp;
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainMultiAddressTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainMultiAddressTest.java
index 9c2906c122f..e9b0edfb535 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainMultiAddressTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainMultiAddressTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.Arrays;
 import java.util.List;
@@ -31,9 +31,9 @@
 import org.apache.zookeeper.admin.ZooKeeperAdmin;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ReconfigTest;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 
 public class QuorumPeerMainMultiAddressTest extends QuorumPeerTestBase {
@@ -51,7 +51,7 @@ public class QuorumPeerMainMultiAddressTest extends QuorumPeerTestBase {
 
   private int zNodeId = 0;
 
-  @Before
+  @BeforeEach
   public void setUp() throws Exception {
     System.setProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_ENABLED, "true");
     ClientBase.setupTestEnv();
@@ -62,7 +62,7 @@ public void setUp() throws Exception {
     System.setProperty("zookeeper.jmx.log4j.disable", "true");
   }
 
-  @After
+  @AfterEach
   public void tearDown() throws Exception {
     super.tearDown();
     System.clearProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_ENABLED);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTLSTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTLSTest.java
new file mode 100644
index 00000000000..79baeabb7a0
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTLSTest.java
@@ -0,0 +1,293 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.quorum;
+
+import static org.apache.zookeeper.server.quorum.QuorumPeerTestBase.MainThread.UNSET_STATIC_CLIENTPORT;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.io.File;
+import java.io.IOException;
+import java.security.Security;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import org.apache.commons.io.FileUtils;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.Watcher;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.admin.ZooKeeperAdmin;
+import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.common.KeyStoreFileType;
+import org.apache.zookeeper.common.X509KeyType;
+import org.apache.zookeeper.common.X509TestContext;
+import org.apache.zookeeper.test.ClientBase;
+import org.apache.zookeeper.test.ReconfigTest;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+
+public class QuorumPeerMainTLSTest extends QuorumPeerTestBase {
+
+  protected static final Logger LOG = LoggerFactory.getLogger(QuorumPeerMainTLSTest.class);
+  private static File tempDir;
+  private static X509TestContext x509TestContext = null;
+
+  @BeforeAll
+  public static void beforeAll() throws Exception {
+    Security.addProvider(new BouncyCastleProvider());
+    tempDir = ClientBase.createEmptyTestDir();
+    x509TestContext = X509TestContext.newBuilder()
+        .setTempDir(tempDir)
+        .setKeyStoreKeyType(X509KeyType.EC)
+        .setTrustStoreKeyType(X509KeyType.EC)
+        .build();
+  }
+
+  @AfterAll
+  public static void afterAll() {
+    Security.removeProvider(BouncyCastleProvider.PROVIDER_NAME);
+    try {
+      FileUtils.deleteDirectory(tempDir);
+    } catch (IOException e) {
+      // ignore
+    }
+  }
+
+
+  // TODO - test reconfig - NIO cnxn factory initially, reconfig to listen on TLS port, should fail coz Netty cnxn factory is needed
+  // TODO - equivalent of testReconfigRemoveClientFromStatic, but for secureClientPort
+  interface QuorumConfigBuilder {
+    String build(int id, String role, int quorumPort, int leaderPort, int clientPort, int secureClientPort);
+  }
+
+  static class MaybeSecureServers extends Servers {
+    public int[] quorumPorts;
+    public int[] leaderPorts;
+    public boolean[] isSecureClient;
+    public int[] secureClientPorts;
+    int numParticipants;
+    int numObservers;
+    String quorumCfg;
+
+    String otherCfg;
+
+    public MaybeSecureServers(int numParticipants, int numObservers, String otherCfg, QuorumConfigBuilder quorumConfigBuilder) throws IOException {
+      this.numParticipants = numParticipants;
+      this.numObservers = numObservers;
+      this.otherCfg = otherCfg;
+      int SIZE = numParticipants + numObservers;
+
+      this.mt = new MainThread[SIZE];
+      this.zk = new ZooKeeper[SIZE];
+      this.quorumPorts = new int[SIZE];
+      this.leaderPorts = new int[SIZE];
+      this.clientPorts = new int[SIZE];
+      this.adminPorts = new int[SIZE];
+      this.secureClientPorts = new int[SIZE];
+      this.isSecureClient = new boolean[SIZE];
+
+      StringBuilder quorumCfg = new StringBuilder();
+
+
+      for (int i = 0; i < SIZE; i++){
+        this.quorumPorts[i] = PortAssignment.unique();
+        this.leaderPorts[i] = PortAssignment.unique();
+        this.clientPorts[i] = PortAssignment.unique();
+        this.adminPorts[i] = PortAssignment.unique();
+        this.secureClientPorts[i] = PortAssignment.unique();
+        String role = i < numParticipants ? "participant" : "observer";
+        String serverEntry = quorumConfigBuilder.build(i, role, this.quorumPorts[i], this.leaderPorts[i], this.clientPorts[i], this.secureClientPorts[i]);
+        quorumCfg.append(serverEntry).append("\n");
+        if (serverEntry.endsWith("" + this.secureClientPorts[i])) {
+          this.isSecureClient[i] = true;
+        }
+      }
+
+      this.quorumCfg = quorumCfg.toString();
+      for (int i = 0; i < SIZE; i++){
+        this.mt[i] = new MainThread(i, UNSET_STATIC_CLIENTPORT, this.adminPorts[i], null, this.quorumCfg, this.otherCfg, null, true, null);
+      }
+    }
+
+    public void restartSecureClient(int clientIndex, Watcher watcher) throws IOException, InterruptedException {
+      if (zk[clientIndex] != null) {
+        zk[clientIndex].close();
+      }
+
+      isSecureClient[clientIndex] = true;
+      zk[clientIndex] = new ZooKeeper(
+          "127.0.0.1:" + secureClientPorts[clientIndex],
+          ClientBase.CONNECTION_TIMEOUT,
+          watcher, getClientTLSConfigs(x509TestContext));
+
+
+    }
+
+    public void restartAllServersAndClients(Watcher watcher) throws IOException, InterruptedException {
+      int index = 0;
+      for (MainThread t : mt) {
+        if (!t.isAlive()) {
+          t.start();
+          index++;
+        }
+      }
+      for (int i = 0; i < zk.length; i++) {
+        if (isSecureClient[i]) {
+          restartSecureClient(i, watcher);
+        } else {
+          restartClient(i, watcher);
+        }
+      }
+    }
+  }
+
+  static Map<String, String> getServerTLSConfigs(X509TestContext x509TestContext) throws IOException {
+    Map<String, String> sslConfigs = new HashMap<>();
+    sslConfigs.put("ssl.keyStore.location", x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM).getAbsolutePath());
+    sslConfigs.put("ssl.trustStore.location", x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM).getAbsolutePath());
+    sslConfigs.put("ssl.keyStore.type", "PEM");
+    sslConfigs.put("ssl.trustStore.type", "PEM");
+    // Netty is required for TLS
+    sslConfigs.put("serverCnxnFactory", org.apache.zookeeper.server.NettyServerCnxnFactory.class.getName());
+    return sslConfigs;
+  }
+
+  static ZKClientConfig getClientTLSConfigs(X509TestContext x509TestContext) throws IOException {
+    if (x509TestContext == null) {
+      throw new RuntimeException("x509TestContext cannot be null");
+    }
+    File clientKeyStore = x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM);
+    File clientTrustStore = x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM);
+
+    ZKClientConfig zKClientConfig = new ZKClientConfig();
+    zKClientConfig.setProperty("zookeeper.client.secure", "true");
+    zKClientConfig.setProperty("zookeeper.ssl.keyStore.location", clientKeyStore.getAbsolutePath());
+    zKClientConfig.setProperty("zookeeper.ssl.trustStore.location", clientTrustStore.getAbsolutePath());
+    zKClientConfig.setProperty("zookeeper.ssl.keyStore.type", "PEM");
+    zKClientConfig.setProperty("zookeeper.ssl.trustStore.type", "PEM");
+    // only netty supports TLS
+    zKClientConfig.setProperty("zookeeper.clientCnxnSocket", org.apache.zookeeper.ClientCnxnSocketNetty.class.getName());
+    return zKClientConfig;
+  }
+
+  /**
+   * Starts a single server in replicated mode
+   */
+  @Test
+  public void testTLSQuorumPeers() throws IOException, InterruptedException {
+    Map<String, String> configMap = new HashMap<>();
+    configMap.put("standaloneEnabled", "false");
+    configMap.put("authProvider.x509", "org.apache.zookeeper.server.auth.X509AuthenticationProvider");
+    configMap.putAll(getServerTLSConfigs(x509TestContext));
+
+    StringBuilder configBuilder = new StringBuilder();
+    for (Map.Entry<String, String> entry : configMap.entrySet()) {
+      configBuilder.append(entry.getKey()).append("=").append(entry.getValue()).append("\n");
+    }
+
+    MaybeSecureServers maybeSecureServers = new MaybeSecureServers(3, 2, configBuilder.toString(),
+        (id, role, quorumPort, leaderPort, clientPort, secureClientPort) -> String.format("server.%d=127.0.0.1:%d:%d:%s;;127.0.0.1:%d", id, quorumPort, leaderPort, role, secureClientPort));
+
+    // wire to "servers" of QuorumPeerTestBase, so it can be destroyed in QuorumPeerTestBase.tearDown()
+    servers = maybeSecureServers;
+
+    // start servers and clients
+    maybeSecureServers.restartAllServersAndClients(this);
+
+    // wait for clients to connect
+    waitForAll(maybeSecureServers, ZooKeeper.States.CONNECTED);
+
+    // Find and log leader
+    maybeSecureServers.findLeader();
+
+    QuorumPeer qp0 = maybeSecureServers.mt[0].getQuorumPeer();
+
+    assertNotNull(qp0);
+
+    // verify no listener on client port
+    assertNull(qp0.cnxnFactory);
+    assertNull(qp0.getClientAddress());
+    assertEquals(-1, qp0.getClientPort());
+
+    // verify valid secure client port listener exists
+    assertNotNull(qp0.secureCnxnFactory);
+    assertNotNull(qp0.getSecureClientAddress());
+    assertEquals(maybeSecureServers.secureClientPorts[0], qp0.getSecureClientPort());
+    assertEquals(maybeSecureServers.secureClientPorts[0], qp0.getSecureClientAddress().getPort());
+  }
+
+  @Test
+  public void reconfigFromClientPortToSecureClientPort() throws IOException, InterruptedException, KeeperException {
+    Map<String, String> configMap = new HashMap<>();
+    configMap.put("reconfigEnabled", "true");
+    configMap.put("authProvider.x509", "org.apache.zookeeper.server.auth.X509AuthenticationProvider");
+    configMap.put("DigestAuthenticationProvider.superDigest", "super:D/InIHSb7yEEbrWz8b9l71RjZJU="/* password is 'test'*/);
+    configMap.putAll(getServerTLSConfigs(x509TestContext));
+
+    StringBuilder configBuilder = new StringBuilder();
+    for (Map.Entry<String, String> entry : configMap.entrySet()) {
+      configBuilder.append(entry.getKey()).append("=").append(entry.getValue()).append("\n");
+    }
+
+    MaybeSecureServers maybeSecureServers = new MaybeSecureServers(3, 0, configBuilder.toString(),
+        (id, role, quorumPort, leaderPort, clientPort, secureClientPort) -> String.format("server.%d=127.0.0.1:%d:%d:%s;127.0.0.1:%d", id, quorumPort, leaderPort, role, clientPort));
+
+    servers = maybeSecureServers;
+
+    maybeSecureServers.restartAllServersAndClients(this);
+
+    waitForAll(maybeSecureServers, ZooKeeper.States.CONNECTED);
+
+    ZooKeeperAdmin zkAdmin = new ZooKeeperAdmin("127.0.0.1:" + maybeSecureServers.clientPorts[0], ClientBase.CONNECTION_TIMEOUT, this);
+    zkAdmin.addAuthInfo("digest", "super:test".getBytes());
+
+    List<String> joiningServers = new ArrayList<>();
+    List<String> leavingServers = new ArrayList<>();
+
+    int reconfigIndex = 1;
+    leavingServers.add(Integer.toString(reconfigIndex));
+    joiningServers.add(String.format("server.%d=127.0.0.1:%d:%d:%s;;127.0.0.1:%d", reconfigIndex,
+        maybeSecureServers.quorumPorts[reconfigIndex], maybeSecureServers.leaderPorts[reconfigIndex],
+        "participant", maybeSecureServers.secureClientPorts[reconfigIndex]));
+
+    ReconfigTest.reconfig(zkAdmin, null, leavingServers, null, -1);
+    LOG.info("Reconfig REMOVE done with leavingServers={}!", leavingServers);
+    ReconfigTest.testServerHasConfig(maybeSecureServers.zk[0], null, leavingServers);
+
+    ReconfigTest.reconfig(zkAdmin, joiningServers, null, null, -1);
+    LOG.info("Reconfig ADD done with joiningServers={}!", joiningServers);
+
+    ReconfigTest.testServerHasConfig(maybeSecureServers.zk[0], joiningServers, null);
+
+    assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + maybeSecureServers.clientPorts[reconfigIndex], 5000, false));
+
+    maybeSecureServers.restartSecureClient(reconfigIndex, this);
+    waitForOne(maybeSecureServers.zk[reconfigIndex], ZooKeeper.States.CONNECTED);
+    ReconfigTest.testNormalOperation(maybeSecureServers.zk[0], maybeSecureServers.zk[reconfigIndex]);
+  }
+
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java
index beb3bb9c069..eb4966e7512 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerMainTest.java
@@ -20,13 +20,13 @@
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
 import static org.apache.zookeeper.test.ClientBase.createEmptyTestDir;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Mockito.doCallRealMethod;
 import static org.mockito.Mockito.mock;
@@ -47,10 +47,6 @@
 import java.util.regex.Pattern;
 import javax.security.sasl.SaslException;
 import org.apache.commons.io.FileUtils;
-import org.apache.log4j.Level;
-import org.apache.log4j.Logger;
-import org.apache.log4j.PatternLayout;
-import org.apache.log4j.WriterAppender;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.PortAssignment;
@@ -62,10 +58,12 @@
 import org.apache.zookeeper.common.X509Exception;
 import org.apache.zookeeper.metrics.BaseTestMetricsProvider;
 import org.apache.zookeeper.metrics.impl.NullMetricsProvider;
+import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.server.quorum.Leader.Proposal;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.apache.zookeeper.test.LoggerTestTool;
+import org.junit.jupiter.api.Test;
 
 /**
  * Test stand-alone server.
@@ -92,23 +90,17 @@ public void testQuorumInternal(String addr) throws Exception {
         q1.start();
         q2.start();
 
-        assertTrue(
-            "waiting for server 1 being up",
-            ClientBase.waitForServerUp(addr + ":" + CLIENT_PORT_QP1, CONNECTION_TIMEOUT));
-        assertTrue(
-            "waiting for server 2 being up",
-            ClientBase.waitForServerUp(addr + ":" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(addr + ":" + CLIENT_PORT_QP1, CONNECTION_TIMEOUT),
+                "waiting for server 1 being up");
+        assertTrue(ClientBase.waitForServerUp(addr + ":" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT),
+                "waiting for server 2 being up");
         QuorumPeer quorumPeer = q1.main.quorumPeer;
 
         int tickTime = quorumPeer.getTickTime();
-        assertEquals(
-            "Default value of minimumSessionTimeOut is not considered",
-            tickTime * 2,
-            quorumPeer.getMinSessionTimeout());
-        assertEquals(
-            "Default value of maximumSessionTimeOut is not considered",
-            tickTime * 20,
-            quorumPeer.getMaxSessionTimeout());
+        assertEquals(tickTime * 2, quorumPeer.getMinSessionTimeout(),
+                "Default value of minimumSessionTimeOut is not considered");
+        assertEquals(tickTime * 20, quorumPeer.getMaxSessionTimeout(),
+                "Default value of maximumSessionTimeOut is not considered");
 
         ZooKeeper zk = new ZooKeeper(addr + ":" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT, this);
         waitForOne(zk, States.CONNECTED);
@@ -125,12 +117,10 @@ public void testQuorumInternal(String addr) throws Exception {
         q1.shutdown();
         q2.shutdown();
 
-        assertTrue(
-            "waiting for server 1 down",
-            ClientBase.waitForServerDown(addr + ":" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT));
-        assertTrue(
-            "waiting for server 2 down",
-            ClientBase.waitForServerDown(addr + ":" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown(addr + ":" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server 1 down");
+        assertTrue(ClientBase.waitForServerDown(addr + ":" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server 2 down");
     }
 
     /**
@@ -237,13 +227,11 @@ public void testEarlyLeaderAbandonment() throws Exception {
         for (int i = 0; i < SERVER_COUNT; i++) {
             for (int j = 0; j < SERVER_COUNT; j++) {
                 if (i == leader) {
-                    assertTrue((j == leader ? ("Leader (" + leader + ")") : ("Follower " + j))
-                                              + " should not have /zk"
-                                              + i, zk[j].exists("/zk" + i, false) == null);
+                    assertTrue(zk[j].exists("/zk" + i, false) == null,
+                            (j == leader ? ("Leader (" + leader + ")") : ("Follower " + j)) + " should not have /zk" + i);
                 } else {
-                    assertTrue((j == leader ? ("Leader (" + leader + ")") : ("Follower " + j))
-                                              + " does not have /zk"
-                                              + i, zk[j].exists("/zk" + i, false) != null);
+                    assertTrue(zk[j].exists("/zk" + i, false) != null,
+                            (j == leader ? ("Leader (" + leader + ")") : ("Follower " + j)) + " does not have /zk" + i);
                 }
             }
         }
@@ -268,7 +256,7 @@ public void testHighestZxidJoinLate() throws Exception {
         int leader = servers.findLeader();
 
         // make sure there is a leader
-        assertTrue("There should be a leader", leader >= 0);
+        assertTrue(leader >= 0, "There should be a leader");
 
         int nonleader = (leader + 1) % numServers;
 
@@ -319,9 +307,9 @@ public void testHighestZxidJoinLate() throws Exception {
         // validate that the old value is there and not the new one
         output = servers.zk[nonleader].getData(path + leader, false, null);
 
-        assertEquals("Expecting old value 1 since 2 isn't committed yet", output[0], 1);
+        assertEquals(output[0], 1, "Expecting old value 1 since 2 isn't committed yet");
 
-        // Do some other update, so we bump the maxCommttedZxid
+        // Do some other update, so we bump the maxCommittedZxid
         // by setting the value to 2
         servers.zk[nonleader].setData(path + nonleader, input, -1);
 
@@ -333,11 +321,11 @@ public void testHighestZxidJoinLate() throws Exception {
 
         // make sure it doesn't have the new value that it alone had logged
         output = servers.zk[leader].getData(path + leader, false, null);
-        assertEquals("Validating that the deposed leader has rolled back that change it had written", output[0], 1);
+        assertEquals(output[0], 1, "Validating that the deposed leader has rolled back that change it had written");
 
         // make sure the leader has the subsequent changes that were made while it was offline
         output = servers.zk[leader].getData(path + nonleader, false, null);
-        assertEquals("Validating that the deposed leader caught up on changes it missed", output[0], 2);
+        assertEquals(output[0], 2, "Validating that the deposed leader caught up on changes it missed");
     }
 
     /**
@@ -348,13 +336,7 @@ public void testHighestZxidJoinLate() throws Exception {
      * @throws InterruptedException
      */
     @Test
-    public void testElectionFraud() throws IOException, InterruptedException {
-        // capture QuorumPeer logging
-        ByteArrayOutputStream os = new ByteArrayOutputStream();
-        WriterAppender appender = getConsoleAppender(os, Level.INFO);
-        Logger qlogger = Logger.getLogger(QuorumPeer.class);
-        qlogger.addAppender(appender);
-
+    public void testElectionFraud() throws Exception {
         numServers = 3;
 
         // used for assertions later
@@ -362,18 +344,19 @@ public void testElectionFraud() throws IOException, InterruptedException {
         boolean foundLooking = false;
         boolean foundFollowing = false;
 
-        try {
+        try (LoggerTestTool loggerTestTool = new LoggerTestTool(QuorumPeer.class)) {
+            ByteArrayOutputStream os = loggerTestTool.getOutputStream();
+
             // spin up a quorum, we use a small ticktime to make the test run faster
             servers = LaunchServers(numServers, 500);
 
             // find the leader
             int trueLeader = servers.findLeader();
-            assertTrue("There should be a leader", trueLeader >= 0);
+            assertTrue(trueLeader >= 0, "There should be a leader");
 
             // find a follower
             int falseLeader = (trueLeader + 1) % numServers;
-            assertTrue("All servers should join the quorum", servers.mt[falseLeader].main.quorumPeer.follower
-                                                                            != null);
+            assertTrue(servers.mt[falseLeader].main.quorumPeer.follower != null, "All servers should join the quorum");
 
             // to keep the quorum peer running and force it to go into the looking state, we kill leader election
             servers.mt[falseLeader].main.quorumPeer.electionAlg.shutdown();
@@ -421,13 +404,11 @@ public void testElectionFraud() throws IOException, InterruptedException {
                     break;
                 }
             }
-        } finally {
-            qlogger.removeAppender(appender);
         }
 
-        assertTrue("falseLeader never attempts to become leader", foundLeading);
-        assertTrue("falseLeader never gives up on leadership", foundLooking);
-        assertTrue("falseLeader never rejoins the quorum", foundFollowing);
+        assertTrue(foundLeading, "falseLeader never attempts to become leader");
+        assertTrue(foundLooking, "falseLeader never gives up on leadership");
+        assertTrue(foundFollowing, "falseLeader never rejoins the quorum");
     }
 
     /**
@@ -437,13 +418,9 @@ public void testElectionFraud() throws IOException, InterruptedException {
     public void testBadPeerAddressInQuorum() throws Exception {
         ClientBase.setupTestEnv();
 
-        // setup the logger to capture all logs
-        ByteArrayOutputStream os = new ByteArrayOutputStream();
-        WriterAppender appender = getConsoleAppender(os, Level.WARN);
-        Logger qlogger = Logger.getLogger("org.apache.zookeeper.server.quorum");
-        qlogger.addAppender(appender);
+        try (LoggerTestTool loggerTestTool = new LoggerTestTool("org.apache.zookeeper.server.quorum")) {
+            ByteArrayOutputStream os = loggerTestTool.getOutputStream();
 
-        try {
             final int CLIENT_PORT_QP1 = PortAssignment.unique();
             final int CLIENT_PORT_QP2 = PortAssignment.unique();
 
@@ -455,29 +432,25 @@ public void testBadPeerAddressInQuorum() throws Exception {
 
             boolean isup = ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, 30000);
 
-            assertFalse("Server never came up", isup);
+            assertFalse(isup, "Server never came up");
 
             q1.shutdown();
 
-            assertTrue(
-                "waiting for server 1 down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT));
-
-        } finally {
-            qlogger.removeAppender(appender);
-        }
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
+                    "waiting for server 1 down");
 
-        LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
-        String line;
-        boolean found = false;
-        Pattern p = Pattern.compile(".*Cannot open channel to .* at election address .*");
-        while ((line = r.readLine()) != null) {
-            found = p.matcher(line).matches();
-            if (found) {
-                break;
+            LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
+            String line;
+            boolean found = false;
+            Pattern p = Pattern.compile(".*Cannot open channel to .* at election address .*");
+            while ((line = r.readLine()) != null) {
+                found = p.matcher(line).matches();
+                if (found) {
+                    break;
+                }
             }
+            assertTrue(found, "complains about host");
         }
-        assertTrue("complains about host", found);
     }
 
     /**
@@ -487,15 +460,11 @@ public void testBadPeerAddressInQuorum() throws Exception {
     public void testInconsistentPeerType() throws Exception {
         ClientBase.setupTestEnv();
 
-        // setup the logger to capture all logs
-        ByteArrayOutputStream os = new ByteArrayOutputStream();
-        WriterAppender appender = getConsoleAppender(os, Level.INFO);
-        Logger qlogger = Logger.getLogger("org.apache.zookeeper.server.quorum");
-        qlogger.addAppender(appender);
-
         // test the most likely situation only: server is stated as observer in
         // servers list, but there's no "peerType=observer" token in config
-        try {
+        try (LoggerTestTool loggerTestTool = new LoggerTestTool("org.apache.zookeeper.server.quorum")) {
+            ByteArrayOutputStream os = loggerTestTool.getOutputStream();
+
             final int CLIENT_PORT_QP1 = PortAssignment.unique();
             final int CLIENT_PORT_QP2 = PortAssignment.unique();
             final int CLIENT_PORT_QP3 = PortAssignment.unique();
@@ -511,52 +480,43 @@ public void testInconsistentPeerType() throws Exception {
             q2.start();
             q3.start();
 
-            assertTrue(
-                "waiting for server 1 being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, CONNECTION_TIMEOUT));
-            assertTrue(
-                "waiting for server 2 being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT));
-            assertTrue(
-                "waiting for server 3 being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP3, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, CONNECTION_TIMEOUT),
+                    "waiting for server 1 being up");
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT),
+                    "waiting for server 2 being up");
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP3, CONNECTION_TIMEOUT),
+                    "waiting for server 3 being up");
 
             q1.shutdown();
             q2.shutdown();
             q3.shutdown();
 
-            assertTrue(
-                "waiting for server 1 down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT));
-            assertTrue(
-                "waiting for server 2 down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT));
-            assertTrue(
-                "waiting for server 3 down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP3, ClientBase.CONNECTION_TIMEOUT));
-
-        } finally {
-            qlogger.removeAppender(appender);
-        }
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
+                    "waiting for server 1 down");
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT),
+                    "waiting for server 2 down");
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP3, ClientBase.CONNECTION_TIMEOUT),
+                    "waiting for server 3 down");
 
-        LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
-        String line;
-        boolean warningPresent = false;
-        boolean defaultedToObserver = false;
-        Pattern pWarn = Pattern.compile(".*Peer type from servers list.* doesn't match peerType.*");
-        Pattern pObserve = Pattern.compile(".*OBSERVING.*");
-        while ((line = r.readLine()) != null) {
-            if (pWarn.matcher(line).matches()) {
-                warningPresent = true;
-            }
-            if (pObserve.matcher(line).matches()) {
-                defaultedToObserver = true;
-            }
-            if (warningPresent && defaultedToObserver) {
-                break;
+            LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
+            String line;
+            boolean warningPresent = false;
+            boolean defaultedToObserver = false;
+            Pattern pWarn = Pattern.compile(".*Peer type from servers list.* doesn't match peerType.*");
+            Pattern pObserve = Pattern.compile(".*OBSERVING.*");
+            while ((line = r.readLine()) != null) {
+                if (pWarn.matcher(line).matches()) {
+                    warningPresent = true;
+                }
+                if (pObserve.matcher(line).matches()) {
+                    defaultedToObserver = true;
+                }
+                if (warningPresent && defaultedToObserver) {
+                    break;
+                }
             }
+            assertTrue(warningPresent && defaultedToObserver, "Should warn about inconsistent peer type");
         }
-        assertTrue("Should warn about inconsistent peer type", warningPresent && defaultedToObserver);
     }
 
     /**
@@ -579,12 +539,10 @@ public void testBadPackets() throws Exception {
         q1.start();
         q2.start();
 
-        assertTrue(
-            "waiting for server 1 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, CONNECTION_TIMEOUT));
-        assertTrue(
-            "waiting for server 2 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, CONNECTION_TIMEOUT),
+                "waiting for server 1 being up");
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT),
+                "waiting for server 2 being up");
 
         byte[] b = new byte[4];
         int length = 1024 * 1024 * 1024;
@@ -616,14 +574,9 @@ public void testBadPackets() throws Exception {
     public void testQuorumDefaults() throws Exception {
         ClientBase.setupTestEnv();
 
-        // setup the logger to capture all logs
-        ByteArrayOutputStream os = new ByteArrayOutputStream();
-        WriterAppender appender = getConsoleAppender(os, Level.INFO);
-        appender.setImmediateFlush(true);
-        Logger zlogger = Logger.getLogger("org.apache.zookeeper");
-        zlogger.addAppender(appender);
+        try (LoggerTestTool loggerTestTool = new LoggerTestTool("org.apache.zookeeper")) {
+            ByteArrayOutputStream os = loggerTestTool.getOutputStream();
 
-        try {
             final int CLIENT_PORT_QP1 = PortAssignment.unique();
             final int CLIENT_PORT_QP2 = PortAssignment.unique();
 
@@ -635,38 +588,32 @@ public void testQuorumDefaults() throws Exception {
             q1.start();
             q2.start();
 
-            assertTrue(
-                "waiting for server 1 being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, CONNECTION_TIMEOUT));
-            assertTrue(
-                "waiting for server 2 being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, CONNECTION_TIMEOUT),
+                    "waiting for server 1 being up");
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT),
+                    "waiting for server 2 being up");
 
             q1.shutdown();
             q2.shutdown();
 
-            assertTrue(
-                "waiting for server 1 down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT));
-            assertTrue(
-                "waiting for server 2 down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
+                    "waiting for server 1 down");
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT),
+                    "waiting for server 2 down");
 
-        } finally {
-            zlogger.removeAppender(appender);
-        }
-        os.close();
-        LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
-        String line;
-        boolean found = false;
-        Pattern p = Pattern.compile(".*FastLeaderElection.*");
-        while ((line = r.readLine()) != null) {
-            found = p.matcher(line).matches();
-            if (found) {
-                break;
+            os.close();
+            LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
+            String line;
+            boolean found = false;
+            Pattern p = Pattern.compile(".*FastLeaderElection.*");
+            while ((line = r.readLine()) != null) {
+                found = p.matcher(line).matches();
+                if (found) {
+                    break;
+                }
             }
+            assertTrue(found, "fastleaderelection used");
         }
-        assertTrue("fastleaderelection used", found);
     }
 
     /**
@@ -714,17 +661,15 @@ public void testMinMaxSessionTimeOut() throws Exception {
         q1.start();
         q2.start();
 
-        assertTrue(
-            "waiting for server 1 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, CONNECTION_TIMEOUT));
-        assertTrue(
-            "waiting for server 2 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, CONNECTION_TIMEOUT),
+                "waiting for server 1 being up");
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT),
+                "waiting for server 2 being up");
 
         QuorumPeer quorumPeer = q1.main.quorumPeer;
 
-        assertEquals("minimumSessionTimeOut is not considered", minSessionTimeOut, quorumPeer.getMinSessionTimeout());
-        assertEquals("maximumSessionTimeOut is not considered", maxSessionTimeOut, quorumPeer.getMaxSessionTimeout());
+        assertEquals(minSessionTimeOut, quorumPeer.getMinSessionTimeout(), "minimumSessionTimeOut is not considered");
+        assertEquals(maxSessionTimeOut, quorumPeer.getMaxSessionTimeout(), "maximumSessionTimeOut is not considered");
     }
 
     /**
@@ -749,20 +694,21 @@ public void testWithOnlyMinSessionTimeout() throws Exception {
         q1.start();
         q2.start();
 
-        assertTrue(
-            "waiting for server 1 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, CONNECTION_TIMEOUT));
-        assertTrue(
-            "waiting for server 2 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, CONNECTION_TIMEOUT),
+                "waiting for server 1 being up");
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT),
+                "waiting for server 2 being up");
 
         QuorumPeer quorumPeer = q1.main.quorumPeer;
         final int maxSessionTimeOut = quorumPeer.tickTime * 20;
 
-        assertEquals("minimumSessionTimeOut is not considered", minSessionTimeOut, quorumPeer.getMinSessionTimeout());
-        assertEquals("maximumSessionTimeOut is wrong", maxSessionTimeOut, quorumPeer.getMaxSessionTimeout());
+        assertEquals(minSessionTimeOut, quorumPeer.getMinSessionTimeout(), "minimumSessionTimeOut is not considered");
+        assertEquals(maxSessionTimeOut, quorumPeer.getMaxSessionTimeout(), "maximumSessionTimeOut is wrong");
     }
 
+    /**
+     * Verify that failed txn in isolated leader got truncated after rejoining quorum.
+     */
     @Test
     public void testFailedTxnAsPartOfQuorumLoss() throws Exception {
         final int LEADER_TIMEOUT_MS = 10_000;
@@ -786,6 +732,8 @@ public void testFailedTxnAsPartOfQuorumLoss() throws Exception {
         // increase the tick time to delay the leader going to looking
         int previousTick = servers.mt[leader].main.quorumPeer.tickTime;
         servers.mt[leader].main.quorumPeer.tickTime = LEADER_TIMEOUT_MS;
+        // isolate it from other quorum members by prevent it from rejoining
+        servers.mt[leader].getQuorumPeer().setSuspended(true);
         // let the previous tick on the leader exhaust itself so the new tick time takes effect
         Thread.sleep(previousTick);
         LOG.warn("LEADER {}", leader);
@@ -796,37 +744,21 @@ public void testFailedTxnAsPartOfQuorumLoss() throws Exception {
             }
         }
 
-        // 3. start up the followers to form a new quorum
-        for (int i = 0; i < SERVER_COUNT; i++) {
-            if (i != leader) {
-                servers.mt[i].start();
-            }
-        }
-
-        // 4. wait one of the follower to be the new leader
-        for (int i = 0; i < SERVER_COUNT; i++) {
-            if (i != leader) {
-                // Recreate a client session since the previous session was not persisted.
-                servers.restartClient(i, this);
-                waitForOne(servers.zk[i], States.CONNECTED);
-            }
-        }
-
-        // 5. send a create request to old leader and make sure it's synced to disk,
+        // 3. send a create request to old leader and make sure it's synced to disk,
         //    which means it acked from itself
         try {
             servers.zk[leader].create("/zk" + leader, "zk".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
             fail("create /zk" + leader + " should have failed");
-        } catch (KeeperException e) {
+        } catch (KeeperException ignored) {
         }
 
-        // just make sure that we actually did get it in process at the
-        // leader
+        // just make sure that we actually did get it in process at the leader
+        //
         // there can be extra sessionClose proposals
-        assertTrue(outstanding.size() > 0);
+        assertFalse(outstanding.isEmpty());
         Proposal p = findProposalOfType(outstanding, OpCode.create);
         LOG.info("Old leader id: {}. All proposals: {}", leader, outstanding);
-        assertNotNull("Old leader doesn't have 'create' proposal", p);
+        assertNotNull(p, "Old leader doesn't have 'create' proposal");
 
         // make sure it has a chance to write it to disk
         int sleepTime = 0;
@@ -839,37 +771,73 @@ public void testFailedTxnAsPartOfQuorumLoss() throws Exception {
             sleepTime += 100;
         }
 
-        // 6. wait for the leader to quit due to not enough followers and come back up as a part of the new quorum
-        LOG.info("Waiting for leader {} to timeout followers", leader);
+        // 4. start up the followers to form a new quorum
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            if (i != leader) {
+                servers.mt[i].start();
+            }
+        }
+
+        // 5. wait one of the follower to be the new leader
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            if (i != leader) {
+                // Recreate a new client session to avoid ConnectionLoss as connecting server is restarted.
+                servers.restartClient(i, this);
+                waitForOne(servers.zk[i], States.CONNECTED);
+            }
+        }
+
+        // 6. make sure new quorum does not replicate the failed txn
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            if (i == leader) {
+                continue;
+            }
+            assertNull(servers.zk[i].exists("/zk" + leader, false),
+                    "server " + i + " should not have /zk" + leader);
+        }
+
+        // resume election to rejoin the cluster
+        servers.mt[leader].getQuorumPeer().setSuspended(false);
+
+        // 7. wait for the leader to quit due to not enough followers and come back up as a part of the new quorum
+        LOG.info("Waiting for leader {} to timeout and rejoin as follower", leader);
         sleepTime = 0;
-        Follower f = servers.mt[leader].main.quorumPeer.follower;
-        while (f == null || !f.isRunning()) {
-            if (sleepTime > LEADER_TIMEOUT_MS * 2) {
-                fail("Took too long for old leader to time out "
+        while (servers.mt[leader].getQuorumPeer().getPeerState() != QuorumPeer.ServerState.FOLLOWING) {
+            if (sleepTime > LEADER_TIMEOUT_MS * 10 * 2) {
+                fail("Took too long for old leader to time out and rejoin "
                                     + servers.mt[leader].main.quorumPeer.getPeerState());
             }
             Thread.sleep(100);
             sleepTime += 100;
-            f = servers.mt[leader].main.quorumPeer.follower;
         }
 
         int newLeader = servers.findLeader();
         // make sure a different leader was elected
         assertNotEquals(leader, newLeader);
 
-        // 7. restart the previous leader to force it to replay the edits and possibly come up in a bad state
-        servers.mt[leader].shutdown();
-        servers.mt[leader].start();
-        // old client session can expire, restart it
+        // Now, all preconditions meet. Let's verify that the failed txn got truncated in whole cluster.
+
+        boolean restarted = false;
         servers.restartClient(leader, this);
-        waitForAll(servers, States.CONNECTED);
+        waitForOne(servers.zk[leader], States.CONNECTED);
+        while (true) {
+            // 7. make sure everything is consistent, that is the failed txn got truncated in old leader.
+            for (int i = 0; i < SERVER_COUNT; i++) {
+                assertNull(servers.zk[i].exists("/zk" + leader, false),
+                        "server " + i + " should not have /zk" + leader);
+            }
 
-        // 8. check the node exist in previous leader but not others
-        //    make sure everything is consistent
-        for (int i = 0; i < SERVER_COUNT; i++) {
-            assertNull(
-                "server " + i + " should not have /zk" + leader,
-                servers.zk[i].exists("/zk" + leader, false));
+            if (restarted) {
+                break;
+            }
+
+            // 8. make sure above holds after restart
+            servers.mt[leader].shutdown();
+            servers.mt[leader].start();
+            // old client session can expire, restart it
+            servers.restartClient(leader, this);
+            waitForAll(servers, States.CONNECTED);
+            restarted = true;
         }
     }
 
@@ -886,13 +854,8 @@ public void testLeaderOutOfView() throws Exception {
         boolean foundLeading = false;
         boolean foundFollowing = false;
 
-        // capture QuorumPeer logging
-        ByteArrayOutputStream os = new ByteArrayOutputStream();
-        WriterAppender appender = getConsoleAppender(os, Level.DEBUG);
-        Logger qlogger = Logger.getLogger("org.apache.zookeeper.server.quorum");
-        qlogger.addAppender(appender);
-
-        try {
+        try (LoggerTestTool loggerTestTool = new LoggerTestTool(QuorumPeerMainTest.class)) {
+            ByteArrayOutputStream os = loggerTestTool.getOutputStream();
             Servers svrs = new Servers();
             svrs.clientPorts = new int[numServers];
             for (int i = 0; i < numServers; i++) {
@@ -927,16 +890,30 @@ public void testLeaderOutOfView() throws Exception {
 
             // Nodes 2 and 3 now form quorum and fully start. 1 attempts to vote for 3, fails, returns to LOOKING state
             for (int i = 1; i < numServers; i++) {
-                assertTrue(
-                    "waiting for server to start",
-                    ClientBase.waitForServerUp("127.0.0.1:" + svrs.clientPorts[i], CONNECTION_TIMEOUT));
+                assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + svrs.clientPorts[i], CONNECTION_TIMEOUT),
+                        "waiting for server to start");
             }
 
-            assertTrue(svrs.mt[0].getQuorumPeer().getPeerState() == QuorumPeer.ServerState.LOOKING);
-            assertTrue(svrs.mt[highestServerIndex].getQuorumPeer().getPeerState()
-                                      == QuorumPeer.ServerState.LEADING);
+            // Expecting that only 3 node will be leader is wrong, even 2 node can be leader, when cluster is formed with 1 node
+            boolean firstAndSecondNodeFormedCluster = false;
+            if (QuorumPeer.ServerState.LEADING == svrs.mt[1].getQuorumPeer().getPeerState()) {
+                assertEquals(QuorumPeer.ServerState.FOLLOWING,
+                    svrs.mt[0].getQuorumPeer().getPeerState());
+                assertEquals(QuorumPeer.ServerState.FOLLOWING,
+                    svrs.mt[highestServerIndex].getQuorumPeer().getPeerState());
+                firstAndSecondNodeFormedCluster = true;
+            } else {
+                // Verify leader out of view scenario
+                assertEquals(QuorumPeer.ServerState.LOOKING,
+                    svrs.mt[0].getQuorumPeer().getPeerState());
+                assertEquals(QuorumPeer.ServerState.LEADING,
+                    svrs.mt[highestServerIndex].getQuorumPeer().getPeerState());
+            }
             for (int i = 1; i < highestServerIndex; i++) {
-                assertTrue(svrs.mt[i].getQuorumPeer().getPeerState() == QuorumPeer.ServerState.FOLLOWING);
+                assertTrue(
+                    svrs.mt[i].getQuorumPeer().getPeerState() == QuorumPeer.ServerState.FOLLOWING
+                        || svrs.mt[i].getQuorumPeer().getPeerState()
+                        == QuorumPeer.ServerState.LEADING);
             }
 
             // Look through the logs for output that indicates Node 1 is LEADING or FOLLOWING
@@ -949,13 +926,16 @@ public void testLeaderOutOfView() throws Exception {
                 foundLeading = leading.matcher(line).matches();
                 foundFollowing = following.matcher(line).matches();
             }
+            if (firstAndSecondNodeFormedCluster) {
+                assertTrue(foundFollowing,
+                    "Corrupt peer should join quorum with servers having same server configuration");
+            } else {
+                assertFalse(foundLeading, "Corrupt peer should never become leader");
+                assertFalse(foundFollowing,
+                    "Corrupt peer should not attempt connection to out of view leader");
+            }
 
-        } finally {
-            qlogger.removeAppender(appender);
         }
-
-        assertFalse("Corrupt peer should never become leader", foundLeading);
-        assertFalse("Corrupt peer should not attempt connection to out of view leader", foundFollowing);
     }
 
     @Test
@@ -981,7 +961,7 @@ public void testDataDirAndDataLogDir() throws Exception {
 
             // Assert
             FileTxnSnapLog txnFactory = qpMain.getQuorumPeer().getTxnFactory();
-            assertEquals(Paths.get(dataLogDir.getAbsolutePath(), "version-2").toString(), txnFactory.getDataDir().getAbsolutePath());
+            assertEquals(Paths.get(dataLogDir.getAbsolutePath(), "version-2").toString(), txnFactory.getDataLogDir().getAbsolutePath());
             assertEquals(Paths.get(dataDir.getAbsolutePath(), "version-2").toString(), txnFactory.getSnapDir().getAbsolutePath());
         } finally {
             FileUtils.deleteDirectory(dataDir);
@@ -1004,13 +984,6 @@ protected QuorumPeer getQuorumPeer() {
 
     }
 
-    private WriterAppender getConsoleAppender(ByteArrayOutputStream os, Level level) {
-        String loggingPattern = ((PatternLayout) Logger.getRootLogger().getAppender("CONSOLE").getLayout()).getConversionPattern();
-        WriterAppender appender = new WriterAppender(new PatternLayout(loggingPattern), os);
-        appender.setThreshold(level);
-        return appender;
-    }
-
     private String getUniquePortCfgForId(int id) {
         return String.format("server.%d=127.0.0.1:%d:%d", id, PortAssignment.unique(), PortAssignment.unique());
     }
@@ -1287,9 +1260,8 @@ public TestQPMain getTestQPMain() {
         // make sure the quorum can be formed within initLimit * tickTime
         // the default setting is 10 * 4000 = 40000 ms
         for (int i = 0; i < SERVERS_TO_START; i++) {
-            assertTrue(
-                "Server " + i + " should have joined quorum by now",
-                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], maxTimeWaitForServerUp));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], maxTimeWaitForServerUp),
+                    "Server " + i + " should have joined quorum by now");
         }
     }
 
@@ -1301,51 +1273,39 @@ public void testMetricsProviderLifecycle() throws Exception {
         ClientBase.setupTestEnv();
         BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.reset();
 
-        // setup the logger to capture all logs
-        ByteArrayOutputStream os = new ByteArrayOutputStream();
-        WriterAppender appender = getConsoleAppender(os, Level.WARN);
-        Logger qlogger = Logger.getLogger("org.apache.zookeeper.server.quorum");
-        qlogger.addAppender(appender);
-
-        try {
-            final int CLIENT_PORT_QP1 = PortAssignment.unique();
-            final int CLIENT_PORT_QP2 = PortAssignment.unique();
+        final int CLIENT_PORT_QP1 = PortAssignment.unique();
+        final int CLIENT_PORT_QP2 = PortAssignment.unique();
 
-            String quorumCfgSectionServer = "server.1=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique() + ";" + CLIENT_PORT_QP1
-                                            + "\nserver.2=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique() + ";" + CLIENT_PORT_QP2 + "\n";
+        String quorumCfgSectionServer = "server.1=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique() + ";" + CLIENT_PORT_QP1
+                                        + "\nserver.2=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique() + ";" + CLIENT_PORT_QP2 + "\n";
 
-            // server 1 boots with a MetricsProvider
-            String quorumCfgSectionServer1 = quorumCfgSectionServer
-                                             + "metricsProvider.className=" + BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.class.getName() + "\n";
+        // server 1 boots with a MetricsProvider
+        String quorumCfgSectionServer1 = quorumCfgSectionServer
+                                         + "metricsProvider.className=" + BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.class.getName() + "\n";
 
-            MainThread q1 = new MainThread(1, CLIENT_PORT_QP1, quorumCfgSectionServer1);
-            MainThread q2 = new MainThread(2, CLIENT_PORT_QP2, quorumCfgSectionServer);
-            q1.start();
-            q2.start();
+        MainThread q1 = new MainThread(1, CLIENT_PORT_QP1, quorumCfgSectionServer1);
+        MainThread q2 = new MainThread(2, CLIENT_PORT_QP2, quorumCfgSectionServer);
+        q1.start();
+        q2.start();
 
-            boolean isup1 = ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, 30000);
-            boolean isup2 = ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, 30000);
-            assertTrue("Server 1 never came up", isup1);
-            assertTrue("Server 2 never came up", isup2);
+        boolean isup1 = ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, 30000);
+        boolean isup2 = ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, 30000);
+        assertTrue(isup1, "Server 1 never came up");
+        assertTrue(isup2, "Server 2 never came up");
 
-            q1.shutdown();
-            q2.shutdown();
+        q1.shutdown();
+        q2.shutdown();
 
-            assertTrue(
-                "waiting for server 1 down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server 1 down");
 
-            assertTrue(
-                "waiting for server 2 down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT));
-        } finally {
-            qlogger.removeAppender(appender);
-        }
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server 2 down");
 
-        assertTrue("metrics provider lifecycle error", BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.configureCalled.get());
-        assertTrue("metrics provider lifecycle error", BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.startCalled.get());
-        assertTrue("metrics provider lifecycle error", BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.getRootContextCalled.get());
-        assertTrue("metrics provider lifecycle error", BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.stopCalled.get());
+        assertTrue(BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.configureCalled.get(), "metrics provider lifecycle error");
+        assertTrue(BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.startCalled.get(), "metrics provider lifecycle error");
+        assertTrue(BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.getRootContextCalled.get(), "metrics provider lifecycle error");
+        assertTrue(BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.stopCalled.get(), "metrics provider lifecycle error");
     }
 
     /**
@@ -1356,48 +1316,36 @@ public void testMetricsProviderConfiguration() throws Exception {
         ClientBase.setupTestEnv();
         BaseTestMetricsProvider.MetricsProviderWithConfiguration.httpPort.set(0);
 
-        // setup the logger to capture all logs
-        ByteArrayOutputStream os = new ByteArrayOutputStream();
-        WriterAppender appender = getConsoleAppender(os, Level.WARN);
-        Logger qlogger = Logger.getLogger("org.apache.zookeeper.server.quorum");
-        qlogger.addAppender(appender);
-
-        try {
-            final int CLIENT_PORT_QP1 = PortAssignment.unique();
-            final int CLIENT_PORT_QP2 = PortAssignment.unique();
+        final int CLIENT_PORT_QP1 = PortAssignment.unique();
+        final int CLIENT_PORT_QP2 = PortAssignment.unique();
 
-            String quorumCfgSectionServer = "server.1=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique() + ";" + CLIENT_PORT_QP1 + "\n"
-                                            + "server.2=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique() + ";" + CLIENT_PORT_QP2 + "\n";
+        String quorumCfgSectionServer = "server.1=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique() + ";" + CLIENT_PORT_QP1 + "\n"
+                                        + "server.2=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique() + ";" + CLIENT_PORT_QP2 + "\n";
 
-            // server 1 boots with a MetricsProvider
-            String quorumCfgSectionServer1 = quorumCfgSectionServer
-                                             + "metricsProvider.className="
-                                             + BaseTestMetricsProvider.MetricsProviderWithConfiguration.class.getName()
-                                             + "\n" + "metricsProvider.httpPort=1234";
+        // server 1 boots with a MetricsProvider
+        String quorumCfgSectionServer1 = quorumCfgSectionServer
+                                         + "metricsProvider.className="
+                                         + BaseTestMetricsProvider.MetricsProviderWithConfiguration.class.getName()
+                                         + "\n" + "metricsProvider.httpPort=1234";
 
-            MainThread q1 = new MainThread(1, CLIENT_PORT_QP1, quorumCfgSectionServer1);
-            MainThread q2 = new MainThread(2, CLIENT_PORT_QP2, quorumCfgSectionServer);
-            q1.start();
-            q2.start();
+        MainThread q1 = new MainThread(1, CLIENT_PORT_QP1, quorumCfgSectionServer1);
+        MainThread q2 = new MainThread(2, CLIENT_PORT_QP2, quorumCfgSectionServer);
+        q1.start();
+        q2.start();
 
-            boolean isup1 = ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, 30000);
-            boolean isup2 = ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, 30000);
-            assertTrue("Server 1 never came up", isup1);
-            assertTrue("Server 2 never came up", isup2);
+        boolean isup1 = ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, 30000);
+        boolean isup2 = ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, 30000);
+        assertTrue(isup1, "Server 1 never came up");
+        assertTrue(isup2, "Server 2 never came up");
 
-            q1.shutdown();
-            q2.shutdown();
+        q1.shutdown();
+        q2.shutdown();
 
-            assertTrue(
-                "waiting for server 1 down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server 1 down");
 
-            assertTrue(
-                "waiting for server 2 down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT));
-        } finally {
-            qlogger.removeAppender(appender);
-        }
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server 2 down");
 
         assertEquals(1234, BaseTestMetricsProvider.MetricsProviderWithConfiguration.httpPort.get());
     }
@@ -1410,13 +1358,9 @@ public void testFaultyMetricsProviderOnStop() throws Exception {
         ClientBase.setupTestEnv();
         BaseTestMetricsProvider.MetricsProviderCapturingLifecycle.reset();
 
-        // setup the logger to capture all logs
-        ByteArrayOutputStream os = new ByteArrayOutputStream();
-        WriterAppender appender = getConsoleAppender(os, Level.WARN);
-        Logger qlogger = Logger.getLogger("org.apache.zookeeper.server.quorum");
-        qlogger.addAppender(appender);
+        try (LoggerTestTool loggerTestTool = new LoggerTestTool("org.apache.zookeeper.server.quorum")) {
+            ByteArrayOutputStream os = loggerTestTool.getOutputStream();
 
-        try {
             final int CLIENT_PORT_QP1 = PortAssignment.unique();
             final int CLIENT_PORT_QP2 = PortAssignment.unique();
 
@@ -1436,36 +1380,31 @@ public void testFaultyMetricsProviderOnStop() throws Exception {
 
             boolean isup1 = ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, 30000);
             boolean isup2 = ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, 30000);
-            assertTrue("Server 1 never came up", isup1);
-            assertTrue("Server 2 never came up", isup2);
+            assertTrue(isup1, "Server 1 never came up");
+            assertTrue(isup2, "Server 2 never came up");
 
             q1.shutdown();
             q2.shutdown();
 
-            assertTrue(
-                    "waiting for server 1 down",
-                    ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT));
-
-            assertTrue(
-                    "waiting for server 2 down",
-                    ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT));
-        } finally {
-            qlogger.removeAppender(appender);
-        }
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
+                    "waiting for server 1 down");
 
-        assertTrue("metrics provider lifecycle error", BaseTestMetricsProvider.MetricsProviderWithErrorInStop.stopCalled.get());
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT),
+                    "waiting for server 2 down");
+            assertTrue(BaseTestMetricsProvider.MetricsProviderWithErrorInStop.stopCalled.get(), "metrics provider lifecycle error");
 
-        LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
-        String line;
-        boolean found = false;
-        Pattern p = Pattern.compile(".*Error while stopping metrics.*");
-        while ((line = r.readLine()) != null) {
-            found = p.matcher(line).matches();
-            if (found) {
-                break;
+            LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
+            String line;
+            boolean found = false;
+            Pattern p = Pattern.compile(".*Error while stopping metrics.*");
+            while ((line = r.readLine()) != null) {
+                found = p.matcher(line).matches();
+                if (found) {
+                    break;
+                }
             }
+            assertTrue(found, "complains about metrics provider");
         }
-        assertTrue("complains about metrics provider", found);
     }
 
     /**
@@ -1475,13 +1414,9 @@ public void testFaultyMetricsProviderOnStop() throws Exception {
     public void testInvalidMetricsProvider() throws Exception {
         ClientBase.setupTestEnv();
 
-        // setup the logger to capture all logs
-        ByteArrayOutputStream os = new ByteArrayOutputStream();
-        WriterAppender appender = getConsoleAppender(os, Level.WARN);
-        Logger qlogger = Logger.getLogger("org.apache.zookeeper.server.quorum");
-        qlogger.addAppender(appender);
+        try (LoggerTestTool loggerTestTool = new LoggerTestTool("org.apache.zookeeper.server.quorum")) {
+            ByteArrayOutputStream os = loggerTestTool.getOutputStream();
 
-        try {
             final int CLIENT_PORT_QP1 = PortAssignment.unique();
 
             String quorumCfgSection = "server.1=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique() + ";" + CLIENT_PORT_QP1
@@ -1493,29 +1428,25 @@ public void testInvalidMetricsProvider() throws Exception {
 
             boolean isup = ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, 5000);
 
-            assertFalse("Server never came up", isup);
+            assertFalse(isup, "Server never came up");
 
             q1.shutdown();
 
-            assertTrue(
-                "waiting for server 1 down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT));
-
-        } finally {
-            qlogger.removeAppender(appender);
-        }
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
+                    "waiting for server 1 down");
 
-        LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
-        String line;
-        boolean found = false;
-        Pattern p = Pattern.compile(".*BadClass.*");
-        while ((line = r.readLine()) != null) {
-            found = p.matcher(line).matches();
-            if (found) {
-                break;
+            LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
+            String line;
+            boolean found = false;
+            Pattern p = Pattern.compile(".*BadClass.*");
+            while ((line = r.readLine()) != null) {
+                found = p.matcher(line).matches();
+                if (found) {
+                    break;
+                }
             }
+            assertTrue(found, "complains about metrics provider");
         }
-        assertTrue("complains about metrics provider", found);
     }
 
     /**
@@ -1525,13 +1456,9 @@ public void testInvalidMetricsProvider() throws Exception {
     public void testFaultyMetricsProviderOnStart() throws Exception {
         ClientBase.setupTestEnv();
 
-        // setup the logger to capture all logs
-        ByteArrayOutputStream os = new ByteArrayOutputStream();
-        WriterAppender appender = getConsoleAppender(os, Level.WARN);
-        Logger qlogger = Logger.getLogger("org.apache.zookeeper.server.quorum");
-        qlogger.addAppender(appender);
+        try (LoggerTestTool loggerTestTool = new LoggerTestTool("org.apache.zookeeper.server.quorum")) {
+            ByteArrayOutputStream os = loggerTestTool.getOutputStream();
 
-        try {
             final int CLIENT_PORT_QP1 = PortAssignment.unique();
 
             String quorumCfgSection = "server.1=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique() + ";" + CLIENT_PORT_QP1
@@ -1544,29 +1471,25 @@ public void testFaultyMetricsProviderOnStart() throws Exception {
 
             boolean isup = ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, 5000);
 
-            assertFalse("Server never came up", isup);
+            assertFalse(isup, "Server never came up");
 
             q1.shutdown();
 
-            assertTrue(
-                "waiting for server 1 down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT));
-
-        } finally {
-            qlogger.removeAppender(appender);
-        }
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
+                    "waiting for server 1 down");
 
-        LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
-        String line;
-        boolean found = false;
-        Pattern p = Pattern.compile(".*MetricsProviderLifeCycleException.*");
-        while ((line = r.readLine()) != null) {
-            found = p.matcher(line).matches();
-            if (found) {
-                break;
+            LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
+            String line;
+            boolean found = false;
+            Pattern p = Pattern.compile(".*MetricsProviderLifeCycleException.*");
+            while ((line = r.readLine()) != null) {
+                found = p.matcher(line).matches();
+                if (found) {
+                    break;
+                }
             }
+            assertTrue(found, "complains about metrics provider MetricsProviderLifeCycleException");
         }
-        assertTrue("complains about metrics provider MetricsProviderLifeCycleException", found);
     }
 
     /**
@@ -1576,13 +1499,9 @@ public void testFaultyMetricsProviderOnStart() throws Exception {
     public void testFaultyMetricsProviderOnConfigure() throws Exception {
         ClientBase.setupTestEnv();
 
-        // setup the logger to capture all logs
-        ByteArrayOutputStream os = new ByteArrayOutputStream();
-        WriterAppender appender = getConsoleAppender(os, Level.WARN);
-        Logger qlogger = Logger.getLogger("org.apache.zookeeper.server.quorum");
-        qlogger.addAppender(appender);
+        try (LoggerTestTool loggerTestTool = new LoggerTestTool("org.apache.zookeeper.server.quorum")) {
+            ByteArrayOutputStream os = loggerTestTool.getOutputStream();
 
-        try {
             final int CLIENT_PORT_QP1 = PortAssignment.unique();
 
             String quorumCfgSection = "server.1=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique() + ";" + CLIENT_PORT_QP1
@@ -1595,29 +1514,186 @@ public void testFaultyMetricsProviderOnConfigure() throws Exception {
 
             boolean isup = ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, 5000);
 
-            assertFalse("Server never came up", isup);
+            assertFalse(isup, "Server never came up");
 
             q1.shutdown();
 
-            assertTrue(
-                "waiting for server 1 down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
+                    "waiting for server 1 down");
+
+            LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
+            String line;
+            boolean found = false;
+            Pattern p = Pattern.compile(".*MetricsProviderLifeCycleException.*");
+            while ((line = r.readLine()) != null) {
+                found = p.matcher(line).matches();
+                if (found) {
+                    break;
+                }
+            }
+            assertTrue(found, "complains about metrics provider MetricsProviderLifeCycleException");
+        }
+    }
+
+    /**
+     * Test the behavior to skip processing the learner forwarded requests in
+     * Leader's CommitProcessor.
+     */
+    @Test
+    public void testLearnerRequestForwardBehavior() throws Exception {
+        System.setProperty(ProposalRequestProcessor.FORWARD_LEARNER_REQUESTS_TO_COMMIT_PROCESSOR_DISABLED, "true");
+
+        try {
+            // 1. set up an ensemble with 3 servers
+            final int numServers = 3;
+            servers = LaunchServers(numServers);
+            int leaderId =  servers.findLeader();
 
+            int followerA = (leaderId + 1) % numServers;
+            waitForOne(servers.zk[followerA], States.CONNECTED);
+
+            // 2. reset all metrics
+            ServerMetrics.getMetrics().resetAll();
+
+            // 3. issue a request
+            final String node = "/testLearnerRequestForwardBehavior";
+            servers.zk[followerA].create(node, new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+            assertNotNull(servers.zk[followerA].exists("/testLearnerRequestForwardBehavior", false),
+                    "node " + node + " should exist");
+
+            assertEquals(1L, ServerMetrics.getMetrics().REQUESTS_NOT_FORWARDED_TO_COMMIT_PROCESSOR.get());
         } finally {
-            qlogger.removeAppender(appender);
+            //clean up
+            System.setProperty(ProposalRequestProcessor.FORWARD_LEARNER_REQUESTS_TO_COMMIT_PROCESSOR_DISABLED, "false");
         }
+    }
 
-        LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
-        String line;
-        boolean found = false;
-        Pattern p = Pattern.compile(".*MetricsProviderLifeCycleException.*");
-        while ((line = r.readLine()) != null) {
-            found = p.matcher(line).matches();
-            if (found) {
-                break;
+    /**
+     * If learner failed to do SNAP sync with leader before it's writing
+     * the snapshot to disk, it's possible that it might have DIFF sync
+     * with new leader or itself being elected as a leader.
+     *
+     * This test is trying to guarantee there is no data inconsistency for
+     * this case.
+     */
+    @Test
+    public void testDiffSyncAfterSnap() throws Exception {
+        final int ENSEMBLE_SERVERS = 3;
+        MainThread[] mt = new MainThread[ENSEMBLE_SERVERS];
+        ZooKeeper[] zk = new ZooKeeper[ENSEMBLE_SERVERS];
+
+        try {
+            // 1. start a quorum
+            final int[] clientPorts = new int[ENSEMBLE_SERVERS];
+            StringBuilder sb = new StringBuilder();
+            String server;
+
+            for (int i = 0; i < ENSEMBLE_SERVERS; i++) {
+                clientPorts[i] = PortAssignment.unique();
+                server = "server." + i + "=127.0.0.1:" + PortAssignment.unique()
+                         + ":" + PortAssignment.unique()
+                         + ":participant;127.0.0.1:" + clientPorts[i];
+                sb.append(server + "\n");
+            }
+            String currentQuorumCfgSection = sb.toString();
+
+            // start servers
+            Context[] contexts = new Context[ENSEMBLE_SERVERS];
+            for (int i = 0; i < ENSEMBLE_SERVERS; i++) {
+                final Context context = new Context();
+                contexts[i] = context;
+                mt[i] = new MainThread(i, clientPorts[i], currentQuorumCfgSection, false) {
+                    @Override
+                    public TestQPMain getTestQPMain() {
+                        return new CustomizedQPMain(context);
+                    }
+                };
+                mt[i].start();
+                zk[i] = new ZooKeeper("127.0.0.1:" + clientPorts[i], ClientBase.CONNECTION_TIMEOUT, this);
+            }
+            waitForAll(zk, States.CONNECTED);
+            LOG.info("all servers started");
+
+            final String nodePath = "/testDiffSyncAfterSnap";
+
+            // 2. find leader and a follower
+            int leaderId = -1;
+            int followerA = -1;
+            for (int i = ENSEMBLE_SERVERS - 1; i >= 0; i--) {
+                if (mt[i].main.quorumPeer.leader != null) {
+                    leaderId = i;
+                } else if (followerA == -1) {
+                    followerA = i;
+                }
+            }
+
+            // 3. stop follower A
+            LOG.info("shutdown follower {}", followerA);
+            mt[followerA].shutdown();
+            waitForOne(zk[followerA], States.CONNECTING);
+
+            // 4. issue some traffic
+            int index = 0;
+            int numOfRequests = 10;
+            for (int i = 0; i < numOfRequests; i++) {
+                zk[leaderId].create(nodePath + index++,
+                   new byte[1], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            }
+
+            CustomQuorumPeer leaderQuorumPeer = (CustomQuorumPeer) mt[leaderId].main.quorumPeer;
+
+            // 5. inject fault to cause the follower exit when received NEWLEADER
+            contexts[followerA].newLeaderReceivedCallback = new NewLeaderReceivedCallback() {
+                boolean processed = false;
+                @Override
+                public void process() throws IOException {
+                    if (processed) {
+                        return;
+                    }
+                    processed = true;
+                    System.setProperty(LearnerHandler.FORCE_SNAP_SYNC, "false");
+                    throw new IOException("read timedout");
+                }
+            };
+
+            // 6. force snap sync once
+            LOG.info("force snapshot sync");
+            System.setProperty(LearnerHandler.FORCE_SNAP_SYNC, "true");
+
+            // 7. start follower A
+            mt[followerA].start();
+            waitForOne(zk[followerA], States.CONNECTED);
+            LOG.info("verify the nodes are exist in memory");
+            for (int i = 0; i < index; i++) {
+                assertNotNull(zk[followerA].exists(nodePath + i, false));
+            }
+
+            // 8. issue another request which will be persisted on disk
+            zk[leaderId].create(nodePath + index++,
+               new byte[1], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+            // wait some time to let this get written to disk
+            Thread.sleep(500);
+
+            // 9. reload data from disk and make sure it's still consistent
+            LOG.info("restarting follower {}", followerA);
+            mt[followerA].shutdown();
+            waitForOne(zk[followerA], States.CONNECTING);
+            mt[followerA].start();
+            waitForOne(zk[followerA], States.CONNECTED);
+
+            for (int i = 0; i < index; i++) {
+                assertNotNull(zk[followerA].exists(nodePath + i, false), "node " + i + " should exist");
+            }
+
+        } finally {
+            System.clearProperty(LearnerHandler.FORCE_SNAP_SYNC);
+            for (int i = 0; i < ENSEMBLE_SERVERS; i++) {
+                mt[i].shutdown();
+                zk[i].close();
             }
         }
-        assertTrue("complains about metrics provider MetricsProviderLifeCycleException", found);
     }
 
     static class Context {
@@ -1625,6 +1701,7 @@ static class Context {
         boolean quitFollowing = false;
         boolean exitWhenAckNewLeader = false;
         NewLeaderAckCallback newLeaderAckCallback = null;
+        NewLeaderReceivedCallback newLeaderReceivedCallback = null;
 
     }
 
@@ -1634,6 +1711,10 @@ interface NewLeaderAckCallback {
 
     }
 
+    interface NewLeaderReceivedCallback {
+        void process() throws IOException;
+    }
+
     interface StartForwardingListener {
 
         void start();
@@ -1707,6 +1788,14 @@ void writePacket(QuorumPacket pp, boolean flush) throws IOException {
                     }
                     super.writePacket(pp, flush);
                 }
+
+                @Override
+                void readPacket(QuorumPacket qp) throws IOException {
+                    super.readPacket(qp);
+                    if (qp.getType() == Leader.NEWLEADER && context.newLeaderReceivedCallback != null) {
+                        context.newLeaderReceivedCallback.process();
+                    }
+                }
             };
         }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTest.java
index 03cb6f06a83..8c95a29fa32 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTest.java
@@ -18,20 +18,25 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.IOException;
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
+import java.nio.file.Files;
 import java.util.HashMap;
 import java.util.Map;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.server.quorum.QuorumPeer.LearnerType;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
-import org.apache.zookeeper.test.ClientBase;
-import org.junit.Test;
+import org.apache.zookeeper.server.quorum.flexible.QuorumMaj;
+import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+import org.mockito.Mockito;
 
 public class QuorumPeerTest {
 
@@ -45,11 +50,10 @@ public class QuorumPeerTest {
      * Test case for https://issues.apache.org/jira/browse/ZOOKEEPER-2301
      */
     @Test
-    public void testQuorumPeerListendOnSpecifiedClientIP() throws IOException {
+    public void testQuorumPeerListendOnSpecifiedClientIP(@TempDir File dataDir) throws IOException {
         long myId = 1;
-        File dataDir = ClientBase.createTmpDir();
         int clientPort = PortAssignment.unique();
-        Map<Long, QuorumServer> peersView = new HashMap<Long, QuorumServer>();
+        Map<Long, QuorumServer> peersView = new HashMap<>();
         InetAddress clientIP = InetAddress.getLoopbackAddress();
 
         peersView.put(Long.valueOf(myId), new QuorumServer(myId, new InetSocketAddress(clientIP, PortAssignment.unique()), new InetSocketAddress(clientIP, PortAssignment.unique()), new InetSocketAddress(clientIP, clientPort), LearnerType.PARTICIPANT));
@@ -77,6 +81,34 @@ public void testQuorumPeerListendOnSpecifiedClientIP() throws IOException {
         peer2.shutdown();
     }
 
+    @Test
+    public void testShutdownWithoutZkDbDoesNotThrow() throws Exception {
+        QuorumPeer peer = new QuorumPeer();
+        assertDoesNotThrow(peer::shutdown);
+    }
+
+    @Test
+    public void testProcessReconfigWillRecreateSocketAddresses() throws IOException {
+        QuorumPeerConfig.setReconfigEnabled(true);
+        QuorumPeer peer = new QuorumPeer();
+
+        File file = Files.createTempFile("", ".tmp").toFile();
+        file.deleteOnExit();
+
+        peer.setConfigFileName(file.getAbsoluteFile().toString());
+
+        Map<Long, QuorumServer> peersView = new HashMap<>();
+        QuorumServer qs = Mockito.mock(QuorumServer.class);
+        peersView.put(0L, qs);
+
+        QuorumVerifier qv = new QuorumMaj(peersView);
+        peer.setQuorumVerifier(qv, false);
+        peer.processReconfig(qv, 0L, 0L, false);
+
+        // verify the qs will recreateSocketAddresses twice for both the old qv and the new qv
+        Mockito.verify(qs, Mockito.times(2)).recreateSocketAddresses();
+    }
+
     @Test
     public void testLocalPeerIsLeader() throws Exception {
         long localPeerId = 7;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java
index aa75218b03b..e7649cdbdfc 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumPeerTestBase.java
@@ -41,7 +41,7 @@
 import org.apache.zookeeper.server.admin.JettyAdminServer;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.QuorumBase;
-import org.junit.After;
+import org.junit.jupiter.api.AfterEach;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -58,16 +58,19 @@ public class QuorumPeerTestBase extends ZKTestCase implements Watcher {
     protected Servers servers;
     protected int numServers = 0;
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
-        if (servers == null || servers.mt == null) {
+        if (servers == null) {
             LOG.info("No servers to shutdown!");
             return;
         }
-        for (int i = 0; i < numServers; i++) {
-            if (i < servers.mt.length) {
-                servers.mt[i].shutdown();
-            }
+
+        if (servers.zk != null) {
+            servers.shutdownAllClients();
+        }
+
+        if (servers.mt != null) {
+            servers.shutDownAllServers();
         }
     }
 
@@ -92,7 +95,7 @@ public static class MainThread implements Runnable {
         final File tmpDir;
 
         public static final int UNSET_STATIC_CLIENTPORT = -1;
-        // standalone mode doens't need myid
+        // standalone mode doesn't need myid
         public static final int UNSET_MYID = -1;
 
         volatile TestQPMain main;
@@ -303,7 +306,7 @@ public void writeTempDynamicConfigFile(String nextQuorumCfgSection, String versi
         }
 
         public MainThread(int myid, int clientPort, String quorumCfgSection) throws IOException {
-            this(myid, clientPort, quorumCfgSection, new HashMap<String, String>());
+            this(myid, clientPort, quorumCfgSection, new HashMap<>());
         }
 
         public MainThread(int myid, int clientPort, String quorumCfgSection, Map<String, String> otherConfigs) throws IOException {
@@ -318,6 +321,18 @@ public synchronized void start() {
             currentThread.start();
         }
 
+        /**
+         * start the QuorumPeer with the passed TestQPMain
+         *
+         * @param testQPMain the TestQPMain to use
+         */
+
+        public synchronized void start(final TestQPMain testQPMain) {
+            main = testQPMain;
+            currentThread = new Thread(this);
+            currentThread.start();
+        }
+
         public TestQPMain getTestQPMain() {
             return new TestQPMain();
         }
@@ -356,7 +371,7 @@ public boolean isAlive() {
         }
 
         public void reinitialize() throws IOException {
-            File dataDir = main.quorumPeer.getTxnFactory().getDataDir();
+            File dataDir = main.quorumPeer.getTxnFactory().getDataLogDir();
             ClientBase.recursiveDelete(dataDir);
             ClientBase.createInitializeFile(dataDir.getParentFile());
         }
@@ -402,11 +417,12 @@ public File getConfFile() {
     }
 
     // This class holds the servers and clients for those servers
-    protected static class Servers {
+    public static class Servers {
 
-        MainThread[] mt;
-        ZooKeeper[] zk;
-        int[] clientPorts;
+        public MainThread[] mt;
+        public ZooKeeper[] zk;
+        public int[] clientPorts;
+        public int[] adminPorts;
 
         public void shutDownAllServers() throws InterruptedException {
             for (MainThread t : mt) {
@@ -414,10 +430,19 @@ public void shutDownAllServers() throws InterruptedException {
             }
         }
 
+        public void shutdownAllClients() throws InterruptedException {
+            for (ZooKeeper zk : zk) {
+                zk.close(5000);
+            }
+        }
+
         public void restartAllServersAndClients(Watcher watcher) throws IOException, InterruptedException {
+            int index = 0;
             for (MainThread t : mt) {
                 if (!t.isAlive()) {
+                    System.setProperty("zookeeper.admin.serverPort", String.valueOf(adminPorts[index]));
                     t.start();
+                    index++;
                 }
             }
             for (int i = 0; i < zk.length; i++) {
@@ -470,23 +495,35 @@ public int findAnyObserver() {
     }
 
     protected Servers LaunchServers(int numServers) throws IOException, InterruptedException {
-        return LaunchServers(numServers, null);
+        return LaunchServers(numServers, (Integer) null);
+    }
+
+    protected Servers LaunchServers(int numServers, Map<String, String> otherConfigs)
+        throws IOException, InterruptedException {
+        return LaunchServers(numServers, 0, null, otherConfigs);
     }
 
     protected Servers LaunchServers(int numServers, Integer tickTime) throws IOException, InterruptedException {
         return LaunchServers(numServers, 0, tickTime);
     }
 
+    protected Servers LaunchServers(int numServers, int numObservers, Integer tickTime)
+        throws IOException, InterruptedException {
+        return LaunchServers(numServers, numObservers, tickTime, new HashMap<>());
+    }
+
     /** * This is a helper function for launching a set of servers
      *
      * @param numServers the number of participant servers
-     * @param numObserver the number of observer servers
+     * @param numObservers the number of observer servers
      * @param tickTime A ticktime to pass to MainThread
+     * @param otherConfigs any zoo.cfg configuration
      * @return
      * @throws IOException
      * @throws InterruptedException
      */
-    protected Servers LaunchServers(int numServers, int numObservers, Integer tickTime) throws IOException, InterruptedException {
+    protected Servers LaunchServers(int numServers, int numObservers, Integer tickTime,
+        Map<String, String> otherConfigs) throws IOException, InterruptedException {
         int SERVER_COUNT = numServers + numObservers;
         QuorumPeerMainTest.Servers svrs = new QuorumPeerMainTest.Servers();
         svrs.clientPorts = new int[SERVER_COUNT];
@@ -498,16 +535,23 @@ protected Servers LaunchServers(int numServers, int numObservers, Integer tickTi
                     i, PortAssignment.unique(), PortAssignment.unique(), role,
                     svrs.clientPorts[i]));
         }
+
+        svrs.adminPorts = new int[SERVER_COUNT];
+        for (int i = 0; i < SERVER_COUNT; i++) {
+            svrs.adminPorts[i] = PortAssignment.unique();
+        }
+
         String quorumCfgSection = sb.toString();
 
         svrs.mt = new MainThread[SERVER_COUNT];
         svrs.zk = new ZooKeeper[SERVER_COUNT];
         for (int i = 0; i < SERVER_COUNT; i++) {
             if (tickTime != null) {
-                svrs.mt[i] = new MainThread(i, svrs.clientPorts[i], quorumCfgSection, new HashMap<String, String>(), tickTime);
+                svrs.mt[i] = new MainThread(i, svrs.clientPorts[i], quorumCfgSection, otherConfigs, tickTime);
             } else {
-                svrs.mt[i] = new MainThread(i, svrs.clientPorts[i], quorumCfgSection);
+                svrs.mt[i] = new MainThread(i, svrs.clientPorts[i], quorumCfgSection, otherConfigs);
             }
+            System.setProperty("zookeeper.admin.serverPort", String.valueOf(svrs.adminPorts[i]));
             svrs.mt[i].start();
             svrs.restartClient(i, this);
         }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumRequestPipelineTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumRequestPipelineTest.java
index 3565c562a60..f848b02895f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumRequestPipelineTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumRequestPipelineTest.java
@@ -18,64 +18,66 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertArrayEquals;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.Arrays;
-import java.util.Collection;
 import java.util.HashSet;
 import java.util.Set;
 import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.ForkJoinPool;
+import java.util.concurrent.ForkJoinTask;
 import java.util.concurrent.TimeUnit;
+import java.util.stream.Stream;
 import org.apache.zookeeper.AsyncCallback.VoidCallback;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.TestableZooKeeper;
-import org.apache.zookeeper.ZKParameterized;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.test.QuorumBase;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
-
-@RunWith(Parameterized.class)
-@Parameterized.UseParametersRunnerFactory(ZKParameterized.RunnerFactory.class)
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
+
 public class QuorumRequestPipelineTest extends QuorumBase {
 
-    protected ServerState serverState;
     protected final CountDownLatch callComplete = new CountDownLatch(1);
     protected boolean complete = false;
     protected static final String PARENT_PATH = "/foo";
-    protected static final Set<String> CHILDREN = new HashSet<String>(Arrays.asList("1", "2", "3"));
+    protected static final Set<String> CHILDREN = new HashSet<>(Arrays.asList("1", "2", "3"));
     protected static final String AUTH_PROVIDER = "digest";
     protected static final byte[] AUTH = "hello".getBytes();
     protected static final byte[] DATA = "Hint Water".getBytes();
 
     protected TestableZooKeeper zkClient;
 
-    @Parameterized.Parameters
-    public static Collection<Object[]> data() {
-        return Arrays.asList(new Object[][]{{ServerState.LEADING}, {ServerState.FOLLOWING}, {ServerState.OBSERVING}});
+    public static Stream<Arguments> data() throws Exception {
+        return Stream.of(
+                Arguments.of(ServerState.LEADING),
+                Arguments.of(ServerState.FOLLOWING),
+                Arguments.of(ServerState.OBSERVING));
     }
 
-    public QuorumRequestPipelineTest(ServerState state) {
-        this.serverState = state;
+    @BeforeEach
+    @Override
+    public void setUp() {
+        //since parameterized test methods need a parameterized setUp method
+        //the inherited method has to be overridden with an empty function body
     }
 
-    @Before
-    public void setUp() throws Exception {
+    public void setUp(ServerState serverState) throws Exception {
         CountdownWatcher clientWatch = new CountdownWatcher();
-        super.setUp(true);
+        super.setUp(true, true);
         zkClient = createClient(clientWatch, getPeersMatching(serverState));
         zkClient.addAuthInfo(AUTH_PROVIDER, AUTH);
         clientWatch.waitForConnected(CONNECTION_TIMEOUT);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         zkClient.close();
         super.tearDown();
@@ -87,66 +89,84 @@ private Stat create2EmptyNode(TestableZooKeeper zkClient, String path) throws Ex
         return stat;
     }
 
-    @Test
-    public void testCreate() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testCreate(ServerState serverState) throws Exception {
+        setUp(serverState);
         zkClient.create(PARENT_PATH, DATA, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        assertArrayEquals(String.format("%s Node created (create) with expected value", serverState), DATA, zkClient.getData(PARENT_PATH, false, null));
+        assertArrayEquals(DATA, zkClient.getData(PARENT_PATH, false, null), String.format("%s Node created (create) with expected value", serverState));
     }
 
-    @Test
-    public void testCreate2() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testCreate2(ServerState serverState) throws Exception {
+        setUp(serverState);
         zkClient.create(PARENT_PATH, DATA, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, null);
-        assertArrayEquals(String.format("%s Node created (create2) with expected value", serverState), DATA, zkClient.getData(PARENT_PATH, false, null));
+        assertArrayEquals(DATA, zkClient.getData(PARENT_PATH, false, null), String.format("%s Node created (create2) with expected value", serverState));
     }
 
-    @Test
-    public void testDelete() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testDelete(ServerState serverState) throws Exception {
+        setUp(serverState);
         create2EmptyNode(zkClient, PARENT_PATH);
         zkClient.delete(PARENT_PATH, -1);
-        assertNull(String.format("%s Node no longer exists", serverState), zkClient.exists(PARENT_PATH, false));
+        assertNull(zkClient.exists(PARENT_PATH, false), String.format("%s Node no longer exists", serverState));
     }
 
-    @Test
-    public void testExists() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testExists(ServerState serverState) throws Exception {
+        setUp(serverState);
         Stat stat = create2EmptyNode(zkClient, PARENT_PATH);
-        assertEquals(String.format("%s Exists returns correct node stat", serverState), stat, zkClient.exists(PARENT_PATH, false));
+        assertEquals(stat, zkClient.exists(PARENT_PATH, false), String.format("%s Exists returns correct node stat", serverState));
     }
 
-    @Test
-    public void testSetAndGetData() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testSetAndGetData(ServerState serverState) throws Exception {
+        setUp(serverState);
         create2EmptyNode(zkClient, PARENT_PATH);
         zkClient.setData(PARENT_PATH, DATA, -1);
-        assertArrayEquals(String.format("%s Node updated with expected value", serverState), DATA, zkClient.getData(PARENT_PATH, false, null));
+        assertArrayEquals(DATA, zkClient.getData(PARENT_PATH, false, null), String.format("%s Node updated with expected value", serverState));
     }
 
-    @Test
-    public void testSetAndGetACL() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testSetAndGetACL(ServerState serverState) throws Exception {
+        setUp(serverState);
         create2EmptyNode(zkClient, PARENT_PATH);
-        assertEquals(String.format("%s Node has open ACL", serverState), Ids.OPEN_ACL_UNSAFE, zkClient.getACL(PARENT_PATH, new Stat()));
+        assertEquals(Ids.OPEN_ACL_UNSAFE, zkClient.getACL(PARENT_PATH, new Stat()), String.format("%s Node has open ACL", serverState));
         zkClient.setACL(PARENT_PATH, Ids.READ_ACL_UNSAFE, -1);
-        assertEquals(String.format("%s Node has world read-only ACL", serverState), Ids.READ_ACL_UNSAFE, zkClient.getACL(PARENT_PATH, new Stat()));
+        assertEquals(Ids.READ_ACL_UNSAFE, zkClient.getACL(PARENT_PATH, new Stat()), String.format("%s Node has world read-only ACL", serverState));
     }
 
-    @Test
-    public void testSetAndGetChildren() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testSetAndGetChildren(ServerState serverState) throws Exception {
+        setUp(serverState);
         create2EmptyNode(zkClient, PARENT_PATH);
         for (String child : CHILDREN) {
             create2EmptyNode(zkClient, PARENT_PATH + "/" + child);
         }
-        assertEquals(String.format("%s Parent has expected children", serverState), CHILDREN, new HashSet<String>(zkClient.getChildren(PARENT_PATH, false)));
+        assertEquals(CHILDREN, new HashSet<String>(zkClient.getChildren(PARENT_PATH, false)), String.format("%s Parent has expected children", serverState));
     }
 
-    @Test
-    public void testSetAndGetChildren2() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testSetAndGetChildren2(ServerState serverState) throws Exception {
+        setUp(serverState);
         create2EmptyNode(zkClient, PARENT_PATH);
         for (String child : CHILDREN) {
             create2EmptyNode(zkClient, PARENT_PATH + "/" + child);
         }
-        assertEquals(String.format("%s Parent has expected children", serverState), CHILDREN, new HashSet<String>(zkClient.getChildren(PARENT_PATH, false, null)));
+        assertEquals(CHILDREN, new HashSet<String>(zkClient.getChildren(PARENT_PATH, false, null)), String.format("%s Parent has expected children", serverState));
     }
 
-    @Test
-    public void testSync() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testSync(ServerState serverState) throws Exception {
+        setUp(serverState);
         complete = false;
         create2EmptyNode(zkClient, PARENT_PATH);
         VoidCallback onSync = new VoidCallback() {
@@ -158,7 +178,18 @@ public void processResult(int rc, String path, Object ctx) {
         };
         zkClient.sync(PARENT_PATH, onSync, null);
         callComplete.await(30, TimeUnit.SECONDS);
-        assertTrue(String.format("%s Sync completed", serverState), complete);
+        assertTrue(complete, String.format("%s Sync completed", serverState));
     }
 
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testSynchronousSync(ServerState serverState) throws Exception {
+        setUp(serverState);
+        create2EmptyNode(zkClient, PARENT_PATH);
+        ForkJoinTask<Void> task = ForkJoinPool.commonPool().submit(() -> {
+            zkClient.sync(PARENT_PATH);
+            return null;
+        });
+        task.get(30, TimeUnit.SECONDS);
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java
index 593edbd9245..16713342412 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSSLTest.java
@@ -20,10 +20,10 @@
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
 import static org.apache.zookeeper.test.ClientBase.createTmpDir;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import com.sun.net.httpserver.Headers;
 import com.sun.net.httpserver.HttpHandler;
 import com.sun.net.httpserver.HttpServer;
@@ -32,8 +32,12 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
 import java.math.BigInteger;
 import java.net.InetSocketAddress;
+import java.net.URLDecoder;
+import java.nio.file.Path;
 import java.security.KeyPair;
 import java.security.KeyPairGenerator;
 import java.security.KeyStore;
@@ -45,6 +49,8 @@
 import java.security.cert.CertificateEncodingException;
 import java.security.cert.X509Certificate;
 import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Base64;
 import java.util.Calendar;
 import java.util.Date;
 import java.util.HashMap;
@@ -56,6 +62,7 @@
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.common.QuorumX509Util;
+import org.apache.zookeeper.common.SecretUtilsTest;
 import org.apache.zookeeper.server.ServerCnxnFactory;
 import org.apache.zookeeper.test.ClientBase;
 import org.bouncycastle.asn1.ocsp.OCSPResponse;
@@ -109,20 +116,33 @@
 import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
 import org.bouncycastle.operator.jcajce.JcaDigestCalculatorProviderBuilder;
 import org.bouncycastle.util.io.pem.PemWriter;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Rule;
-import org.junit.Test;
-import org.junit.rules.Timeout;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Timeout;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
 
 public class QuorumSSLTest extends QuorumPeerTestBase {
 
+    @Retention(RetentionPolicy.RUNTIME)
+    @ParameterizedTest(name = "fipsEnabled = {0}")
+    @ValueSource(booleans = { false, true})
+    private @interface TestBothFipsModes {
+    }
+
+    @Retention(RetentionPolicy.RUNTIME)
+    @ParameterizedTest(name = "fipsEnabled = {0}")
+    @ValueSource(booleans = { false })
+    private @interface TestNoFipsOnly {
+    }
+
     private static final String SSL_QUORUM_ENABLED = "sslQuorum=true\n";
     private static final String PORT_UNIFICATION_ENABLED = "portUnification=true\n";
     private static final String PORT_UNIFICATION_DISABLED = "portUnification=false\n";
 
     private static final char[] PASSWORD = "testpass".toCharArray();
     private static final String HOSTNAME = "localhost";
+    private static final String IPADDRESS = "127.0.0.1";
 
     private QuorumX509Util quorumX509Util;
 
@@ -150,10 +170,7 @@ public class QuorumSSLTest extends QuorumPeerTestBase {
     private Date certStartTime;
     private Date certEndTime;
 
-    @Rule
-    public Timeout timeout = Timeout.builder().withTimeout(5, TimeUnit.MINUTES).withLookingForStuckThread(true).build();
-
-    @Before
+    @BeforeEach
     public void setup() throws Exception {
         quorumX509Util = new QuorumX509Util();
         ClientBase.setupTestEnv();
@@ -179,12 +196,12 @@ public void setup() throws Exception {
 
         rootKeyPair = createKeyPair();
         contentSigner = new JcaContentSignerBuilder("SHA256WithRSAEncryption").build(rootKeyPair.getPrivate());
-        rootCertificate = createSelfSignedCertifcate(rootKeyPair);
+        rootCertificate = createSelfSignedCertificate(rootKeyPair);
 
         // Write the truststore
         KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
         trustStore.load(null, PASSWORD);
-        trustStore.setCertificateEntry(rootCertificate.getSubjectDN().toString(), rootCertificate);
+        trustStore.setCertificateEntry(rootCertificate.getSubjectX500Principal().toString(), rootCertificate);
         FileOutputStream outputStream = new FileOutputStream(truststorePath);
         trustStore.store(outputStream, PASSWORD);
         outputStream.flush();
@@ -228,12 +245,24 @@ public OCSPHandler(X509Certificate revokedCert) {
         public void handle(com.sun.net.httpserver.HttpExchange httpExchange) throws IOException {
             byte[] responseBytes;
             try {
+                String uri = httpExchange.getRequestURI().toString();
+                LOG.info("OCSP request: {} {}", httpExchange.getRequestMethod(), uri);
+                httpExchange.getRequestHeaders().entrySet().forEach((e) -> {
+                    LOG.info("OCSP request header: {} {}", e.getKey(), e.getValue());
+                });
                 InputStream request = httpExchange.getRequestBody();
                 byte[] requestBytes = new byte[10000];
-                request.read(requestBytes);
+                int len = request.read(requestBytes);
+                LOG.info("OCSP request size {}", len);
 
+                if (len < 0) {
+                    String removedUriEncoding = URLDecoder.decode(uri.substring(1), "utf-8");
+                    LOG.info("OCSP request from URI no encoding {}", removedUriEncoding);
+                    requestBytes = Base64.getDecoder().decode(removedUriEncoding);
+                }
                 OCSPReq ocspRequest = new OCSPReq(requestBytes);
                 Req[] requestList = ocspRequest.getRequestList();
+                LOG.info("requestList {}", Arrays.toString(requestList));
 
                 DigestCalculator digestCalculator = new JcaDigestCalculatorProviderBuilder().build().get(CertificateID.HASH_SHA1);
 
@@ -247,16 +276,21 @@ public void handle(com.sun.net.httpserver.HttpExchange httpExchange) throws IOEx
                     } else {
                         certificateStatus = CertificateStatus.GOOD;
                     }
-
+                    LOG.info("addResponse {} {}", certId, certificateStatus);
                     responseBuilder.addResponse(certId, certificateStatus, null);
                 }
 
                 X509CertificateHolder[] chain = new X509CertificateHolder[]{new JcaX509CertificateHolder(rootCertificate)};
                 ContentSigner signer = new JcaContentSignerBuilder("SHA1withRSA").setProvider("BC").build(rootKeyPair.getPrivate());
                 BasicOCSPResp ocspResponse = responseBuilder.build(signer, chain, Calendar.getInstance().getTime());
-
+                LOG.info("response {}", ocspResponse);
                 responseBytes = new OCSPRespBuilder().build(OCSPRespBuilder.SUCCESSFUL, ocspResponse).getEncoded();
+                LOG.error("OCSP server response OK");
             } catch (OperatorException | CertificateEncodingException | OCSPException exception) {
+                LOG.error("Internal OCSP server error", exception);
+                responseBytes = new OCSPResp(new OCSPResponse(new OCSPResponseStatus(OCSPRespBuilder.INTERNAL_ERROR), null)).getEncoded();
+            } catch (Throwable exception) {
+                LOG.error("Internal OCSP server error", exception);
                 responseBytes = new OCSPResp(new OCSPResponse(new OCSPResponseStatus(OCSPRespBuilder.INTERNAL_ERROR), null)).getEncoded();
             }
 
@@ -271,7 +305,7 @@ public void handle(com.sun.net.httpserver.HttpExchange httpExchange) throws IOEx
 
     }
 
-    private X509Certificate createSelfSignedCertifcate(KeyPair keyPair) throws Exception {
+    private X509Certificate createSelfSignedCertificate(KeyPair keyPair) throws Exception {
         X500NameBuilder nameBuilder = new X500NameBuilder(BCStyle.INSTANCE);
         nameBuilder.addRDN(BCStyle.CN, HOSTNAME);
         BigInteger serialNumber = new BigInteger(128, new Random());
@@ -428,7 +462,7 @@ public void setSSLSystemProperties() {
         System.setProperty(quorumX509Util.getSslTruststorePasswdProperty(), "testpass");
     }
 
-    @After
+    @AfterEach
     public void cleanUp() throws Exception {
         System.clearProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_ENABLED);
         clearSSLSystemProperties();
@@ -449,17 +483,23 @@ public void cleanUp() throws Exception {
     private void clearSSLSystemProperties() {
         System.clearProperty(quorumX509Util.getSslKeystoreLocationProperty());
         System.clearProperty(quorumX509Util.getSslKeystorePasswdProperty());
+        System.clearProperty(quorumX509Util.getSslKeystorePasswdPathProperty());
         System.clearProperty(quorumX509Util.getSslTruststoreLocationProperty());
         System.clearProperty(quorumX509Util.getSslTruststorePasswdProperty());
+        System.clearProperty(quorumX509Util.getSslTruststorePasswdPathProperty());
         System.clearProperty(quorumX509Util.getSslHostnameVerificationEnabledProperty());
+        System.clearProperty(quorumX509Util.getSslAllowReverseDnsLookupProperty());
         System.clearProperty(quorumX509Util.getSslOcspEnabledProperty());
         System.clearProperty(quorumX509Util.getSslCrlEnabledProperty());
         System.clearProperty(quorumX509Util.getCipherSuitesProperty());
         System.clearProperty(quorumX509Util.getSslProtocolProperty());
     }
 
-    @Test
-    public void testQuorumSSL() throws Exception {
+    @TestBothFipsModes
+    @Timeout(value = 5, unit = TimeUnit.MINUTES)
+    public void testQuorumSSL(boolean fipsEnabled) throws Exception {
+        System.setProperty(quorumX509Util.getFipsModeProperty(), Boolean.toString(fipsEnabled));
+
         q1 = new MainThread(1, clientPortQp1, quorumConfiguration, SSL_QUORUM_ENABLED);
         q2 = new MainThread(2, clientPortQp2, quorumConfiguration, SSL_QUORUM_ENABLED);
 
@@ -478,9 +518,37 @@ public void testQuorumSSL() throws Exception {
         assertFalse(ClientBase.waitForServerUp("127.0.0.1:" + clientPortQp3, CONNECTION_TIMEOUT));
     }
 
+    @TestBothFipsModes
+    @Timeout(value = 5, unit = TimeUnit.MINUTES)
+    public void testQuorumSSL_withPasswordFromFile(boolean fipsEnabled) throws Exception {
+        System.setProperty(quorumX509Util.getFipsModeProperty(), Boolean.toString(fipsEnabled));
+
+        final Path secretFile = SecretUtilsTest.createSecretFile(String.valueOf(PASSWORD));
+
+        System.clearProperty(quorumX509Util.getSslKeystorePasswdProperty());
+        System.setProperty(quorumX509Util.getSslKeystorePasswdPathProperty(), secretFile.toString());
+
+        System.clearProperty(quorumX509Util.getSslTruststorePasswdProperty());
+        System.setProperty(quorumX509Util.getSslTruststorePasswdPathProperty(), secretFile.toString());
+
+        q1 = new MainThread(1, clientPortQp1, quorumConfiguration, SSL_QUORUM_ENABLED);
+        q2 = new MainThread(2, clientPortQp2, quorumConfiguration, SSL_QUORUM_ENABLED);
+        q3 = new MainThread(3, clientPortQp3, quorumConfiguration, SSL_QUORUM_ENABLED);
+
+        q1.start();
+        q2.start();
+        q3.start();
+
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPortQp1, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPortQp2, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPortQp3, CONNECTION_TIMEOUT));
+    }
+
+    @TestBothFipsModes
+    @Timeout(value = 5, unit = TimeUnit.MINUTES)
+    public void testQuorumSSLWithMultipleAddresses(boolean fipsEnabled) throws Exception {
+        System.setProperty(quorumX509Util.getFipsModeProperty(), Boolean.toString(fipsEnabled));
 
-    @Test
-    public void testQuorumSSLWithMultipleAddresses() throws Exception {
         System.setProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_ENABLED, "true");
         quorumConfiguration = generateMultiAddressQuorumConfiguration();
 
@@ -503,8 +571,11 @@ public void testQuorumSSLWithMultipleAddresses() throws Exception {
     }
 
 
-    @Test
-    public void testRollingUpgrade() throws Exception {
+    @TestBothFipsModes
+    @Timeout(value = 5, unit = TimeUnit.MINUTES)
+    public void testRollingUpgrade(boolean fipsEnabled) throws Exception {
+        System.setProperty(quorumX509Util.getFipsModeProperty(), Boolean.toString(fipsEnabled));
+
         // Form a quorum without ssl
         q1 = new MainThread(1, clientPortQp1, quorumConfiguration);
         q2 = new MainThread(2, clientPortQp2, quorumConfiguration);
@@ -550,8 +621,10 @@ private void stopAppendConfigRestartAll(Map<Integer, MainThread> members, String
         }
     }
 
-    @Test
-    public void testHostnameVerificationWithInvalidHostname() throws Exception {
+    @TestNoFipsOnly
+    @Timeout(value = 5, unit = TimeUnit.MINUTES)
+    public void testHostnameVerificationWithInvalidHostname(boolean fipsEnabled) throws Exception {
+        System.setProperty(quorumX509Util.getFipsModeProperty(), Boolean.toString(fipsEnabled));
         String badhostnameKeystorePath = tmpDir + "/badhost.jks";
         X509Certificate badHostCert = buildEndEntityCert(
             defaultKeyPair,
@@ -566,8 +639,10 @@ public void testHostnameVerificationWithInvalidHostname() throws Exception {
         testHostnameVerification(badhostnameKeystorePath, false);
     }
 
-    @Test
-    public void testHostnameVerificationWithInvalidIPAddress() throws Exception {
+    @TestNoFipsOnly
+    @Timeout(value = 5, unit = TimeUnit.MINUTES)
+    public void testHostnameVerificationWithInvalidIPAddress(boolean fipsEnabled) throws Exception {
+        System.setProperty(quorumX509Util.getFipsModeProperty(), Boolean.toString(fipsEnabled));
         String badhostnameKeystorePath = tmpDir + "/badhost.jks";
         X509Certificate badHostCert = buildEndEntityCert(
             defaultKeyPair,
@@ -582,8 +657,11 @@ public void testHostnameVerificationWithInvalidIPAddress() throws Exception {
         testHostnameVerification(badhostnameKeystorePath, false);
     }
 
-    @Test
-    public void testHostnameVerificationWithInvalidIpAddressAndInvalidHostname() throws Exception {
+    @TestNoFipsOnly
+    @Timeout(value = 5, unit = TimeUnit.MINUTES)
+    public void testHostnameVerificationWithInvalidIpAddressAndInvalidHostname(boolean fipsEnabled) throws Exception {
+        System.setProperty(quorumX509Util.getFipsModeProperty(), Boolean.toString(fipsEnabled));
+
         String badhostnameKeystorePath = tmpDir + "/badhost.jks";
         X509Certificate badHostCert = buildEndEntityCert(
             defaultKeyPair,
@@ -598,8 +676,11 @@ public void testHostnameVerificationWithInvalidIpAddressAndInvalidHostname() thr
         testHostnameVerification(badhostnameKeystorePath, false);
     }
 
-    @Test
-    public void testHostnameVerificationForInvalidMultiAddressServerConfig() throws Exception {
+    @TestNoFipsOnly
+    @Timeout(value = 5, unit = TimeUnit.MINUTES)
+    public void testHostnameVerificationForInvalidMultiAddressServerConfig(boolean fipsEnabled) throws Exception {
+        System.setProperty(quorumX509Util.getFipsModeProperty(), Boolean.toString(fipsEnabled));
+
         System.setProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_ENABLED, "true");
         quorumConfiguration = generateMultiAddressQuorumConfiguration();
 
@@ -617,8 +698,13 @@ public void testHostnameVerificationForInvalidMultiAddressServerConfig() throws
         testHostnameVerification(badhostnameKeystorePath, false);
     }
 
-    @Test
-    public void testHostnameVerificationWithInvalidIpAddressAndValidHostname() throws Exception {
+    @TestNoFipsOnly
+    @Timeout(value = 5, unit = TimeUnit.MINUTES)
+    public void testHostnameVerificationWithInvalidIpAddressAndValidHostname(boolean fipsEnabled) throws Exception {
+        System.setProperty(quorumX509Util.getFipsModeProperty(), Boolean.toString(fipsEnabled));
+        // We need reverse DNS lookup to get this working, because quorum is connecting via ip addresses
+        System.setProperty(quorumX509Util.getSslAllowReverseDnsLookupProperty(), Boolean.toString(true));
+
         String badhostnameKeystorePath = tmpDir + "/badhost.jks";
         X509Certificate badHostCert = buildEndEntityCert(
             defaultKeyPair,
@@ -633,8 +719,11 @@ public void testHostnameVerificationWithInvalidIpAddressAndValidHostname() throw
         testHostnameVerification(badhostnameKeystorePath, true);
     }
 
-    @Test
-    public void testHostnameVerificationWithValidIpAddressAndInvalidHostname() throws Exception {
+    @TestNoFipsOnly
+    @Timeout(value = 5, unit = TimeUnit.MINUTES)
+    public void testHostnameVerificationWithValidIpAddressAndInvalidHostname(boolean fipsEnabled) throws Exception {
+        System.setProperty(quorumX509Util.getFipsModeProperty(), Boolean.toString(fipsEnabled));
+
         String badhostnameKeystorePath = tmpDir + "/badhost.jks";
         X509Certificate badHostCert = buildEndEntityCert(
             defaultKeyPair,
@@ -699,8 +788,11 @@ private void testHostnameVerification(String keystorePath, boolean expectSuccess
             ClientBase.waitForServerUp("127.0.0.1:" + clientPortQp3, CONNECTION_TIMEOUT));
     }
 
-    @Test
-    public void testCertificateRevocationList() throws Exception {
+    @TestBothFipsModes
+    @Timeout(value = 5, unit = TimeUnit.MINUTES)
+    public void testCertificateRevocationList(boolean fipsEnabled) throws Exception {
+        System.setProperty(quorumX509Util.getFipsModeProperty(), Boolean.toString(fipsEnabled));
+
         q1 = new MainThread(1, clientPortQp1, quorumConfiguration, SSL_QUORUM_ENABLED);
         q2 = new MainThread(2, clientPortQp2, quorumConfiguration, SSL_QUORUM_ENABLED);
 
@@ -717,7 +809,7 @@ public void testCertificateRevocationList() throws Exception {
             rootCertificate,
             rootKeyPair.getPrivate(),
             HOSTNAME,
-            null,
+            IPADDRESS,
             crlPath,
             null);
         writeKeystore(revokedInCRLCert, defaultKeyPair, revokedInCRLKeystorePath);
@@ -747,7 +839,7 @@ public void testCertificateRevocationList() throws Exception {
             rootCertificate,
             rootKeyPair.getPrivate(),
             HOSTNAME,
-            null,
+            IPADDRESS,
             crlPath,
             null);
         writeKeystore(validCertificate, defaultKeyPair, validKeystorePath);
@@ -764,8 +856,11 @@ public void testCertificateRevocationList() throws Exception {
         assertFalse(ClientBase.waitForServerUp("127.0.0.1:" + clientPortQp3, CONNECTION_TIMEOUT));
     }
 
-    @Test
-    public void testOCSP() throws Exception {
+    @TestBothFipsModes
+    @Timeout(value = 5, unit = TimeUnit.MINUTES)
+    public void testOCSP(boolean fipsEnabled) throws Exception {
+        System.setProperty(quorumX509Util.getFipsModeProperty(), Boolean.toString(fipsEnabled));
+
         Integer ocspPort = PortAssignment.unique();
 
         q1 = new MainThread(1, clientPortQp1, quorumConfiguration, SSL_QUORUM_ENABLED);
@@ -783,7 +878,7 @@ public void testOCSP() throws Exception {
             rootCertificate,
             rootKeyPair.getPrivate(),
             HOSTNAME,
-            null,
+            IPADDRESS,
             null,
             ocspPort);
         writeKeystore(revokedInOCSPCert, defaultKeyPair, revokedInOCSPKeystorePath);
@@ -810,6 +905,7 @@ public void testOCSP() throws Exception {
             assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + clientPortQp3, CONNECTION_TIMEOUT));
 
             setSSLSystemProperties();
+            System.setProperty(quorumX509Util.getSslCrlEnabledProperty(), "true");
             System.setProperty(quorumX509Util.getSslOcspEnabledProperty(), "true");
 
             X509Certificate validCertificate = buildEndEntityCert(
@@ -817,7 +913,7 @@ public void testOCSP() throws Exception {
                 rootCertificate,
                 rootKeyPair.getPrivate(),
                 HOSTNAME,
-                null,
+                IPADDRESS,
                 null,
                 ocspPort);
             writeKeystore(validCertificate, defaultKeyPair, validKeystorePath);
@@ -837,11 +933,14 @@ public void testOCSP() throws Exception {
         }
     }
 
-    @Test
-    public void testCipherSuites() throws Exception {
+    @TestBothFipsModes
+    @Timeout(value = 5, unit = TimeUnit.MINUTES)
+    public void testCipherSuites(boolean fipsEnabled) throws Exception {
+        System.setProperty(quorumX509Util.getFipsModeProperty(), Boolean.toString(fipsEnabled));
+
         // Get default cipher suites from JDK
         SSLServerSocketFactory ssf = (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
-        List<String> defaultCiphers = new ArrayList<String>();
+        List<String> defaultCiphers = new ArrayList<>();
         for (String cipher : ssf.getDefaultCipherSuites()) {
             if (!cipher.matches(".*EMPTY.*") && cipher.startsWith("TLS") && cipher.contains("RSA")) {
                 defaultCiphers.add(cipher);
@@ -877,8 +976,10 @@ public void testCipherSuites() throws Exception {
         assertFalse(ClientBase.waitForServerUp("127.0.0.1:" + clientPortQp3, CONNECTION_TIMEOUT));
     }
 
-    @Test
-    public void testProtocolVersion() throws Exception {
+    @TestBothFipsModes
+    @Timeout(value = 5, unit = TimeUnit.MINUTES)
+    public void testProtocolVersion(boolean fipsEnabled) throws Exception {
+        System.setProperty(quorumX509Util.getFipsModeProperty(), Boolean.toString(fipsEnabled));
         System.setProperty(quorumX509Util.getSslProtocolProperty(), "TLSv1.2");
 
         q1 = new MainThread(1, clientPortQp1, quorumConfiguration, SSL_QUORUM_ENABLED);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumServerTest.java
index 6f5155bf022..df4744543da 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumServerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumServerTest.java
@@ -17,14 +17,17 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import java.net.InetSocketAddress;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
-import org.junit.After;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
 
 public class QuorumServerTest extends ZKTestCase {
 
@@ -32,7 +35,7 @@ public class QuorumServerTest extends ZKTestCase {
     private String ipv6n2 = "[2600:0:0:0:0:0:1:0]";
     private String ipv4config = "127.0.0.1:1234:1236";
 
-    @After
+    @AfterEach
     public void tearDown() {
         System.clearProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_ENABLED);
     }
@@ -42,32 +45,43 @@ public void testToString() throws ConfigException {
         String provided = ipv4config + ":participant;0.0.0.0:1237";
         String expected = ipv4config + ":participant;0.0.0.0:1237";
         QuorumServer qs = new QuorumServer(0, provided);
-        assertEquals("Use IP address", expected, qs.toString());
+        assertEquals(expected, qs.toString(), "Use IP address");
 
         provided = ipv4config + ";0.0.0.0:1237";
         expected = ipv4config + ":participant;0.0.0.0:1237";
         qs = new QuorumServer(0, provided);
-        assertEquals("Type unspecified", expected, qs.toString());
+        assertEquals(expected, qs.toString(), "Type unspecified");
 
         provided = ipv4config + ":observer;0.0.0.0:1237";
         expected = ipv4config + ":observer;0.0.0.0:1237";
         qs = new QuorumServer(0, provided);
-        assertEquals("Observer type", expected, qs.toString());
+        assertEquals(expected, qs.toString(), "Observer type");
 
         provided = ipv4config + ":participant;1237";
         expected = ipv4config + ":participant;0.0.0.0:1237";
         qs = new QuorumServer(0, provided);
-        assertEquals("Client address unspecified", expected, qs.toString());
+        assertEquals(expected, qs.toString(), "Client address unspecified");
 
         provided = ipv4config + ":participant;1.2.3.4:1237";
         expected = ipv4config + ":participant;1.2.3.4:1237";
         qs = new QuorumServer(0, provided);
-        assertEquals("Client address specified", expected, qs.toString());
+        assertEquals(expected, qs.toString(), "Client address specified");
 
         provided = "example.com:1234:1236:participant;1237";
         expected = "example.com:1234:1236:participant;0.0.0.0:1237";
         qs = new QuorumServer(0, provided);
-        assertEquals("Use hostname", expected, qs.toString());
+        assertEquals(expected, qs.toString(), "Use hostname");
+
+        provided = "example.com:1234:1236:participant;1237;1238";
+        expected = "example.com:1234:1236:participant;0.0.0.0:1237;0.0.0.0:1238";
+        qs = new QuorumServer(0, provided);
+        assertEquals(expected, qs.toString(), "clientPort and secureClientPort");
+
+        provided = ipv4config + ":participant;;1.2.3.4:1237";
+        expected = ipv4config + ":participant;;1.2.3.4:1237";
+        qs = new QuorumServer(0, provided);
+        assertEquals(expected, qs.toString(), "Only secureClientPort");
+
     }
 
     @Test
@@ -84,27 +98,36 @@ public void constructionUnderstandsIpv6LiteralsInClientConfig() throws ConfigExc
         assertEquals(ipv4config + ":participant;[0:0:0:0:0:0:0:1]:1237", qs.toString());
     }
 
-    @Test(expected = ConfigException.class)
-    public void unbalancedIpv6LiteralsInServerConfigFailToBeParsed() throws ConfigException {
-        new QuorumServer(0, "[::1:1234:1236:participant");
+    @Test
+    public void unbalancedIpv6LiteralsInServerConfigFailToBeParsed()  {
+        assertThrows(ConfigException.class, () -> {
+            new QuorumServer(0, "[::1:1234:1236:participant");
+        });
     }
 
-    @Test(expected = ConfigException.class)
-    public void unbalancedIpv6LiteralsInClientConfigFailToBeParsed() throws ConfigException {
-        new QuorumServer(0, ipv4config + ":participant;[::1:1237");
+    @Test
+    public void unbalancedIpv6LiteralsInClientConfigFailToBeParsed() {
+        assertThrows(ConfigException.class, () -> {
+            new QuorumServer(0, ipv4config + ":participant;[::1:1237");
+        });
     }
 
-    @Test(expected = ConfigException.class)
-    public void shouldNotAllowMultipleAddressesWhenMultiAddressFeatureIsDisabled() throws ConfigException {
-        System.setProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_ENABLED, "false");
-        new QuorumServer(0, "127.0.0.1:1234:1236|127.0.0.1:2234:2236");
+    @Test
+    public void shouldNotAllowMultipleAddressesWhenMultiAddressFeatureIsDisabled() {
+        assertThrows(ConfigException.class, () -> {
+            System.setProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_ENABLED, "false");
+            new QuorumServer(0, "127.0.0.1:1234:1236|127.0.0.1:2234:2236");
+        });
     }
 
     @Test
     public void shouldAllowMultipleAddressesWhenMultiAddressFeatureIsEnabled() throws ConfigException {
         System.setProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_ENABLED, "true");
         QuorumServer qs = new QuorumServer(0, "127.0.0.1:1234:1236|127.0.0.1:2234:2236");
-        assertEquals("MultiAddress parse error", "127.0.0.1:1234:1236|127.0.0.1:2234:2236:participant", qs.toString());
+        assertEquals("127.0.0.1:1234:1236|127.0.0.1:2234:2236:participant", qs.toString(), "MultiAddress parse error");
+
+        qs = new QuorumServer(0, "127.0.0.1:1234:1236|127.0.0.1:2234:2236;1237;1238");
+        assertEquals("127.0.0.1:1234:1236|127.0.0.1:2234:2236:participant;0.0.0.0:1237;0.0.0.0:1238", qs.toString(), "MultiAddress parse with clientPort and secureClientPort");
     }
 
     @Test
@@ -125,17 +148,46 @@ public void testWildcard() throws KeeperException.BadArgumentsException {
         }
     }
 
-    @Test(expected = KeeperException.BadArgumentsException.class)
-    public void testDuplicate() throws KeeperException.BadArgumentsException {
-        QuorumPeer.QuorumServer server1 = new QuorumPeer.QuorumServer(1, new InetSocketAddress(ipv6n1, 1234), // peer
-                                                                      new InetSocketAddress(ipv6n1, 1236), // election
-                                                                      new InetSocketAddress(ipv6n1, 1237)  // client
-        );
-        QuorumPeer.QuorumServer server2 = new QuorumPeer.QuorumServer(2, new InetSocketAddress(ipv6n2, 1234), // peer
-                                                                      new InetSocketAddress(ipv6n2, 1236), // election
-                                                                      new InetSocketAddress(ipv6n1, 1237)  // client
-        );
-        server1.checkAddressDuplicate(server2);
+    @Test
+    public void testDuplicate() {
+        assertThrows(KeeperException.BadArgumentsException.class, () -> {
+            QuorumPeer.QuorumServer server1 = new QuorumPeer.QuorumServer(1, new InetSocketAddress(ipv6n1, 1234), // peer
+                    new InetSocketAddress(ipv6n1, 1236), // election
+                    new InetSocketAddress(ipv6n1, 1237)  // client
+            );
+            QuorumPeer.QuorumServer server2 = new QuorumPeer.QuorumServer(2, new InetSocketAddress(ipv6n2, 1234), // peer
+                    new InetSocketAddress(ipv6n2, 1236), // election
+                    new InetSocketAddress(ipv6n1, 1237)  // client
+            );
+            server1.checkAddressDuplicate(server2);
+        });
+    }
+
+    @Test
+    public void testClientAddrAndSecureClientAddr() throws ConfigException {
+        QuorumPeer.QuorumServer qs = new QuorumPeer.QuorumServer(0, "example.com:1234:1236:participant;1237;1238");
+        assertNotNull(qs.clientAddr, "clientPort specified");
+        assertNotNull(qs.secureClientAddr, "secureClientPort specified");
+
+        qs = new QuorumPeer.QuorumServer(0, "example.com:1234:1236:participant;;1238");
+        assertNull(qs.clientAddr, "clientPort not specified");
+        assertNotNull(qs.secureClientAddr, "secureClientPort specified");
+
+        qs = new QuorumPeer.QuorumServer(0, "example.com:1234:1236:participant;1237;");
+        assertNotNull(qs.clientAddr, "clientPort specified");
+        assertNull(qs.secureClientAddr, "secureClientPort not specified");
+
+        qs = new QuorumPeer.QuorumServer(0, "example.com:1234:1236:participant;1237");
+        assertNotNull(qs.clientAddr, "clientPort specified");
+        assertNull(qs.secureClientAddr, "secureClientPort not specified");
+
+        qs = new QuorumPeer.QuorumServer(0, "example.com:1234:1236:participant");
+        assertNull(qs.clientAddr, "clientPort not specified");
+        assertNull(qs.secureClientAddr, "secureClientPort not specified");
+
+        qs = new QuorumPeer.QuorumServer(0, "example.com:1234:1236:participant;;");
+        assertNull(qs.clientAddr, "clientPort not specified");
+        assertNull(qs.secureClientAddr, "secureClientPort not specified");
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSyncTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSyncTest.java
new file mode 100644
index 00000000000..c4b7720cf92
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/QuorumSyncTest.java
@@ -0,0 +1,100 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.quorum;
+
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import java.util.Comparator;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.test.ClientBase;
+import org.apache.zookeeper.test.QuorumUtil;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+
+public class QuorumSyncTest extends ZKTestCase {
+    private QuorumUtil qu;
+
+    @AfterEach
+    public void tearDown() throws Exception {
+        if (qu != null) {
+            qu.shutdownAll();
+        }
+    }
+
+    @Test
+    public void testStaleDiffSync() throws Exception {
+        qu = new QuorumUtil(2);
+        qu.startAll();
+
+        int[] followerIds = qu.getFollowerQuorumPeers()
+            .stream()
+            .sorted(Comparator.comparingLong(QuorumPeer::getMyId).reversed())
+            .mapToInt(peer -> (int) peer.getMyId()).toArray();
+
+        int follower1 = followerIds[0];
+        int follower2 = followerIds[1];
+
+        String leaderConnectString = qu.getConnectString(qu.getLeaderQuorumPeer());
+        try (ZooKeeper zk = ClientBase.createZKClient(leaderConnectString)) {
+            qu.shutdown(follower2);
+
+            for (int i = 0; i < 10; i++) {
+                zk.create("/foo" + i, null, ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            }
+
+            qu.shutdown(follower1);
+
+            for (int i = 0; i < 10; i++) {
+                zk.create("/bar" + i, null, ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            }
+
+            qu.restart(follower1);
+        }
+
+        try (ZooKeeper zk = ClientBase.createZKClient(qu.getConnectionStringForServer(follower1))) {
+            for (int i = 0; i < 10; i++) {
+                String path = "/foo" + i;
+                assertNotNull(zk.exists(path, false), path + " not found");
+            }
+
+            for (int i = 0; i < 10; i++) {
+                String path = "/bar" + i;
+                assertNotNull(zk.exists(path, false), path + " not found");
+            }
+        }
+
+        qu.shutdown(qu.getLeaderServer());
+
+        qu.restart(follower2);
+
+        try (ZooKeeper zk = ClientBase.createZKClient(qu.getConnectionStringForServer(follower2))) {
+            for (int i = 0; i < 10; i++) {
+                String path = "/foo" + i;
+                assertNotNull(zk.exists(path, false), path + " not found");
+            }
+
+            for (int i = 0; i < 10; i++) {
+                String path = "/bar" + i;
+                assertNotNull(zk.exists(path, false), path + " not found");
+            }
+        }
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/RaceConditionTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/RaceConditionTest.java
index 38739a1f2eb..5216eb70324 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/RaceConditionTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/RaceConditionTest.java
@@ -19,11 +19,10 @@
 package org.apache.zookeeper.server.quorum;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
 import java.net.SocketException;
-import java.nio.ByteBuffer;
 import javax.security.sasl.SaslException;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.ZooDefs;
@@ -32,13 +31,16 @@
 import org.apache.zookeeper.server.PrepRequestProcessor;
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.RequestProcessor;
+import org.apache.zookeeper.server.RequestRecord;
 import org.apache.zookeeper.server.SyncRequestProcessor;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Test;
+import org.apache.zookeeper.txn.DeleteTxn;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -57,13 +59,14 @@ public class RaceConditionTest extends QuorumPeerTestBase {
      * Deadlock while shutting down the ZooKeeper
      */
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testRaceConditionBetweenLeaderAndAckRequestProcessor() throws Exception {
         mt = startQuorum();
         // get leader
         QuorumPeer leader = getLeader(mt);
         long oldLeaderCurrentEpoch = leader.getCurrentEpoch();
-        assertNotNull("Leader should not be null", leader);
+        assertNotNull(leader, "Leader should not be null");
         // shutdown 2 followers so that leader does not have majority and goes
         // into looking state or following/leading state.
         shutdownFollowers(mt);
@@ -75,18 +78,16 @@ public void testRaceConditionBetweenLeaderAndAckRequestProcessor() throws Except
          * after the leader election, not the old LEADING state.
          * </pre>
          */
-        boolean leaderStateChanged = ClientBase.waitForServerState(leader, 15000, QuorumStats.Provider.LOOKING_STATE, QuorumStats.Provider.FOLLOWING_STATE);
+        boolean leaderStateChanged = ClientBase
+            .waitForServerState(leader, 15000, QuorumStats.Provider.LOOKING_STATE, QuorumStats.Provider.FOLLOWING_STATE);
         // Wait for the old leader to start completely
-        assertTrue(
-                "Failed to bring up the old leader server",
-                ClientBase.waitForServerUp("127.0.0.1:" + leader.getClientPort(), CONNECTION_TIMEOUT));
-        assertTrue(
-                "Leader failed to transition to new state. Current state is " + leader.getServerState(),
-                leaderStateChanged
-                        || (leader.getCurrentEpoch() > oldLeaderCurrentEpoch));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + leader.getClientPort(), CONNECTION_TIMEOUT),
+            "Failed to bring up the old leader server");
+        assertTrue(leaderStateChanged || (leader.getCurrentEpoch() > oldLeaderCurrentEpoch),
+            "Leader failed to transition to new state. Current state is " + leader.getServerState());
     }
 
-    @After
+    @AfterEach
     public void tearDown() {
         // stop all severs
         if (null != mt) {
@@ -130,8 +131,8 @@ public TestQPMain getTestQPMain() {
         // ensure all servers started
         for (int i = 0; i < SERVER_COUNT; i++) {
             assertTrue(
-                    "waiting for server " + i + " being up",
-                    ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                "waiting for server " + i + " being up");
         }
         return mt;
     }
@@ -220,7 +221,8 @@ public void shutdown() {
              * Add a request so that something is there for SyncRequestProcessor
              * to process, while we are in shutdown flow
              */
-            Request request = new Request(null, 0, 0, ZooDefs.OpCode.delete, ByteBuffer.wrap("/deadLockIssue".getBytes()), null);
+            DeleteTxn deleteTxn = new DeleteTxn("/deadLockIssue");
+            Request request = new Request(null, 0, 0, ZooDefs.OpCode.delete, RequestRecord.fromRecord(deleteTxn), null);
             processRequest(request);
             super.shutdown();
         }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServerTest.java
new file mode 100644
index 00000000000..298b5d1d95f
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReadOnlyZooKeeperServerTest.java
@@ -0,0 +1,62 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.quorum;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.mock;
+import org.apache.zookeeper.proto.ConnectRequest;
+import org.apache.zookeeper.server.MockServerCnxn;
+import org.apache.zookeeper.server.ServerCnxn;
+import org.apache.zookeeper.server.ZKDatabase;
+import org.apache.zookeeper.server.ZooKeeperServer;
+import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
+import org.junit.jupiter.api.Test;
+
+/**
+ * test ReadOnlyZooKeeperServer
+ */
+public class ReadOnlyZooKeeperServerTest {
+
+    /**
+     * test method {@link ZooKeeperServer#processConnectRequest(ServerCnxn, ConnectRequest)}
+     */
+    @Test
+    public void testReadOnlyZookeeperServer() {
+        ReadOnlyZooKeeperServer readOnlyZooKeeperServer = new ReadOnlyZooKeeperServer(
+                mock(FileTxnSnapLog.class),
+                mock(QuorumPeer.class),
+                mock(ZKDatabase.class));
+
+        final ConnectRequest request = new ConnectRequest();
+        request.setProtocolVersion(1);
+        request.setLastZxidSeen(99L);
+        request.setTimeOut(500);
+        request.setSessionId(123L);
+        request.setPasswd(new byte[]{ 1 });
+        request.setReadOnly(false);
+
+        ServerCnxn.CloseRequestException e = assertThrows(
+                ServerCnxn.CloseRequestException.class,
+                () -> readOnlyZooKeeperServer.processConnectRequest(new MockServerCnxn(), request));
+        assertEquals(e.getReason(), ServerCnxn.DisconnectReason.NOT_READ_ONLY_CLIENT);
+    }
+
+
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigBackupTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigBackupTest.java
index 8efb9d7cce9..cb03b2f8f71 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigBackupTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigBackupTest.java
@@ -18,29 +18,29 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
-import java.io.FileNotFoundException;
 import java.io.IOException;
 import java.io.StringReader;
+import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.List;
 import java.util.Properties;
-import java.util.Scanner;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.admin.ZooKeeperAdmin;
 import org.apache.zookeeper.common.StringUtils;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ReconfigTest;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class ReconfigBackupTest extends QuorumPeerTestBase {
 
@@ -50,17 +50,7 @@ public static String getVersionFromConfigStr(String config) throws IOException {
         return props.getProperty("version", "");
     }
 
-    // upgrade this once we have Google-Guava or Java 7+
-    public static String getFileContent(File file) throws FileNotFoundException {
-        Scanner sc = new Scanner(file);
-        StringBuilder sb = new StringBuilder();
-        while (sc.hasNextLine()) {
-            sb.append(sc.nextLine() + "\n");
-        }
-        return sb.toString();
-    }
-
-    @Before
+    @BeforeEach
     public void setup() {
         ClientBase.setupTestEnv();
         System.setProperty("zookeeper.DigestAuthenticationProvider.superDigest", "super:D/InIHSb7yEEbrWz8b9l71RjZJU="/* password is 'test'*/);
@@ -92,18 +82,17 @@ public void testBackupStatic() throws Exception {
         for (int i = 0; i < SERVER_COUNT; i++) {
             mt[i] = new MainThread(i, clientPorts[i], currentQuorumCfgSection, false);
             // check that a dynamic configuration file doesn't exist
-            assertNull("static file backup shouldn't exist before bootup", mt[i].getFileByName("zoo.cfg.bak"));
-            staticFileContent[i] = getFileContent(mt[i].confFile);
+            assertNull(mt[i].getFileByName("zoo.cfg.bak"), "static file backup shouldn't exist before bootup");
+            staticFileContent[i] = new String(Files.readAllBytes(mt[i].confFile.toPath()), UTF_8);
             mt[i].start();
         }
 
         for (int i = 0; i < SERVER_COUNT; i++) {
-            assertTrue(
-                    "waiting for server " + i + " being up",
-                    ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                    "waiting for server " + i + " being up");
             File backupFile = mt[i].getFileByName("zoo.cfg.bak");
-            assertNotNull("static file backup should exist", backupFile);
-            staticBackupContent[i] = getFileContent(backupFile);
+            assertNotNull(backupFile, "static file backup should exist");
+            staticBackupContent[i] = new String(Files.readAllBytes(backupFile.toPath()), UTF_8);
             assertEquals(staticFileContent[i], staticBackupContent[i]);
         }
 
@@ -128,8 +117,8 @@ public void testReconfigCreateNewVersionFile() throws Exception {
         final String[] servers = new String[NEW_SERVER_COUNT];
 
         StringBuilder sb = new StringBuilder();
-        ArrayList<String> oldServers = new ArrayList<String>();
-        ArrayList<String> newServers = new ArrayList<String>();
+        ArrayList<String> oldServers = new ArrayList<>();
+        ArrayList<String> newServers = new ArrayList<>();
 
         for (int i = 0; i < NEW_SERVER_COUNT; i++) {
             clientPorts[i] = PortAssignment.unique();
@@ -162,9 +151,8 @@ public void testReconfigCreateNewVersionFile() throws Exception {
 
         // test old cluster
         for (int i = 0; i < SERVER_COUNT; i++) {
-            assertTrue(
-                    "waiting for server " + i + " being up",
-                    ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                    "waiting for server " + i + " being up");
             zk[i] = ClientBase.createZKClient("127.0.0.1:" + clientPorts[i]);
             zkAdmin[i] = new ZooKeeperAdmin("127.0.0.1:" + clientPorts[i], ClientBase.CONNECTION_TIMEOUT, this);
             zkAdmin[i].addAuthInfo("digest", "super:test".getBytes());
@@ -199,9 +187,8 @@ public void testReconfigCreateNewVersionFile() throws Exception {
 
         // wait for new servers to be up running
         for (int i = SERVER_COUNT; i < NEW_SERVER_COUNT; i++) {
-            assertTrue(
-                    "waiting for server " + i + " being up",
-                    ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                    "waiting for server " + i + " being up");
             zk[i] = ClientBase.createZKClient("127.0.0.1:" + clientPorts[i]);
         }
 
@@ -251,7 +238,7 @@ public void testVersionOfDynamicFilename() throws Exception {
         StringBuilder sb = new StringBuilder();
         String server;
         StringBuilder oldSb = new StringBuilder();
-        ArrayList<String> allServers = new ArrayList<String>();
+        ArrayList<String> allServers = new ArrayList<>();
 
         for (int i = 0; i < SERVER_COUNT; i++) {
             clientPorts[i] = PortAssignment.unique();
@@ -297,9 +284,8 @@ public void testVersionOfDynamicFilename() throws Exception {
         String dynamicFileContent = null;
 
         for (int i = 0; i < SERVER_COUNT; i++) {
-            assertTrue(
-                    "waiting for server " + i + " being up",
-                    ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                    "waiting for server " + i + " being up");
             ZooKeeper zk = ClientBase.createZKClient("127.0.0.1:" + clientPorts[i]);
 
             // we should see that now all servers have the same config of 5 servers
@@ -317,11 +303,12 @@ public void testVersionOfDynamicFilename() throws Exception {
             // All dynamic files created with the same version should have
             // same configs, and they should be equal to the config we get from QuorumPeer.
             if (i == 0) {
-                dynamicFileContent = getFileContent(dynamicConfigFile);
-                assertEquals(sortedConfigStr, dynamicFileContent + "version=200000000");
+                dynamicFileContent = new String(Files.readAllBytes(dynamicConfigFile.toPath()), UTF_8);
+                // last line in file should be version number
+                assertEquals(sortedConfigStr, dynamicFileContent + "\n" + "version=200000000");
             } else {
-                String otherDynamicFileContent = getFileContent(dynamicConfigFile);
-                assertEquals(dynamicFileContent, otherDynamicFileContent);
+                String otherDynamicFileContent = new String(Files.readAllBytes(dynamicConfigFile.toPath()), UTF_8);
+                assertEquals(dynamicFileContent + "\n", otherDynamicFileContent);
             }
 
             zk.close();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigDuringLeaderSyncTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigDuringLeaderSyncTest.java
index ee51baf955e..15695c3b3bf 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigDuringLeaderSyncTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigDuringLeaderSyncTest.java
@@ -19,14 +19,12 @@
 package org.apache.zookeeper.server.quorum;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.IOException;
 import java.net.InetSocketAddress;
-import java.util.Arrays;
-import java.util.Collection;
 import java.util.Map;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.PortAssignment;
@@ -39,17 +37,14 @@
 import org.apache.zookeeper.server.quorum.flexible.QuorumMaj;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.After;
-import org.junit.AfterClass;
-import org.junit.Before;
-import org.junit.BeforeClass;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-@RunWith(Parameterized.class)
 public class ReconfigDuringLeaderSyncTest extends QuorumPeerTestBase {
 
     private static final Logger LOG = LoggerFactory.getLogger(ReconfigDuringLeaderSyncTest.class);
@@ -57,30 +52,18 @@ public class ReconfigDuringLeaderSyncTest extends QuorumPeerTestBase {
     private MainThread[] mt;
     private static boolean bakAsyncSending;
 
-    private boolean asyncSending;
-
-    public ReconfigDuringLeaderSyncTest(boolean asyncSending) {
-        this.asyncSending = asyncSending;
-    }
-
-    @Parameterized.Parameters
-    public static Collection sendingModes() {
-        return Arrays.asList(new Object[][]{{true}, {false}});
-    }
-
-    @Before
-    public void setup() {
+    public void setup(boolean asyncSending) {
         System.setProperty("zookeeper.DigestAuthenticationProvider.superDigest", "super:D/InIHSb7yEEbrWz8b9l71RjZJU="/* password is 'test'*/);
         Learner.setAsyncSending(asyncSending);
         QuorumPeerConfig.setReconfigEnabled(true);
     }
 
-    @BeforeClass
+    @BeforeAll
     public static void saveAsyncSendingFlag() {
         bakAsyncSending = Learner.getAsyncSending();
     }
 
-    @AfterClass
+    @AfterAll
     public static void resetAsyncSendingFlag() {
         Learner.setAsyncSending(bakAsyncSending);
     }
@@ -97,8 +80,10 @@ public static void resetAsyncSendingFlag() {
      * deleted.
      */
 
-    @Test
-    public void testDuringLeaderSync() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testDuringLeaderSync(boolean asyncSending) throws Exception {
+        setup(asyncSending);
         final int[] clientPorts = new int[SERVER_COUNT + 1];
         StringBuilder sb = new StringBuilder();
         String[] serverConfig = new String[SERVER_COUNT + 1];
@@ -120,9 +105,8 @@ public void testDuringLeaderSync() throws Exception {
 
         // ensure all servers started
         for (int i = 0; i < SERVER_COUNT; i++) {
-            assertTrue(
-                "waiting for server " + i + " being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                    "waiting for server " + i + " being up");
         }
         CountdownWatcher watch = new CountdownWatcher();
         ZooKeeperAdmin preReconfigClient = new ZooKeeperAdmin(
@@ -196,13 +180,12 @@ public TestQPMain getTestQPMain() {
         watch.waitForConnected(ClientBase.CONNECTION_TIMEOUT);
         // do one successful operation on the newly added node
         postReconfigClient.create("/reconfigIssue", "".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        assertFalse("zoo.cfg.dynamic.next is not deleted.", nextDynaFile.exists());
+        assertFalse(nextDynaFile.exists(), "zoo.cfg.dynamic.next is not deleted.");
 
         // verify that joiner has up-to-date config, including all four servers.
         for (long j = 0; j <= SERVER_COUNT; j++) {
-            assertNotNull(
-                "server " + j + " is not present in the new quorum",
-                qp.getQuorumVerifier().getVotingMembers().get(j));
+            assertNotNull(qp.getQuorumVerifier().getVotingMembers().get(j),
+                    "server " + j + " is not present in the new quorum");
         }
 
         // close clients
@@ -225,7 +208,7 @@ private static CustomQuorumPeer getCustomQuorumPeer(MainThread mt) {
         }
     }
 
-    @After
+    @AfterEach
     public void tearDown() {
         // stop all severs
         if (null != mt) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigFailureCasesTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigFailureCasesTest.java
index a10e9c7abfa..12036544470 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigFailureCasesTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigFailureCasesTest.java
@@ -19,8 +19,8 @@
 package org.apache.zookeeper.server.quorum;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.HashSet;
@@ -34,21 +34,21 @@
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.QuorumUtil;
 import org.apache.zookeeper.test.ReconfigTest;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class ReconfigFailureCasesTest extends QuorumPeerTestBase {
 
     private QuorumUtil qu;
 
-    @Before
+    @BeforeEach
     public void setup() {
         QuorumPeerConfig.setReconfigEnabled(true);
         System.setProperty("zookeeper.DigestAuthenticationProvider.superDigest", "super:D/InIHSb7yEEbrWz8b9l71RjZJU="/* password is 'test'*/);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         if (qu != null) {
             qu.tearDown();
@@ -66,7 +66,7 @@ public void testIncrementalReconfigInvokedOnHiearchicalQS() throws Exception {
         ZooKeeper[] zkArr = ReconfigTest.createHandles(qu);
         ZooKeeperAdmin[] zkAdminArr = ReconfigTest.createAdminHandles(qu);
 
-        ArrayList<String> members = new ArrayList<String>();
+        ArrayList<String> members = new ArrayList<>();
         members.add("group.1=3:4:5");
         members.add("group.2=1:2");
         members.add("weight.1=0");
@@ -88,7 +88,7 @@ public void testIncrementalReconfigInvokedOnHiearchicalQS() throws Exception {
         ReconfigTest.testNormalOperation(zkArr[1], zkArr[2]);
 
         // Attempt an incremental reconfig.
-        List<String> leavingServers = new ArrayList<String>();
+        List<String> leavingServers = new ArrayList<>();
         leavingServers.add("3");
         try {
             zkAdminArr[1].reconfigure(null, leavingServers, null, -1, null);
@@ -117,7 +117,7 @@ public void testTooFewRemainingPariticipants() throws Exception {
         ZooKeeper[] zkArr = ReconfigTest.createHandles(qu);
         ZooKeeperAdmin[] zkAdminArr = ReconfigTest.createAdminHandles(qu);
 
-        List<String> leavingServers = new ArrayList<String>();
+        List<String> leavingServers = new ArrayList<>();
         leavingServers.add("2");
         leavingServers.add("3");
         try {
@@ -144,7 +144,7 @@ public void testReconfigVersionConditionFails() throws Exception {
         ZooKeeper[] zkArr = ReconfigTest.createHandles(qu);
         ZooKeeperAdmin[] zkAdminArr = ReconfigTest.createAdminHandles(qu);
 
-        List<String> leavingServers = new ArrayList<String>();
+        List<String> leavingServers = new ArrayList<>();
         leavingServers.add("3");
         try {
             zkAdminArr[1].reconfigure(null, leavingServers, null, 8, null);
@@ -183,7 +183,7 @@ public void testObserverToParticipantConversionFails() throws Exception {
         int[][] ports = ReconfigRecoveryTest.generatePorts(SERVER_COUNT);
 
         // generate old config string
-        Set<Integer> observers = new HashSet<Integer>();
+        Set<Integer> observers = new HashSet<>();
         observers.add(3);
         StringBuilder sb = ReconfigRecoveryTest.generateConfig(SERVER_COUNT, ports, observers);
         String currentQuorumCfgSection = sb.toString();
@@ -203,9 +203,8 @@ public void testObserverToParticipantConversionFails() throws Exception {
         }
 
         for (int i = 1; i < SERVER_COUNT; i++) {
-            assertTrue(
-                "waiting for server " + i + " being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + ports[i][2], CONNECTION_TIMEOUT * 2));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + ports[i][2], CONNECTION_TIMEOUT * 2),
+                    "waiting for server " + i + " being up");
         }
 
         try {
@@ -218,7 +217,7 @@ public void testObserverToParticipantConversionFails() throws Exception {
             fail("Reconfig should have failed with NewConfigNoQuorum");
         }
         // In this scenario to change 3's role to participant we need to remove it first
-        ArrayList<String> leavingServers = new ArrayList<String>();
+        ArrayList<String> leavingServers = new ArrayList<>();
         leavingServers.add("3");
         ReconfigTest.reconfig(zkAdmin[1], null, leavingServers, null, -1);
         ReconfigTest.testNormalOperation(zk[2], zk[3]);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigLegacyTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigLegacyTest.java
index d6eba89a391..6f956899522 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigLegacyTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigLegacyTest.java
@@ -18,30 +18,68 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static org.apache.zookeeper.server.quorum.QuorumPeerMainTLSTest.getClientTLSConfigs;
+import static org.apache.zookeeper.server.quorum.QuorumPeerMainTLSTest.getServerTLSConfigs;
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.IOException;
+import java.security.Security;
 import java.util.ArrayList;
+import java.util.Map;
 import java.util.Properties;
+import org.apache.commons.io.FileUtils;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.admin.ZooKeeperAdmin;
+import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.common.X509KeyType;
+import org.apache.zookeeper.common.X509TestContext;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ReconfigTest;
-import org.junit.Before;
-import org.junit.Test;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+
 
 public class ReconfigLegacyTest extends QuorumPeerTestBase {
 
     private static final int SERVER_COUNT = 3;
+    private static File tempDir;
+    private static X509TestContext x509TestContext = null;
+
+    @BeforeAll
+    public static void beforeAll() throws Exception {
+        Security.addProvider(new BouncyCastleProvider());
+        tempDir = ClientBase.createEmptyTestDir();
+        x509TestContext = X509TestContext.newBuilder()
+            .setTempDir(tempDir)
+            .setKeyStoreKeyType(X509KeyType.EC)
+            .setTrustStoreKeyType(X509KeyType.EC)
+            .build();
+    }
+
+    @AfterAll
+    public static void afterAll() {
+        Security.removeProvider(BouncyCastleProvider.PROVIDER_NAME);
+        try {
+            FileUtils.deleteDirectory(tempDir);
+        } catch (IOException e) {
+            // ignore
+        }
+    }
 
-    @Before
+    @BeforeEach
     public void setup() {
         ClientBase.setupTestEnv();
         QuorumPeerConfig.setReconfigEnabled(true);
@@ -59,12 +97,12 @@ public void testConfigFileBackwardCompatibility() throws Exception {
         final int[] clientPorts = new int[SERVER_COUNT];
         StringBuilder sb = new StringBuilder();
         String server;
-        ArrayList<String> allServers = new ArrayList<String>();
+        ArrayList<String> allServers = new ArrayList<>();
 
         for (int i = 0; i < SERVER_COUNT; i++) {
             clientPorts[i] = PortAssignment.unique();
             server = "server." + i + "=localhost:" + PortAssignment.unique() + ":" + PortAssignment.unique()
-                     + ":participant;localhost:" + clientPorts[i];
+                + ":participant;localhost:" + clientPorts[i];
             allServers.add(server);
             sb.append(server + "\n");
         }
@@ -85,8 +123,8 @@ public void testConfigFileBackwardCompatibility() throws Exception {
         // Check that the static config was split into static and dynamic files correctly.
         for (int i = 0; i < SERVER_COUNT; i++) {
             assertTrue(
-                "waiting for server " + i + " being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                "waiting for server " + i + " being up");
             zk[i] = ClientBase.createZKClient("127.0.0.1:" + clientPorts[i]);
             File[] dynamicFiles = mt[i].getDynamicFiles();
 
@@ -123,8 +161,8 @@ public void testConfigFileBackwardCompatibility() throws Exception {
         }
         for (int i = 0; i < SERVER_COUNT; i++) {
             assertTrue(
-                "waiting for server " + i + " being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                "waiting for server " + i + " being up");
             zk[i] = ClientBase.createZKClient("127.0.0.1:" + clientPorts[i]);
             ReconfigTest.testServerHasConfig(zk[i], allServers, null);
         }
@@ -143,21 +181,26 @@ public void testConfigFileBackwardCompatibility() throws Exception {
      *    and new port added to dynamic file.
      * @throws Exception
      */
-    @Test
-    public void testReconfigRemoveClientFromStatic() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {false, true})
+    public void testReconfigRemoveClientFromStatic(boolean isSecure) throws Exception {
         final int[] clientPorts = new int[SERVER_COUNT];
+        final int[] secureClientPorts = new int[SERVER_COUNT];
+        final int[] adminServerPorts = new int[SERVER_COUNT];
         final int[] quorumPorts = new int[SERVER_COUNT];
         final int[] electionPorts = new int[SERVER_COUNT];
 
         final int changedServerId = 0;
-        final int newClientPort = PortAssignment.unique();
+        final int newClientPortOrSecureClientPort = PortAssignment.unique();
 
         StringBuilder sb = new StringBuilder();
-        ArrayList<String> allServers = new ArrayList<String>();
-        ArrayList<String> newServers = new ArrayList<String>();
+        ArrayList<String> allServers = new ArrayList<>();
+        ArrayList<String> newServers = new ArrayList<>();
 
         for (int i = 0; i < SERVER_COUNT; i++) {
             clientPorts[i] = PortAssignment.unique();
+            secureClientPorts[i] = PortAssignment.unique();
+            adminServerPorts[i] = PortAssignment.unique();
             quorumPorts[i] = PortAssignment.unique();
             electionPorts[i] = PortAssignment.unique();
 
@@ -166,7 +209,12 @@ public void testReconfigRemoveClientFromStatic() throws Exception {
             sb.append(server + "\n");
 
             if (i == changedServerId) {
-                newServers.add(server + ";0.0.0.0:" + newClientPort);
+                if (isSecure) {
+                    newServers.add(server + ";;0.0.0.0:" + newClientPortOrSecureClientPort);
+                } else {
+                    newServers.add(server + ";0.0.0.0:" + newClientPortOrSecureClientPort);
+                }
+
             } else {
                 newServers.add(server);
             }
@@ -177,27 +225,51 @@ public void testReconfigRemoveClientFromStatic() throws Exception {
         ZooKeeper[] zk = new ZooKeeper[SERVER_COUNT];
         ZooKeeperAdmin[] zkAdmin = new ZooKeeperAdmin[SERVER_COUNT];
 
+        Map<String, String> configMap = getServerTLSConfigs(x509TestContext);
+        StringBuilder configBuilder = new StringBuilder();
+        for (Map.Entry<String, String> entry : configMap.entrySet()) {
+            configBuilder.append(entry.getKey()).append("=").append(entry.getValue()).append("\n");
+        }
+
         // Start the servers with a static config file, without a dynamic config file.
         for (int i = 0; i < SERVER_COUNT; i++) {
-            mt[i] = new MainThread(i, clientPorts[i], quorumCfgSection, false);
+            if (isSecure) {
+                mt[i] = new MainThread(i, MainThread.UNSET_STATIC_CLIENTPORT, adminServerPorts[i], secureClientPorts[i], quorumCfgSection, configBuilder.toString(), null, false, null);
+            } else {
+                mt[i] = new MainThread(i, clientPorts[i], adminServerPorts[i], quorumCfgSection, null, null, false);
+            }
             mt[i].start();
         }
 
+
+        ZKClientConfig clientConfig;
+        if (isSecure) {
+            clientConfig = getClientTLSConfigs(x509TestContext);
+        } else {
+            clientConfig = null;
+        }
+
         // Check that when a server starts from old style config, it should keep the client
         // port in static config file.
         for (int i = 0; i < SERVER_COUNT; i++) {
+            String cnxnString = "127.0.0.1:" + (isSecure ? secureClientPorts[i] : clientPorts[i]);
             assertTrue(
-                    "waiting for server " + i + " being up",
-                    ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
-            zk[i] = ClientBase.createZKClient("127.0.0.1:" + clientPorts[i]);
-            zkAdmin[i] = new ZooKeeperAdmin("127.0.0.1:" + clientPorts[i], ClientBase.CONNECTION_TIMEOUT, this);
+                ClientBase.waitForServerUp(cnxnString, CONNECTION_TIMEOUT, isSecure, clientConfig),
+                "waiting for server " + i + " being up");
+            zk[i] = ClientBase.createZKClient(cnxnString, CONNECTION_TIMEOUT, CONNECTION_TIMEOUT, clientConfig);
+            zkAdmin[i] = new ZooKeeperAdmin(cnxnString, ClientBase.CONNECTION_TIMEOUT, this, clientConfig);
             zkAdmin[i].addAuthInfo("digest", "super:test".getBytes());
 
             ReconfigTest.testServerHasConfig(zk[i], allServers, null);
             Properties cfg = readPropertiesFromFile(mt[i].confFile);
 
             assertTrue(cfg.containsKey("dynamicConfigFile"));
-            assertTrue(cfg.containsKey("clientPort"));
+            if (isSecure) {
+                assertTrue(cfg.containsKey("secureClientPort"));
+            } else {
+                assertTrue(cfg.containsKey("clientPort"));
+            }
+
         }
         ReconfigTest.testNormalOperation(zk[0], zk[1]);
 
@@ -214,10 +286,11 @@ public void testReconfigRemoveClientFromStatic() throws Exception {
         for (int i = 0; i < SERVER_COUNT; i++) {
             ReconfigTest.testServerHasConfig(zk[i], newServers, null);
             Properties staticCfg = readPropertiesFromFile(mt[i].confFile);
+            String configKey = isSecure ? "secureClientPort" : "clientPort";
             if (i == changedServerId) {
-                assertFalse(staticCfg.containsKey("clientPort"));
+                assertFalse(staticCfg.containsKey(configKey));
             } else {
-                assertTrue(staticCfg.containsKey("clientPort"));
+                assertTrue(staticCfg.containsKey(configKey));
             }
         }
 
@@ -244,7 +317,8 @@ public static Properties readPropertiesFromFile(File file) throws IOException {
      *
      * @throws Exception
      */
-    @Test(timeout = 120000)
+    @Test
+    @Timeout(value = 120)
     public void testRestartZooKeeperServer() throws Exception {
         final int[] clientPorts = new int[SERVER_COUNT];
         StringBuilder sb = new StringBuilder();
@@ -253,7 +327,7 @@ public void testRestartZooKeeperServer() throws Exception {
         for (int i = 0; i < SERVER_COUNT; i++) {
             clientPorts[i] = PortAssignment.unique();
             server = "server." + i + "=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique()
-                     + ":participant;127.0.0.1:" + clientPorts[i];
+                + ":participant;127.0.0.1:" + clientPorts[i];
             sb.append(server + "\n");
         }
         String currentQuorumCfgSection = sb.toString();
@@ -266,9 +340,8 @@ public void testRestartZooKeeperServer() throws Exception {
 
         // ensure server started
         for (int i = 0; i < SERVER_COUNT; i++) {
-            assertTrue(
-                "waiting for server " + i + " being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                "waiting for server " + i + " being up");
         }
 
         ZooKeeper zk = ClientBase.createZKClient("127.0.0.1:" + clientPorts[0]);
@@ -287,9 +360,8 @@ public void testRestartZooKeeperServer() throws Exception {
         mt[1].start();
         // ensure server started
         for (int i = 0; i < SERVER_COUNT; i++) {
-            assertTrue(
-                "waiting for server " + i + " being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                "waiting for server " + i + " being up");
         }
         zk = ClientBase.createZKClient("127.0.0.1:" + clientPorts[0]);
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigRecoveryTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigRecoveryTest.java
index ee0fb4a03ab..80b2a215f7a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigRecoveryTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigRecoveryTest.java
@@ -19,9 +19,9 @@
 package org.apache.zookeeper.server.quorum;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.ArrayList;
 import java.util.HashSet;
 import java.util.Set;
@@ -29,12 +29,12 @@
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ReconfigTest;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class ReconfigRecoveryTest extends QuorumPeerTestBase {
 
-    @Before
+    @BeforeEach
     public void setup() {
         QuorumPeerConfig.setReconfigEnabled(true);
     }
@@ -52,7 +52,7 @@ public void testNextConfigCompletion() throws Exception {
         final int[] clientPorts = new int[SERVER_COUNT];
         StringBuilder sb = new StringBuilder();
         String server;
-        ArrayList<String> allServers = new ArrayList<String>();
+        ArrayList<String> allServers = new ArrayList<>();
 
         String currentQuorumCfgSection = null, nextQuorumCfgSection;
 
@@ -84,11 +84,10 @@ public void testNextConfigCompletion() throws Exception {
             zk[i] = new ZooKeeper("127.0.0.1:" + clientPorts[i], ClientBase.CONNECTION_TIMEOUT, this);
         }
 
-        assertTrue(
-            "waiting for server 0 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[0], CONNECTION_TIMEOUT));
-        assertTrue(
-            "waiting for server 1 being up", ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[1], CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[0], CONNECTION_TIMEOUT),
+                "waiting for server 0 being up");
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[1], CONNECTION_TIMEOUT),
+                "waiting for server 1 being up");
 
         int leader = mt[0].main.quorumPeer.leader == null ? 1 : 0;
 
@@ -103,9 +102,8 @@ public void testNextConfigCompletion() throws Exception {
         mt[2].start();
         zk[2] = new ZooKeeper("127.0.0.1:" + clientPorts[2], ClientBase.CONNECTION_TIMEOUT, this);
 
-        assertTrue(
-            "waiting for server 2 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[2], CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[2], CONNECTION_TIMEOUT),
+                "waiting for server 2 being up");
 
         ReconfigTest.testServerHasConfig(zk[0], allServers, null);
         ReconfigTest.testServerHasConfig(zk[1], allServers, null);
@@ -138,7 +136,7 @@ public void testCurrentServersAreObserversInNextConfig() throws Exception {
 
         String currentQuorumCfg, nextQuorumCfgSection;
 
-        ArrayList<String> allServersNext = new ArrayList<String>();
+        ArrayList<String> allServersNext = new ArrayList<>();
 
         for (int i = 0; i < 2; i++) {
             oldClientPorts[i] = PortAssignment.unique();
@@ -176,10 +174,8 @@ public void testCurrentServersAreObserversInNextConfig() throws Exception {
         }
 
         for (int i = 0; i < 2; i++) {
-            assertTrue(
-                "waiting for server " + i + " being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + oldClientPorts[i], CONNECTION_TIMEOUT
-                                                                                                                                       * 2));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + oldClientPorts[i], CONNECTION_TIMEOUT * 2),
+                    "waiting for server " + i + " being up");
         }
 
         ReconfigTest.testNormalOperation(zk[0], zk[1]);
@@ -191,10 +187,8 @@ public void testCurrentServersAreObserversInNextConfig() throws Exception {
         }
 
         for (int i = 0; i < 2; i++) {
-            assertTrue("waiting for server " + i + " being up", ClientBase.waitForServerDown(
-                    "127.0.0.1:"
-                            + oldClientPorts[i], CONNECTION_TIMEOUT
-                                                         * 2));
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + oldClientPorts[i], CONNECTION_TIMEOUT * 2),
+                    "waiting for server " + i + " being up");
         }
 
         for (int i = 0; i < 2; i++) {
@@ -211,9 +205,8 @@ public void testCurrentServersAreObserversInNextConfig() throws Exception {
         }
 
         for (int i = 0; i < SERVER_COUNT; i++) {
-            assertTrue(
-                "waiting for server " + i + " being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT * 2));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT * 2),
+                    "waiting for server " + i + " being up");
             ReconfigTest.testServerHasConfig(zk[i], allServersNext, null);
         }
 
@@ -275,9 +268,8 @@ public void testNextConfigUnreachable() throws Exception {
         // make sure servers 0, 1 don't come online - this should be the case
         // since they can't complete the reconfig
         for (int i = 0; i < 2; i++) {
-            assertFalse(
-                "server " + i + " is up but shouldn't be",
-                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT / 10));
+            assertFalse(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT / 10),
+                    "server " + i + " is up but shouldn't be");
         }
 
         for (int i = 0; i < 2; i++) {
@@ -302,7 +294,7 @@ public void testNextConfigAlreadyActive() throws Exception {
 
         String currentQuorumCfgSection = null, nextQuorumCfgSection;
 
-        ArrayList<String> allServers = new ArrayList<String>();
+        ArrayList<String> allServers = new ArrayList<>();
         for (int i = 0; i < SERVER_COUNT; i++) {
             clientPorts[i] = PortAssignment.unique();
             server = "server." + i + "=localhost:" + PortAssignment.unique() + ":" + PortAssignment.unique()
@@ -324,9 +316,8 @@ public void testNextConfigAlreadyActive() throws Exception {
             zk[i] = new ZooKeeper("127.0.0.1:" + clientPorts[i], ClientBase.CONNECTION_TIMEOUT, this);
         }
         for (int i = 2; i < SERVER_COUNT; i++) {
-            assertTrue(
-                    "waiting for server " + i + " being up",
-                    ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                    "waiting for server " + i + " being up");
         }
 
         ReconfigTest.testNormalOperation(zk[2], zk[3]);
@@ -346,9 +337,8 @@ public void testNextConfigAlreadyActive() throws Exception {
         // servers 0 and 1 should connect to all servers, including the one in
         // their .next file during startup, and will find the next config and join it
         for (int i = 0; i < 2; i++) {
-            assertTrue(
-                "waiting for server " + i + " being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT * 2));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT * 2),
+                    "waiting for server " + i + " being up");
         }
 
         // make sure they joined the new config without any change to it
@@ -385,13 +375,13 @@ public void testObserverConvertedToParticipantDuringFLE() throws Exception {
         String currentQuorumCfgSection, nextQuorumCfgSection;
 
         // generate old config string
-        Set<Integer> observers = new HashSet<Integer>();
+        Set<Integer> observers = new HashSet<>();
         observers.add(2);
         StringBuilder sb = generateConfig(3, ports, observers);
         currentQuorumCfgSection = sb.toString();
 
         // generate new config string
-        ArrayList<String> allServersNext = new ArrayList<String>();
+        ArrayList<String> allServersNext = new ArrayList<>();
         sb = new StringBuilder();
         for (int i = 2; i < SERVER_COUNT; i++) {
             String server = "server." + i + "=localhost:" + ports[i][0] + ":" + ports[i][1]
@@ -415,9 +405,8 @@ public void testObserverConvertedToParticipantDuringFLE() throws Exception {
         zk[3] = new ZooKeeper("127.0.0.1:" + ports[3][2], ClientBase.CONNECTION_TIMEOUT, this);
 
         for (int i = 2; i < SERVER_COUNT; i++) {
-            assertTrue(
-                "waiting for server " + i + " being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + ports[i][2], CONNECTION_TIMEOUT * 2));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + ports[i][2], CONNECTION_TIMEOUT * 2),
+                    "waiting for server " + i + " being up");
             ReconfigTest.testServerHasConfig(zk[i], allServersNext, null);
         }
 
@@ -457,7 +446,7 @@ public void testCurrentObserverIsParticipantInNewConfig() throws Exception {
         String currentQuorumCfg, nextQuorumCfgSection;
 
         // generate old config string
-        Set<Integer> observers = new HashSet<Integer>();
+        Set<Integer> observers = new HashSet<>();
         observers.add(2);
 
         StringBuilder sb = generateConfig(3, ports, observers);
@@ -475,9 +464,8 @@ public void testCurrentObserverIsParticipantInNewConfig() throws Exception {
         ReconfigTest.testNormalOperation(zk[0], zk[2]);
 
         for (int i = 0; i <= 2; i++) {
-            assertTrue(
-                "waiting for server " + i + " being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + ports[i][2], CONNECTION_TIMEOUT * 2));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + ports[i][2], CONNECTION_TIMEOUT * 2),
+                    "waiting for server " + i + " being up");
         }
 
         // shut servers 0..2 down
@@ -487,7 +475,7 @@ public void testCurrentObserverIsParticipantInNewConfig() throws Exception {
         }
 
         // generate new config string
-        ArrayList<String> allServersNext = new ArrayList<String>();
+        ArrayList<String> allServersNext = new ArrayList<>();
         sb = new StringBuilder();
         for (int i = 2; i < SERVER_COUNT; i++) {
             String server = "server." + i + "=localhost:" + ports[i][0] + ":" + ports[i][1]
@@ -511,9 +499,8 @@ public void testCurrentObserverIsParticipantInNewConfig() throws Exception {
         zk[3] = new ZooKeeper("127.0.0.1:" + ports[3][2], ClientBase.CONNECTION_TIMEOUT, this);
 
         for (int i = 2; i < SERVER_COUNT; i++) {
-            assertTrue(
-                "waiting for server " + i + " being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + ports[i][2], CONNECTION_TIMEOUT * 3));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + ports[i][2], CONNECTION_TIMEOUT * 3),
+                    "waiting for server " + i + " being up");
             ReconfigTest.testServerHasConfig(zk[i], allServersNext, null);
         }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigRollingRestartCompatibilityTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigRollingRestartCompatibilityTest.java
index c4d2bd7eaa7..62db39b413f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigRollingRestartCompatibilityTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ReconfigRollingRestartCompatibilityTest.java
@@ -19,9 +19,9 @@
 package org.apache.zookeeper.server.quorum;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
@@ -36,7 +36,8 @@
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ReconfigTest;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 /**
  * ReconfigRollingRestartCompatibilityTest - we want to make sure that users
@@ -88,9 +89,11 @@ private String updateExistingQuorumConfig(List<Integer> sidsToAdd, List<Integer>
         return sb.toString();
     }
 
-    @Test(timeout = 60000)
+
     // Verify no zoo.cfg.dynamic and zoo.cfg.bak files existing locally
     // when reconfig feature flag is off by default.
+    @Test
+    @Timeout(value = 60)
     public void testNoLocalDynamicConfigAndBackupFiles() throws InterruptedException, IOException {
         int serverCount = 3;
         String config = generateNewQuorumConfig(serverCount);
@@ -103,11 +106,11 @@ public void testNoLocalDynamicConfigAndBackupFiles() throws InterruptedException
         }
 
         for (int i = 0; i < serverCount; i++) {
-            assertTrue("waiting for server " + i + " being up", ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(i), CONNECTION_TIMEOUT));
-            assertNull("static file backup (zoo.cfg.bak) shouldn't exist!", mt[i].getFileByName(ZOO_CFG_BAK_FILE));
-            assertNull("dynamic configuration file (zoo.cfg.dynamic.*) shouldn't exist!", mt[i].getFileByName(mt[i].getQuorumPeer().getNextDynamicConfigFilename()));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(i), CONNECTION_TIMEOUT), "waiting for server " + i + " being up");
+            assertNull(mt[i].getFileByName(ZOO_CFG_BAK_FILE), "static file backup (zoo.cfg.bak) shouldn't exist!");
+            assertNull(mt[i].getFileByName(mt[i].getQuorumPeer().getNextDynamicConfigFilename()), "dynamic configuration file (zoo.cfg.dynamic.*) shouldn't exist!");
             staticFileContent[i] = Files.readAllLines(mt[i].confFile.toPath(), StandardCharsets.UTF_8).toString();
-            assertTrue("static config file should contain server entry " + serverAddress.get(i), staticFileContent[i].contains(serverAddress.get(i)));
+            assertTrue(staticFileContent[i].contains(serverAddress.get(i)), "static config file should contain server entry " + serverAddress.get(i));
         }
 
         for (int i = 0; i < serverCount; i++) {
@@ -115,11 +118,12 @@ public void testNoLocalDynamicConfigAndBackupFiles() throws InterruptedException
         }
     }
 
-    @Test(timeout = 60000)
     // This test simulate the usual rolling restart with no membership change:
     // 1. A node is shutdown first (e.g. to upgrade software, or hardware, or cleanup local data.).
     // 2. After upgrade, start the node.
     // 3. Do this for every node, one at a time.
+    @Test
+    @Timeout(value = 60)
     public void testRollingRestartWithoutMembershipChange() throws Exception {
         int serverCount = 3;
         String config = generateNewQuorumConfig(serverCount);
@@ -132,7 +136,7 @@ public void testRollingRestartWithoutMembershipChange() throws Exception {
         }
 
         for (int i = 0; i < serverCount; ++i) {
-            assertTrue("waiting for server " + i + " being up", ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(i), CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(i), CONNECTION_TIMEOUT), "waiting for server " + i + " being up");
         }
 
         for (int i = 0; i < serverCount; ++i) {
@@ -147,12 +151,13 @@ public void testRollingRestartWithoutMembershipChange() throws Exception {
         }
     }
 
-    @Test(timeout = 90000)
-    // This test simulate the use case of change of membership through rolling
-    // restart. For a 3 node ensemble we expand it to a 5 node ensemble, verify
+    // This test simulate the use case of change of membership by starting new servers
+    // without dynamic reconfig. For a 3 node ensemble we expand it to a 5 node ensemble, verify
     // during the process each node has the expected configuration setting pushed
     // via updating local zoo.cfg file.
-    public void testRollingRestartWithMembershipChange() throws Exception {
+    @Test
+    @Timeout(value = 90)
+    public void testExtendingQuorumWithNewMembers() throws Exception {
         int serverCount = 3;
         String config = generateNewQuorumConfig(serverCount);
         QuorumPeerTestBase.MainThread[] mt = new QuorumPeerTestBase.MainThread[serverCount];
@@ -164,7 +169,7 @@ public void testRollingRestartWithMembershipChange() throws Exception {
         }
 
         for (int i = 0; i < serverCount; ++i) {
-            assertTrue("waiting for server " + i + " being up", ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(i), CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(i), CONNECTION_TIMEOUT), "waiting for server " + i + " being up");
         }
 
         for (int i = 0; i < serverCount; ++i) {
@@ -174,11 +179,11 @@ public void testRollingRestartWithMembershipChange() throws Exception {
 
         Map<Integer, String> oldServerAddress = new HashMap<>(serverAddress);
         List<String> newServers = new ArrayList<>(joiningServers);
-        config = updateExistingQuorumConfig(Arrays.asList(3, 4), new ArrayList<Integer>());
+        config = updateExistingQuorumConfig(Arrays.asList(3, 4), new ArrayList<>());
         newServers.add(serverAddress.get(3));
         newServers.add(serverAddress.get(4));
         serverCount = serverAddress.size();
-        assertEquals("Server count should be 5 after config update.", serverCount, 5);
+        assertEquals(serverCount, 5, "Server count should be 5 after config update.");
 
         // We are adding two new servers to the ensemble. These two servers should have the config which includes
         // all five servers (the old three servers, plus the two servers added). The old three servers should only
@@ -188,7 +193,7 @@ public void testRollingRestartWithMembershipChange() throws Exception {
         for (int i = 3; i < 5; ++i) {
             mt[i] = new QuorumPeerTestBase.MainThread(i, clientPorts.get(i), config, false);
             mt[i].start();
-            assertTrue("waiting for server " + i + " being up", ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(i), CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(i), CONNECTION_TIMEOUT), "waiting for server " + i + " being up");
             verifyQuorumConfig(i, newServers, null);
             verifyQuorumMembers(mt[i]);
         }
@@ -209,6 +214,138 @@ public void testRollingRestartWithMembershipChange() throws Exception {
         }
     }
 
+    @Test
+    public void testRollingRestartWithExtendedMembershipConfig() throws Exception {
+        // in this test we are performing rolling restart with extended quorum config, see ZOOKEEPER-3829
+
+        // Start a quorum with 3 members
+        int serverCount = 3;
+        String config = generateNewQuorumConfig(serverCount);
+        QuorumPeerTestBase.MainThread[] mt = new QuorumPeerTestBase.MainThread[serverCount];
+        List<String> joiningServers = new ArrayList<>();
+        for (int i = 0; i < serverCount; i++) {
+            mt[i] = new QuorumPeerTestBase.MainThread(i, clientPorts.get(i), config, false);
+            mt[i].start();
+            joiningServers.add(serverAddress.get(i));
+        }
+        for (int i = 0; i < serverCount; i++) {
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(i), CONNECTION_TIMEOUT), "waiting for server " + i + " being up");
+        }
+        for (int i = 0; i < serverCount; i++) {
+            verifyQuorumConfig(i, joiningServers, null);
+            verifyQuorumMembers(mt[i]);
+        }
+
+        // Create updated config with 4 members
+        List<String> newServers = new ArrayList<>(joiningServers);
+        config = updateExistingQuorumConfig(Arrays.asList(3), new ArrayList<>());
+        newServers.add(serverAddress.get(3));
+        serverCount = serverAddress.size();
+        assertEquals(serverCount, 4, "Server count should be 4 after config update.");
+
+        // We are adding one new server to the ensemble. The new server should be started with the new config
+        mt = Arrays.copyOf(mt, mt.length + 1);
+        mt[3] = new QuorumPeerTestBase.MainThread(3, clientPorts.get(3), config, false);
+        mt[3].start();
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(3), CONNECTION_TIMEOUT), "waiting for server 3 being up");
+        verifyQuorumConfig(3, newServers, null);
+        verifyQuorumMembers(mt[3]);
+
+        // Now we restart the first 3 servers, one-by-one with the new config
+        for (int i = 0; i < 3; i++) {
+            mt[i].shutdown();
+
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + clientPorts.get(i), ClientBase.CONNECTION_TIMEOUT),
+                    String.format("Timeout during waiting for server %d to go down", i));
+
+            mt[i] = new QuorumPeerTestBase.MainThread(i, clientPorts.get(i), config, false);
+            mt[i].start();
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(i), CONNECTION_TIMEOUT), "waiting for server " + i + " being up");
+            verifyQuorumConfig(i, newServers, null);
+            verifyQuorumMembers(mt[i]);
+        }
+
+        // now verify that all nodes can handle traffic
+        for (int i = 0; i < 4; ++i) {
+            ZooKeeper zk = ClientBase.createZKClient("127.0.0.1:" + clientPorts.get(i));
+            ReconfigTest.testNormalOperation(zk, zk, false);
+        }
+
+        for (int i = 0; i < 4; ++i) {
+            mt[i].shutdown();
+        }
+    }
+
+    @Test
+    public void testRollingRestartWithHostAddedAndRemoved() throws Exception {
+        // in this test we are performing rolling restart with a new quorum config,
+        // contains a deleted node and a new node
+
+        // Start a quorum with 3 members
+        int serverCount = 3;
+        String config = generateNewQuorumConfig(serverCount);
+        QuorumPeerTestBase.MainThread[] mt = new QuorumPeerTestBase.MainThread[serverCount];
+        List<String> originalServers = new ArrayList<>();
+        for (int i = 0; i < serverCount; i++) {
+            mt[i] = new QuorumPeerTestBase.MainThread(i, clientPorts.get(i), config, false);
+            mt[i].start();
+            originalServers.add(serverAddress.get(i));
+        }
+        for (int i = 0; i < serverCount; i++) {
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(i), CONNECTION_TIMEOUT), "waiting for server " + i + " being up");
+        }
+        for (int i = 0; i < serverCount; i++) {
+            verifyQuorumConfig(i, originalServers, null);
+            verifyQuorumMembers(mt[i]);
+        }
+
+        // we are stopping the third server (myid=2)
+        mt[2].shutdown();
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + clientPorts.get(2), ClientBase.CONNECTION_TIMEOUT),
+                String.format("Timeout during waiting for server %d to go down", 2));
+        String leavingServer = originalServers.get(2);
+
+        // Create updated config with the first 2 existing members, but we remove 3rd and add one with different myid
+        config = updateExistingQuorumConfig(Arrays.asList(3), Arrays.asList(2));
+        List<String> newServers = new ArrayList<>(serverAddress.values());
+        serverCount = serverAddress.size();
+        assertEquals(serverCount, 3, "Server count should be 3 after config update.");
+
+
+        // We are adding one new server to the ensemble. The new server should be started with the new config
+        mt = Arrays.copyOf(mt, mt.length + 1);
+        mt[3] = new QuorumPeerTestBase.MainThread(3, clientPorts.get(3), config, false);
+        mt[3].start();
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(3), CONNECTION_TIMEOUT), "waiting for server 3 being up");
+        verifyQuorumConfig(3, newServers, Arrays.asList(leavingServer));
+        verifyQuorumMembers(mt[3]);
+
+        // Now we restart the first 2 servers, one-by-one with the new config
+        for (int i = 0; i < 2; i++) {
+            mt[i].shutdown();
+
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + clientPorts.get(i), ClientBase.CONNECTION_TIMEOUT),
+                    String.format("Timeout during waiting for server %d to go down", i));
+
+            mt[i] = new QuorumPeerTestBase.MainThread(i, clientPorts.get(i), config, false);
+            mt[i].start();
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts.get(i), CONNECTION_TIMEOUT), "waiting for server " + i + " being up");
+            verifyQuorumConfig(i, newServers, null);
+            verifyQuorumMembers(mt[i]);
+        }
+
+        // now verify that all three nodes can handle traffic
+        for (int i : serverAddress.keySet()) {
+            ZooKeeper zk = ClientBase.createZKClient("127.0.0.1:" + clientPorts.get(i));
+            ReconfigTest.testNormalOperation(zk, zk, false);
+        }
+
+        for (int i : serverAddress.keySet()) {
+            mt[i].shutdown();
+        }
+    }
+
+
     // Verify each quorum peer has expected config in its config zNode.
     private void verifyQuorumConfig(int sid, List<String> joiningServers, List<String> leavingServers) throws Exception {
         ZooKeeper zk = ClientBase.createZKClient("127.0.0.1:" + clientPorts.get(sid));
@@ -229,11 +366,11 @@ private void verifyQuorumMembers(QuorumPeerTestBase.MainThread mt) {
     private void verifyQuorumMembers(QuorumPeerTestBase.MainThread mt, Set<String> expectedConfigs) {
         Map<Long, QuorumPeer.QuorumServer> members = mt.getQuorumPeer().getQuorumVerifier().getAllMembers();
 
-        assertTrue("Quorum member should not change.", members.size() == expectedConfigs.size());
+        assertTrue(members.size() == expectedConfigs.size(), "Quorum member should not change.");
 
         for (QuorumPeer.QuorumServer qs : members.values()) {
             String actualConfig = qs.toString();
-            assertTrue("Unexpected config " + actualConfig + " found!", expectedConfigs.contains(actualConfig));
+            assertTrue(expectedConfigs.contains(actualConfig), "Unexpected config " + actualConfig + " found!");
         }
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/RemotePeerBeanTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/RemotePeerBeanTest.java
index 97aa763efdc..cc2321c10f2 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/RemotePeerBeanTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/RemotePeerBeanTest.java
@@ -18,16 +18,16 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 import java.net.InetSocketAddress;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class RemotePeerBeanTest {
 
@@ -59,4 +59,20 @@ public void testIsLeader() {
         assertFalse(remotePeerBean.isLeader());
     }
 
+    @Test
+    public void testHostPortReturnedWhenIPIsIPV6() {
+        QuorumPeer.QuorumServer quorumServerMock = mock(QuorumPeer.QuorumServer.class);
+        InetSocketAddress address = new InetSocketAddress("127::1", 2181);
+        MultipleAddresses multipleAddresses = new MultipleAddresses(address);
+        quorumServerMock.clientAddr = address;
+        quorumServerMock.electionAddr = multipleAddresses;
+        quorumServerMock.addr = multipleAddresses;
+        QuorumPeer peerMock = mock(QuorumPeer.class);
+        RemotePeerBean remotePeerBean = new RemotePeerBean(peerMock, quorumServerMock);
+        String expectedHostPort = "[127:0:0:0:0:0:0:1]:2181";
+        assertEquals(expectedHostPort, remotePeerBean.getClientAddress());
+        assertEquals(expectedHostPort, remotePeerBean.getElectionAddress());
+        assertEquals(expectedHostPort, remotePeerBean.getQuorumAddress());
+    }
+
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SendAckRequestProcessorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SendAckRequestProcessorTest.java
new file mode 100644
index 00000000000..74cdd0bc558
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SendAckRequestProcessorTest.java
@@ -0,0 +1,46 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.quorum;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.io.IOException;
+import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.server.Request;
+import org.apache.zookeeper.txn.TxnHeader;
+import org.junit.jupiter.api.Test;
+
+class SendAckRequestProcessorTest extends ZKTestCase {
+    static class FakeLearner extends Learner {
+        public FakeLearner() {
+            sock = null;
+        }
+
+        void writePacket(QuorumPacket pp, boolean flush) throws IOException {
+            throw new IOException();
+        }
+    }
+
+    @Test
+    public void learnerSocketCloseTest() {
+        SendAckRequestProcessor processor = new SendAckRequestProcessor(new FakeLearner());
+        processor.processRequest(new Request(0L, 0, ZooDefs.OpCode.sync, new TxnHeader(), new LearnerInfo(), 0L));
+        assertTrue(true, "should get here without exception");
+    }
+}
\ No newline at end of file
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SessionUpgradeQuorumTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SessionUpgradeQuorumTest.java
index e89d5aee0c7..8876f74c905 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SessionUpgradeQuorumTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SessionUpgradeQuorumTest.java
@@ -18,11 +18,11 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.nio.ByteBuffer;
@@ -39,13 +39,13 @@
 import org.apache.zookeeper.ZooKeeper.States;
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.proto.CreateRequest;
-import org.apache.zookeeper.server.ByteBufferInputStream;
 import org.apache.zookeeper.server.Request;
+import org.apache.zookeeper.server.RequestRecord;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -59,7 +59,7 @@ public class SessionUpgradeQuorumTest extends QuorumPeerTestBase {
     private int[] clientPorts;
     private TestQPMainDropSessionUpgrading[] qpMain;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         LOG.info("STARTING quorum {}", getClass().getName());
         // setup the env with RetainDB and local session upgrading
@@ -91,11 +91,11 @@ public TestQPMain getTestQPMain() {
         }
 
         for (int i = 0; i < SERVER_COUNT; i++) {
-            assertTrue("waiting for server " + i + " being up", ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT), "waiting for server " + i + " being up");
         }
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         LOG.info("STOPPING quorum {}", getClass().getName());
         for (int i = 0; i < SERVER_COUNT; i++) {
@@ -149,7 +149,7 @@ public void testLocalSessionUpgradeSnapshot() throws IOException, InterruptedExc
             mt[i].shutdown();
         }
 
-        ArrayList<States> waitStates = new ArrayList<States>();
+        ArrayList<States> waitStates = new ArrayList<>();
         waitStates.add(States.CONNECTING);
         waitStates.add(States.CLOSED);
         waitForOne(zk, waitStates);
@@ -161,15 +161,14 @@ public void testLocalSessionUpgradeSnapshot() throws IOException, InterruptedExc
         }
 
         for (int i = 0; i < SERVER_COUNT; i++) {
-            assertTrue("waiting for server " + i + " being up", ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT), "waiting for server " + i + " being up");
         }
 
         // check global session not exist on follower A
         for (int i = 0; i < SERVER_COUNT; i++) {
             ConcurrentHashMap<Long, Integer> sessions = mt[i].main.quorumPeer.getZkDb().getSessionWithTimeOuts();
-            assertFalse(
-                "server " + i + " should not have global " + "session " + sessionId,
-                sessions.containsKey(sessionId));
+            assertFalse(sessions.containsKey(sessionId),
+                    "server " + i + " should not have global " + "session " + sessionId);
         }
 
         zk.close();
@@ -189,8 +188,8 @@ public void testOnlyUpgradeSessionOnce() throws IOException, InterruptedExceptio
         Request create1 = createEphemeralRequest("/data-1", sessionId);
         Request create2 = createEphemeralRequest("/data-2", sessionId);
 
-        assertNotNull("failed to upgrade on a ephemeral create", server.checkUpgradeSession(create1));
-        assertNull("tried to upgrade again", server.checkUpgradeSession(create2));
+        assertNotNull(server.checkUpgradeSession(create1), "failed to upgrade on a ephemeral create");
+        assertNull(server.checkUpgradeSession(create2), "tried to upgrade again");
 
         // clean al the setups and close the zk
         zk.close();
@@ -319,16 +318,13 @@ protected void request(Request request) throws IOException {
                             }
 
                             if (request.type == ZooDefs.OpCode.create && request.cnxn != null) {
-                                CreateRequest createRequest = new CreateRequest();
-                                request.request.rewind();
-                                ByteBufferInputStream.byteBuffer2Record(request.request, createRequest);
-                                request.request.rewind();
+                                CreateRequest createRequest = request.readRequestRecord(CreateRequest::new);
                                 try {
                                     CreateMode createMode = CreateMode.fromFlag(createRequest.getFlags());
                                     if (createMode.isEphemeral()) {
                                         request.cnxn.sendCloseSession();
                                     }
-                                } catch (KeeperException e) {
+                                } catch (KeeperException ignore) {
                                 }
                                 return;
                             }
@@ -359,7 +355,7 @@ private Request createEphemeralRequest(String path, long sessionId) throws IOExc
         CreateRequest createRequest = new CreateRequest(path, "data".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL.toFlag());
         createRequest.serialize(boa, "request");
         ByteBuffer bb = ByteBuffer.wrap(boas.toByteArray());
-        return new Request(null, sessionId, 1, ZooDefs.OpCode.create2, bb, new ArrayList<Id>());
+        return new Request(null, sessionId, 1, ZooDefs.OpCode.create2, RequestRecord.fromBytes(bb), new ArrayList<Id>());
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/StandaloneDisabledTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/StandaloneDisabledTest.java
index 70fcab7bcd8..1483d80a899 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/StandaloneDisabledTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/StandaloneDisabledTest.java
@@ -19,9 +19,9 @@
 package org.apache.zookeeper.server.quorum;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.ArrayList;
 import java.util.concurrent.TimeUnit;
 import org.apache.zookeeper.KeeperException;
@@ -32,7 +32,8 @@
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ReconfigTest;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 public class StandaloneDisabledTest extends QuorumPeerTestBase {
 
@@ -53,23 +54,20 @@ public class StandaloneDisabledTest extends QuorumPeerTestBase {
      * Test normal quorum operations work cleanly
      * with just a single server.
      */
-    @Test(timeout = 600000)
+    @Test
+    @Timeout(value = 10, unit = TimeUnit.MINUTES)
     public void startSingleServerTest() throws Exception {
         setUpData();
 
         //start one server
         startServer(leaderId, serverStrings.get(leaderId) + "\n");
         ReconfigTest.testServerHasConfig(zkHandles[leaderId], null, null);
-        LOG.info(
-            "Initial Configuration:\n{}",
-            new String(zkHandles[leaderId].getConfig(this, new Stat())));
+        LOG.info("Initial Configuration:\n{}", new String(zkHandles[leaderId].getConfig(this, new Stat())));
 
         //start and add 2 followers
         startFollowers();
         testReconfig(leaderId, true, reconfigServers);
-        LOG.info(
-            "Configuration after adding 2 followers:\n{}",
-            new String(zkHandles[leaderId].getConfig(this, new Stat())));
+        LOG.info("Configuration after adding 2 followers:\n{}", new String(zkHandles[leaderId].getConfig(this, new Stat())));
 
         //shutdown leader- quorum should still exist
         shutDownServer(leaderId);
@@ -91,9 +89,7 @@ public void startSingleServerTest() throws Exception {
         reconfigServers.add(Integer.toString(leaderId));
         reconfigServers.add(Integer.toString(follower1));
         testReconfig(follower2, false, reconfigServers);
-        LOG.info(
-            "Configuration after removing leader and follower 1:\n{}",
-            new String(zkHandles[follower2].getConfig(this, new Stat())));
+        LOG.info("Configuration after removing leader and follower 1:\n{}", new String(zkHandles[follower2].getConfig(this, new Stat())));
 
         // Kill server 1 to avoid it interferences with FLE of the quorum {2, 3, 4}.
         shutDownServer(follower1);
@@ -112,13 +108,11 @@ public void startSingleServerTest() throws Exception {
 
         //Add two participants and change them to observers to check
         //that we can reconfigure down to one participant with observers.
-        ArrayList<String> observerStrings = new ArrayList<String>();
+        ArrayList<String> observerStrings = new ArrayList<>();
         startObservers(observerStrings);
         testReconfig(follower2, true, reconfigServers); //add partcipants
         testReconfig(follower2, true, observerStrings); //change to observers
-        LOG.info(
-            "Configuration after adding two observers:\n{}",
-            new String(zkHandles[follower2].getConfig(this, new Stat())));
+        LOG.info("Configuration after adding two observers:\n{}", new String(zkHandles[follower2].getConfig(this, new Stat())));
 
         shutDownData();
     }
@@ -135,7 +129,7 @@ private void setUpData() throws Exception {
         zkAdminHandles = new ZooKeeperAdmin[NUM_SERVERS];
         clientPorts = new int[NUM_SERVERS];
         serverStrings = buildServerStrings();
-        reconfigServers = new ArrayList<String>();
+        reconfigServers = new ArrayList<>();
         System.setProperty("zookeeper.DigestAuthenticationProvider.superDigest", "super:D/InIHSb7yEEbrWz8b9l71RjZJU="/* password is 'test'*/);
     }
 
@@ -157,7 +151,7 @@ private void shutDownData() throws Exception {
      * the test servers.
      */
     private ArrayList<String> buildServerStrings() {
-        ArrayList<String> serverStrings = new ArrayList<String>();
+        ArrayList<String> serverStrings = new ArrayList<>();
 
         for (int i = 0; i < NUM_SERVERS; i++) {
             clientPorts[i] = PortAssignment.unique();
@@ -177,9 +171,9 @@ private void startServer(int id, String config) throws Exception {
         peers[id] = new MainThread(id, clientPorts[id], config);
         peers[id].start();
         assertTrue(
-            "Server " + id + " is not up",
-            ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[id], CONNECTION_TIMEOUT));
-        assertTrue("Error- Server started in Standalone Mode!", peers[id].isQuorumPeerRunning());
+            ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[id], CONNECTION_TIMEOUT),
+            "Server " + id + " is not up");
+        assertTrue(peers[id].isQuorumPeerRunning(), "Error- Server started in Standalone Mode!");
         zkHandles[id] = ClientBase.createZKClient("127.0.0.1:" + clientPorts[id]);
         zkAdminHandles[id] = new ZooKeeperAdmin("127.0.0.1:" + clientPorts[id], CONNECTION_TIMEOUT, this);
         zkAdminHandles[id].addAuthInfo("digest", "super:test".getBytes());
@@ -264,8 +258,8 @@ public void startObserver() throws Exception {
         MainThread observer = new MainThread(observer1, clientPort, config);
         observer.start();
         assertFalse(
-            "Observer was able to start by itself!",
-            ClientBase.waitForServerUp("127.0.0.1:" + clientPort, CONNECTION_TIMEOUT));
+            ClientBase.waitForServerUp("127.0.0.1:" + clientPort, CONNECTION_TIMEOUT),
+            "Observer was able to start by itself!");
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/StatCommandTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/StatCommandTest.java
index 7a46bac05e7..f5eb931f6dd 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/StatCommandTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/StatCommandTest.java
@@ -19,7 +19,7 @@
 package org.apache.zookeeper.server.quorum;
 
 import static org.hamcrest.CoreMatchers.containsString;
-import static org.junit.Assert.assertThat;
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 import java.io.PrintWriter;
@@ -32,8 +32,8 @@
 import org.apache.zookeeper.server.ZKDatabase;
 import org.apache.zookeeper.server.command.FourLetterCommands;
 import org.apache.zookeeper.server.command.StatCommand;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class StatCommandTest {
 
@@ -41,7 +41,7 @@ public class StatCommandTest {
     private StatCommand statCommand;
     private ServerStats.Provider providerMock;
 
-    @Before
+    @BeforeEach
     public void setUp() {
         outputWriter = new StringWriter();
         ServerCnxn serverCnxnMock = mock(ServerCnxn.class);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/StatResetCommandTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/StatResetCommandTest.java
index 850c4d81f1a..48642e008bc 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/StatResetCommandTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/StatResetCommandTest.java
@@ -19,7 +19,7 @@
 package org.apache.zookeeper.server.quorum;
 
 import static org.apache.zookeeper.server.command.AbstractFourLetterCommand.ZK_NOT_SERVING;
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
@@ -30,8 +30,8 @@
 import org.apache.zookeeper.server.ServerStats;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.command.StatResetCommand;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class StatResetCommandTest {
 
@@ -40,7 +40,7 @@ public class StatResetCommandTest {
     private ZooKeeperServer zks;
     private ServerStats serverStats;
 
-    @Before
+    @BeforeEach
     public void setUp() {
         outputWriter = new StringWriter();
         ServerCnxn serverCnxnMock = mock(ServerCnxn.class);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SyncRequestProcessorMetricTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SyncRequestProcessorMetricTest.java
index c00362219ba..8ca33f798c7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SyncRequestProcessorMetricTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/SyncRequestProcessorMetricTest.java
@@ -18,15 +18,14 @@
 
 package org.apache.zookeeper.server.quorum;
 
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.number.OrderingComparison.greaterThan;
 import static org.hamcrest.number.OrderingComparison.greaterThanOrEqualTo;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Mockito.doAnswer;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
-import java.nio.ByteBuffer;
 import java.util.Map;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
@@ -34,11 +33,12 @@
 import org.apache.zookeeper.metrics.MetricsUtils;
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.RequestProcessor;
+import org.apache.zookeeper.server.RequestRecord;
 import org.apache.zookeeper.server.SyncRequestProcessor;
 import org.apache.zookeeper.server.ZKDatabase;
 import org.apache.zookeeper.server.ZooKeeperServer;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class SyncRequestProcessorMetricTest {
 
@@ -46,7 +46,7 @@ public class SyncRequestProcessorMetricTest {
     RequestProcessor nextProcessor;
     CountDownLatch allRequestsFlushed;
 
-    @Before
+    @BeforeEach
     public void setup() throws Exception {
         ZKDatabase db = mock(ZKDatabase.class);
         when(db.append(any(Request.class))).thenReturn(true);
@@ -64,15 +64,15 @@ public void setup() throws Exception {
         }).when(nextProcessor).processRequest(any(Request.class));
     }
 
-    private Request createRquest(long sessionId, int xid) {
-        return new Request(null, sessionId, xid, ZooDefs.OpCode.setData, ByteBuffer.wrap(new byte[10]), null);
+    private Request createRequest(long sessionId, int xid) {
+        return new Request(null, sessionId, xid, ZooDefs.OpCode.setData, RequestRecord.fromBytes(new byte[10]), null);
     }
 
     @Test
     public void testSyncProcessorMetrics() throws Exception {
         SyncRequestProcessor syncProcessor = new SyncRequestProcessor(zks, nextProcessor);
         for (int i = 0; i < 500; i++) {
-            syncProcessor.processRequest(createRquest(1, i));
+            syncProcessor.processRequest(createRequest(1, i));
         }
 
         Map<String, Object> values = MetricsUtils.currentServerMetrics();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/UnifiedServerSocketModeDetectionTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/UnifiedServerSocketModeDetectionTest.java
index 94b0e01d0eb..05b67debcda 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/UnifiedServerSocketModeDetectionTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/UnifiedServerSocketModeDetectionTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.IOException;
 import java.net.InetAddress;
@@ -29,14 +29,11 @@
 import java.net.Socket;
 import java.net.SocketOptions;
 import java.security.Security;
-import java.util.ArrayList;
-import java.util.Collection;
 import java.util.concurrent.Callable;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
 import java.util.concurrent.Future;
 import java.util.concurrent.TimeUnit;
-import org.apache.commons.io.FileUtils;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.common.ClientX509Util;
@@ -44,15 +41,13 @@
 import org.apache.zookeeper.common.X509KeyType;
 import org.apache.zookeeper.common.X509TestContext;
 import org.apache.zookeeper.common.X509Util;
-import org.apache.zookeeper.test.ClientBase;
 import org.bouncycastle.jce.provider.BouncyCastleProvider;
-import org.junit.After;
-import org.junit.AfterClass;
-import org.junit.Before;
-import org.junit.BeforeClass;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.io.TempDir;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -61,23 +56,13 @@
  * trigger blocking mode detection. This is necessary to ensure that the
  * Leader's accept() thread doesn't get blocked.
  */
-@RunWith(Parameterized.class)
 public class UnifiedServerSocketModeDetectionTest extends ZKTestCase {
 
     private static final Logger LOG = LoggerFactory.getLogger(UnifiedServerSocketModeDetectionTest.class);
-
-    @Parameterized.Parameters
-    public static Collection<Object[]> params() {
-        ArrayList<Object[]> result = new ArrayList<>();
-        result.add(new Object[]{true});
-        result.add(new Object[]{false});
-        return result;
-    }
-
-    private static File tempDir;
+    @TempDir
+    static File tempDir;
     private static X509TestContext x509TestContext;
 
-    private boolean useSecureClient;
     private X509Util x509Util;
     private UnifiedServerSocket listeningSocket;
     private UnifiedServerSocket.UnifiedSocket serverSideSocket;
@@ -86,20 +71,14 @@ public static Collection<Object[]> params() {
     private int port;
     private InetSocketAddress localServerAddress;
 
-    @BeforeClass
+    @BeforeAll
     public static void setUpClass() throws Exception {
         Security.addProvider(new BouncyCastleProvider());
-        tempDir = ClientBase.createEmptyTestDir();
         x509TestContext = X509TestContext.newBuilder().setTempDir(tempDir).setKeyStoreKeyType(X509KeyType.EC).setTrustStoreKeyType(X509KeyType.EC).build();
     }
 
-    @AfterClass
+    @AfterAll
     public static void tearDownClass() {
-        try {
-            FileUtils.deleteDirectory(tempDir);
-        } catch (IOException e) {
-            // ignore
-        }
         Security.removeProvider(BouncyCastleProvider.PROVIDER_NAME);
     }
 
@@ -123,12 +102,7 @@ private static void forceClose(ServerSocket s) {
         }
     }
 
-    public UnifiedServerSocketModeDetectionTest(Boolean useSecureClient) {
-        this.useSecureClient = useSecureClient;
-    }
-
-    @Before
-    public void setUp() throws Exception {
+    public void init(boolean useSecureClient) throws Exception {
         x509Util = new ClientX509Util();
         x509TestContext.setSystemProperties(x509Util, KeyStoreFileType.JKS, KeyStoreFileType.JKS);
         System.setProperty(x509Util.getSslHandshakeDetectionTimeoutMillisProperty(), "100");
@@ -160,7 +134,7 @@ public UnifiedServerSocket.UnifiedSocket call() throws Exception {
         serverSideSocket = acceptFuture.get();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         x509TestContext.clearSystemProperties(x509Util);
         System.clearProperty(x509Util.getSslHandshakeDetectionTimeoutMillisProperty());
@@ -172,62 +146,82 @@ public void tearDown() throws Exception {
         x509Util.close();
     }
 
-    @Test
-    public void testGetInetAddress() {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetInetAddress(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.getInetAddress();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testGetLocalAddress() {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetLocalAddress(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.getLocalAddress();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testGetPort() {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetPort(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.getPort();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testGetLocalPort() {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetLocalPort(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.getLocalPort();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testGetRemoteSocketAddress() {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetRemoteSocketAddress(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.getRemoteSocketAddress();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testGetLocalSocketAddress() {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetLocalSocketAddress(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.getLocalSocketAddress();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testGetInputStream() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetInputStream(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.getInputStream();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testGetOutputStream() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetOutputStream(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.getOutputStream();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testGetTcpNoDelay() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetTcpNoDelay(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.getTcpNoDelay();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testSetTcpNoDelay() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testSetTcpNoDelay(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         boolean tcpNoDelay = serverSideSocket.getTcpNoDelay();
         tcpNoDelay = !tcpNoDelay;
         serverSideSocket.setTcpNoDelay(tcpNoDelay);
@@ -235,14 +229,18 @@ public void testSetTcpNoDelay() throws IOException {
         assertEquals(tcpNoDelay, serverSideSocket.getTcpNoDelay());
     }
 
-    @Test
-    public void testGetSoLinger() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetSoLinger(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.getSoLinger();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testSetSoLinger() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testSetSoLinger(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         int soLinger = serverSideSocket.getSoLinger();
         if (soLinger == -1) {
             // enable it if disabled
@@ -257,14 +255,18 @@ public void testSetSoLinger() throws IOException {
         }
     }
 
-    @Test
-    public void testGetSoTimeout() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetSoTimeout(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.getSoTimeout();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testSetSoTimeout() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testSetSoTimeout(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         int timeout = serverSideSocket.getSoTimeout();
         timeout = timeout + 10;
         serverSideSocket.setSoTimeout(timeout);
@@ -272,14 +274,18 @@ public void testSetSoTimeout() throws IOException {
         assertEquals(timeout, serverSideSocket.getSoTimeout());
     }
 
-    @Test
-    public void testGetSendBufferSize() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetSendBufferSize(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.getSendBufferSize();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testSetSendBufferSize() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testSetSendBufferSize(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.setSendBufferSize(serverSideSocket.getSendBufferSize() + 1024);
         assertFalse(serverSideSocket.isModeKnown());
         // Note: the new buffer size is a hint and socket implementation
@@ -288,14 +294,18 @@ public void testSetSendBufferSize() throws IOException {
 
     }
 
-    @Test
-    public void testGetReceiveBufferSize() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetReceiveBufferSize(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.getReceiveBufferSize();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testSetReceiveBufferSize() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testSetReceiveBufferSize(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.setReceiveBufferSize(serverSideSocket.getReceiveBufferSize() + 1024);
         assertFalse(serverSideSocket.isModeKnown());
         // Note: the new buffer size is a hint and socket implementation
@@ -304,14 +314,18 @@ public void testSetReceiveBufferSize() throws IOException {
 
     }
 
-    @Test
-    public void testGetKeepAlive() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetKeepAlive(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.getKeepAlive();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testSetKeepAlive() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testSetKeepAlive(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         boolean keepAlive = serverSideSocket.getKeepAlive();
         keepAlive = !keepAlive;
         serverSideSocket.setKeepAlive(keepAlive);
@@ -319,14 +333,18 @@ public void testSetKeepAlive() throws IOException {
         assertEquals(keepAlive, serverSideSocket.getKeepAlive());
     }
 
-    @Test
-    public void testGetTrafficClass() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetTrafficClass(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.getTrafficClass();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testSetTrafficClass() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testSetTrafficClass(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.setTrafficClass(SocketOptions.IP_TOS);
         assertFalse(serverSideSocket.isModeKnown());
         // Note: according to the Socket javadocs, setTrafficClass() may be
@@ -334,14 +352,18 @@ public void testSetTrafficClass() throws IOException {
         // we set is returned.
     }
 
-    @Test
-    public void testGetReuseAddress() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetReuseAddress(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.getReuseAddress();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testSetReuseAddress() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testSetReuseAddress(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         boolean reuseAddress = serverSideSocket.getReuseAddress();
         reuseAddress = !reuseAddress;
         serverSideSocket.setReuseAddress(reuseAddress);
@@ -349,52 +371,68 @@ public void testSetReuseAddress() throws IOException {
         assertEquals(reuseAddress, serverSideSocket.getReuseAddress());
     }
 
-    @Test
-    public void testClose() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testClose(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.close();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testShutdownInput() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testShutdownInput(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.shutdownInput();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testShutdownOutput() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testShutdownOutput(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.shutdownOutput();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testIsConnected() {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testIsConnected(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.isConnected();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testIsBound() {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testIsBound(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.isBound();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testIsClosed() {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testIsClosed(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.isClosed();
         assertFalse(serverSideSocket.isModeKnown());
     }
 
-    @Test
-    public void testIsInputShutdown() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testIsInputShutdown(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.isInputShutdown();
         assertFalse(serverSideSocket.isModeKnown());
         serverSideSocket.shutdownInput();
         assertTrue(serverSideSocket.isInputShutdown());
     }
 
-    @Test
-    public void testIsOutputShutdown() throws IOException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testIsOutputShutdown(boolean useSecureClient) throws Exception {
+        init(useSecureClient);
         serverSideSocket.isOutputShutdown();
         assertFalse(serverSideSocket.isModeKnown());
         serverSideSocket.shutdownOutput();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/UnifiedServerSocketTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/UnifiedServerSocketTest.java
index 7e4fa69ad2c..fa710f4658f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/UnifiedServerSocketTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/UnifiedServerSocketTest.java
@@ -18,12 +18,12 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertArrayEquals;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.BufferedInputStream;
 import java.io.IOException;
 import java.net.ConnectException;
@@ -33,12 +33,12 @@
 import java.net.Socket;
 import java.net.SocketException;
 import java.util.ArrayList;
-import java.util.Collection;
 import java.util.List;
 import java.util.Random;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
 import java.util.concurrent.TimeUnit;
+import java.util.stream.Stream;
 import javax.net.ssl.HandshakeCompletedEvent;
 import javax.net.ssl.HandshakeCompletedListener;
 import javax.net.ssl.SSLSocket;
@@ -50,27 +50,24 @@
 import org.apache.zookeeper.common.X509KeyType;
 import org.apache.zookeeper.common.X509TestContext;
 import org.apache.zookeeper.common.X509Util;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
 
-@RunWith(Parameterized.class)
 public class UnifiedServerSocketTest extends BaseX509ParameterizedTestCase {
 
-    @Parameterized.Parameters
-    public static Collection<Object[]> params() {
-        ArrayList<Object[]> result = new ArrayList<>();
+    public static Stream<Arguments> data() {
+        ArrayList<Arguments> result = new ArrayList<>();
         int paramIndex = 0;
         for (X509KeyType caKeyType : X509KeyType.values()) {
             for (X509KeyType certKeyType : X509KeyType.values()) {
                 for (Boolean hostnameVerification : new Boolean[]{true, false}) {
-                    result.add(new Object[]{caKeyType, certKeyType, hostnameVerification, paramIndex++});
+                    result.add(Arguments.of(caKeyType, certKeyType, hostnameVerification, paramIndex++));
                 }
             }
         }
-        return result;
+        return result.stream();
     }
 
     private static final int MAX_RETRIES = 5;
@@ -84,9 +81,9 @@ public static Collection<Object[]> params() {
     // access only inside synchronized(handshakeCompletedLock) { ... } blocks
     private boolean handshakeCompleted = false;
 
-    public UnifiedServerSocketTest(
+    public void init(
             final X509KeyType caKeyType, final X509KeyType certKeyType, final Boolean hostnameVerification, final Integer paramIndex) {
-        super(paramIndex, () -> {
+        super.init(paramIndex, () -> {
             try {
                 return X509TestContext.newBuilder().setTempDir(tempDir).setKeyStoreKeyType(certKeyType).setTrustStoreKeyType(caKeyType).setHostnameVerification(hostnameVerification).build();
             } catch (Exception e) {
@@ -95,14 +92,13 @@ public UnifiedServerSocketTest(
         });
     }
 
-    @Before
     public void setUp() throws Exception {
         localServerAddress = new InetSocketAddress(InetAddress.getLoopbackAddress(), PortAssignment.unique());
         x509Util = new ClientX509Util();
         x509TestContext.setSystemProperties(x509Util, KeyStoreFileType.JKS, KeyStoreFileType.JKS);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         x509TestContext.clearSystemProperties(x509Util);
         x509Util.close();
@@ -235,7 +231,7 @@ public void handshakeCompleted(HandshakeCompletedEvent handshakeCompletedEvent)
             retries++;
         }
 
-        assertNotNull("Failed to connect to server with SSL", sslSocket);
+        assertNotNull(sslSocket, "Failed to connect to server with SSL");
         return sslSocket;
     }
 
@@ -256,7 +252,7 @@ private Socket connectWithoutSSL() throws IOException, InterruptedException {
             }
             retries++;
         }
-        assertNotNull("Failed to connect to server without SSL", socket);
+        assertNotNull(socket, "Failed to connect to server without SSL");
         return socket;
     }
 
@@ -268,8 +264,13 @@ private Socket connectWithoutSSL() throws IOException, InterruptedException {
     /**
      * Attempting to connect to a SSL-or-plaintext server with SSL should work.
      */
-    @Test
-    public void testConnectWithSSLToNonStrictServer() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testConnectWithSSLToNonStrictServer(
+        final X509KeyType caKeyType, final X509KeyType certKeyType, final Boolean hostnameVerification, final Integer paramIndex
+    ) throws Exception {
+        init(caKeyType, certKeyType, hostnameVerification, paramIndex);
+        setUp();
         UnifiedServerThread serverThread = new UnifiedServerThread(x509Util, localServerAddress, true, DATA_TO_CLIENT);
         serverThread.start();
 
@@ -298,8 +299,13 @@ public void testConnectWithSSLToNonStrictServer() throws Exception {
     /**
      * Attempting to connect to a SSL-only server with SSL should work.
      */
-    @Test
-    public void testConnectWithSSLToStrictServer() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testConnectWithSSLToStrictServer(
+        final X509KeyType caKeyType, final X509KeyType certKeyType, final Boolean hostnameVerification, final Integer paramIndex
+    ) throws Exception {
+        init(caKeyType, certKeyType, hostnameVerification, paramIndex);
+        setUp();
         UnifiedServerThread serverThread = new UnifiedServerThread(x509Util, localServerAddress, false, DATA_TO_CLIENT);
         serverThread.start();
 
@@ -329,8 +335,13 @@ public void testConnectWithSSLToStrictServer() throws Exception {
     /**
      * Attempting to connect to a SSL-or-plaintext server without SSL should work.
      */
-    @Test
-    public void testConnectWithoutSSLToNonStrictServer() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testConnectWithoutSSLToNonStrictServer(
+        final X509KeyType caKeyType, final X509KeyType certKeyType, final Boolean hostnameVerification, final Integer paramIndex
+    ) throws Exception {
+        init(caKeyType, certKeyType, hostnameVerification, paramIndex);
+        setUp();
         UnifiedServerThread serverThread = new UnifiedServerThread(x509Util, localServerAddress, true, DATA_TO_CLIENT);
         serverThread.start();
 
@@ -355,8 +366,13 @@ public void testConnectWithoutSSLToNonStrictServer() throws Exception {
      * less than 5 bytes does not break the logic in the server's initial 5
      * byte read.
      */
-    @Test
-    public void testConnectWithoutSSLToNonStrictServerPartialWrite() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testConnectWithoutSSLToNonStrictServerPartialWrite(
+        final X509KeyType caKeyType, final X509KeyType certKeyType, final Boolean hostnameVerification, final Integer paramIndex
+    ) throws Exception {
+        init(caKeyType, certKeyType, hostnameVerification, paramIndex);
+        setUp();
         UnifiedServerThread serverThread = new UnifiedServerThread(x509Util, localServerAddress, true, DATA_TO_CLIENT);
         serverThread.start();
 
@@ -384,8 +400,13 @@ public void testConnectWithoutSSLToNonStrictServerPartialWrite() throws Exceptio
     /**
      * Attempting to connect to a SSL-only server without SSL should fail.
      */
-    @Test
-    public void testConnectWithoutSSLToStrictServer() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testConnectWithoutSSLToStrictServer(
+        final X509KeyType caKeyType, final X509KeyType certKeyType, final Boolean hostnameVerification, final Integer paramIndex
+    ) throws Exception {
+        init(caKeyType, certKeyType, hostnameVerification, paramIndex);
+        setUp();
         UnifiedServerThread serverThread = new UnifiedServerThread(x509Util, localServerAddress, false, DATA_TO_CLIENT);
         serverThread.start();
 
@@ -409,7 +430,7 @@ public void testConnectWithoutSSLToStrictServer() throws Exception {
 
             // independently of the client socket implementation details, we always make sure the
             // server didn't receive any data during the test
-            assertFalse("The strict server accepted connection without SSL.", serverThread.receivedAnyDataFromClient());
+            assertFalse(serverThread.receivedAnyDataFromClient(), "The strict server accepted connection without SSL.");
         }
         fail("Expected server to hang up the connection. Read from server succeeded unexpectedly.");
     }
@@ -425,8 +446,13 @@ public void testConnectWithoutSSLToStrictServer() throws Exception {
      * This version of the test uses a non-strict server socket (i.e. it
      * accepts both TLS and plaintext connections).
      */
-    @Test
-    public void testTLSDetectionNonBlockingNonStrictServerIdleClient() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testTLSDetectionNonBlockingNonStrictServerIdleClient(
+        final X509KeyType caKeyType, final X509KeyType certKeyType, final Boolean hostnameVerification, final Integer paramIndex
+    ) throws Exception {
+        init(caKeyType, certKeyType, hostnameVerification, paramIndex);
+        setUp();
         Socket badClientSocket = null;
         Socket clientSocket = null;
         Socket secureClientSocket = null;
@@ -476,8 +502,13 @@ public void testTLSDetectionNonBlockingNonStrictServerIdleClient() throws Except
      * Like the above test, but with a strict server socket (closes non-TLS
      * connections after seeing that there is no handshake).
      */
-    @Test
-    public void testTLSDetectionNonBlockingStrictServerIdleClient() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testTLSDetectionNonBlockingStrictServerIdleClient(
+        final X509KeyType caKeyType, final X509KeyType certKeyType, final Boolean hostnameVerification, final Integer paramIndex
+    ) throws Exception {
+        init(caKeyType, certKeyType, hostnameVerification, paramIndex);
+        setUp();
         Socket badClientSocket = null;
         Socket secureClientSocket = null;
         UnifiedServerThread serverThread = new UnifiedServerThread(x509Util, localServerAddress, false, DATA_TO_CLIENT);
@@ -512,8 +543,13 @@ public void testTLSDetectionNonBlockingStrictServerIdleClient() throws Exception
      * Similar to the tests above, but the bad client disconnects immediately
      * without sending any data.
      */
-    @Test
-    public void testTLSDetectionNonBlockingNonStrictServerDisconnectedClient() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testTLSDetectionNonBlockingNonStrictServerDisconnectedClient(
+        final X509KeyType caKeyType, final X509KeyType certKeyType, final Boolean hostnameVerification, final Integer paramIndex
+    ) throws Exception {
+        init(caKeyType, certKeyType, hostnameVerification, paramIndex);
+        setUp();
         Socket clientSocket = null;
         Socket secureClientSocket = null;
         UnifiedServerThread serverThread = new UnifiedServerThread(x509Util, localServerAddress, true, DATA_TO_CLIENT);
@@ -562,8 +598,13 @@ public void testTLSDetectionNonBlockingNonStrictServerDisconnectedClient() throw
      * Like the above test, but with a strict server socket (closes non-TLS
      * connections after seeing that there is no handshake).
      */
-    @Test
-    public void testTLSDetectionNonBlockingStrictServerDisconnectedClient() throws Exception {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testTLSDetectionNonBlockingStrictServerDisconnectedClient(
+        final X509KeyType caKeyType, final X509KeyType certKeyType, final Boolean hostnameVerification, final Integer paramIndex
+    ) throws Exception {
+        init(caKeyType, certKeyType, hostnameVerification, paramIndex);
+        setUp();
         Socket secureClientSocket = null;
         UnifiedServerThread serverThread = new UnifiedServerThread(x509Util, localServerAddress, false, DATA_TO_CLIENT);
         serverThread.start();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/WatchLeakTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/WatchLeakTest.java
index 2455738e4b8..228527980da 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/WatchLeakTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/WatchLeakTest.java
@@ -17,7 +17,7 @@
 
 package org.apache.zookeeper.server.quorum;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
@@ -36,8 +36,6 @@
 import java.nio.channels.Selector;
 import java.nio.channels.SocketChannel;
 import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collection;
 import java.util.Collections;
 import java.util.List;
 import java.util.Random;
@@ -45,7 +43,6 @@
 import org.apache.jute.OutputArchive;
 import org.apache.zookeeper.ClientCnxn;
 import org.apache.zookeeper.MockPacket;
-import org.apache.zookeeper.ZKParameterized;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.proto.ConnectRequest;
 import org.apache.zookeeper.proto.ReplyHeader;
@@ -57,11 +54,9 @@
 import org.apache.zookeeper.server.NIOServerCnxnFactory;
 import org.apache.zookeeper.server.ZKDatabase;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
-import org.junit.runners.Parameterized.Parameters;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
 import org.mockito.invocation.InvocationOnMock;
 import org.mockito.stubbing.Answer;
 import org.slf4j.Logger;
@@ -70,36 +65,24 @@
 /**
  * Demonstrate ZOOKEEPER-1382 : Watches leak on expired session
  */
-@RunWith(Parameterized.class)
-@Parameterized.UseParametersRunnerFactory(ZKParameterized.RunnerFactory.class)
 public class WatchLeakTest {
 
     protected static final Logger LOG = LoggerFactory.getLogger(WatchLeakTest.class);
 
     final long SESSION_ID = 0xBABEL;
 
-    private final boolean sessionTimedout;
-
-    @Before
+    @BeforeEach
     public void setUp() {
         System.setProperty("zookeeper.admin.enableServer", "false");
     }
 
-    public WatchLeakTest(boolean sessionTimedout) {
-        this.sessionTimedout = sessionTimedout;
-    }
-
-    @Parameters
-    public static Collection<Object[]> configs() {
-        return Arrays.asList(new Object[][]{{false}, {true}});
-    }
-
     /**
      * Check that if session has expired then no watch can be set
      */
 
-    @Test
-    public void testWatchesLeak() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testWatchesLeak(boolean sessionTimedout) throws Exception {
 
         NIOServerCnxnFactory serverCnxnFactory = mock(NIOServerCnxnFactory.class);
         final SelectionKey sk = new FakeSK();
@@ -114,12 +97,12 @@ public Boolean answer(InvocationOnMock invocation) throws Throwable {
             }
         });
 
-        ZKDatabase database = new ZKDatabase(null);
+        ZKDatabase database = new ZKDatabase(mock(FileTxnSnapLog.class));
         database.setlastProcessedZxid(2L);
         QuorumPeer quorumPeer = mock(QuorumPeer.class);
         FileTxnSnapLog logfactory = mock(FileTxnSnapLog.class);
         // Directories are not used but we need it to avoid NPE
-        when(logfactory.getDataDir()).thenReturn(new File(""));
+        when(logfactory.getDataLogDir()).thenReturn(new File(""));
         when(logfactory.getSnapDir()).thenReturn(new File(""));
         FollowerZooKeeperServer fzks = null;
 
@@ -145,7 +128,7 @@ public Boolean answer(InvocationOnMock invocation) throws Throwable {
             // OK, now the follower knows that the session is valid or invalid, let's try
             // to send the watches
             nioCnxn.doIO(sk);
-            // wait for the the request processor to do his job
+            // wait for the request processor to do his job
             Thread.sleep(1000L);
             LOG.info("Watches processed");
             // If session has not been validated, there must be NO watches
@@ -153,11 +136,11 @@ public Boolean answer(InvocationOnMock invocation) throws Throwable {
             if (sessionTimedout) {
                 // Session has not been re-validated !
                 LOG.info("session is not valid, watches = {}", watchCount);
-                assertEquals("Session is not valid so there should be no watches", 0, watchCount);
+                assertEquals(0, watchCount, "Session is not valid so there should be no watches");
             } else {
                 // Session has been re-validated
                 LOG.info("session is valid, watches = {}", watchCount);
-                assertEquals("Session is valid so the watch should be there", 1, watchCount);
+                assertEquals(1, watchCount, "Session is valid so the watch should be there");
             }
         } finally {
             if (fzks != null) {
@@ -245,7 +228,7 @@ public int readyOps() {
      * @return a message that attempts to set 1 watch on /
      */
     private ByteBuffer createWatchesMessage() {
-        List<String> dataWatches = new ArrayList<String>(1);
+        List<String> dataWatches = new ArrayList<>(1);
         dataWatches.add("/");
         List<String> existWatches = Collections.emptyList();
         List<String> childWatches = Collections.emptyList();
@@ -272,8 +255,8 @@ private ByteBuffer createConnRequest() {
         Random r = new Random(SESSION_ID ^ superSecret);
         byte[] p = new byte[16];
         r.nextBytes(p);
-        ConnectRequest conReq = new ConnectRequest(0, 1L, 30000, SESSION_ID, p);
-        MockPacket packet = new MockPacket(null, null, conReq, null, null, false);
+        ConnectRequest conReq = new ConnectRequest(0, 1L, 30000, SESSION_ID, p, false);
+        MockPacket packet = new MockPacket(null, null, conReq, null, null);
         return packet.createAndReturnBB();
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/Zab1_0Test.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/Zab1_0Test.java
index b8630ae1319..d374062e293 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/Zab1_0Test.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/Zab1_0Test.java
@@ -22,10 +22,10 @@
 import static org.apache.zookeeper.server.quorum.ZabUtils.createLeader;
 import static org.apache.zookeeper.server.quorum.ZabUtils.createMockLeader;
 import static org.apache.zookeeper.server.quorum.ZabUtils.createQuorumPeer;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.spy;
 import static org.mockito.Mockito.verify;
@@ -53,9 +53,9 @@
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.server.ByteBufferInputStream;
-import org.apache.zookeeper.server.ByteBufferOutputStream;
 import org.apache.zookeeper.server.DataTree;
 import org.apache.zookeeper.server.Request;
+import org.apache.zookeeper.server.RequestRecord;
 import org.apache.zookeeper.server.ZKDatabase;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
@@ -67,8 +67,9 @@
 import org.apache.zookeeper.txn.ErrorTxn;
 import org.apache.zookeeper.txn.SetDataTxn;
 import org.apache.zookeeper.txn.TxnHeader;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -76,9 +77,7 @@ public class Zab1_0Test extends ZKTestCase {
 
     private static final Logger LOG = LoggerFactory.getLogger(Zab1_0Test.class);
 
-    private static final File testData = new File(System.getProperty("test.data.dir", "src/test/resources/data"));
-
-    @Before
+    @BeforeEach
     public void setUp() {
         System.setProperty("zookeeper.admin.enableServer", "false");
     }
@@ -136,7 +135,7 @@ public void run() {
 
     }
     @Test
-    public void testLeaderInConnectingFollowers() throws Exception {
+    public void testLeaderInConnectingFollowers(@TempDir File testData) throws Exception {
         File tmpDir = File.createTempFile("test", "dir", testData);
         tmpDir.delete();
         tmpDir.mkdir();
@@ -162,8 +161,8 @@ public void testLeaderInConnectingFollowers() throws Exception {
             // epoch were accounted for, so the leader should not block and since it started with
             // accepted epoch = 5 it should now have 6
             try {
-                long epoch = leader.getEpochToPropose(leader.self.getId(), leader.self.getAcceptedEpoch());
-                assertEquals("leader got wrong epoch from getEpochToPropose", 6, epoch);
+                long epoch = leader.getEpochToPropose(leader.self.getMyId(), leader.self.getAcceptedEpoch());
+                assertEquals(6, epoch, "leader got wrong epoch from getEpochToPropose");
             } catch (Exception e) {
                 fail("leader timed out in getEpochToPropose");
             }
@@ -190,7 +189,7 @@ public void testLeaderInConnectingFollowers() throws Exception {
      */
 
     @Test
-    public void testLastAcceptedEpoch() throws Exception {
+    public void testLastAcceptedEpoch(@TempDir File testData) throws Exception {
         File tmpDir = File.createTempFile("test", "dir", testData);
         tmpDir.delete();
         tmpDir.mkdir();
@@ -210,7 +209,7 @@ public void testLastAcceptedEpoch() throws Exception {
 
             try {
                 long epoch = leader.getEpochToPropose(1, 6);
-                assertEquals("New proposed epoch is wrong", 7, epoch);
+                assertEquals(7, epoch, "New proposed epoch is wrong");
             } catch (Exception e) {
                 fail("Timed out in getEpochToPropose");
             }
@@ -228,7 +227,7 @@ public void testLastAcceptedEpoch() throws Exception {
     }
 
     @Test
-    public void testLeaderInElectingFollowers() throws Exception {
+    public void testLeaderInElectingFollowers(@TempDir File testData) throws Exception {
         File tmpDir = File.createTempFile("test", "dir", testData);
         tmpDir.delete();
         tmpDir.mkdir();
@@ -253,8 +252,8 @@ public void testLeaderInElectingFollowers() throws Exception {
             f2.join(leader.self.getInitLimit() * leader.self.getTickTime() + 5000);
 
             // make sure that they timed out and didn't return normally
-            assertTrue(f1.msg + " without waiting for leader", f1.msg == null);
-            assertTrue(f2.msg + " without waiting for leader", f2.msg == null);
+            assertTrue(f1.msg == null, f1.msg + " without waiting for leader");
+            assertTrue(f2.msg == null, f2.msg + " without waiting for leader");
         } finally {
             if (leader != null) {
                 leader.shutdown("end of test");
@@ -302,7 +301,7 @@ public interface ObserverConversation {
 
     }
 
-    public void testLeaderConversation(LeaderConversation conversation) throws Exception {
+    public void testLeaderConversation(LeaderConversation conversation, File testData) throws Exception {
         Socket[] pair = getSocketPair();
         Socket leaderSocket = pair[0];
         Socket followerSocket = pair[1];
@@ -342,7 +341,7 @@ public void testLeaderConversation(LeaderConversation conversation) throws Excep
         }
     }
 
-    public void testPopulatedLeaderConversation(PopulatedLeaderConversation conversation, int ops) throws Exception {
+    public void testPopulatedLeaderConversation(PopulatedLeaderConversation conversation, int ops, File testData) throws Exception {
         Socket[] pair = getSocketPair();
         Socket leaderSocket = pair[0];
         Socket followerSocket = pair[1];
@@ -408,7 +407,7 @@ public void testPopulatedLeaderConversation(PopulatedLeaderConversation conversa
         }
     }
 
-    public void testFollowerConversation(FollowerConversation conversation) throws Exception {
+    public void testFollowerConversation(FollowerConversation conversation, File testData) throws Exception {
         File tmpDir = File.createTempFile("test", "dir", testData);
         tmpDir.delete();
         tmpDir.mkdir();
@@ -458,7 +457,7 @@ public void run() {
         }
     }
 
-    public void testObserverConversation(ObserverConversation conversation) throws Exception {
+    public void testObserverConversation(ObserverConversation conversation, File testData) throws Exception {
         File tmpDir = File.createTempFile("test", "dir", testData);
         tmpDir.delete();
         tmpDir.mkdir();
@@ -508,7 +507,7 @@ public void run() {
     }
 
     @Test
-    public void testUnnecessarySnap() throws Exception {
+    public void testUnnecessarySnap(@TempDir File testData) throws Exception {
         testPopulatedLeaderConversation(new PopulatedLeaderConversation() {
             @Override
             public void converseWithLeader(InputArchive ia, OutputArchive oa, Leader l, long zxid) throws Exception {
@@ -518,8 +517,7 @@ public void converseWithLeader(InputArchive ia, OutputArchive oa, Leader l, long
 
                 /* we test a normal run. everything should work out well. */
                 LearnerInfo li = new LearnerInfo(1, 0x10000, 0);
-                byte[] liBytes = new byte[20];
-                ByteBufferOutputStream.record2ByteBuffer(li, ByteBuffer.wrap(liBytes));
+                byte[] liBytes = RequestRecord.fromRecord(li).readBytes();
                 QuorumPacket qp = new QuorumPacket(Leader.FOLLOWERINFO, 1, liBytes, null);
                 oa.writeRecord(qp, null);
 
@@ -540,7 +538,7 @@ public void converseWithLeader(InputArchive ia, OutputArchive oa, Leader l, long
                 assertEquals(Leader.DIFF, qp.getType());
 
             }
-        }, 2);
+        }, 2, testData);
     }
 
     // We want to track the change with a callback rather than depending on timing
@@ -568,14 +566,14 @@ public synchronized boolean changed() {
     }
 
     @Test
-    public void testNormalFollowerRun() throws Exception {
+    public void testNormalFollowerRun(@TempDir File testData) throws Exception {
         testFollowerConversation(new FollowerConversation() {
             @Override
             public void converseWithFollower(InputArchive ia, OutputArchive oa, Follower f) throws Exception {
                 File tmpDir = File.createTempFile("test", "dir", testData);
                 tmpDir.delete();
                 tmpDir.mkdir();
-                File logDir = f.fzk.getTxnLogFactory().getDataDir().getParentFile();
+                File logDir = f.fzk.getTxnLogFactory().getDataLogDir().getParentFile();
                 File snapDir = f.fzk.getTxnLogFactory().getSnapDir().getParentFile();
                 //Spy on ZK so we can check if a snapshot happened or not.
                 f.zk = spy(f.zk);
@@ -698,18 +696,18 @@ private void proposeSetData(QuorumPacket qp, long zxid, String data, int version
                 boa.writeRecord(sdt, null);
                 qp.setData(baos.toByteArray());
             }
-        });
+        }, testData);
     }
 
     @Test
-    public void testNormalFollowerRunWithDiff() throws Exception {
+    public void testNormalFollowerRunWithDiff(@TempDir File testData) throws Exception {
         testFollowerConversation(new FollowerConversation() {
             @Override
             public void converseWithFollower(InputArchive ia, OutputArchive oa, Follower f) throws Exception {
                 File tmpDir = File.createTempFile("test", "dir", testData);
                 tmpDir.delete();
                 tmpDir.mkdir();
-                File logDir = f.fzk.getTxnLogFactory().getDataDir().getParentFile();
+                File logDir = f.fzk.getTxnLogFactory().getDataLogDir().getParentFile();
                 File snapDir = f.fzk.getTxnLogFactory().getSnapDir().getParentFile();
                 //Spy on ZK so we can check if a snapshot happened or not.
                 f.zk = spy(f.zk);
@@ -743,8 +741,8 @@ public void converseWithFollower(InputArchive ia, OutputArchive oa, Follower f)
 
                     readPacketSkippingPing(ia, qp);
                     assertEquals(Leader.ACKEPOCH, qp.getType());
-                    assertEquals(0, qp.getZxid());
-                    assertEquals(ZxidUtils.makeZxid(0, 0), ByteBuffer.wrap(qp.getData()).getInt());
+                    assertEquals(ZxidUtils.makeZxid(0, 0), qp.getZxid());
+                    assertEquals(0, ByteBuffer.wrap(qp.getData()).getInt());
                     assertEquals(1, f.self.getAcceptedEpoch());
                     assertEquals(0, f.self.getCurrentEpoch());
 
@@ -767,36 +765,22 @@ public void converseWithFollower(InputArchive ia, OutputArchive oa, Follower f)
                     qp.setZxid(0);
                     oa.writeRecord(qp, null);
 
-                    // Read the uptodate ack
-                    readPacketSkippingPing(ia, qp);
-                    assertEquals(Leader.ACK, qp.getType());
-                    assertEquals(ZxidUtils.makeZxid(1, 0), qp.getZxid());
-
                     // Get the ack of the new leader
                     readPacketSkippingPing(ia, qp);
                     assertEquals(Leader.ACK, qp.getType());
                     assertEquals(ZxidUtils.makeZxid(1, 0), qp.getZxid());
                     assertEquals(1, f.self.getAcceptedEpoch());
                     assertEquals(1, f.self.getCurrentEpoch());
-
-                    //Wait for the transactions to be written out. The thread that writes them out
-                    // does not send anything back when it is done.
-                    long start = System.currentTimeMillis();
-                    while (createSessionZxid != f.fzk.getLastProcessedZxid()
-                                   && (System.currentTimeMillis() - start) < 50) {
-                        Thread.sleep(1);
-                    }
-
                     assertEquals(createSessionZxid, f.fzk.getLastProcessedZxid());
 
+                    // Read the uptodate ack
+                    readPacketSkippingPing(ia, qp);
+                    assertEquals(Leader.ACK, qp.getType());
+                    assertEquals(ZxidUtils.makeZxid(1, 0), qp.getZxid());
+
                     // Make sure the data was recorded in the filesystem ok
                     ZKDatabase zkDb2 = new ZKDatabase(new FileTxnSnapLog(logDir, snapDir));
-                    start = System.currentTimeMillis();
                     zkDb2.loadDataBase();
-                    while (zkDb2.getSessionWithTimeOuts().isEmpty() && (System.currentTimeMillis() - start) < 50) {
-                        Thread.sleep(1);
-                        zkDb2.loadDataBase();
-                    }
                     LOG.info("zkdb2 sessions:{}", zkDb2.getSessions());
                     LOG.info("zkdb2 with timeouts:{}", zkDb2.getSessionWithTimeOuts());
                     assertNotNull(zkDb2.getSessionWithTimeOuts().get(4L));
@@ -819,11 +803,148 @@ private void proposeNewSession(QuorumPacket qp, long zxid, long sessionId) throw
                 boa.writeRecord(cst, null);
                 qp.setData(baos.toByteArray());
             }
-        });
+        }, testData);
+    }
+
+    @Test
+    public void testNormalFollowerRun_ProcessCommitInSyncAfterAckNewLeader(@TempDir File testData) throws Exception {
+        testFollowerConversation(new FollowerConversation() {
+            @Override
+            public void converseWithFollower(InputArchive ia, OutputArchive oa, Follower f) throws Exception {
+                File tmpDir = File.createTempFile("test", "dir", testData);
+                tmpDir.delete();
+                tmpDir.mkdir();
+                File logDir = f.fzk.getTxnLogFactory().getDataLogDir().getParentFile();
+                File snapDir = f.fzk.getTxnLogFactory().getSnapDir().getParentFile();
+                //Spy on ZK so we can check if a snapshot happened or not.
+                f.zk = spy(f.zk);
+                try {
+                    assertEquals(0, f.self.getAcceptedEpoch());
+                    assertEquals(0, f.self.getCurrentEpoch());
+
+                    // Setup a database with a single /foo node
+                    ZKDatabase zkDb = new ZKDatabase(new FileTxnSnapLog(tmpDir, tmpDir));
+                    final long firstZxid = ZxidUtils.makeZxid(1, 1);
+                    zkDb.processTxn(new TxnHeader(13, 1313, firstZxid, 33, ZooDefs.OpCode.create), new CreateTxn("/foo", "data1".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, false, 1), null);
+                    Stat stat = new Stat();
+                    assertEquals("data1", new String(zkDb.getData("/foo", stat, null)));
+
+                    QuorumPacket qp = new QuorumPacket();
+                    readPacketSkippingPing(ia, qp);
+                    assertEquals(Leader.FOLLOWERINFO, qp.getType());
+                    assertEquals(qp.getZxid(), 0);
+                    LearnerInfo learnInfo = new LearnerInfo();
+                    ByteBufferInputStream.byteBuffer2Record(ByteBuffer.wrap(qp.getData()), learnInfo);
+                    assertEquals(learnInfo.getProtocolVersion(), 0x10000);
+                    assertEquals(learnInfo.getServerid(), 0);
+
+                    // We are simulating an established leader, so the epoch is 1
+                    qp.setType(Leader.LEADERINFO);
+                    qp.setZxid(ZxidUtils.makeZxid(1, 0));
+                    byte[] protoBytes = new byte[4];
+                    ByteBuffer.wrap(protoBytes).putInt(0x10000);
+                    qp.setData(protoBytes);
+                    oa.writeRecord(qp, null);
+
+                    readPacketSkippingPing(ia, qp);
+                    assertEquals(Leader.ACKEPOCH, qp.getType());
+                    assertEquals(0, qp.getZxid());
+                    assertEquals(ZxidUtils.makeZxid(0, 0), ByteBuffer.wrap(qp.getData()).getInt());
+                    assertEquals(1, f.self.getAcceptedEpoch());
+                    assertEquals(0, f.self.getCurrentEpoch());
+
+                    // Send the snapshot we created earlier
+                    qp.setType(Leader.SNAP);
+                    qp.setData(new byte[0]);
+                    qp.setZxid(zkDb.getDataTreeLastProcessedZxid());
+                    oa.writeRecord(qp, null);
+                    zkDb.serializeSnapshot(oa);
+                    oa.writeString("BenWasHere", null);
+                    Thread.sleep(10); //Give it some time to process the snap
+                    //No Snapshot taken yet, the SNAP was applied in memory
+                    verify(f.zk, never()).takeSnapshot();
+
+                    // Leader sends an outstanding proposal
+                    long proposalZxid = ZxidUtils.makeZxid(1, 1001);
+                    proposeSetData(qp, proposalZxid, "data2", 2);
+                    oa.writeRecord(qp, null);
+
+                    qp.setType(Leader.NEWLEADER);
+                    qp.setZxid(ZxidUtils.makeZxid(1, 0));
+                    qp.setData(null);
+                    oa.writeRecord(qp, null);
+
+                    // Get the ack of the new leader
+                    readPacketSkippingPing(ia, qp);
+                    assertEquals(Leader.ACK, qp.getType());
+                    assertEquals(ZxidUtils.makeZxid(1, 0), qp.getZxid());
+                    assertEquals(1, f.self.getAcceptedEpoch());
+                    assertEquals(1, f.self.getCurrentEpoch());
+                    //Make sure that we did take the snapshot now
+                    verify(f.zk).takeSnapshot(true);
+                    assertEquals(firstZxid, f.fzk.getLastProcessedZxid());
+
+                    // The outstanding proposal has not been persisted yet
+                    ZKDatabase zkDb2 = new ZKDatabase(new FileTxnSnapLog(logDir, snapDir));
+                    long lastZxid = zkDb2.loadDataBase();
+                    assertEquals("data1", new String(zkDb2.getData("/foo", stat, null)));
+                    assertEquals(firstZxid, lastZxid);
+
+                    TrackerWatcher watcher = new TrackerWatcher();
+
+                    // The change should not have happened yet
+                    assertEquals("data1", new String(f.fzk.getZKDatabase().getData("/foo", stat, watcher)));
+
+                    // Leader commits proposalZxid right after it sends NEWLEADER to follower
+                    qp.setType(Leader.COMMIT);
+                    qp.setZxid(proposalZxid);
+                    qp.setData(null);
+                    oa.writeRecord(qp, null);
+
+                    qp.setType(Leader.UPTODATE);
+                    qp.setZxid(0);
+                    qp.setData(null);
+                    oa.writeRecord(qp, null);
+
+                    // Read the uptodate ack
+                    readPacketSkippingPing(ia, qp);
+                    assertEquals(Leader.ACK, qp.getType());
+                    assertEquals(ZxidUtils.makeZxid(1, 0), qp.getZxid());
+
+                    readPacketSkippingPing(ia, qp);
+                    assertEquals(Leader.ACK, qp.getType());
+                    assertEquals(proposalZxid, qp.getZxid());
+
+                    // The change should happen now
+                    watcher.waitForChange();
+                    assertEquals("data2", new String(f.fzk.getZKDatabase().getData("/foo", stat, null)));
+
+                    // check and make sure the change is persisted
+                    zkDb2 = new ZKDatabase(new FileTxnSnapLog(logDir, snapDir));
+                    lastZxid = zkDb2.loadDataBase();
+                    assertEquals("data2", new String(zkDb2.getData("/foo", stat, null)));
+                    assertEquals(proposalZxid, lastZxid);
+                } finally {
+                    TestUtils.deleteFileRecursively(tmpDir);
+                }
+            }
+
+            private void proposeSetData(QuorumPacket qp, long zxid, String data, int version) throws IOException {
+                qp.setType(Leader.PROPOSAL);
+                qp.setZxid(zxid);
+                TxnHeader hdr = new TxnHeader(4, 1414, qp.getZxid(), 55, ZooDefs.OpCode.setData);
+                SetDataTxn sdt = new SetDataTxn("/foo", data.getBytes(), version);
+                ByteArrayOutputStream baos = new ByteArrayOutputStream();
+                OutputArchive boa = BinaryOutputArchive.getArchive(baos);
+                boa.writeRecord(hdr, null);
+                boa.writeRecord(sdt, null);
+                qp.setData(baos.toByteArray());
+            }
+        }, testData);
     }
 
     @Test
-    public void testNormalRun() throws Exception {
+    public void testNormalRun(@TempDir File testData) throws Exception {
         testLeaderConversation(new LeaderConversation() {
             public void converseWithLeader(InputArchive ia, OutputArchive oa, Leader l) throws IOException {
                 assertEquals(0, l.self.getAcceptedEpoch());
@@ -831,8 +952,7 @@ public void converseWithLeader(InputArchive ia, OutputArchive oa, Leader l) thro
 
                 /* we test a normal run. everything should work out well. */
                 LearnerInfo li = new LearnerInfo(1, 0x10000, 0);
-                byte[] liBytes = new byte[20];
-                ByteBufferOutputStream.record2ByteBuffer(li, ByteBuffer.wrap(liBytes));
+                byte[] liBytes = RequestRecord.fromRecord(li).readBytes();
                 QuorumPacket qp = new QuorumPacket(Leader.FOLLOWERINFO, 0, liBytes, null);
                 oa.writeRecord(qp, null);
 
@@ -861,19 +981,18 @@ public void converseWithLeader(InputArchive ia, OutputArchive oa, Leader l) thro
                 readPacketSkippingPing(ia, qp);
                 assertEquals(Leader.UPTODATE, qp.getType());
             }
-        });
+        }, testData);
     }
 
     @Test
-    public void testTxnTimeout() throws Exception {
+    public void testTxnTimeout(@TempDir File testData) throws Exception {
         testLeaderConversation(new LeaderConversation() {
             public void converseWithLeader(InputArchive ia, OutputArchive oa, Leader l) throws IOException, InterruptedException, org.apache.zookeeper.server.quorum.Leader.XidRolloverException {
                 assertEquals(0, l.self.getAcceptedEpoch());
                 assertEquals(0, l.self.getCurrentEpoch());
 
                 LearnerInfo li = new LearnerInfo(1, 0x10000, 0);
-                byte[] liBytes = new byte[20];
-                ByteBufferOutputStream.record2ByteBuffer(li, ByteBuffer.wrap(liBytes));
+                byte[] liBytes = RequestRecord.fromRecord(li).readBytes();
                 QuorumPacket qp = new QuorumPacket(Leader.FOLLOWERINFO, 0, liBytes, null);
                 oa.writeRecord(qp, null);
 
@@ -922,7 +1041,7 @@ public void converseWithLeader(InputArchive ia, OutputArchive oa, Leader l) thro
                 }
                 fail("Connection hasn't been closed by leader after transaction times out.");
             }
-        });
+        }, testData);
     }
 
     private void deserializeSnapshot(InputArchive ia) throws IOException {
@@ -933,14 +1052,14 @@ private void deserializeSnapshot(InputArchive ia) throws IOException {
     }
 
     @Test
-    public void testNormalObserverRun() throws Exception {
+    public void testNormalObserverRun(@TempDir File testData) throws Exception {
         testObserverConversation(new ObserverConversation() {
             @Override
             public void converseWithObserver(InputArchive ia, OutputArchive oa, Observer o) throws Exception {
                 File tmpDir = File.createTempFile("test", "dir", testData);
                 tmpDir.delete();
                 tmpDir.mkdir();
-                File logDir = o.zk.getTxnLogFactory().getDataDir().getParentFile();
+                File logDir = o.zk.getTxnLogFactory().getDataLogDir().getParentFile();
                 File snapDir = o.zk.getTxnLogFactory().getSnapDir().getParentFile();
                 try {
                     assertEquals(0, o.self.getAcceptedEpoch());
@@ -1066,17 +1185,16 @@ private void proposeSetData(QuorumPacket qp, String path, long zxid, String data
                 boa.writeRecord(sdt, null);
                 qp.setData(baos.toByteArray());
             }
-        });
+        }, testData);
     }
 
     @Test
-    public void testLeaderBehind() throws Exception {
+    public void testLeaderBehind(@TempDir File testData) throws Exception {
         testLeaderConversation(new LeaderConversation() {
             public void converseWithLeader(InputArchive ia, OutputArchive oa, Leader l) throws IOException {
                 /* we test a normal run. everything should work out well. */
                 LearnerInfo li = new LearnerInfo(1, 0x10000, 0);
-                byte[] liBytes = new byte[20];
-                ByteBufferOutputStream.record2ByteBuffer(li, ByteBuffer.wrap(liBytes));
+                byte[] liBytes = RequestRecord.fromRecord(li).readBytes();
                 /* we are going to say we last acked epoch 20 */
                 QuorumPacket qp = new QuorumPacket(Leader.FOLLOWERINFO, ZxidUtils.makeZxid(20, 0), liBytes, null);
                 oa.writeRecord(qp, null);
@@ -1098,7 +1216,7 @@ public void converseWithLeader(InputArchive ia, OutputArchive oa, Leader l) thro
                 readPacketSkippingPing(ia, qp);
                 assertEquals(Leader.UPTODATE, qp.getType());
             }
-        });
+        }, testData);
     }
 
     /**
@@ -1108,13 +1226,12 @@ public void converseWithLeader(InputArchive ia, OutputArchive oa, Leader l) thro
      * @throws Exception
      */
     @Test
-    public void testAbandonBeforeACKEpoch() throws Exception {
+    public void testAbandonBeforeACKEpoch(@TempDir File testData) throws Exception {
         testLeaderConversation(new LeaderConversation() {
             public void converseWithLeader(InputArchive ia, OutputArchive oa, Leader l) throws IOException, InterruptedException {
                 /* we test a normal run. everything should work out well. */
                 LearnerInfo li = new LearnerInfo(1, 0x10000, 0);
-                byte[] liBytes = new byte[20];
-                ByteBufferOutputStream.record2ByteBuffer(li, ByteBuffer.wrap(liBytes));
+                byte[] liBytes = RequestRecord.fromRecord(li).readBytes();
                 QuorumPacket qp = new QuorumPacket(Leader.FOLLOWERINFO, 0, liBytes, null);
                 oa.writeRecord(qp, null);
                 readPacketSkippingPing(ia, qp);
@@ -1126,7 +1243,7 @@ public void converseWithLeader(InputArchive ia, OutputArchive oa, Leader l) thro
                 // The leader didn't get a quorum of acks - make sure that leader's current epoch is not advanced
                 assertEquals(0, l.self.getCurrentEpoch());
             }
-        });
+        }, testData);
     }
 
     static class ConversableFollower extends Follower {
@@ -1187,7 +1304,7 @@ private String readContentsOfFile(File f) throws IOException {
     }
 
     @Test
-    public void testInitialAcceptedCurrent() throws Exception {
+    public void testInitialAcceptedCurrent(@TempDir File testData) throws Exception {
         File tmpDir = File.createTempFile("test", ".dir", testData);
         tmpDir.delete();
         tmpDir.mkdir();
@@ -1195,7 +1312,7 @@ public void testInitialAcceptedCurrent() throws Exception {
             FileTxnSnapLog logFactory = new FileTxnSnapLog(tmpDir, tmpDir);
             File version2 = new File(tmpDir, "version-2");
             version2.mkdir();
-            logFactory.save(new DataTree(), new ConcurrentHashMap<Long, Integer>(), false);
+            logFactory.save(new DataTree(), new ConcurrentHashMap<>(), false);
             long zxid = ZxidUtils.makeZxid(3, 3);
             logFactory.append(new Request(1, 1, ZooDefs.OpCode.error, new TxnHeader(1, 1, zxid, 1, ZooDefs.OpCode.error), new ErrorTxn(1), zxid));
             logFactory.commit();
@@ -1229,6 +1346,6 @@ private void assertCurrentEpochGotUpdated(int expected, QuorumPeer self, long ti
             }
             elapsedTime = elapsedTime + waitInterval;
         }
-        assertEquals("CurrentEpoch update failed", expected, self.getCurrentEpoch());
+        assertEquals(expected, self.getCurrentEpoch(), "CurrentEpoch update failed");
     }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ZabUtils.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ZabUtils.java
index fff5e62de0c..0755e892016 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ZabUtils.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/ZabUtils.java
@@ -42,7 +42,7 @@ private ZabUtils() {
     public static final int SYNC_LIMIT = 2;
 
     public static QuorumPeer createQuorumPeer(File tmpDir) throws IOException {
-        HashMap<Long, QuorumPeer.QuorumServer> peers = new HashMap<Long, QuorumPeer.QuorumServer>();
+        HashMap<Long, QuorumPeer.QuorumServer> peers = new HashMap<>();
         QuorumPeer peer = QuorumPeer.testingQuorumPeer();
         peer.syncLimit = SYNC_LIMIT;
         peer.initLimit = 2;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/DigestSecurityTestcase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/DigestSecurityTestcase.java
new file mode 100644
index 00000000000..a3a206be4c4
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/DigestSecurityTestcase.java
@@ -0,0 +1,44 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.quorum.auth;
+
+import org.apache.zookeeper.common.X509Util;
+import org.apache.zookeeper.test.SaslAuthDigestTestBase;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+
+/**
+ * Created for test cases which use Digest Auth mech for SASL.
+ * Primary reason is that we have to disable FIPS mode, otherwise DIGEST-MD5 cannot be used.
+ *
+ * @see SaslAuthDigestTestBase
+ */
+public class DigestSecurityTestcase extends QuorumAuthTestBase {
+
+  @BeforeAll
+  public static void setUpClass() throws Exception {
+    // Need to disable Fips-mode, because we use DIGEST-MD5 mech for Sasl
+    System.setProperty(X509Util.FIPS_MODE_PROPERTY, "false");
+  }
+
+  @AfterAll
+  public static void tearDownClass() throws Exception {
+    System.clearProperty(X509Util.FIPS_MODE_PROPERTY);
+  }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/KerberosSecurityTestcase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/KerberosSecurityTestcase.java
index cc6af7be5fe..8ab6644ddbf 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/KerberosSecurityTestcase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/KerberosSecurityTestcase.java
@@ -18,14 +18,11 @@
 
 package org.apache.zookeeper.server.quorum.auth;
 
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
 import java.io.File;
-import java.io.IOException;
 import java.util.Properties;
-import org.apache.commons.io.FileUtils;
-import org.junit.AfterClass;
-import org.junit.BeforeClass;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.io.TempDir;
 
 /*
  * This code is originally from HDFS, see the similarly named file there
@@ -48,50 +45,27 @@
 public class KerberosSecurityTestcase extends QuorumAuthTestBase {
 
     private static MiniKdc kdc;
-    private static File workDir;
+    @TempDir
+    static File workDir;
     private static Properties conf;
 
-    @BeforeClass
+    @BeforeAll
     public static void setUpSasl() throws Exception {
         startMiniKdc();
     }
 
-    @AfterClass
+    @AfterAll
     public static void tearDownSasl() throws Exception {
         stopMiniKdc();
-        FileUtils.deleteQuietly(workDir);
     }
 
     public static void startMiniKdc() throws Exception {
-        createTestDir();
         createMiniKdcConf();
 
         kdc = new MiniKdc(conf, workDir);
         kdc.start();
     }
 
-    /**
-     * Create a working directory, it should be the build directory. Under this
-     * directory an ApacheDS working directory will be created, this directory
-     * will be deleted when the MiniKdc stops.
-     *
-     * @throws IOException
-     */
-    public static void createTestDir() throws IOException {
-        workDir = createTmpDir(new File(System.getProperty("build.test.dir", "build")));
-    }
-
-    static File createTmpDir(File parentDir) throws IOException {
-        File tmpFile = File.createTempFile("test", ".junit", parentDir);
-        // don't delete tmpFile - this ensures we don't attempt to create
-        // a tmpDir with a duplicate name
-        File tmpDir = new File(tmpFile + ".dir");
-        // never true if tmpfile does it's job
-        assertFalse(tmpDir.exists());
-        assertTrue(tmpDir.mkdirs());
-        return tmpDir;
-    }
-
     /**
      * Create a Kdc configuration
      */
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/KerberosTestUtils.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/KerberosTestUtils.java
index 755712b79f9..e7de1dc353a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/KerberosTestUtils.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/KerberosTestUtils.java
@@ -19,11 +19,17 @@
 package org.apache.zookeeper.server.quorum.auth;
 
 import java.io.File;
+import java.util.HashMap;
+import java.util.Map;
 import java.util.UUID;
+import javax.security.auth.login.AppConfigurationEntry;
+import javax.security.auth.login.Configuration;
 import org.apache.zookeeper.util.SecurityUtils;
 
 public class KerberosTestUtils {
 
+    private static final boolean IBM_JAVA = System.getProperty("java.vendor").contains("IBM");
+
     private static String keytabFile = new File(System.getProperty("build.test.dir", "build"), UUID.randomUUID().toString()).getAbsolutePath();
 
     public static String getRealm() {
@@ -81,4 +87,59 @@ public static String replacePattern(String[] components, String hostname) {
         }
     }
 
+    public static class KerberosConfiguration extends Configuration {
+
+        private String principal;
+        private String keytab;
+        private boolean isInitiator;
+
+        private KerberosConfiguration(String principal, File keytab, boolean client) {
+            this.principal = principal;
+            this.keytab = keytab.getAbsolutePath();
+            this.isInitiator = client;
+        }
+
+        public static Configuration createClientConfig(String principal, File keytab) {
+            return new KerberosConfiguration(principal, keytab, true);
+        }
+
+        public static Configuration createServerConfig(String principal, File keytab) {
+            return new KerberosConfiguration(principal, keytab, false);
+        }
+
+        private static String getKrb5LoginModuleName() {
+            return System.getProperty("java.vendor").contains("IBM")
+              ? "com.ibm.security.auth.module.Krb5LoginModule"
+              : "com.sun.security.auth.module.Krb5LoginModule";
+        }
+
+        @Override
+        public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
+            Map<String, String> options = new HashMap<>();
+            options.put("principal", principal);
+            options.put("refreshKrb5Config", "true");
+            if (IBM_JAVA) {
+                options.put("useKeytab", keytab);
+                options.put("credsType", "both");
+            } else {
+                options.put("keyTab", keytab);
+                options.put("useKeyTab", "true");
+                options.put("storeKey", "true");
+                options.put("doNotPrompt", "true");
+                options.put("useTicketCache", "true");
+                options.put("renewTGT", "true");
+                options.put("isInitiator", Boolean.toString(isInitiator));
+            }
+            String ticketCache = System.getenv("KRB5CCNAME");
+            if (ticketCache != null) {
+                options.put("ticketCache", ticketCache);
+            }
+            options.put("debug", "true");
+
+            return new AppConfigurationEntry[]{new AppConfigurationEntry(getKrb5LoginModuleName(), AppConfigurationEntry.LoginModuleControlFlag.REQUIRED, options)};
+        }
+
+    }
+
+
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/MiniKdc.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/MiniKdc.java
index 4adcc0b011a..bfb61a7d8b1 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/MiniKdc.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/MiniKdc.java
@@ -63,6 +63,7 @@
  *   <li>kdc.port=0 (ephemeral port)</li>
  *   <li>instance=DefaultKrbServer</li>
  *   <li>max.ticket.lifetime=86400000 (1 day)</li>
+ *   <li>min.ticket.lifetime=3600000 (1 hour)</li>
  *   <li>max.renewable.lifetime=604800000 (7 days)</li>
  *   <li>transport=TCP</li>
  *   <li>debug=false</li>
@@ -148,22 +149,23 @@ public void run() {
     public static final String KDC_PORT = "kdc.port";
     public static final String INSTANCE = "instance";
     public static final String MAX_TICKET_LIFETIME = "max.ticket.lifetime";
+    public static final String MIN_TICKET_LIFETIME = "min.ticket.lifetime";
     public static final String MAX_RENEWABLE_LIFETIME = "max.renewable.lifetime";
     public static final String TRANSPORT = "transport";
     public static final String DEBUG = "debug";
 
-    private static final Set<String> PROPERTIES = new HashSet<String>();
+    private static final Set<String> PROPERTIES = new HashSet<>();
     private static final Properties DEFAULT_CONFIG = new Properties();
 
     static {
         PROPERTIES.add(ORG_NAME);
         PROPERTIES.add(ORG_DOMAIN);
         PROPERTIES.add(KDC_BIND_ADDRESS);
-        PROPERTIES.add(KDC_BIND_ADDRESS);
         PROPERTIES.add(KDC_PORT);
         PROPERTIES.add(INSTANCE);
         PROPERTIES.add(TRANSPORT);
         PROPERTIES.add(MAX_TICKET_LIFETIME);
+        PROPERTIES.add(MIN_TICKET_LIFETIME);
         PROPERTIES.add(MAX_RENEWABLE_LIFETIME);
 
         DEFAULT_CONFIG.setProperty(KDC_BIND_ADDRESS, "localhost");
@@ -173,6 +175,7 @@ public void run() {
         DEFAULT_CONFIG.setProperty(ORG_DOMAIN, "COM");
         DEFAULT_CONFIG.setProperty(TRANSPORT, "TCP");
         DEFAULT_CONFIG.setProperty(MAX_TICKET_LIFETIME, "86400000");
+        DEFAULT_CONFIG.setProperty(MIN_TICKET_LIFETIME, "3600000");
         DEFAULT_CONFIG.setProperty(MAX_RENEWABLE_LIFETIME, "604800000");
         DEFAULT_CONFIG.setProperty(DEBUG, "false");
     }
@@ -211,7 +214,7 @@ public void setTransport(String transport) {
      */
     public MiniKdc(Properties conf, File workDir) throws Exception {
         if (!conf.keySet().containsAll(PROPERTIES)) {
-            Set<String> missingProperties = new HashSet<String>(PROPERTIES);
+            Set<String> missingProperties = new HashSet<>(PROPERTIES);
             missingProperties.removeAll(conf.keySet());
             throw new IllegalArgumentException("Missing configuration properties: " + missingProperties);
         }
@@ -313,6 +316,10 @@ private void prepareKdcServer() throws Exception {
             throw new IllegalArgumentException("Need to set transport!");
         }
         simpleKdc.getKdcConfig().setString(KdcConfigKey.KDC_SERVICE_NAME, conf.getProperty(INSTANCE));
+        long minTicketLifetimeConf = Long.parseLong(conf.getProperty(MIN_TICKET_LIFETIME)) / 1000;
+        simpleKdc.getKdcConfig().setLong(KdcConfigKey.MINIMUM_TICKET_LIFETIME, minTicketLifetimeConf);
+        long maxTicketLifetimeConf = Long.parseLong(conf.getProperty(MAX_TICKET_LIFETIME)) / 1000;
+        simpleKdc.getKdcConfig().setLong(KdcConfigKey.MAXIMUM_TICKET_LIFETIME, maxTicketLifetimeConf);
         if (conf.getProperty(DEBUG) != null) {
             krb5Debug = getAndSet(SUN_SECURITY_KRB5_DEBUG, conf.getProperty(DEBUG));
         }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/MiniKdcTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/MiniKdcTest.java
index 659551558dc..4221ceb81d1 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/MiniKdcTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/MiniKdcTest.java
@@ -18,24 +18,22 @@
 
 package org.apache.zookeeper.server.quorum.auth;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotSame;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotSame;
 import java.io.File;
 import java.security.Principal;
 import java.util.Arrays;
-import java.util.HashMap;
 import java.util.HashSet;
 import java.util.List;
-import java.util.Map;
 import java.util.Set;
 import javax.security.auth.Subject;
 import javax.security.auth.kerberos.KerberosPrincipal;
-import javax.security.auth.login.AppConfigurationEntry;
-import javax.security.auth.login.Configuration;
 import javax.security.auth.login.LoginContext;
 import org.apache.kerby.kerberos.kerb.keytab.Keytab;
 import org.apache.kerby.kerberos.kerb.type.base.PrincipalName;
-import org.junit.Test;
+import org.apache.zookeeper.server.quorum.auth.KerberosTestUtils.KerberosConfiguration;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 /*
  * This code is originally from HDFS, see the file name TestMiniKdc there
@@ -46,15 +44,16 @@
  */
 public class MiniKdcTest extends KerberosSecurityTestcase {
 
-    private static final boolean IBM_JAVA = System.getProperty("java.vendor").contains("IBM");
 
-    @Test(timeout = 60000)
+    @Test
+    @Timeout(value = 60)
     public void testMiniKdcStart() {
         MiniKdc kdc = getKdc();
         assertNotSame(0, kdc.getPort());
     }
 
-    @Test(timeout = 60000)
+    @Test
+    @Timeout(value = 60)
     public void testKeytabGen() throws Exception {
         MiniKdc kdc = getKdc();
         File workDir = getWorkDir();
@@ -62,71 +61,18 @@ public void testKeytabGen() throws Exception {
         kdc.createPrincipal(new File(workDir, "keytab"), "foo/bar", "bar/foo");
         List<PrincipalName> principalNameList = Keytab.loadKeytab(new File(workDir, "keytab")).getPrincipals();
 
-        Set<String> principals = new HashSet<String>();
+        Set<String> principals = new HashSet<>();
         for (PrincipalName principalName : principalNameList) {
             principals.add(principalName.getName());
         }
 
-        assertEquals(
-            new HashSet<>(Arrays.asList("foo/bar@" + kdc.getRealm(), "bar/foo@" + kdc.getRealm())),
+        assertEquals(new HashSet<>(Arrays.asList("foo/bar@" + kdc.getRealm(), "bar/foo@" + kdc.getRealm())),
             principals);
     }
 
-    private static class KerberosConfiguration extends Configuration {
 
-        private String principal;
-        private String keytab;
-        private boolean isInitiator;
-
-        private KerberosConfiguration(String principal, File keytab, boolean client) {
-            this.principal = principal;
-            this.keytab = keytab.getAbsolutePath();
-            this.isInitiator = client;
-        }
-
-        public static Configuration createClientConfig(String principal, File keytab) {
-            return new KerberosConfiguration(principal, keytab, true);
-        }
-
-        public static Configuration createServerConfig(String principal, File keytab) {
-            return new KerberosConfiguration(principal, keytab, false);
-        }
-
-        private static String getKrb5LoginModuleName() {
-            return System.getProperty("java.vendor").contains("IBM")
-                ? "com.ibm.security.auth.module.Krb5LoginModule"
-                : "com.sun.security.auth.module.Krb5LoginModule";
-        }
-
-        @Override
-        public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
-            Map<String, String> options = new HashMap<String, String>();
-            options.put("principal", principal);
-            options.put("refreshKrb5Config", "true");
-            if (IBM_JAVA) {
-                options.put("useKeytab", keytab);
-                options.put("credsType", "both");
-            } else {
-                options.put("keyTab", keytab);
-                options.put("useKeyTab", "true");
-                options.put("storeKey", "true");
-                options.put("doNotPrompt", "true");
-                options.put("useTicketCache", "true");
-                options.put("renewTGT", "true");
-                options.put("isInitiator", Boolean.toString(isInitiator));
-            }
-            String ticketCache = System.getenv("KRB5CCNAME");
-            if (ticketCache != null) {
-                options.put("ticketCache", ticketCache);
-            }
-            options.put("debug", "true");
-
-            return new AppConfigurationEntry[]{new AppConfigurationEntry(getKrb5LoginModuleName(), AppConfigurationEntry.LoginModuleControlFlag.REQUIRED, options)};
-        }
-
-    }
-
-    @Test(timeout = 60000)
+    @Test
+    @Timeout(value = 60)
     public void testKerberosLogin() throws Exception {
         MiniKdc kdc = getKdc();
         File workDir = getWorkDir();
@@ -136,7 +82,7 @@ public void testKerberosLogin() throws Exception {
             File keytab = new File(workDir, "foo.keytab");
             kdc.createPrincipal(keytab, principal);
 
-            Set<Principal> principals = new HashSet<Principal>();
+            Set<Principal> principals = new HashSet<>();
             principals.add(new KerberosPrincipal(principal));
 
             // client login
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthObserverTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthObserverTest.java
new file mode 100644
index 00000000000..8660558adf5
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthObserverTest.java
@@ -0,0 +1,87 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.quorum.auth;
+
+import java.util.HashMap;
+import java.util.Map;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.ZooDefs.Ids;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.test.ClientBase;
+import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+
+public class QuorumAuthObserverTest extends DigestSecurityTestcase {
+
+    static {
+        String jaasEntries = "QuorumServer {\n"
+                             + "       org.apache.zookeeper.server.auth.DigestLoginModule required\n"
+                             + "       user_test=\"mypassword\";\n"
+                             + "};\n"
+                             + "QuorumLearner {\n"
+                             + "       org.apache.zookeeper.server.auth.DigestLoginModule required\n"
+                             + "       username=\"test\"\n"
+                             + "       password=\"mypassword\";\n"
+                             + "};\n";
+        setupJaasConfig(jaasEntries);
+    }
+
+    @AfterEach
+    @Override
+    public void tearDown() throws Exception {
+        shutdownAll();
+        super.tearDown();
+    }
+
+    @AfterAll
+    public static void cleanup() {
+        cleanupJaasConfig();
+    }
+
+    /**
+     * Test to ensure observer with small myid can join SASL quorum.
+     * peer0 myid：11 participant
+     * peer1 myid：21 participant
+     * peer2 myid：1 observer
+     */
+    @Test
+    public void testSmallObserverJoinSASLQuorum() throws Exception {
+        Map<String, String> authConfigs = new HashMap<>();
+        authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
+        authConfigs.put(QuorumAuth.QUORUM_SERVER_SASL_AUTH_REQUIRED, "true");
+        authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_AUTH_REQUIRED, "true");
+
+        // create quorum
+        StringBuilder connectStringBuilder = new StringBuilder();
+        int[] myidList = {11, 21, 1};
+        String[] roleList = {"participant", "participant", "observer"};
+        int[] clientPorts = startQuorum(3, connectStringBuilder, authConfigs, 3, false, myidList, roleList);
+
+        // observer with small myid should have joined the quorum
+        String connectStr = "127.0.0.1:" + clientPorts[2];
+        CountdownWatcher watcher = new CountdownWatcher();
+        ZooKeeper zk = new ZooKeeper(connectStr, ClientBase.CONNECTION_TIMEOUT, watcher);
+        watcher.waitForConnected(ClientBase.CONNECTION_TIMEOUT);
+
+        zk.create("/foo", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk.close();
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthTestBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthTestBase.java
index d365c9a97d5..dfc12d8f1f4 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthTestBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthTestBase.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.server.quorum.auth;
 
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.FileWriter;
 import java.io.IOException;
@@ -32,7 +32,7 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer;
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase.MainThread;
 import org.apache.zookeeper.test.ClientBase;
-import org.junit.After;
+import org.junit.jupiter.api.AfterEach;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -43,7 +43,7 @@
 public class QuorumAuthTestBase extends ZKTestCase {
 
     protected static final Logger LOG = LoggerFactory.getLogger(QuorumAuthTestBase.class);
-    protected List<MainThread> mt = new ArrayList<MainThread>();
+    protected List<MainThread> mt = new ArrayList<>();
     protected static File jaasConfigDir;
 
     public static void setupJaasConfig(String jaasEntries) {
@@ -71,7 +71,7 @@ public static void cleanupJaasConfig() {
         }
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         System.clearProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_ENABLED);
     }
@@ -96,23 +96,35 @@ protected String startQuorum(
         final int[] clientPorts = startQuorum(serverCount, connectStr, authConfigs, authServerCount, multiAddress);
         for (int i = 0; i < serverCount; i++) {
             assertTrue(
-                "waiting for server " + i + " being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], ClientBase.CONNECTION_TIMEOUT));
+                ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server " + i + " being up");
         }
         return connectStr.toString();
     }
 
     protected int[] startQuorum(final int serverCount, StringBuilder connectStr, Map<String, String> authConfigs,
-        int authServerCount, boolean multiAddress) throws IOException {
+                                int authServerCount, boolean multiAddress) throws IOException {
+        int[] defaultMyidList = new int[serverCount];
+        String[] defaultRoleList = new String[serverCount];
+        for (int i = 0; i < serverCount; i++) {
+            defaultMyidList[i] = i;
+            defaultRoleList[i] = "participant";
+        }
+        return startQuorum(serverCount, connectStr, authConfigs, authServerCount, multiAddress, defaultMyidList, defaultRoleList);
+    }
+
+    protected int[] startQuorum(final int serverCount, StringBuilder connectStr, Map<String, String> authConfigs,
+        int authServerCount, boolean multiAddress, int[] myidList, String[] roleList) throws IOException {
         final int[] clientPorts = new int[serverCount];
         StringBuilder sb = new StringBuilder();
         for (int i = 0; i < serverCount; i++) {
             clientPorts[i] = PortAssignment.unique();
-            String server = String.format("server.%d=localhost:%d:%d", i, PortAssignment.unique(), PortAssignment.unique());
+            String server = String.format("server.%d=localhost:%d:%d", myidList[i], PortAssignment.unique(), PortAssignment.unique());
             if (multiAddress) {
                 server = server + String.format("|localhost:%d:%d", PortAssignment.unique(), PortAssignment.unique());
             }
-            sb.append(server + ":participant\n");
+
+            sb.append(server + ":" + roleList[i] + "\n");
             connectStr.append("127.0.0.1:" + clientPorts[i]);
             if (i < serverCount - 1) {
                 connectStr.append(",");
@@ -122,11 +134,11 @@ protected int[] startQuorum(final int serverCount, StringBuilder connectStr, Map
         // servers with authentication interfaces configured
         int i = 0;
         for (; i < authServerCount; i++) {
-            startServer(authConfigs, clientPorts, quorumCfg, i);
+            startServer(authConfigs, clientPorts, quorumCfg, i, myidList);
         }
         // servers without any authentication configured
         for (int j = 0; j < serverCount - authServerCount; j++, i++) {
-            MainThread mthread = new MainThread(i, clientPorts[i], quorumCfg);
+            MainThread mthread = new MainThread(myidList[i], clientPorts[i], quorumCfg);
             mt.add(mthread);
             mthread.start();
         }
@@ -137,8 +149,9 @@ private void startServer(
         Map<String, String> authConfigs,
         final int[] clientPorts,
         String quorumCfg,
-        int i) throws IOException {
-        MainThread mthread = new MainThread(i, clientPorts[i], quorumCfg, authConfigs);
+        int i,
+        int[] myidList) throws IOException {
+        MainThread mthread = new MainThread(myidList[i], clientPorts[i], quorumCfg, authConfigs);
         mt.add(mthread);
         mthread.start();
     }
@@ -149,6 +162,16 @@ protected void startServer(MainThread restartPeer, Map<String, String> authConfi
         mthread.start();
     }
 
+    protected void startServer(
+            Map<String, String> authConfigs,
+            final int clientPort,
+            String quorumCfg,
+            int myid) throws IOException {
+        MainThread mthread = new MainThread(myid, clientPort, quorumCfg, authConfigs);
+        mt.add(mthread);
+        mthread.start();
+    }
+
     void shutdownAll() {
         for (int i = 0; i < mt.size(); i++) {
             shutdown(i);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthUpgradeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthUpgradeTest.java
index ecdfaeb469a..aed0c9fe9a2 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthUpgradeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumAuthUpgradeTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.server.quorum.auth;
 
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
 import java.util.HashMap;
 import java.util.Map;
@@ -32,9 +32,10 @@
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
 import org.apache.zookeeper.test.ClientTest;
-import org.junit.After;
-import org.junit.AfterClass;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 /**
  * Rolling upgrade should do in three steps:
@@ -51,7 +52,7 @@
  * quorum.auth.enableSasl=true, quorum.auth.learnerRequireSasl=true and quorum.auth.serverRequireSasl=true
  * Now, all the servers are fully upgraded and running in secured mode.
  */
-public class QuorumAuthUpgradeTest extends QuorumAuthTestBase {
+public class QuorumAuthUpgradeTest extends DigestSecurityTestcase {
 
     static {
         String jaasEntries = "QuorumServer {\n"
@@ -66,14 +67,14 @@ public class QuorumAuthUpgradeTest extends QuorumAuthTestBase {
         setupJaasConfig(jaasEntries);
     }
 
-    @After
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         shutdownAll();
         super.tearDown();
     }
 
-    @AfterClass
+    @AfterAll
     public static void cleanup() {
         cleanupJaasConfig();
     }
@@ -83,9 +84,10 @@ public static void cleanup() {
      * peer0 -&gt; quorum.auth.enableSasl=false
      * peer1 -&gt; quorum.auth.enableSasl=false
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testNullAuthLearnerServer() throws Exception {
-        Map<String, String> authConfigs = new HashMap<String, String>();
+        Map<String, String> authConfigs = new HashMap<>();
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "false");
 
         String connectStr = startQuorum(2, authConfigs, 0);
@@ -101,9 +103,10 @@ public void testNullAuthLearnerServer() throws Exception {
      * peer0 -&gt; quorum.auth.enableSasl=true, quorum.auth.learnerRequireSasl=false, quorum.auth.serverRequireSasl=false
      * peer1 -&gt; quorum.auth.enableSasl=false, quorum.auth.learnerRequireSasl=false, quorum.auth.serverRequireSasl=false
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testAuthLearnerAgainstNullAuthServer() throws Exception {
-        Map<String, String> authConfigs = new HashMap<String, String>();
+        Map<String, String> authConfigs = new HashMap<>();
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
 
         String connectStr = startQuorum(2, authConfigs, 1);
@@ -119,9 +122,10 @@ public void testAuthLearnerAgainstNullAuthServer() throws Exception {
      * peer0 -&gt; quorum.auth.enableSasl=true, quorum.auth.learnerRequireSasl=false, quorum.auth.serverRequireSasl=false
      * peer1 -&gt; quorum.auth.enableSasl=true, quorum.auth.learnerRequireSasl=false, quorum.auth.serverRequireSasl=false
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testAuthLearnerAgainstNoAuthRequiredServer() throws Exception {
-        Map<String, String> authConfigs = new HashMap<String, String>();
+        Map<String, String> authConfigs = new HashMap<>();
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
 
         String connectStr = startQuorum(2, authConfigs, 2);
@@ -137,9 +141,10 @@ public void testAuthLearnerAgainstNoAuthRequiredServer() throws Exception {
      * peer0 -&gt; quorum.auth.enableSasl=true, quorum.auth.learnerRequireSasl=true, quorum.auth.serverRequireSasl=true
      * peer1 -&gt; quorum.auth.enableSasl=true, quorum.auth.learnerRequireSasl=true, quorum.auth.serverRequireSasl=true
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testAuthLearnerServer() throws Exception {
-        Map<String, String> authConfigs = new HashMap<String, String>();
+        Map<String, String> authConfigs = new HashMap<>();
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
         authConfigs.put(QuorumAuth.QUORUM_SERVER_SASL_AUTH_REQUIRED, "true");
         authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_AUTH_REQUIRED, "true");
@@ -167,12 +172,13 @@ public void testAuthLearnerServer() throws Exception {
      * quorum.auth.enableSasl=true, quorum.auth.learnerRequireSasl=true and quorum.auth.serverRequireSasl=true
      * Now, all the servers are fully upgraded and running in secured mode.
      */
-    @Test(timeout = 90000)
+    @Test
+    @Timeout(value = 90)
     public void testRollingUpgrade() throws Exception {
         // Start peer0,1,2 servers with quorum.auth.enableSasl=false and
         // quorum.auth.learnerRequireSasl=false, quorum.auth.serverRequireSasl=false
         // Assume this is an existing cluster.
-        Map<String, String> authConfigs = new HashMap<String, String>();
+        Map<String, String> authConfigs = new HashMap<>();
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "false");
 
         String connectStr = startQuorum(3, authConfigs, 0);
@@ -214,9 +220,8 @@ public void testRollingUpgrade() throws Exception {
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "false");
         MainThread m = shutdown(2);
         startServer(m, authConfigs);
-        assertFalse(
-            "waiting for server 2 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + m.getClientPort(), 5000));
+        assertFalse(ClientBase.waitForServerUp("127.0.0.1:" + m.getClientPort(), 5000),
+            "waiting for server 2 being up");
     }
 
     private void restartServer(
@@ -224,14 +229,13 @@ private void restartServer(
         int index,
         ZooKeeper zk,
         CountdownWatcher watcher) throws IOException, KeeperException, InterruptedException, TimeoutException {
-        LOG.info("Restarting server myid={}", index);
-        MainThread m = shutdown(index);
-        startServer(m, authConfigs);
-        assertTrue(
-            "waiting for server" + index + "being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + m.getClientPort(), ClientBase.CONNECTION_TIMEOUT));
-        watcher.waitForConnected(ClientTest.CONNECTION_TIMEOUT);
-        zk.create("/foo", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_SEQUENTIAL);
+            LOG.info("Restarting server myid={}", index);
+            MainThread m = shutdown(index);
+            startServer(m, authConfigs);
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + m.getClientPort(), ClientBase.CONNECTION_TIMEOUT),
+                "waiting for server" + index + "being up");
+            watcher.waitForConnected(ClientTest.CONNECTION_TIMEOUT);
+            zk.create("/foo", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_SEQUENTIAL);
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumDigestAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumDigestAuthTest.java
index cb28389efab..8630c69d655 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumDigestAuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumDigestAuthTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.server.quorum.auth;
 
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.HashMap;
 import java.util.Map;
@@ -27,18 +27,19 @@
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.common.ConfigException;
 import org.apache.zookeeper.server.admin.AdminServer;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
 import org.apache.zookeeper.server.quorum.QuorumPeerMain;
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase.MainThread;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.After;
-import org.junit.AfterClass;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
-public class QuorumDigestAuthTest extends QuorumAuthTestBase {
+public class QuorumDigestAuthTest extends DigestSecurityTestcase {
 
     static {
         String jaasEntries = "QuorumServer {\n"
@@ -59,7 +60,7 @@ public class QuorumDigestAuthTest extends QuorumAuthTestBase {
         setupJaasConfig(jaasEntries);
     }
 
-    @After
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         for (MainThread mainThread : mt) {
@@ -69,7 +70,7 @@ public void tearDown() throws Exception {
         super.tearDown();
     }
 
-    @AfterClass
+    @AfterAll
     public static void cleanup() {
         cleanupJaasConfig();
     }
@@ -77,9 +78,10 @@ public static void cleanup() {
     /**
      * Test to verify that server is able to start with valid credentials
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testValidCredentials() throws Exception {
-        Map<String, String> authConfigs = new HashMap<String, String>();
+        Map<String, String> authConfigs = new HashMap<>();
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
         authConfigs.put(QuorumAuth.QUORUM_SERVER_SASL_AUTH_REQUIRED, "true");
         authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_AUTH_REQUIRED, "true");
@@ -98,9 +100,10 @@ public void testValidCredentials() throws Exception {
      * Test to verify that server is able to start with valid credentials
      * when using multiple Quorum / Election addresses
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testValidCredentialsWithMultiAddresses() throws Exception {
-        Map<String, String> authConfigs = new HashMap<String, String>();
+        Map<String, String> authConfigs = new HashMap<>();
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
         authConfigs.put(QuorumAuth.QUORUM_SERVER_SASL_AUTH_REQUIRED, "true");
         authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_AUTH_REQUIRED, "true");
@@ -120,9 +123,10 @@ public void testValidCredentialsWithMultiAddresses() throws Exception {
      * the configuration is set to quorum.auth.serverRequireSasl=false.
      * Quorum will talk each other even if the authentication is not succeeded
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testSaslNotRequiredWithInvalidCredentials() throws Exception {
-        Map<String, String> authConfigs = new HashMap<String, String>();
+        Map<String, String> authConfigs = new HashMap<>();
         authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_LOGIN_CONTEXT, "QuorumLearnerInvalid");
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "false");
         authConfigs.put(QuorumAuth.QUORUM_SERVER_SASL_AUTH_REQUIRED, "false");
@@ -141,9 +145,10 @@ public void testSaslNotRequiredWithInvalidCredentials() throws Exception {
      * if the configuration is set to quorum.auth.serverRequireSasl=true,
      * quorum.auth.learnerRequireSasl=true
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testSaslRequiredInvalidCredentials() throws Exception {
-        Map<String, String> authConfigs = new HashMap<String, String>();
+        Map<String, String> authConfigs = new HashMap<>();
         authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_LOGIN_CONTEXT, "QuorumLearnerInvalid");
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
         authConfigs.put(QuorumAuth.QUORUM_SERVER_SASL_AUTH_REQUIRED, "true");
@@ -152,7 +157,7 @@ public void testSaslRequiredInvalidCredentials() throws Exception {
         final int[] clientPorts = startQuorum(serverCount, new StringBuilder(), authConfigs, serverCount, false);
         for (int i = 0; i < serverCount; i++) {
             boolean waitForServerUp = ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], QuorumPeerTestBase.TIMEOUT);
-            assertFalse("Shouldn't start server with invalid credentials", waitForServerUp);
+            assertFalse(waitForServerUp, "Shouldn't start server with invalid credentials");
         }
     }
 
@@ -161,9 +166,10 @@ public void testSaslRequiredInvalidCredentials() throws Exception {
      * quorum. So this test is ensuring that the quorumpeer learner is also auth
      * enabled while enabling quorum server require sasl.
      */
-    @Test(timeout = 10000)
+    @Test
+    @Timeout(value = 10)
     public void testEnableQuorumServerRequireSaslWithoutQuorumLearnerRequireSasl() throws Exception {
-        Map<String, String> authConfigs = new HashMap<String, String>();
+        Map<String, String> authConfigs = new HashMap<>();
         authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_LOGIN_CONTEXT, "QuorumLearner");
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
         authConfigs.put(QuorumAuth.QUORUM_SERVER_SASL_AUTH_REQUIRED, "true");
@@ -189,9 +195,10 @@ protected void initializeAndRun(String[] args) throws ConfigException, IOExcepti
      * quorum. So this test is ensuring that the quorumpeer learner is also auth
      * enabled while enabling quorum server require sasl.
      */
-    @Test(timeout = 10000)
+    @Test
+    @Timeout(value = 10)
     public void testEnableQuorumAuthenticationConfigurations() throws Exception {
-        Map<String, String> authConfigs = new HashMap<String, String>();
+        Map<String, String> authConfigs = new HashMap<>();
         authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_LOGIN_CONTEXT, "QuorumLearner");
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "false");
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumKerberosAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumKerberosAuthTest.java
index 28b93c7b487..4a8458054b7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumKerberosAuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumKerberosAuthTest.java
@@ -29,10 +29,11 @@
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase.MainThread;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.After;
-import org.junit.AfterClass;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 public class QuorumKerberosAuthTest extends KerberosSecurityTestcase {
 
@@ -56,7 +57,7 @@ public class QuorumKerberosAuthTest extends KerberosSecurityTestcase {
                                      + "       debug=false\n"
                                      + "       refreshKrb5Config=true\n"
                                      + "       principal=\""
-                                     + KerberosTestUtils.getServerPrincipal()
+                                     + KerberosTestUtils.replaceHostPattern(KerberosTestUtils.getHostServerPrincipal())
                                      + "\";\n"
                                      + "};\n"
                                      + "QuorumLearner {\n"
@@ -70,24 +71,24 @@ public class QuorumKerberosAuthTest extends KerberosSecurityTestcase {
                                      + "       debug=false\n"
                                      + "       refreshKrb5Config=true\n"
                                      + "       principal=\""
-                                     + KerberosTestUtils.getLearnerPrincipal()
+                                     + KerberosTestUtils.replaceHostPattern(KerberosTestUtils.getHostLearnerPrincipal())
                                      + "\";\n"
                                      + "};\n";
         setupJaasConfig(jaasEntries);
     }
 
-    @BeforeClass
+    @BeforeAll
     public static void setUp() throws Exception {
         // create keytab
         keytabFile = new File(KerberosTestUtils.getKeytabFile());
-        String learnerPrincipal = KerberosTestUtils.getLearnerPrincipal();
-        String serverPrincipal = KerberosTestUtils.getServerPrincipal();
-        learnerPrincipal = learnerPrincipal.substring(0, learnerPrincipal.lastIndexOf("@"));
-        serverPrincipal = serverPrincipal.substring(0, serverPrincipal.lastIndexOf("@"));
+        String learnerPrincipal = KerberosTestUtils.getHostLearnerPrincipal();
+        String serverPrincipal = KerberosTestUtils.getHostServerPrincipal();
+        learnerPrincipal = KerberosTestUtils.replaceHostPattern(learnerPrincipal.substring(0, learnerPrincipal.lastIndexOf("@")));
+        serverPrincipal = KerberosTestUtils.replaceHostPattern(serverPrincipal.substring(0, serverPrincipal.lastIndexOf("@")));
         getKdc().createPrincipal(keytabFile, learnerPrincipal, serverPrincipal);
     }
 
-    @After
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         for (MainThread mainThread : mt) {
@@ -97,7 +98,7 @@ public void tearDown() throws Exception {
         super.tearDown();
     }
 
-    @AfterClass
+    @AfterAll
     public static void cleanup() {
         if (keytabFile != null) {
             FileUtils.deleteQuietly(keytabFile);
@@ -108,11 +109,12 @@ public static void cleanup() {
     /**
      * Test to verify that server is able to start with valid credentials
      */
-    @Test(timeout = 120000)
+    @Test
+    @Timeout(value = 120)
     public void testValidCredentials() throws Exception {
         String serverPrincipal = KerberosTestUtils.getServerPrincipal();
         serverPrincipal = serverPrincipal.substring(0, serverPrincipal.lastIndexOf("@"));
-        Map<String, String> authConfigs = new HashMap<String, String>();
+        Map<String, String> authConfigs = new HashMap<>();
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
         authConfigs.put(QuorumAuth.QUORUM_SERVER_SASL_AUTH_REQUIRED, "true");
         authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_AUTH_REQUIRED, "true");
@@ -131,11 +133,12 @@ public void testValidCredentials() throws Exception {
      * Test to verify that server is able to start with valid credentials
      * when using multiple Quorum / Election addresses
      */
-    @Test(timeout = 120000)
+    @Test
+    @Timeout(value = 120)
     public void testValidCredentialsWithMultiAddresses() throws Exception {
         String serverPrincipal = KerberosTestUtils.getServerPrincipal();
         serverPrincipal = serverPrincipal.substring(0, serverPrincipal.lastIndexOf("@"));
-        Map<String, String> authConfigs = new HashMap<String, String>();
+        Map<String, String> authConfigs = new HashMap<>();
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
         authConfigs.put(QuorumAuth.QUORUM_SERVER_SASL_AUTH_REQUIRED, "true");
         authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_AUTH_REQUIRED, "true");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumKerberosHostBasedAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumKerberosHostBasedAuthTest.java
index c9b93c57bde..55a6d74804c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumKerberosHostBasedAuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/quorum/auth/QuorumKerberosHostBasedAuthTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.server.quorum.auth;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.util.HashMap;
 import java.util.Map;
@@ -32,10 +32,11 @@
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase.MainThread;
 import org.apache.zookeeper.test.ClientBase;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.After;
-import org.junit.AfterClass;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 public class QuorumKerberosHostBasedAuthTest extends KerberosSecurityTestcase {
 
@@ -43,15 +44,17 @@ public class QuorumKerberosHostBasedAuthTest extends KerberosSecurityTestcase {
     private static String hostServerPrincipal = KerberosTestUtils.getHostServerPrincipal();
     private static String hostLearnerPrincipal = KerberosTestUtils.getHostLearnerPrincipal();
     private static String hostNamedLearnerPrincipal = KerberosTestUtils.getHostNamedLearnerPrincipal("myHost");
+    private static String hostlessLearnerPrincipal = KerberosTestUtils.getLearnerPrincipal();
 
     static {
-        setupJaasConfigEntries(hostServerPrincipal, hostLearnerPrincipal, hostNamedLearnerPrincipal);
+        setupJaasConfigEntries(hostServerPrincipal, hostLearnerPrincipal, hostNamedLearnerPrincipal, hostlessLearnerPrincipal);
     }
 
     private static void setupJaasConfigEntries(
         String hostServerPrincipal,
         String hostLearnerPrincipal,
-        String hostNamedLearnerPrincipal) {
+        String hostNamedLearnerPrincipal,
+        String hostlessLearnerPrincipal) {
         String keytabFilePath = FilenameUtils.normalize(KerberosTestUtils.getKeytabFile(), true);
 
         // note: we use "refreshKrb5Config=true" to refresh the kerberos config in the JVM,
@@ -92,11 +95,23 @@ private static void setupJaasConfigEntries(
                              + "       refreshKrb5Config=true\n"
                              + "       principal=\"" + hostNamedLearnerPrincipal
                              + "\";\n"
+                             + "};\n"
+                             + "QuorumLearnerMissingHost {\n"
+                             + "       com.sun.security.auth.module.Krb5LoginModule required\n"
+                             + "       useKeyTab=true\n"
+                             + "       keyTab=\"" + keytabFilePath
+                             + "\"\n"
+                             + "       storeKey=true\n"
+                             + "       useTicketCache=false\n"
+                             + "       debug=false\n"
+                             + "       refreshKrb5Config=true\n"
+                             + "       principal=\"" + hostlessLearnerPrincipal
+                             + "\";\n"
                              + "};\n";
         setupJaasConfig(jaasEntries);
     }
 
-    @BeforeClass
+    @BeforeAll
     public static void setUp() throws Exception {
         // create keytab
         keytabFile = new File(KerberosTestUtils.getKeytabFile());
@@ -109,10 +124,14 @@ public static void setUp() throws Exception {
 
         // learner with ipaddress in principal
         String learnerPrincipal2 = hostNamedLearnerPrincipal.substring(0, hostNamedLearnerPrincipal.lastIndexOf("@"));
-        getKdc().createPrincipal(keytabFile, learnerPrincipal, learnerPrincipal2, serverPrincipal);
+
+        // learner without host in principal
+        String learnerPrincipal3 = hostlessLearnerPrincipal.substring(0, hostlessLearnerPrincipal.lastIndexOf("@"));
+
+        getKdc().createPrincipal(keytabFile, learnerPrincipal, learnerPrincipal2, learnerPrincipal3, serverPrincipal);
     }
 
-    @After
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         for (MainThread mainThread : mt) {
@@ -122,7 +141,7 @@ public void tearDown() throws Exception {
         super.tearDown();
     }
 
-    @AfterClass
+    @AfterAll
     public static void cleanup() {
         if (keytabFile != null) {
             FileUtils.deleteQuietly(keytabFile);
@@ -133,10 +152,11 @@ public static void cleanup() {
     /**
      * Test to verify that server is able to start with valid credentials
      */
-    @Test(timeout = 120000)
+    @Test
+    @Timeout(value = 120)
     public void testValidCredentials() throws Exception {
         String serverPrincipal = hostServerPrincipal.substring(0, hostServerPrincipal.lastIndexOf("@"));
-        Map<String, String> authConfigs = new HashMap<String, String>();
+        Map<String, String> authConfigs = new HashMap<>();
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
         authConfigs.put(QuorumAuth.QUORUM_SERVER_SASL_AUTH_REQUIRED, "true");
         authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_AUTH_REQUIRED, "true");
@@ -155,10 +175,11 @@ public void testValidCredentials() throws Exception {
      * Test to verify that server is able to start with valid credentials
      * when using multiple Quorum / Election addresses
      */
-    @Test(timeout = 120000)
+    @Test
+    @Timeout(value = 120)
     public void testValidCredentialsWithMultiAddresses() throws Exception {
         String serverPrincipal = hostServerPrincipal.substring(0, hostServerPrincipal.lastIndexOf("@"));
-        Map<String, String> authConfigs = new HashMap<String, String>();
+        Map<String, String> authConfigs = new HashMap<>();
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
         authConfigs.put(QuorumAuth.QUORUM_SERVER_SASL_AUTH_REQUIRED, "true");
         authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_AUTH_REQUIRED, "true");
@@ -176,10 +197,11 @@ public void testValidCredentialsWithMultiAddresses() throws Exception {
     /**
      * Test to verify that the bad server connection to the quorum should be rejected.
      */
-    @Test(timeout = 120000)
+    @Test
+    @Timeout(value = 120)
     public void testConnectBadServer() throws Exception {
         String serverPrincipal = hostServerPrincipal.substring(0, hostServerPrincipal.lastIndexOf("@"));
-        Map<String, String> authConfigs = new HashMap<String, String>();
+        Map<String, String> authConfigs = new HashMap<>();
         authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
         authConfigs.put(QuorumAuth.QUORUM_SERVER_SASL_AUTH_REQUIRED, "true");
         authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_AUTH_REQUIRED, "true");
@@ -220,4 +242,52 @@ public void testConnectBadServer() throws Exception {
         }
     }
 
+    /**
+     * Test to verify that the bad server connection to the quorum should be rejected.
+     */
+    @Test
+    @Timeout(value = 120)
+    public void testConnectHostlessPrincipalBadServer() throws Exception {
+        String serverPrincipal = hostServerPrincipal.substring(0, hostServerPrincipal.lastIndexOf("@"));
+        Map<String, String> authConfigs = new HashMap<>();
+        authConfigs.put(QuorumAuth.QUORUM_SASL_AUTH_ENABLED, "true");
+        authConfigs.put(QuorumAuth.QUORUM_SERVER_SASL_AUTH_REQUIRED, "true");
+        authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_AUTH_REQUIRED, "true");
+        authConfigs.put(QuorumAuth.QUORUM_KERBEROS_SERVICE_PRINCIPAL, serverPrincipal);
+        String connectStr = startQuorum(3, authConfigs, 3);
+        CountdownWatcher watcher = new CountdownWatcher();
+        ZooKeeper zk = new ZooKeeper(connectStr, ClientBase.CONNECTION_TIMEOUT, watcher);
+        watcher.waitForConnected(ClientBase.CONNECTION_TIMEOUT);
+        for (int i = 0; i < 10; i++) {
+            zk.create("/" + i, new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        }
+        zk.close();
+
+        String quorumCfgSection = mt.get(0).getQuorumCfgSection();
+        StringBuilder sb = new StringBuilder();
+        sb.append(quorumCfgSection);
+
+        int myid = mt.size() + 1;
+        final int clientPort = PortAssignment.unique();
+        String server = String.format("server.%d=localhost:%d:%d:participant", myid, PortAssignment.unique(), PortAssignment.unique());
+        sb.append(server + "\n");
+        quorumCfgSection = sb.toString();
+        authConfigs.put(QuorumAuth.QUORUM_LEARNER_SASL_LOGIN_CONTEXT, "QuorumLearnerMissingHost");
+        MainThread badServer = new MainThread(myid, clientPort, quorumCfgSection, authConfigs);
+        badServer.start();
+        watcher = new CountdownWatcher();
+        connectStr = "127.0.0.1:" + clientPort;
+        zk = new ZooKeeper(connectStr, ClientBase.CONNECTION_TIMEOUT, watcher);
+        try {
+            watcher.waitForConnected(ClientBase.CONNECTION_TIMEOUT / 3);
+            fail("Must throw exception as the principal does not include an authorized host!");
+        } catch (TimeoutException e) {
+            // expected
+        } finally {
+            zk.close();
+            badServer.shutdown();
+            badServer.deleteBaseDir();
+        }
+    }
+
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/AdHashTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/AdHashTest.java
index 671d484647b..f30de6404ba 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/AdHashTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/AdHashTest.java
@@ -18,13 +18,13 @@
 
 package org.apache.zookeeper.server.util;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Random;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class AdHashTest extends ZKTestCase {
 
@@ -52,7 +52,7 @@ private static void removeListOfDigests(AdHash hash, List<Long> digests) {
     }
 
     /**
-     * Test thhe add and remove digest from AdHash is working as expected.
+     * Test the add and remove digest from AdHash is working as expected.
      */
     @Test
     public void testAdHash() throws Exception {
@@ -78,16 +78,16 @@ public void testAdHash() throws Exception {
         addListOfDigests(hashall, bucket3);
         addListOfDigests(hashall, bucket4);
         addListOfDigests(hashall, bucket5);
-        assertFalse("digest of different set not different", hashall.equals(hash21));
+        assertNotEquals(hashall, hash21, "digest of different set not different");
         removeListOfDigests(hashall, bucket4);
         removeListOfDigests(hashall, bucket5);
         addListOfDigests(hash21, bucket3);
-        assertEquals("hashall with 4 & 5 removed should match hash21 with 3 added", hashall, hash21);
+        assertEquals(hashall, hash21, "hashall with 4 & 5 removed should match hash21 with 3 added");
 
         removeListOfDigests(hashall, bucket3);
         removeListOfDigests(hashall, bucket2);
         removeListOfDigests(hashall, bucket1);
-        assertEquals("empty hashall's digest should be 0", hashall.toString(), "0");
+        assertEquals(hashall.toString(), "0", "empty hashall's digest should be 0");
 
         AdHash hash45 = new AdHash();
         addListOfDigests(hash45, bucket4);
@@ -95,7 +95,7 @@ public void testAdHash() throws Exception {
 
         addListOfDigests(hashall, bucket4);
         addListOfDigests(hashall, bucket5);
-        assertEquals("empty hashall + 4&5 should equal hash45", hashall, hash45);
+        assertEquals(hashall, hash45, "empty hashall + 4&5 should equal hash45");
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/AuthUtilTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/AuthUtilTest.java
index 801a76944ec..8dcacf58883 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/AuthUtilTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/AuthUtilTest.java
@@ -17,17 +17,17 @@
  */
 package org.apache.zookeeper.server.util;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNull;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.server.auth.ProviderRegistry;
-import org.junit.AfterClass;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
 
 public class AuthUtilTest {
 
-    @BeforeClass
+    @BeforeAll
     public static void beforeClassSetUp() {
         ProviderRegistry.reset();
         System.setProperty("zookeeper.authProvider.sasl",
@@ -36,7 +36,7 @@ public static void beforeClassSetUp() {
                 "org.apache.zookeeper.server.auth.X509AuthenticationProvider");
     }
 
-    @AfterClass
+    @AfterAll
     public static void afterClassTearDown() {
         System.clearProperty("zookeeper.authProvider.sasl");
         System.clearProperty("zookeeper.authProvider.x509");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/BitHashSetTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/BitHashSetTest.java
index ff67c4e6639..8d42528afd0 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/BitHashSetTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/BitHashSetTest.java
@@ -17,14 +17,14 @@
 
 package org.apache.zookeeper.server.util;
 
-import static org.junit.Assert.assertArrayEquals;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.ArrayList;
 import java.util.List;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class BitHashSetTest extends ZKTestCase {
 
@@ -36,7 +36,7 @@ public void testAddWatchBit() {
         assertEquals(1, ws.size());
         assertEquals(1, ws.cachedSize());
 
-        List<Integer> actualBits = new ArrayList<Integer>();
+        List<Integer> actualBits = new ArrayList<>();
 
         for (int bit : ws) {
             actualBits.add(bit);
@@ -77,7 +77,7 @@ public void testRemoveWatchBit() {
         assertEquals(1, ws.size());
         assertEquals(0, ws.cachedSize());
 
-        List<Integer> actualBits = new ArrayList<Integer>();
+        List<Integer> actualBits = new ArrayList<>();
 
         for (int bit : ws) {
             actualBits.add(bit);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/BitMapTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/BitMapTest.java
index 799a7866248..9ea76e70220 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/BitMapTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/BitMapTest.java
@@ -17,18 +17,18 @@
 
 package org.apache.zookeeper.server.util;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotEquals;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class BitMapTest extends ZKTestCase {
 
     @Test
     public void testAddAndRemove() {
-        BitMap<String> bitMap = new BitMap<String>();
+        BitMap<String> bitMap = new BitMap<>();
         String v1 = "v1";
         Integer bit = bitMap.add(v1);
 
@@ -62,7 +62,7 @@ public void testAddAndRemove() {
 
     @Test
     public void testBitReuse() {
-        BitMap<String> bitMap = new BitMap<String>();
+        BitMap<String> bitMap = new BitMap<>();
         int v1Bit = bitMap.add("v1");
         int v2Bit = bitMap.add("v2");
         int v3Bit = bitMap.add("v3");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/CircularBufferTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/CircularBufferTest.java
index ff3c83c4239..bf33dc74bfc 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/CircularBufferTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/CircularBufferTest.java
@@ -18,8 +18,12 @@
 
 package org.apache.zookeeper.server.util;
 
-import org.junit.Assert;
-import org.junit.Test;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+import org.junit.jupiter.api.Test;
 
 public class CircularBufferTest {
 
@@ -28,109 +32,109 @@ public void testCircularBuffer() {
         final int capacity = 3;
         CircularBuffer<String> buffer = new CircularBuffer<>(String.class, capacity);
 
-        Assert.assertTrue(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertTrue(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
         // write to the buffer
         buffer.write("A");
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertFalse(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
         buffer.write("B");
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertFalse(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
         buffer.write("C");
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertTrue(buffer.isFull());
+        assertFalse(buffer.isEmpty());
+        assertTrue(buffer.isFull());
 
         // Buffer is full.
         // Read from buffer
-        Assert.assertEquals("A", buffer.take());
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertEquals("A", buffer.take());
+        assertFalse(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
-        Assert.assertEquals("B", buffer.take());
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertEquals("B", buffer.take());
+        assertFalse(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
-        Assert.assertEquals("C", buffer.take());
-        Assert.assertTrue(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertEquals("C", buffer.take());
+        assertTrue(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
         // write to the buffer
         buffer.write("1");
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertFalse(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
         buffer.write("2");
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertFalse(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
         buffer.write("3");
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertTrue(buffer.isFull());
+        assertFalse(buffer.isEmpty());
+        assertTrue(buffer.isFull());
 
         buffer.write("4"); // 4 overwrites 1
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertTrue(buffer.isFull());
+        assertFalse(buffer.isEmpty());
+        assertTrue(buffer.isFull());
 
         // Buffer if full
         // Read from buffer
-        Assert.assertEquals("2", buffer.take());
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertEquals("2", buffer.take());
+        assertFalse(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
-        Assert.assertEquals("3", buffer.take());
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertEquals("3", buffer.take());
+        assertFalse(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
-        Assert.assertEquals("4", buffer.take());
-        Assert.assertTrue(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertEquals("4", buffer.take());
+        assertTrue(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
         // write to the buffer
         buffer.write("a");
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertFalse(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
         buffer.write("b");
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertFalse(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
         buffer.write("c");
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertTrue(buffer.isFull());
+        assertFalse(buffer.isEmpty());
+        assertTrue(buffer.isFull());
 
         buffer.write("d"); // d overwrites a
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertTrue(buffer.isFull());
+        assertFalse(buffer.isEmpty());
+        assertTrue(buffer.isFull());
 
         buffer.write("e"); // e overwrites b
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertTrue(buffer.isFull());
+        assertFalse(buffer.isEmpty());
+        assertTrue(buffer.isFull());
 
         buffer.write("f"); // f overwrites c
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertTrue(buffer.isFull());
+        assertFalse(buffer.isEmpty());
+        assertTrue(buffer.isFull());
 
         buffer.write("g"); // g overwrites d
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertTrue(buffer.isFull());
+        assertFalse(buffer.isEmpty());
+        assertTrue(buffer.isFull());
 
         // Buffer is full.
         // Read from buffer
-        Assert.assertEquals("e", buffer.take());
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertEquals("e", buffer.take());
+        assertFalse(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
-        Assert.assertEquals("f", buffer.take());
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertEquals("f", buffer.take());
+        assertFalse(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
-        Assert.assertEquals("g", buffer.take());
-        Assert.assertTrue(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertEquals("g", buffer.take());
+        assertTrue(buffer.isEmpty());
+        assertFalse(buffer.isFull());
     }
 
     @Test
@@ -138,23 +142,23 @@ public void testCircularBufferWithCapacity1() {
         final int capacity = 1;
         CircularBuffer<String> buffer = new CircularBuffer<>(String.class, capacity);
 
-        Assert.assertTrue(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertTrue(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
         // write to the buffer
         buffer.write("A");
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertTrue(buffer.isFull());
+        assertFalse(buffer.isEmpty());
+        assertTrue(buffer.isFull());
 
         buffer.write("B"); // B overwrite A
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertTrue(buffer.isFull());
+        assertFalse(buffer.isEmpty());
+        assertTrue(buffer.isFull());
 
         // Buffer is full.
         // Read from buffer
-        Assert.assertEquals("B", buffer.take());
-        Assert.assertTrue(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertEquals("B", buffer.take());
+        assertTrue(buffer.isEmpty());
+        assertFalse(buffer.isFull());
     }
 
     @Test
@@ -162,37 +166,37 @@ public void testCircularBufferReset() {
         final int capacity = 3;
         CircularBuffer<String> buffer = new CircularBuffer<>(String.class, capacity);
 
-        Assert.assertTrue(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
+        assertTrue(buffer.isEmpty());
+        assertFalse(buffer.isFull());
 
         // write to the buffer
         buffer.write("A");
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
-        Assert.assertEquals(1, buffer.size());
-        Assert.assertEquals("A", buffer.peek());
+        assertFalse(buffer.isEmpty());
+        assertFalse(buffer.isFull());
+        assertEquals(1, buffer.size());
+        assertEquals("A", buffer.peek());
 
         buffer.write("B");
-        Assert.assertFalse(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
-        Assert.assertEquals(2, buffer.size());
-        Assert.assertEquals("A", buffer.peek());
+        assertFalse(buffer.isEmpty());
+        assertFalse(buffer.isFull());
+        assertEquals(2, buffer.size());
+        assertEquals("A", buffer.peek());
 
         // reset
         buffer.reset();
-        Assert.assertNull(buffer.peek());
-        Assert.assertTrue(buffer.isEmpty());
-        Assert.assertFalse(buffer.isFull());
-        Assert.assertEquals(0, buffer.size());
+        assertNull(buffer.peek());
+        assertTrue(buffer.isEmpty());
+        assertFalse(buffer.isFull());
+        assertEquals(0, buffer.size());
     }
 
     @Test
     public void testCircularBufferIllegalCapacity() {
         try {
             CircularBuffer<String> buffer = new CircularBuffer<>(String.class, 0);
-            Assert.fail();
+            fail();
         } catch (IllegalArgumentException e) {
-            Assert.assertEquals("CircularBuffer capacity should be greater than 0", e.getMessage());
+            assertEquals("CircularBuffer capacity should be greater than 0", e.getMessage());
         }
     }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/ConfigUtilsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/ConfigUtilsTest.java
index ba68b229ec0..ecce3eaee78 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/ConfigUtilsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/ConfigUtilsTest.java
@@ -18,9 +18,13 @@
 
 package org.apache.zookeeper.server.util;
 
-import static org.junit.Assert.assertEquals;
-import org.apache.zookeeper.server.quorum.QuorumPeerConfig.ConfigException;
-import org.junit.Test;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import org.apache.zookeeper.common.ConfigException;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
 
 public class ConfigUtilsTest {
 
@@ -48,14 +52,18 @@ public void testGetHostAndPortWithIPv4() throws ConfigException {
         assertEquals(nsa[2], "3888");
     }
 
-    @Test(expected = ConfigException.class)
-    public void testGetHostAndPortWithoutBracket() throws ConfigException {
-        String[] nsa = ConfigUtils.getHostAndPort("[2001:db8:85a3:8d3:1319:8a2e:370:7348");
+    @Test
+    public void testGetHostAndPortWithoutBracket() {
+        assertThrows(ConfigException.class, () -> {
+            String[] nsa = ConfigUtils.getHostAndPort("[2001:db8:85a3:8d3:1319:8a2e:370:7348");
+        });
     }
 
-    @Test(expected = ConfigException.class)
-    public void testGetHostAndPortWithoutPortAfterColon() throws ConfigException {
-        String[] nsa = ConfigUtils.getHostAndPort("[2001:db8:1::242:ac11:2]:");
+    @Test
+    public void testGetHostAndPortWithoutPortAfterColon() {
+        assertThrows(ConfigException.class, () -> {
+            String[] nsa = ConfigUtils.getHostAndPort("[2001:db8:1::242:ac11:2]:");
+        });
     }
 
     @Test
@@ -69,4 +77,75 @@ public void testGetHostAndPortWithoutPort() throws ConfigException {
         assertEquals(nsa.length, 1);
     }
 
+    @Test
+    public void testGetPropertyBackwardCompatibleWay() throws ConfigException {
+        String newProp = "zookeeper.prop.x.y.z";
+        String oldProp = "prop.x.y.z";
+
+        // Null as both properties are not set
+        String result = ConfigUtils.getPropertyBackwardCompatibleWay(newProp);
+        assertNull(result);
+
+        // Return old property value when only old property is set
+        String oldPropValue = "oldPropertyValue";
+        System.setProperty(oldProp, oldPropValue);
+        result = ConfigUtils.getPropertyBackwardCompatibleWay(newProp);
+        assertEquals(oldPropValue, result);
+
+        // Return new property value when both properties are set
+        String newPropValue = "newPropertyValue";
+        System.setProperty(newProp, newPropValue);
+        result = ConfigUtils.getPropertyBackwardCompatibleWay(newProp);
+        assertEquals(newPropValue, result);
+
+        // cleanUp
+        clearProp(newProp, oldProp);
+
+        // Return trimmed value
+        System.setProperty(oldProp, oldPropValue + "  ");
+        result = ConfigUtils.getPropertyBackwardCompatibleWay(newProp);
+        assertEquals(oldPropValue, result);
+
+        System.setProperty(newProp, "  " + newPropValue);
+        result = ConfigUtils.getPropertyBackwardCompatibleWay(newProp);
+        assertEquals(newPropValue, result);
+
+        // cleanUp
+        clearProp(newProp, oldProp);
+    }
+
+    /**
+     * Tests the ConfigUtils.getClientConfigStr(String) method with version.
+     */
+    @ParameterizedTest
+    @ValueSource(strings = {
+            "version=1.2.3\n",
+            "version = 1.2.3\n",
+            "version=1.2.3\nfoo=bar\n",
+            "foo=bar\nversion=1.2.3\n"
+    })
+    public void testGetClientConfigStrWithVersion(String configData) {
+        String result = ConfigUtils.getClientConfigStr(configData);
+        assertEquals("1.2.3 ", result);
+    }
+
+    /**
+     * Tests the ConfigUtils.getClientConfigStr(String) method without version.
+     */
+    @ParameterizedTest
+    @ValueSource(strings = {
+            "versions=1.2.3\n",
+            "versions = 1.2.3\n",
+            "foo=bar\n",
+            "version=\n"
+    })
+    public void testGetClientConfigStrWithoutVersion(String configData) {
+        String result = ConfigUtils.getClientConfigStr(configData);
+        assertEquals(" ", result);
+    }
+
+    private void clearProp(String newProp, String oldProp) {
+        System.clearProperty(newProp);
+        System.clearProperty(oldProp);
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/JvmPauseMonitorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/JvmPauseMonitorTest.java
index 58b1902a2b2..ab6666387af 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/JvmPauseMonitorTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/JvmPauseMonitorTest.java
@@ -18,12 +18,13 @@
 
 package org.apache.zookeeper.server.util;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
-import org.junit.After;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 public class JvmPauseMonitorTest {
 
@@ -32,7 +33,8 @@ public class JvmPauseMonitorTest {
     private final Long warnTH = -1L;
     private JvmPauseMonitor pauseMonitor;
 
-    @Test(timeout = 5000)
+    @Test
+    @Timeout(value = 5)
     public void testJvmPauseMonitorExceedInfoThreshold() throws InterruptedException {
         QuorumPeerConfig qpConfig = mock(QuorumPeerConfig.class);
         when(qpConfig.getJvmPauseSleepTimeMs()).thenReturn(sleepTime);
@@ -49,7 +51,8 @@ public void testJvmPauseMonitorExceedInfoThreshold() throws InterruptedException
         }
     }
 
-    @Test(timeout = 5000)
+    @Test
+    @Timeout(value = 5)
     public void testJvmPauseMonitorExceedWarnThreshold() throws InterruptedException {
         QuorumPeerConfig qpConfig = mock(QuorumPeerConfig.class);
         when(qpConfig.getJvmPauseSleepTimeMs()).thenReturn(sleepTime);
@@ -64,10 +67,9 @@ public void testJvmPauseMonitorExceedWarnThreshold() throws InterruptedException
         while (pauseMonitor.getNumGcWarnThresholdExceeded() == 0) {
             Thread.sleep(200);
         }
-
     }
 
-    @After
+    @AfterEach
     public void teardown() {
         pauseMonitor.serviceStop();
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/MessageTrackerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/MessageTrackerTest.java
index f1cef10b4f0..d400cf993c9 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/MessageTrackerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/MessageTrackerTest.java
@@ -18,10 +18,11 @@
 
 package org.apache.zookeeper.server.util;
 
-import org.junit.After;
-import org.junit.Assert;
-import org.junit.Before;
-import org.junit.Test;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -29,12 +30,12 @@ public class MessageTrackerTest {
     private static final int BUFFERED_MESSAGE_SIZE = 5;
     private static final Logger LOG = LoggerFactory.getLogger(MessageTrackerTest.class);
 
-    @Before
+    @BeforeEach
     public void setup() {
         System.setProperty(MessageTracker.MESSAGE_TRACKER_ENABLED, "true");
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         System.clearProperty(MessageTracker.MESSAGE_TRACKER_ENABLED);
     }
@@ -46,14 +47,14 @@ public void testTrackSend() throws InterruptedException {
 
         // First timestamp is added
         messageTracker.trackSent(timestamp1);
-        Assert.assertEquals(messageTracker.peekSentTimestamp(), timestamp1);
+        assertEquals(messageTracker.peekSentTimestamp(), timestamp1);
 
         Thread.sleep(2);
 
         // Second timestamp is added
         long timestamp2 = System.currentTimeMillis();
         messageTracker.trackSent(timestamp2);
-        Assert.assertEquals(messageTracker.peekSentTimestamp(), timestamp1);
+        assertEquals(messageTracker.peekSentTimestamp(), timestamp1);
     }
 
     @Test
@@ -63,14 +64,14 @@ public void testTrackReceived() throws InterruptedException {
 
         // First timestamp is added
         messageTracker.trackReceived(timestamp1);
-        Assert.assertEquals(messageTracker.peekReceivedTimestamp(), timestamp1);
+        assertEquals(messageTracker.peekReceivedTimestamp(), timestamp1);
 
         Thread.sleep(2);
 
         // Second timestamp is added
         long timestamp2 = System.currentTimeMillis();
         messageTracker.trackReceived(timestamp2);
-        Assert.assertEquals(messageTracker.peekReceivedTimestamp(), timestamp1);
+        assertEquals(messageTracker.peekReceivedTimestamp(), timestamp1);
     }
 
     @Test
@@ -94,8 +95,8 @@ public void testMessageTrackerFull() throws InterruptedException {
             Thread.sleep(1);
         }
 
-        Assert.assertEquals(messageTracker.peekSentTimestamp(), timestampSent);
-        Assert.assertEquals(messageTracker.peekReceivedTimestamp(), timestampReceived);
+        assertEquals(messageTracker.peekSentTimestamp(), timestampSent);
+        assertEquals(messageTracker.peekReceivedTimestamp(), timestampReceived);
     }
 
     @Test
@@ -106,24 +107,24 @@ public void testDumpToLog() {
 
         // MessageTracker is empty
         messageTracker.dumpToLog(sid);
-        Assert.assertNull(messageTracker.peekSent());
-        Assert.assertNull(messageTracker.peekReceived());
+        assertNull(messageTracker.peekSent());
+        assertNull(messageTracker.peekReceived());
 
         // There is 1 sent and 0 received
         messageTracker.trackSent(timestamp1);
-        Assert.assertEquals(messageTracker.peekSentTimestamp(), timestamp1);
-        Assert.assertNull(messageTracker.peekReceived());
+        assertEquals(messageTracker.peekSentTimestamp(), timestamp1);
+        assertNull(messageTracker.peekReceived());
         messageTracker.dumpToLog(sid);
-        Assert.assertNull(messageTracker.peekSent());
-        Assert.assertNull(messageTracker.peekReceived());
+        assertNull(messageTracker.peekSent());
+        assertNull(messageTracker.peekReceived());
 
         // There is 1 sent and 1 received
         messageTracker.trackSent(timestamp1);
         messageTracker.trackReceived(timestamp1);
-        Assert.assertEquals(messageTracker.peekSentTimestamp(), timestamp1);
-        Assert.assertEquals(messageTracker.peekReceivedTimestamp(), timestamp1);
+        assertEquals(messageTracker.peekSentTimestamp(), timestamp1);
+        assertEquals(messageTracker.peekReceivedTimestamp(), timestamp1);
         messageTracker.dumpToLog(sid);
-        Assert.assertNull(messageTracker.peekSent());
-        Assert.assertNull(messageTracker.peekReceived());
+        assertNull(messageTracker.peekSent());
+        assertNull(messageTracker.peekReceived());
     }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/QuotaMetricsUtilsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/QuotaMetricsUtilsTest.java
new file mode 100644
index 00000000000..5e5f979feee
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/QuotaMetricsUtilsTest.java
@@ -0,0 +1,326 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.util;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.UUID;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.Quotas;
+import org.apache.zookeeper.StatsTrack;
+import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.metrics.MetricsContext;
+import org.apache.zookeeper.metrics.MetricsProvider;
+import org.apache.zookeeper.metrics.MetricsUtils;
+import org.apache.zookeeper.server.DataNode;
+import org.apache.zookeeper.server.DataTree;
+import org.apache.zookeeper.server.ServerMetrics;
+import org.junit.jupiter.api.Test;
+
+public class QuotaMetricsUtilsTest extends ZKTestCase {
+    @Test
+    public void testQuotaMetrics_singleQuotaSubtree() throws Exception {
+        // register the metrics
+        final String nameSuffix = UUID.randomUUID().toString();
+        final DataTree dt = new DataTree();
+        registerQuotaMetrics(nameSuffix, dt);
+
+        // build the data tree
+        final String ns = UUID.randomUUID().toString();
+
+        final long countLimit = 10;
+        final long bytesLimit = 100;
+        final long countHardLimit = 5;
+        final long bytesHardLimit = 50;
+
+        final long countUsage = 5;
+        final long bytesUsage = 40;
+
+        final StatsTrack limitTrack = buildLimitStatsTrack(countLimit, bytesLimit, countHardLimit, bytesHardLimit);
+        final StatsTrack usageTrack = buildUsageStatsTrack(countUsage, bytesUsage);
+        buildDataTree("/" + ns, limitTrack, usageTrack, dt);
+
+        // validate the quota metrics
+        validateQuotaMetrics(ns, countHardLimit, bytesHardLimit, countUsage, bytesUsage, nameSuffix);
+    }
+
+
+    @Test
+    public void testQuotaMetrics_multipleQuotaSubtrees() throws Exception {
+        // register the metrics
+        final String nameSuffix = UUID.randomUUID().toString();
+        final DataTree dt = new DataTree();
+        registerQuotaMetrics(nameSuffix, dt);
+
+        // build the data tree
+        final String ns = UUID.randomUUID().toString();
+
+        final long countLimit1 = 10;
+        final long bytesLimit1 = 100;
+        final long countHardLimit1 = 5;
+        final long bytesHardLimit1 = 50;
+
+        final long countUsage1 = 5;
+        final long bytesUsage1 = 40;
+
+        final StatsTrack limitTrack1 = buildLimitStatsTrack(countLimit1, bytesLimit1, countHardLimit1, bytesHardLimit1);
+        final StatsTrack usageTrack1 = buildUsageStatsTrack(countUsage1, bytesUsage1);
+
+        buildDataTree("/" + ns + "/a/b", limitTrack1, usageTrack1, dt);
+
+        // validate the quota metrics
+        validateQuotaMetrics(ns, countHardLimit1, bytesHardLimit1, countUsage1, bytesUsage1, nameSuffix);
+
+        // update the data tree with another quota subtree
+        final long countLimit2 = 20;
+        final long bytesLimit2 = 200;
+        final long countHardLimit2 = 10;
+        final long bytesHardLimit2 = 100;
+
+        final long countUsage2 = 9;
+        final long bytesUsage2 = 80;
+
+        final StatsTrack limitTrack2 = buildLimitStatsTrack(countLimit2, bytesLimit2, countHardLimit2, bytesHardLimit2);
+        final StatsTrack usageTrack2 = buildUsageStatsTrack(countUsage2, bytesUsage2);
+
+        buildDataTree("/" + ns + "/a/c/d", limitTrack2, usageTrack2, dt);
+
+        // validate the quota metrics
+        validateQuotaMetrics(ns, countHardLimit1 + countHardLimit2, bytesHardLimit1 + bytesHardLimit2,
+                countUsage1 + countUsage2, bytesUsage1 + bytesUsage2, nameSuffix);
+    }
+
+    @Test
+    public void testQuotaMetrics_noUsage() throws Exception {
+        // register the metrics
+        final String nameSuffix = UUID.randomUUID().toString();
+        final DataTree dt = new DataTree();
+        registerQuotaMetrics(nameSuffix, dt);
+
+        // build the data tree
+        final String ns = UUID.randomUUID().toString();
+
+        final long countLimit = 20;
+        final long bytesLimit = 200;
+        final long countHardLimit = -1;
+        final long bytesHardLimit = -1;
+
+        final long countUsage = 1;  // the node itself is always counted
+        final long bytesUsage = 0;
+
+        final StatsTrack limitTrack = buildLimitStatsTrack(countLimit, bytesLimit, countHardLimit, bytesHardLimit);
+        final StatsTrack usageTrack = buildUsageStatsTrack(countUsage, bytesUsage);
+        buildDataTree("/" + ns, limitTrack, usageTrack, dt);
+
+        // validate the quota
+        validateQuotaMetrics(ns, countLimit, bytesLimit, countUsage, bytesUsage, nameSuffix);
+    }
+
+    @Test
+    public void testQuotaMetrics_nullDataTree() {
+        // register the metrics
+        final String nameSuffix = UUID.randomUUID().toString();
+        registerQuotaMetrics(nameSuffix, null);
+
+        // validate the quota
+        validateQuotaMetrics(UUID.randomUUID().toString(), null, null, null, null, nameSuffix);
+    }
+
+    @Test
+    public void testQuotaMetrics_emptyDataTree() {
+        // register the metrics
+        final String nameSuffix = UUID.randomUUID().toString();
+        registerQuotaMetrics(nameSuffix, new DataTree());
+
+        // validate the quota
+        validateQuotaMetrics(UUID.randomUUID().toString(), null, null, null, null, nameSuffix);
+    }
+
+    @Test
+    public void testShouldCollect_limitPath() {
+        final String limitPath = Quotas.quotaPath("/ns1") + QuotaMetricsUtils.LIMIT_END_STRING;
+
+        assertTrue(QuotaMetricsUtils.shouldCollect(limitPath, QuotaMetricsUtils.QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_COUNT_LIMIT));
+        assertTrue(QuotaMetricsUtils.shouldCollect(limitPath, QuotaMetricsUtils.QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_BYTES_LIMIT));
+
+        assertFalse(QuotaMetricsUtils.shouldCollect(limitPath, QuotaMetricsUtils.QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_COUNT_USAGE));
+        assertFalse(QuotaMetricsUtils.shouldCollect(limitPath, QuotaMetricsUtils.QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_BYTES_USAGE));
+    }
+
+    @Test
+    public void testShouldCollect_usagePath() {
+        final String usagePath = Quotas.quotaPath("/ns1") + QuotaMetricsUtils.STATS_END_STRING;
+
+        assertTrue(QuotaMetricsUtils.shouldCollect(usagePath, QuotaMetricsUtils.QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_COUNT_USAGE));
+        assertTrue(QuotaMetricsUtils.shouldCollect(usagePath, QuotaMetricsUtils.QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_BYTES_USAGE));
+
+        assertFalse(QuotaMetricsUtils.shouldCollect(usagePath, QuotaMetricsUtils.QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_COUNT_LIMIT));
+        assertFalse(QuotaMetricsUtils.shouldCollect(usagePath, QuotaMetricsUtils.QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_BYTES_LIMIT));
+    }
+
+    @Test
+    public void testShouldCollect_notLimitOrUsagePath() {
+        final String usagePath = Quotas.quotaPath("/ns1") + "/notLimitOrUsage";
+
+        assertFalse(QuotaMetricsUtils.shouldCollect(usagePath, QuotaMetricsUtils.QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_COUNT_USAGE));
+        assertFalse(QuotaMetricsUtils.shouldCollect(usagePath, QuotaMetricsUtils.QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_BYTES_USAGE));
+
+        assertFalse(QuotaMetricsUtils.shouldCollect(usagePath, QuotaMetricsUtils.QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_COUNT_LIMIT));
+        assertFalse(QuotaMetricsUtils.shouldCollect(usagePath, QuotaMetricsUtils.QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_BYTES_LIMIT));
+    }
+
+    @Test
+    public void testGetQuotaLimit() {
+        assertEquals(0L, QuotaMetricsUtils.getQuotaLimit(0L, -1L));
+        assertEquals(1L, QuotaMetricsUtils.getQuotaLimit(-1L, 1L));
+        assertEquals(0L, QuotaMetricsUtils.getQuotaLimit(-2L, 0L));
+    }
+
+    @Test
+    public void testCollectQuotaMetrics_noData() {
+        final Map<String, Number> metricsMap = new HashMap<>();
+
+        QuotaMetricsUtils.collectQuotaLimitOrUsage(Quotas.quotaPath("/ns1") + QuotaMetricsUtils.LIMIT_END_STRING,
+                                        new DataNode(new byte[0], null, null),
+                                        metricsMap,
+                                        QuotaMetricsUtils.QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_BYTES_LIMIT);
+
+        assertEquals(1, metricsMap.size());
+        final Map.Entry<String, Number> entry = metricsMap.entrySet().iterator().next();
+        assertEquals("ns1", entry.getKey());
+        assertEquals(-1L,  entry.getValue().longValue());
+    }
+
+    @Test
+    public void testCollectQuotaMetrics_nullData() {
+        final Map<String, Number> metricsMap = new HashMap<>();
+
+        QuotaMetricsUtils.collectQuotaLimitOrUsage(Quotas.quotaPath("/ns1") + QuotaMetricsUtils.LIMIT_END_STRING,
+                new DataNode(null, null, null),
+                metricsMap,
+                QuotaMetricsUtils.QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_BYTES_LIMIT);
+
+        assertEquals(0, metricsMap.size());
+    }
+
+    @Test
+    public void testCollectQuotaMetrics_noNamespace() {
+        final Map<String, Number> metricsMap = new HashMap<>();
+
+        QuotaMetricsUtils.collectQuotaLimitOrUsage("/zookeeper/quota",
+                new DataNode(null, null, null),
+                metricsMap,
+                QuotaMetricsUtils.QUOTA_LIMIT_USAGE_METRIC_TYPE.QUOTA_BYTES_USAGE);
+
+        assertEquals(0, metricsMap.size());
+    }
+
+    private void registerQuotaMetrics(final String nameSuffix, final DataTree dt) {
+        final MetricsProvider metricProvider = ServerMetrics.getMetrics().getMetricsProvider();
+        final MetricsContext rootContext = metricProvider.getRootContext();
+
+        // added random UUID as NAME_SUFFIX to avoid GaugeSet being overwritten when registering with same name
+        rootContext.registerGaugeSet(
+                QuotaMetricsUtils.QUOTA_COUNT_LIMIT_PER_NAMESPACE + nameSuffix, () -> QuotaMetricsUtils.getQuotaCountLimit(dt));
+        rootContext.registerGaugeSet(
+                QuotaMetricsUtils.QUOTA_BYTES_LIMIT_PER_NAMESPACE + nameSuffix, () -> QuotaMetricsUtils.getQuotaBytesLimit(dt));
+        rootContext.registerGaugeSet(
+                QuotaMetricsUtils.QUOTA_COUNT_USAGE_PER_NAMESPACE + nameSuffix, () -> QuotaMetricsUtils.getQuotaCountUsage(dt));
+        rootContext.registerGaugeSet(
+                QuotaMetricsUtils.QUOTA_BYTES_USAGE_PER_NAMESPACE + nameSuffix, () -> QuotaMetricsUtils.getQuotaBytesUsage(dt));
+    }
+
+    private StatsTrack buildLimitStatsTrack(final long countLimit,
+                                            final long bytesLimit,
+                                            final long countHardLimit,
+                                            final long bytesHardLimit) {
+        final StatsTrack limitTrack = new StatsTrack();
+        limitTrack.setCount(countLimit);
+        limitTrack.setBytes(bytesLimit);
+        limitTrack.setCountHardLimit(countHardLimit);
+        limitTrack.setByteHardLimit(bytesHardLimit);
+        return limitTrack;
+    }
+
+    private StatsTrack buildUsageStatsTrack(final long countUsage,
+                                            final long bytesUsage) {
+        final StatsTrack usageTrack = new StatsTrack();
+        usageTrack.setCount(countUsage);
+        usageTrack.setBytes(bytesUsage);
+
+        return usageTrack;
+    }
+
+    private void buildDataTree(final String path,
+                               final StatsTrack limitTrack,
+                               final StatsTrack usageTrack,
+                               final DataTree dataTree) throws Exception {
+
+        // create the ancestor and child data nodes
+        buildAncestors(path, dataTree);
+        int childCount = (int) usageTrack.getCount() - 1; // the node count always includes the top namespace itself
+        if (childCount > 0) {
+            int dataBytes = (int) usageTrack.getBytes() / childCount;
+            for (int i = 0; i < childCount; i++) {
+                dataTree.createNode(path + "/n_" + i, new byte[dataBytes], null, -1, 1, 1, 1);
+            }
+        }
+
+        // create the quota tree
+        buildAncestors(Quotas.quotaPath(path), dataTree);
+
+        final String limitPath = Quotas.limitPath(path);
+        dataTree.createNode(limitPath, limitTrack.getStatsBytes(), null, -1, 1, 1, 1);
+        assertEquals(limitTrack, new StatsTrack(dataTree.getNode(limitPath).getData()));
+
+        final String usagePath = Quotas.statPath(path);
+        dataTree.createNode(usagePath, usageTrack.getStatsBytes(), null, -1, 1, 1, 1);
+        assertEquals(usageTrack, new StatsTrack(dataTree.getNode(usagePath).getData()));
+    }
+
+    private void buildAncestors(final String path, final DataTree dataTree) throws Exception {
+        final String[] parts = path.split("/");
+        String nodePath = "";
+
+        for (int i = 1; i < parts.length; i++) {
+            nodePath = nodePath + "/" + parts[i];
+            try {
+                dataTree.createNode(nodePath, null, null, -1, 1, 1, 1);
+            } catch (final KeeperException.NodeExistsException e) {
+                // ignored
+            }
+        }
+    }
+
+    private void validateQuotaMetrics(final String namespace,
+                                      final Long countLimit,
+                                      final Long bytesLimit,
+                                      final Long countUsage,
+                                      final Long bytesUsage,
+                                      final String nameSuffix) {
+        final Map<String, Object> values = MetricsUtils.currentServerMetrics();
+        assertEquals(countLimit, values.get(namespace + "_" + QuotaMetricsUtils.QUOTA_COUNT_LIMIT_PER_NAMESPACE + nameSuffix));
+        assertEquals(bytesLimit, values.get(namespace + "_" + QuotaMetricsUtils.QUOTA_BYTES_LIMIT_PER_NAMESPACE + nameSuffix));
+        assertEquals(countUsage, values.get(namespace + "_" + QuotaMetricsUtils.QUOTA_COUNT_USAGE_PER_NAMESPACE + nameSuffix));
+        assertEquals(bytesUsage, values.get(namespace + "_" + QuotaMetricsUtils.QUOTA_BYTES_USAGE_PER_NAMESPACE + nameSuffix));
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/RateLimiterTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/RateLimiterTest.java
new file mode 100644
index 00000000000..b19e9682391
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/RateLimiterTest.java
@@ -0,0 +1,62 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.server.util;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ThreadPoolExecutor;
+import java.util.concurrent.TimeUnit;
+import org.junit.jupiter.api.Test;
+
+public class RateLimiterTest {
+
+    @Test
+    public void testAllow_withinInterval() {
+        final int rate = 2;
+        final RateLimiter rateLimiter = new RateLimiter(rate, 5, TimeUnit.SECONDS);
+        for (int i = 0; i < rate; i++) {
+            assertTrue(rateLimiter.allow());
+        }
+        assertFalse(rateLimiter.allow());
+    }
+
+    @Test
+    public void testAllow_withinInterval_multiThreaded() {
+        final int rate = 10;
+
+        final RateLimiter rateLimiter = new RateLimiter(rate, 5, TimeUnit.SECONDS);
+        final ThreadPoolExecutor executor = (ThreadPoolExecutor) Executors.newFixedThreadPool(rate + 1);
+        for (int i = 0; i < rate; i++) {
+            executor.execute(() -> assertTrue(rateLimiter.allow()));
+        }
+        executor.execute(() -> assertFalse(rateLimiter.allow()));
+    }
+
+    @Test
+    public void testAllow_exceedInterval() throws Exception {
+        final int interval = 1;
+
+        final RateLimiter rateLimiter = new RateLimiter(1, interval, TimeUnit.SECONDS);
+        assertTrue(rateLimiter.allow());
+        assertFalse(rateLimiter.allow());
+        Thread.sleep(TimeUnit.SECONDS.toMillis(interval + 1));
+        assertTrue(rateLimiter.allow());
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/RequestPathMetricsCollectorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/RequestPathMetricsCollectorTest.java
index ecfc92c000c..7fc406b5263 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/RequestPathMetricsCollectorTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/RequestPathMetricsCollectorTest.java
@@ -26,21 +26,21 @@
 import static org.apache.zookeeper.ZooDefs.OpCode.getChildren2;
 import static org.apache.zookeeper.ZooDefs.OpCode.getData;
 import static org.apache.zookeeper.ZooDefs.OpCode.setData;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.Map;
 import java.util.Random;
 import java.util.concurrent.Executors;
 import java.util.concurrent.ThreadPoolExecutor;
 import java.util.concurrent.TimeUnit;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Ignore;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Disabled;
+import org.junit.jupiter.api.Test;
 
 public class RequestPathMetricsCollectorTest {
 
-    @Before
+    @BeforeEach
     public void setUp() {
         System.setProperty("zookeeper.pathStats.enabled", "true");
         System.setProperty("zookeeper.pathStats.slotCapacity", "60");
@@ -49,7 +49,7 @@ public void setUp() {
         System.setProperty("zookeeper.pathStats.sampleRate", "1.0");
     }
 
-    @After
+    @AfterEach
     public void tearDown() {
         System.clearProperty("zookeeper.pathStats.enabled");
         System.clearProperty("zookeeper.pathStats.slotCapacity");
@@ -61,21 +61,21 @@ public void tearDown() {
     @Test
     public void testTrimPath() {
         //normal cases
-        String trimedPath = RequestPathMetricsCollector.trimPathDepth("/p1/p2/p3", 1);
-        assertTrue(trimedPath.equalsIgnoreCase("/p1"));
-        trimedPath = RequestPathMetricsCollector.trimPathDepth("/p1/p2/p3", 2);
-        assertTrue(trimedPath.equalsIgnoreCase("/p1/p2"));
-        trimedPath = RequestPathMetricsCollector.trimPathDepth("/p1/p2/p3", 3);
-        assertTrue(trimedPath.equalsIgnoreCase("/p1/p2/p3"));
-        trimedPath = RequestPathMetricsCollector.trimPathDepth("/p1/p2/p3", 4);
-        assertTrue(trimedPath.equalsIgnoreCase("/p1/p2/p3"));
+        String trimmedPath = RequestPathMetricsCollector.trimPathDepth("/p1/p2/p3", 1);
+        assertTrue(trimmedPath.equalsIgnoreCase("/p1"));
+        trimmedPath = RequestPathMetricsCollector.trimPathDepth("/p1/p2/p3", 2);
+        assertTrue(trimmedPath.equalsIgnoreCase("/p1/p2"));
+        trimmedPath = RequestPathMetricsCollector.trimPathDepth("/p1/p2/p3", 3);
+        assertTrue(trimmedPath.equalsIgnoreCase("/p1/p2/p3"));
+        trimmedPath = RequestPathMetricsCollector.trimPathDepth("/p1/p2/p3", 4);
+        assertTrue(trimmedPath.equalsIgnoreCase("/p1/p2/p3"));
         //some extra symbols
-        trimedPath = RequestPathMetricsCollector.trimPathDepth("//p1 next/p2.index/p3:next", 3);
-        assertTrue(trimedPath.equalsIgnoreCase("/p1 next/p2.index/p3:next"));
-        trimedPath = RequestPathMetricsCollector.trimPathDepth("//p1 next/p2.index/p3:next", 2);
-        assertTrue(trimedPath.equalsIgnoreCase("/p1 next/p2.index"));
-        trimedPath = RequestPathMetricsCollector.trimPathDepth("//p1 next/p2.index/p3:next", 6);
-        assertTrue(trimedPath.equalsIgnoreCase("/p1 next/p2.index/p3:next"));
+        trimmedPath = RequestPathMetricsCollector.trimPathDepth("//p1 next/p2.index/p3:next", 3);
+        assertTrue(trimmedPath.equalsIgnoreCase("/p1 next/p2.index/p3:next"));
+        trimmedPath = RequestPathMetricsCollector.trimPathDepth("//p1 next/p2.index/p3:next", 2);
+        assertTrue(trimmedPath.equalsIgnoreCase("/p1 next/p2.index"));
+        trimmedPath = RequestPathMetricsCollector.trimPathDepth("//p1 next/p2.index/p3:next", 6);
+        assertTrue(trimmedPath.equalsIgnoreCase("/p1 next/p2.index/p3:next"));
     }
 
     @Test
@@ -160,7 +160,7 @@ public void testCollectEmptyStats() throws InterruptedException {
     }
 
     @Test
-    @Ignore
+    @Disabled
     public void testCollectStats() throws InterruptedException {
         RequestPathMetricsCollector requestPathMetricsCollector = new RequestPathMetricsCollector(true);
         RequestPathMetricsCollector.PathStatsQueue pathStatsQueue = requestPathMetricsCollector.new PathStatsQueue(getChildren);
@@ -421,23 +421,23 @@ public void testMultiThreadPerf() throws InterruptedException {
         ThreadPoolExecutor executor = (ThreadPoolExecutor) Executors.newCachedThreadPool();
         //call 100k get Data
         for (int i = 0; i < 100000; i++) {
-            executor.submit(new Thread(() -> requestPathMetricsCollector.registerRequest(getData, "/path1/path2/path"
-                                                                                                          + rand.nextInt(10))));
+            executor.submit(
+                () -> requestPathMetricsCollector.registerRequest(getData, "/path1/path2/path" + rand.nextInt(10)));
         }
         //5K create
         for (int i = 0; i < 5000; i++) {
-            executor.submit(new Thread(() -> requestPathMetricsCollector.registerRequest(create2, "/path1/path2/path"
-                                                                                                          + rand.nextInt(10))));
+            executor.submit(
+                () -> requestPathMetricsCollector.registerRequest(create2, "/path1/path2/path" + rand.nextInt(10)));
         }
         //5K delete
         for (int i = 0; i < 5000; i++) {
-            executor.submit(new Thread(() -> requestPathMetricsCollector.registerRequest(delete, "/path1/path2/path"
-                                                                                                         + rand.nextInt(10))));
+            executor.submit(
+                () -> requestPathMetricsCollector.registerRequest(delete, "/path1/path2/path" + rand.nextInt(10)));
         }
         //40K getChildren
         for (int i = 0; i < 40000; i++) {
-            executor.submit(new Thread(() -> requestPathMetricsCollector.registerRequest(getChildren, "/path1/path2/path"
-                                                                                                              + rand.nextInt(10))));
+            executor.submit(
+                () -> requestPathMetricsCollector.registerRequest(getChildren, "/path1/path2/path" + rand.nextInt(10)));
         }
         executor.shutdown();
         //wait for at most 10 mill seconds
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/SerializeUtilsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/SerializeUtilsTest.java
index 5caa7180058..4e2421d13de 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/SerializeUtilsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/SerializeUtilsTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.server.util;
 
-import static org.junit.Assert.assertArrayEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.ArgumentMatchers.eq;
@@ -35,23 +35,17 @@
 import org.apache.jute.Record;
 import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.txn.TxnHeader;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.mockito.InOrder;
 import org.mockito.invocation.InvocationOnMock;
 import org.mockito.stubbing.Answer;
 
 public class SerializeUtilsTest {
 
-    @Test
-    public void testSerializeRequestRequestIsNull() {
-        byte[] data = SerializeUtils.serializeRequest(null);
-        assertNull(data);
-    }
-
     @Test
     public void testSerializeRequestRequestHeaderIsNull() {
         Request request = new Request(0, 0, 0, null, null, 0);
-        byte[] data = SerializeUtils.serializeRequest(request);
+        byte[] data = request.getSerializeData();
         assertNull(data);
     }
 
@@ -71,7 +65,7 @@ public Object answer(InvocationOnMock invocation) throws Throwable {
         Request request = new Request(1, 2, 3, header, null, 4);
 
         // Act
-        byte[] data = SerializeUtils.serializeRequest(request);
+        byte[] data = request.getSerializeData();
 
         // Assert
         assertNotNull(data);
@@ -109,7 +103,7 @@ public Object answer(InvocationOnMock invocation) throws Throwable {
         Request request = new Request(1, 2, 3, header, txn, 4);
 
         // Act
-        byte[] data = SerializeUtils.serializeRequest(request);
+        byte[] data = request.getSerializeData();
 
         // Assert
         assertNotNull(data);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/VerifyingFileFactoryTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/VerifyingFileFactoryTest.java
index 925b01feaea..4561fc2853f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/VerifyingFileFactoryTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/util/VerifyingFileFactoryTest.java
@@ -18,11 +18,12 @@
 
 package org.apache.zookeeper.server.util;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import java.io.File;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -30,7 +31,7 @@ public class VerifyingFileFactoryTest extends ZKTestCase {
 
     private Logger log;
 
-    @Before
+    @BeforeEach
     public void setUp() {
         log = LoggerFactory.getLogger("TODO: Mock Logging");
     }
@@ -49,10 +50,12 @@ public void testForNoWarningOnIntendedRelativePath() {
         // assertFalse(log.hasWarned);
     }
 
-    @Test(expected = IllegalArgumentException.class)
+    @Test
     public void testForFailForNonExistingPath() {
-        VerifyingFileFactory vff = new VerifyingFileFactory.Builder(log).failForNonExistingPath().build();
-        vff.create("/I/H0p3/this/path/d035/n0t/ex15t");
+        assertThrows(IllegalArgumentException.class, () -> {
+            VerifyingFileFactory vff = new VerifyingFileFactory.Builder(log).failForNonExistingPath().build();
+            vff.create("/I/H0p3/this/path/d035/n0t/ex15t");
+        });
     }
 
     @Test
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/PathParentIteratorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/PathParentIteratorTest.java
index 59bb17adaa3..23ba5bb51f0 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/PathParentIteratorTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/PathParentIteratorTest.java
@@ -18,67 +18,69 @@
 
 package org.apache.zookeeper.server.watch;
 
-import org.junit.Assert;
-import org.junit.Test;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import org.junit.jupiter.api.Test;
 
 public class PathParentIteratorTest {
     @Test
     public void testRoot() {
         PathParentIterator pathParentIterator = PathParentIterator.forAll("/");
-        Assert.assertTrue(pathParentIterator.hasNext());
-        Assert.assertFalse(pathParentIterator.atParentPath());
-        Assert.assertEquals(pathParentIterator.next(), "/");
-        Assert.assertFalse(pathParentIterator.hasNext());
+        assertTrue(pathParentIterator.hasNext());
+        assertFalse(pathParentIterator.atParentPath());
+        assertEquals(pathParentIterator.next(), "/");
+        assertFalse(pathParentIterator.hasNext());
     }
 
     @Test
     public void test1Level() {
         PathParentIterator pathParentIterator = PathParentIterator.forAll("/a");
-        Assert.assertTrue(pathParentIterator.hasNext());
-        Assert.assertFalse(pathParentIterator.atParentPath());
-        Assert.assertEquals(pathParentIterator.next(), "/a");
+        assertTrue(pathParentIterator.hasNext());
+        assertFalse(pathParentIterator.atParentPath());
+        assertEquals(pathParentIterator.next(), "/a");
 
-        Assert.assertTrue(pathParentIterator.hasNext());
-        Assert.assertEquals(pathParentIterator.next(), "/");
-        Assert.assertTrue(pathParentIterator.atParentPath());
+        assertTrue(pathParentIterator.hasNext());
+        assertEquals(pathParentIterator.next(), "/");
+        assertTrue(pathParentIterator.atParentPath());
 
-        Assert.assertFalse(pathParentIterator.hasNext());
+        assertFalse(pathParentIterator.hasNext());
     }
 
     @Test
     public void testLong() {
         PathParentIterator pathParentIterator = PathParentIterator.forAll("/a/b/c/d");
 
-        Assert.assertTrue(pathParentIterator.hasNext());
-        Assert.assertEquals(pathParentIterator.next(), "/a/b/c/d");
-        Assert.assertFalse(pathParentIterator.atParentPath());
+        assertTrue(pathParentIterator.hasNext());
+        assertEquals(pathParentIterator.next(), "/a/b/c/d");
+        assertFalse(pathParentIterator.atParentPath());
 
-        Assert.assertTrue(pathParentIterator.hasNext());
-        Assert.assertEquals(pathParentIterator.next(), "/a/b/c");
-        Assert.assertTrue(pathParentIterator.atParentPath());
+        assertTrue(pathParentIterator.hasNext());
+        assertEquals(pathParentIterator.next(), "/a/b/c");
+        assertTrue(pathParentIterator.atParentPath());
 
-        Assert.assertTrue(pathParentIterator.hasNext());
-        Assert.assertEquals(pathParentIterator.next(), "/a/b");
-        Assert.assertTrue(pathParentIterator.atParentPath());
+        assertTrue(pathParentIterator.hasNext());
+        assertEquals(pathParentIterator.next(), "/a/b");
+        assertTrue(pathParentIterator.atParentPath());
 
-        Assert.assertTrue(pathParentIterator.hasNext());
-        Assert.assertEquals(pathParentIterator.next(), "/a");
-        Assert.assertTrue(pathParentIterator.atParentPath());
+        assertTrue(pathParentIterator.hasNext());
+        assertEquals(pathParentIterator.next(), "/a");
+        assertTrue(pathParentIterator.atParentPath());
 
-        Assert.assertTrue(pathParentIterator.hasNext());
-        Assert.assertEquals(pathParentIterator.next(), "/");
-        Assert.assertTrue(pathParentIterator.atParentPath());
+        assertTrue(pathParentIterator.hasNext());
+        assertEquals(pathParentIterator.next(), "/");
+        assertTrue(pathParentIterator.atParentPath());
 
-        Assert.assertFalse(pathParentIterator.hasNext());
+        assertFalse(pathParentIterator.hasNext());
     }
 
     @Test
     public void testForPathOnly() {
         PathParentIterator pathParentIterator = PathParentIterator.forPathOnly("/a/b/c/d");
-        Assert.assertTrue(pathParentIterator.hasNext());
-        Assert.assertEquals(pathParentIterator.next(), "/a/b/c/d");
-        Assert.assertFalse(pathParentIterator.atParentPath());
+        assertTrue(pathParentIterator.hasNext());
+        assertEquals(pathParentIterator.next(), "/a/b/c/d");
+        assertFalse(pathParentIterator.atParentPath());
 
-        Assert.assertFalse(pathParentIterator.hasNext());
+        assertFalse(pathParentIterator.hasNext());
     }
 }
\ No newline at end of file
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/RecursiveWatchQtyTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/RecursiveWatchQtyTest.java
index 067cb2af94a..0582ddafc84 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/RecursiveWatchQtyTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/RecursiveWatchQtyTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.server.watch;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.List;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.ExecutorService;
@@ -30,8 +30,8 @@
 import java.util.stream.IntStream;
 import org.apache.zookeeper.WatchedEvent;
 import org.apache.zookeeper.Watcher;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class RecursiveWatchQtyTest {
     private WatchManager watchManager;
@@ -46,33 +46,11 @@ public void process(WatchedEvent event) {
         }
     }
 
-    @Before
+    @BeforeEach
     public void setup() {
         watchManager = new WatchManager();
     }
 
-    @Test
-    public void testRecursiveQty() {
-        WatcherModeManager manager = new WatcherModeManager();
-        DummyWatcher watcher = new DummyWatcher();
-        manager.setWatcherMode(watcher, "/a", WatcherMode.DEFAULT_WATCHER_MODE);
-        assertEquals(0, manager.getRecursiveQty());
-        manager.setWatcherMode(watcher, "/a", WatcherMode.PERSISTENT_RECURSIVE);
-        assertEquals(1, manager.getRecursiveQty());
-        manager.setWatcherMode(watcher, "/a/b", WatcherMode.PERSISTENT_RECURSIVE);
-        assertEquals(2, manager.getRecursiveQty());
-        manager.setWatcherMode(watcher, "/a", WatcherMode.PERSISTENT_RECURSIVE);
-        assertEquals(2, manager.getRecursiveQty());
-        manager.setWatcherMode(watcher, "/a/b", WatcherMode.PERSISTENT);
-        assertEquals(1, manager.getRecursiveQty());
-        manager.setWatcherMode(watcher, "/a/b", WatcherMode.PERSISTENT_RECURSIVE);
-        assertEquals(2, manager.getRecursiveQty());
-        manager.setWatcherMode(watcher, "/a/b", WatcherMode.DEFAULT_WATCHER_MODE);
-        assertEquals(1, manager.getRecursiveQty());
-        manager.setWatcherMode(watcher, "/a", WatcherMode.PERSISTENT);
-        assertEquals(0, manager.getRecursiveQty());
-    }
-
     @Test
     public void testAddRemove() {
         Watcher watcher1 = new DummyWatcher();
@@ -125,7 +103,7 @@ public void testSameWatcherMultiPath() {
     }
 
     @Test
-    public void testChangeType() {
+    public void testDifferentWatchModes() {
         Watcher watcher = new DummyWatcher();
 
         watchManager.addWatch("/a", watcher, WatcherMode.PERSISTENT);
@@ -133,15 +111,14 @@ public void testChangeType() {
         watchManager.addWatch("/a", watcher, WatcherMode.PERSISTENT_RECURSIVE);
         assertEquals(1, watchManager.getRecursiveWatchQty());
         watchManager.addWatch("/a", watcher, WatcherMode.STANDARD);
-        assertEquals(0, watchManager.getRecursiveWatchQty());
+        assertEquals(1, watchManager.getRecursiveWatchQty());
         assertTrue(watchManager.removeWatcher("/a", watcher));
         assertEquals(0, watchManager.getRecursiveWatchQty());
     }
 
     @Test
-    public void testRecursiveQtyConcurrency() {
-        ThreadLocalRandom random = ThreadLocalRandom.current();
-        WatcherModeManager manager = new WatcherModeManager();
+    public void testRecursiveQtyConcurrency() throws Exception {
+        WatchManager manager = new WatchManager();
         ExecutorService threadPool = Executors.newFixedThreadPool(clientQty);
         List<Future<?>> tasks = null;
         CountDownLatch completedLatch = new CountDownLatch(clientQty);
@@ -149,11 +126,7 @@ public void testRecursiveQtyConcurrency() {
             tasks = IntStream.range(0, clientQty)
                     .mapToObj(__ -> threadPool.submit(() -> iterate(manager, completedLatch)))
                     .collect(Collectors.toList());
-            try {
-                completedLatch.await();
-            } catch (InterruptedException e) {
-                Thread.currentThread().interrupt();
-            }
+            completedLatch.await();
         } finally {
             if (tasks != null) {
                 tasks.forEach(t -> t.cancel(true));
@@ -161,14 +134,15 @@ public void testRecursiveQtyConcurrency() {
             threadPool.shutdownNow();
         }
 
-        int expectedRecursiveQty = (int) manager.getWatcherModes().values()
+        int expectedRecursiveQty = (int) manager.getWatch2Paths().values()
                 .stream()
-                .filter(mode -> mode == WatcherMode.PERSISTENT_RECURSIVE)
+                .flatMap(paths -> paths.values().stream())
+                .filter(stats -> stats.hasMode(WatcherMode.PERSISTENT_RECURSIVE))
                 .count();
-        assertEquals(expectedRecursiveQty, manager.getRecursiveQty());
+        assertEquals(expectedRecursiveQty, manager.getRecursiveWatchQty());
     }
 
-    private void iterate(WatcherModeManager manager, CountDownLatch completedLatch) {
+    private void iterate(WatchManager manager, CountDownLatch completedLatch) {
         ThreadLocalRandom random = ThreadLocalRandom.current();
         try {
             for (int i = 0; i < iterations; ++i) {
@@ -176,9 +150,9 @@ private void iterate(WatcherModeManager manager, CountDownLatch completedLatch)
                 boolean doSet = random.nextInt(100) > 33;    // 2/3 will be sets
                 if (doSet) {
                     WatcherMode mode = WatcherMode.values()[random.nextInt(WatcherMode.values().length)];
-                    manager.setWatcherMode(new DummyWatcher(), path, mode);
+                    manager.addWatch(path, new DummyWatcher(), mode);
                 } else {
-                    manager.removeWatcher(new DummyWatcher(), path);
+                    manager.removeWatcher(path, new DummyWatcher());
                 }
 
                 int sleepMillis = random.nextInt(2);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchManagerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchManagerTest.java
index e29dab90649..51bbb94d88a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchManagerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchManagerTest.java
@@ -17,12 +17,12 @@
 
 package org.apache.zookeeper.server.watch;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
 import java.util.ArrayList;
-import java.util.Arrays;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
@@ -30,6 +30,7 @@
 import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.atomic.AtomicInteger;
+import java.util.stream.Stream;
 import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.Watcher.Event.EventType;
 import org.apache.zookeeper.ZKTestCase;
@@ -37,14 +38,15 @@
 import org.apache.zookeeper.server.DumbWatcher;
 import org.apache.zookeeper.server.ServerCnxn;
 import org.apache.zookeeper.server.ServerMetrics;
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-@RunWith(Parameterized.class)
 public class WatchManagerTest extends ZKTestCase {
 
     protected static final Logger LOG = LoggerFactory.getLogger(WatchManagerTest.class);
@@ -53,25 +55,21 @@ public class WatchManagerTest extends ZKTestCase {
 
     private ConcurrentHashMap<Integer, DumbWatcher> watchers;
     private Random r;
-    private String className;
 
-    public WatchManagerTest(String className) {
-        this.className = className;
+    public static Stream<Arguments> data() {
+        return Stream.of(
+            Arguments.of(WatchManager.class.getName()),
+            Arguments.of(WatchManagerOptimized.class.getName()));
     }
 
-    @Parameterized.Parameters
-    public static List<Object[]> data() {
-        return Arrays.asList(new Object[][]{{WatchManager.class.getName()}, {WatchManagerOptimized.class.getName()}});
-    }
-
-    @Before
+    @BeforeEach
     public void setUp() {
         ServerMetrics.getMetrics().resetAll();
-        watchers = new ConcurrentHashMap<Integer, DumbWatcher>();
+        watchers = new ConcurrentHashMap<>();
         r = new Random(System.nanoTime());
     }
 
-    public IWatchManager getWatchManager() throws IOException {
+    public IWatchManager getWatchManager(String className) throws IOException {
         System.setProperty(WatchManagerFactory.ZOOKEEPER_WATCH_MANAGER_NAME, className);
         return WatchManagerFactory.createWatchManager();
     }
@@ -135,7 +133,7 @@ public WatcherTriggerWorker(
         public void run() {
             while (!stopped) {
                 String path = PATH_PREFIX + r.nextInt(paths);
-                WatcherOrBitSet s = manager.triggerWatch(path, EventType.NodeDeleted);
+                WatcherOrBitSet s = manager.triggerWatch(path, EventType.NodeDeleted, -1, null);
                 if (s != null) {
                     triggeredCount.addAndGet(s.size());
                 }
@@ -229,16 +227,18 @@ public void shutdown() {
      * Concurrently add and trigger watch, make sure the watches triggered
      * are the same as the number added.
      */
-    @Test(timeout = 90000)
-    public void testAddAndTriggerWatcher() throws IOException {
-        IWatchManager manager = getWatchManager();
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 90)
+    public void testAddAndTriggerWatcher(String className) throws IOException {
+        IWatchManager manager = getWatchManager(className);
         int paths = 1;
         int watchers = 10000;
 
         // 1. start 5 workers to trigger watchers on that path
         //    count all the watchers have been fired
         AtomicInteger watchTriggered = new AtomicInteger();
-        List<WatcherTriggerWorker> triggerWorkers = new ArrayList<WatcherTriggerWorker>();
+        List<WatcherTriggerWorker> triggerWorkers = new ArrayList<>();
         for (int i = 0; i < 5; i++) {
             WatcherTriggerWorker worker = new WatcherTriggerWorker(manager, paths, watchTriggered);
             triggerWorkers.add(worker);
@@ -248,7 +248,7 @@ public void testAddAndTriggerWatcher() throws IOException {
         // 2. start 5 workers to add different watchers on the same path
         //    count all the watchers being added
         AtomicInteger watchesAdded = new AtomicInteger();
-        List<AddWatcherWorker> addWorkers = new ArrayList<AddWatcherWorker>();
+        List<AddWatcherWorker> addWorkers = new ArrayList<>();
         for (int i = 0; i < 5; i++) {
             AddWatcherWorker worker = new AddWatcherWorker(manager, paths, watchers, watchesAdded);
             addWorkers.add(worker);
@@ -288,16 +288,18 @@ public void testAddAndTriggerWatcher() throws IOException {
      * Concurrently add and remove watch, make sure the watches left +
      * the watches removed are equal to the total added watches.
      */
-    @Test(timeout = 90000)
-    public void testRemoveWatcherOnPath() throws IOException {
-        IWatchManager manager = getWatchManager();
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 90)
+    public void testRemoveWatcherOnPath(String className) throws IOException {
+        IWatchManager manager = getWatchManager(className);
         int paths = 10;
         int watchers = 10000;
 
         // 1. start 5 workers to remove watchers on those path
         //    record the watchers have been removed
         AtomicInteger watchesRemoved = new AtomicInteger();
-        List<RemoveWatcherWorker> removeWorkers = new ArrayList<RemoveWatcherWorker>();
+        List<RemoveWatcherWorker> removeWorkers = new ArrayList<>();
         for (int i = 0; i < 5; i++) {
             RemoveWatcherWorker worker = new RemoveWatcherWorker(manager, paths, watchers, watchesRemoved);
             removeWorkers.add(worker);
@@ -307,7 +309,7 @@ public void testRemoveWatcherOnPath() throws IOException {
         // 2. start 5 workers to add different watchers on different path
         //    record the watchers have been added
         AtomicInteger watchesAdded = new AtomicInteger();
-        List<AddWatcherWorker> addWorkers = new ArrayList<AddWatcherWorker>();
+        List<AddWatcherWorker> addWorkers = new ArrayList<>();
         for (int i = 0; i < 5; i++) {
             AddWatcherWorker worker = new AddWatcherWorker(manager, paths, watchers, watchesAdded);
             addWorkers.add(worker);
@@ -342,23 +344,336 @@ public void testRemoveWatcherOnPath() throws IOException {
         assertEquals(watchesAdded.get(), watchesRemoved.get() + manager.size());
     }
 
+    /**
+     * Test add, contains and remove on generic watch manager.
+     */
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testAddRemoveWatcher(String className) throws IOException {
+        IWatchManager manager = getWatchManager(className);
+        Watcher watcher1 = new DumbWatcher();
+        Watcher watcher2 = new DumbWatcher();
+
+        // given: add watcher1 to "/node1"
+        manager.addWatch("/node1", watcher1);
+
+        // then: contains or remove should fail on mismatch path and watcher pair
+        assertFalse(manager.containsWatcher("/node1", watcher2));
+        assertFalse(manager.containsWatcher("/node2", watcher1));
+        assertFalse(manager.removeWatcher("/node1", watcher2));
+        assertFalse(manager.removeWatcher("/node2", watcher1));
+
+        // then: contains or remove should succeed on matching path and watcher pair
+        assertTrue(manager.containsWatcher("/node1", watcher1));
+        assertTrue(manager.removeWatcher("/node1", watcher1));
+
+        // then: contains or remove should fail on removed path and watcher pair
+        assertFalse(manager.containsWatcher("/node1", watcher1));
+        assertFalse(manager.removeWatcher("/node1", watcher1));
+    }
+
+    /**
+     * Test containsWatcher on all pairs, and removeWatcher on mismatch pairs.
+     */
+    @Test
+    public void testContainsMode() {
+        IWatchManager manager = new WatchManager();
+        Watcher watcher1 = new DumbWatcher();
+        Watcher watcher2 = new DumbWatcher();
+
+        // given: add watcher1 to "/node1" in persistent mode
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertNotEquals(WatcherMode.PERSISTENT, WatcherMode.DEFAULT_WATCHER_MODE);
+
+        // then: contains should succeed on watcher1 to "/node1" in persistent and any mode
+        assertTrue(manager.containsWatcher("/node1", watcher1));
+        assertTrue(manager.containsWatcher("/node1", watcher1, null));
+        assertTrue(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+
+        // then: contains and remove should fail on mismatch watcher
+        assertFalse(manager.containsWatcher("/node1", watcher2));
+        assertFalse(manager.containsWatcher("/node1", watcher2, null));
+        assertFalse(manager.containsWatcher("/node1", watcher2, WatcherMode.STANDARD));
+        assertFalse(manager.containsWatcher("/node1", watcher2, WatcherMode.PERSISTENT));
+        assertFalse(manager.containsWatcher("/node1", watcher2, WatcherMode.PERSISTENT_RECURSIVE));
+        assertFalse(manager.removeWatcher("/node1", watcher2));
+        assertFalse(manager.removeWatcher("/node1", watcher2, null));
+        assertFalse(manager.removeWatcher("/node1", watcher2, WatcherMode.STANDARD));
+        assertFalse(manager.removeWatcher("/node1", watcher2, WatcherMode.PERSISTENT));
+        assertFalse(manager.removeWatcher("/node1", watcher2, WatcherMode.PERSISTENT_RECURSIVE));
+
+        // then: contains and remove should fail on mismatch path
+        assertFalse(manager.containsWatcher("/node2", watcher1));
+        assertFalse(manager.containsWatcher("/node2", watcher1, null));
+        assertFalse(manager.containsWatcher("/node2", watcher1, WatcherMode.STANDARD));
+        assertFalse(manager.containsWatcher("/node2", watcher1, WatcherMode.PERSISTENT));
+        assertFalse(manager.containsWatcher("/node2", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+        assertFalse(manager.removeWatcher("/node2", watcher1));
+        assertFalse(manager.removeWatcher("/node2", watcher1, null));
+        assertFalse(manager.removeWatcher("/node2", watcher1, WatcherMode.STANDARD));
+        assertFalse(manager.removeWatcher("/node2", watcher1, WatcherMode.PERSISTENT));
+        assertFalse(manager.removeWatcher("/node2", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+
+        // then: contains and remove should fail on mismatch modes
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.STANDARD));
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.STANDARD));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+
+        // when: add watcher1 to "/node1" in remaining modes
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.STANDARD));
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+
+        // then: contains should succeed on watcher to "/node1" in all modes
+        assertTrue(manager.containsWatcher("/node1", watcher1));
+        assertTrue(manager.containsWatcher("/node1", watcher1, null));
+        assertTrue(manager.containsWatcher("/node1", watcher1, WatcherMode.STANDARD));
+        assertTrue(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertTrue(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+    }
+
+    /**
+     * Test repeatedly {@link WatchManager#addWatch(String, Watcher, WatcherMode)}.
+     */
+    @Test
+    public void testAddModeRepeatedly() {
+        IWatchManager manager = new WatchManager();
+        Watcher watcher1 = new DumbWatcher();
+
+        // given: add watcher1 to "/node1" in all modes
+        manager.addWatch("/node1", watcher1, WatcherMode.STANDARD);
+        manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT);
+        manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE);
+
+        // when: add watcher1 to "/node1" in these modes repeatedly
+        assertFalse(manager.addWatch("/node1", watcher1, WatcherMode.STANDARD));
+        assertFalse(manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertFalse(manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+
+        // then: contains and remove should work normally on watcher1 to "/node1"
+        assertTrue(manager.containsWatcher("/node1", watcher1));
+        assertTrue(manager.containsWatcher("/node1", watcher1, null));
+        assertTrue(manager.containsWatcher("/node1", watcher1, WatcherMode.STANDARD));
+        assertTrue(manager.removeWatcher("/node1", watcher1, WatcherMode.STANDARD));
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.STANDARD));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.STANDARD));
+
+        assertTrue(manager.containsWatcher("/node1", watcher1));
+        assertTrue(manager.containsWatcher("/node1", watcher1, null));
+        assertTrue(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertTrue(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+
+        assertTrue(manager.containsWatcher("/node1", watcher1));
+        assertTrue(manager.containsWatcher("/node1", watcher1, null));
+        assertTrue(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+        assertTrue(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+
+        assertFalse(manager.containsWatcher("/node1", watcher1));
+        assertFalse(manager.containsWatcher("/node1", watcher1, null));
+        assertFalse(manager.removeWatcher("/node1", watcher1));
+        assertFalse(manager.removeWatcher("/node1", watcher1, null));
+    }
+
+    /**
+     * Test {@link WatchManager#removeWatcher(String, Watcher, WatcherMode)} on one pair should not break others.
+     */
+    @Test
+    public void testRemoveModeOne() {
+        IWatchManager manager = new WatchManager();
+        Watcher watcher1 = new DumbWatcher();
+        Watcher watcher2 = new DumbWatcher();
+
+        // given: add watcher1 to "/node1" and watcher2 to "/node2" in all modes
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.STANDARD));
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+        assertTrue(manager.addWatch("/node2", watcher2, WatcherMode.STANDARD));
+        assertTrue(manager.addWatch("/node2", watcher2, WatcherMode.PERSISTENT));
+        assertTrue(manager.addWatch("/node2", watcher2, WatcherMode.PERSISTENT_RECURSIVE));
+
+        // when: remove one pair
+        assertTrue(manager.removeWatcher("/node1", watcher1, WatcherMode.STANDARD));
+
+        // then: contains and remove should succeed on other pairs
+        assertTrue(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertTrue(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+        assertTrue(manager.containsWatcher("/node2", watcher2, WatcherMode.STANDARD));
+        assertTrue(manager.containsWatcher("/node2", watcher2, WatcherMode.PERSISTENT));
+        assertTrue(manager.containsWatcher("/node2", watcher2, WatcherMode.PERSISTENT_RECURSIVE));
+        assertTrue(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertTrue(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+        assertTrue(manager.removeWatcher("/node2", watcher2, WatcherMode.STANDARD));
+        assertTrue(manager.removeWatcher("/node2", watcher2, WatcherMode.PERSISTENT));
+        assertTrue(manager.removeWatcher("/node2", watcher2, WatcherMode.PERSISTENT_RECURSIVE));
+    }
+
+    /**
+     * Test {@link WatchManager#removeWatcher(String, Watcher, WatcherMode)} with {@code null} watcher mode.
+     */
+    @Test
+    public void testRemoveModeAll() {
+        IWatchManager manager = new WatchManager();
+        Watcher watcher1 = new DumbWatcher();
+
+        // given: add watcher1 to "/node1" in all modes
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.STANDARD));
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+
+        // when: remove watcher1 using null watcher mode
+        assertTrue(manager.removeWatcher("/node1", watcher1, null));
+
+        // then: contains and remove should fail on watcher1 to "/node1" in all modes
+        assertFalse(manager.containsWatcher("/node1", watcher1));
+        assertFalse(manager.containsWatcher("/node1", watcher1, null));
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.STANDARD));
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+        assertFalse(manager.removeWatcher("/node1", watcher1));
+        assertFalse(manager.removeWatcher("/node1", watcher1, null));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.STANDARD));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+
+        // given: add watcher1 to "/node1" in all modes
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.STANDARD));
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+
+        // then: remove watcher1 without a mode should behave same to removing all modes
+        assertTrue(manager.removeWatcher("/node1", watcher1));
+
+        assertFalse(manager.containsWatcher("/node1", watcher1));
+        assertFalse(manager.containsWatcher("/node1", watcher1, null));
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.STANDARD));
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+        assertFalse(manager.removeWatcher("/node1", watcher1));
+        assertFalse(manager.removeWatcher("/node1", watcher1, null));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.STANDARD));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+    }
+
+    /**
+     * Test {@link WatchManager#removeWatcher(String, Watcher)}.
+     */
+    @Test
+    public void testRemoveModeAllDefault() {
+        IWatchManager manager = new WatchManager();
+        Watcher watcher1 = new DumbWatcher();
+
+        // given: add watcher1 to "/node1" in all modes
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.STANDARD));
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+
+        // then: remove watcher1 without a mode should behave same to removing all modes
+        assertTrue(manager.removeWatcher("/node1", watcher1));
+
+        assertFalse(manager.containsWatcher("/node1", watcher1));
+        assertFalse(manager.containsWatcher("/node1", watcher1, null));
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.STANDARD));
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+        assertFalse(manager.removeWatcher("/node1", watcher1));
+        assertFalse(manager.removeWatcher("/node1", watcher1, null));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.STANDARD));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+    }
+
+    /**
+     * Test {@link WatchManager#removeWatcher(String, Watcher, WatcherMode)} all modes individually.
+     */
+    @Test
+    public void testRemoveModeAllIndividually() {
+        IWatchManager manager = new WatchManager();
+        Watcher watcher1 = new DumbWatcher();
+
+        // given: add watcher1 to "/node1" in all modes
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.STANDARD));
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+
+        // when: remove all modes individually
+        assertTrue(manager.removeWatcher("/node1", watcher1, WatcherMode.STANDARD));
+        assertTrue(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertTrue(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+
+        // then: contains and remove should fail on watcher1 to "/node1" in all modes
+        assertFalse(manager.containsWatcher("/node1", watcher1));
+        assertFalse(manager.containsWatcher("/node1", watcher1, null));
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.STANDARD));
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertFalse(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+        assertFalse(manager.removeWatcher("/node1", watcher1));
+        assertFalse(manager.removeWatcher("/node1", watcher1, null));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.STANDARD));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertFalse(manager.removeWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+    }
+
+    /**
+     * Test {@link WatchManager#removeWatcher(String, Watcher, WatcherMode)} on mismatch pair should break nothing.
+     */
+    @Test
+    public void testRemoveModeMismatch() {
+        IWatchManager manager = new WatchManager();
+        Watcher watcher1 = new DumbWatcher();
+        Watcher watcher2 = new DumbWatcher();
+
+        // given: add watcher1 to "/node1" and watcher2 to "/node2" in all modes
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.STANDARD));
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertTrue(manager.addWatch("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+        assertTrue(manager.addWatch("/node2", watcher2, WatcherMode.STANDARD));
+        assertTrue(manager.addWatch("/node2", watcher2, WatcherMode.PERSISTENT));
+        assertTrue(manager.addWatch("/node2", watcher2, WatcherMode.PERSISTENT_RECURSIVE));
+
+        // when: remove mismatch path and watcher pairs
+        assertFalse(manager.removeWatcher("/node1", watcher2));
+        assertFalse(manager.removeWatcher("/node1", watcher2, null));
+        assertFalse(manager.removeWatcher("/node1", watcher2, WatcherMode.STANDARD));
+        assertFalse(manager.removeWatcher("/node1", watcher2, WatcherMode.PERSISTENT));
+        assertFalse(manager.removeWatcher("/node1", watcher2, WatcherMode.PERSISTENT_RECURSIVE));
+
+        // then: no existing watching pairs should break
+        assertTrue(manager.containsWatcher("/node1", watcher1));
+        assertTrue(manager.containsWatcher("/node1", watcher1, null));
+        assertTrue(manager.containsWatcher("/node1", watcher1, WatcherMode.STANDARD));
+        assertTrue(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT));
+        assertTrue(manager.containsWatcher("/node1", watcher1, WatcherMode.PERSISTENT_RECURSIVE));
+        assertTrue(manager.containsWatcher("/node2", watcher2));
+        assertTrue(manager.containsWatcher("/node2", watcher2, null));
+        assertTrue(manager.containsWatcher("/node2", watcher2, WatcherMode.STANDARD));
+        assertTrue(manager.containsWatcher("/node2", watcher2, WatcherMode.PERSISTENT));
+        assertTrue(manager.containsWatcher("/node2", watcher2, WatcherMode.PERSISTENT_RECURSIVE));
+    }
+
     /**
      * Concurrently add watch while close the watcher to simulate the
      * client connections closed on prod.
      */
-    @Test(timeout = 90000)
-    public void testDeadWatchers() throws IOException {
+    @ParameterizedTest
+    @MethodSource("data")
+    @Timeout(value = 90)
+    public void testDeadWatchers(String className) throws IOException {
         System.setProperty("zookeeper.watcherCleanThreshold", "10");
         System.setProperty("zookeeper.watcherCleanIntervalInSeconds", "1");
 
-        IWatchManager manager = getWatchManager();
+        IWatchManager manager = getWatchManager(className);
         int paths = 1;
         int watchers = 100000;
 
         // 1. start 5 workers to randomly mark those watcher as dead
         //    and remove them from watch manager
-        Set<Watcher> deadWatchers = new HashSet<Watcher>();
-        List<CreateDeadWatchersWorker> deadWorkers = new ArrayList<CreateDeadWatchersWorker>();
+        Set<Watcher> deadWatchers = new HashSet<>();
+        List<CreateDeadWatchersWorker> deadWorkers = new ArrayList<>();
         for (int i = 0; i < 5; i++) {
             CreateDeadWatchersWorker worker = new CreateDeadWatchersWorker(manager, watchers, deadWatchers);
             deadWorkers.add(worker);
@@ -367,7 +682,7 @@ public void testDeadWatchers() throws IOException {
 
         // 2. start 5 workers to add different watchers on the same path
         AtomicInteger watchesAdded = new AtomicInteger();
-        List<AddWatcherWorker> addWorkers = new ArrayList<AddWatcherWorker>();
+        List<AddWatcherWorker> addWorkers = new ArrayList<>();
         for (int i = 0; i < 5; i++) {
             AddWatcherWorker worker = new AddWatcherWorker(manager, paths, watchers, watchesAdded);
             addWorkers.add(worker);
@@ -414,9 +729,16 @@ private void checkMetrics(String metricName, long min, long max, double avg, lon
         assertEquals(sum, values.get("sum_" + metricName));
     }
 
-    @Test
-    public void testWatcherMetrics() throws IOException {
-        IWatchManager manager = getWatchManager();
+    private void checkMostRecentWatchedEvent(DumbWatcher watcher, String path, EventType eventType, long zxid) {
+        assertEquals(path, watcher.getMostRecentPath());
+        assertEquals(eventType, watcher.getMostRecentEventType());
+        assertEquals(zxid, watcher.getMostRecentZxid());
+    }
+
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testWatcherMetrics(String className) throws IOException {
+        IWatchManager manager = getWatchManager(className);
         ServerMetrics.getMetrics().resetAll();
 
         DumbWatcher watcher1 = new DumbWatcher(1);
@@ -427,41 +749,54 @@ public void testWatcherMetrics() throws IOException {
 
         final String path3 = "/path3";
 
-        //both wather1 and wather2 are watching path1
+        //both watcher1 and watcher2 are watching path1
         manager.addWatch(path1, watcher1);
         manager.addWatch(path1, watcher2);
 
         //path2 is watched by watcher1
         manager.addWatch(path2, watcher1);
 
-        manager.triggerWatch(path3, EventType.NodeCreated);
+        manager.triggerWatch(path3, EventType.NodeCreated, 1, null);
         //path3 is not being watched so metric is 0
         checkMetrics("node_created_watch_count", 0L, 0L, 0D, 0L, 0L);
+        // Watchers shouldn't have received any events yet so the zxid should be -1.
+        checkMostRecentWatchedEvent(watcher1, null, null, -1);
+        checkMostRecentWatchedEvent(watcher2, null, null, -1);
 
         //path1 is watched by two watchers so two fired
-        manager.triggerWatch(path1, EventType.NodeCreated);
+        manager.triggerWatch(path1, EventType.NodeCreated, 2, null);
         checkMetrics("node_created_watch_count", 2L, 2L, 2D, 1L, 2L);
+        checkMostRecentWatchedEvent(watcher1, path1, EventType.NodeCreated, 2);
+        checkMostRecentWatchedEvent(watcher2, path1, EventType.NodeCreated, 2);
 
         //path2 is watched by one watcher so one fired now total is 3
-        manager.triggerWatch(path2, EventType.NodeCreated);
+        manager.triggerWatch(path2, EventType.NodeCreated, 3, null);
         checkMetrics("node_created_watch_count", 1L, 2L, 1.5D, 2L, 3L);
+        checkMostRecentWatchedEvent(watcher1, path2, EventType.NodeCreated, 3);
+        checkMostRecentWatchedEvent(watcher2, path1, EventType.NodeCreated, 2);
 
         //watches on path1 are no longer there so zero fired
-        manager.triggerWatch(path1, EventType.NodeDataChanged);
+        manager.triggerWatch(path1, EventType.NodeDataChanged, 4, null);
         checkMetrics("node_changed_watch_count", 0L, 0L, 0D, 0L, 0L);
+        checkMostRecentWatchedEvent(watcher1, path2, EventType.NodeCreated, 3);
+        checkMostRecentWatchedEvent(watcher2, path1, EventType.NodeCreated, 2);
 
-        //both wather1 and wather2 are watching path1
+        //both watcher and watcher are watching path1
         manager.addWatch(path1, watcher1);
         manager.addWatch(path1, watcher2);
 
         //path2 is watched by watcher1
         manager.addWatch(path2, watcher1);
 
-        manager.triggerWatch(path1, EventType.NodeDataChanged);
+        manager.triggerWatch(path1, EventType.NodeDataChanged, 5, null);
         checkMetrics("node_changed_watch_count", 2L, 2L, 2D, 1L, 2L);
+        checkMostRecentWatchedEvent(watcher1, path1, EventType.NodeDataChanged, 5);
+        checkMostRecentWatchedEvent(watcher2, path1, EventType.NodeDataChanged, 5);
 
-        manager.triggerWatch(path2, EventType.NodeDeleted);
+        manager.triggerWatch(path2, EventType.NodeDeleted, 6, null);
         checkMetrics("node_deleted_watch_count", 1L, 1L, 1D, 1L, 1L);
+        checkMostRecentWatchedEvent(watcher1, path2, EventType.NodeDeleted, 6);
+        checkMostRecentWatchedEvent(watcher2, path1, EventType.NodeDataChanged, 5);
 
         //make sure that node created watch count is not impacted by the fire of other event types
         checkMetrics("node_created_watch_count", 1L, 2L, 1.5D, 2L, 3L);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatcherCleanerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatcherCleanerTest.java
index 5152b5eb27a..3320f1a247c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatcherCleanerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatcherCleanerTest.java
@@ -17,11 +17,11 @@
 
 package org.apache.zookeeper.server.watch;
 
-import static org.hamcrest.number.OrderingComparison.greaterThan;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertThat;
-import static org.junit.Assert.assertTrue;
+import static org.hamcrest.Matchers.greaterThan;
+import static org.hamcrest.Matchers.is;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.HashSet;
 import java.util.Map;
 import java.util.Set;
@@ -31,7 +31,7 @@
 import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.metrics.MetricsUtils;
 import org.apache.zookeeper.server.ServerMetrics;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -43,7 +43,7 @@ public static class MyDeadWatcherListener implements IDeadWatcherListener {
 
         private CountDownLatch latch;
         private int delayMs;
-        private Set<Integer> deadWatchers = new HashSet<Integer>();
+        private Set<Integer> deadWatchers = new HashSet<>();
 
         public void setCountDownLatch(CountDownLatch latch) {
             this.latch = latch;
@@ -140,7 +140,7 @@ public void testMaxInProcessingDeadWatchers() {
     }
 
     @Test
-    public void testDeadWatcherMetrics() {
+    public void testDeadWatcherMetrics() throws InterruptedException {
         ServerMetrics.getMetrics().resetAll();
         MyDeadWatcherListener listener = new MyDeadWatcherListener();
         WatcherCleaner cleaner = new WatcherCleaner(listener, 1, 1, 1, 1);
@@ -156,19 +156,19 @@ public void testDeadWatcherMetrics() {
         assertTrue(listener.wait(5000));
 
         Map<String, Object> values = MetricsUtils.currentServerMetrics();
-        assertThat("Adding dead watcher should be stalled twice", (Long) values.get("add_dead_watcher_stall_time"), greaterThan(0L));
-        assertEquals("Total dead watchers added to the queue should be 3", 3L, values.get("dead_watchers_queued"));
-        assertEquals("Total dead watchers cleared should be 3", 3L, values.get("dead_watchers_cleared"));
-
-        assertEquals(3L, values.get("cnt_dead_watchers_cleaner_latency"));
+        // Adding dead watcher should be stalled twice
+        waitForMetric("add_dead_watcher_stall_time", greaterThan(0L));
+        waitForMetric("dead_watchers_queued", is(3L));
+        waitForMetric("dead_watchers_cleared", is(3L));
+        waitForMetric("cnt_dead_watchers_cleaner_latency", is(3L));
 
         //Each latency should be a little over 20 ms, allow 5 ms deviation
-        assertEquals(20D, (Double) values.get("avg_dead_watchers_cleaner_latency"), 5);
-        assertEquals(20D, ((Long) values.get("min_dead_watchers_cleaner_latency")).doubleValue(), 5);
-        assertEquals(20D, ((Long) values.get("max_dead_watchers_cleaner_latency")).doubleValue(), 5);
-        assertEquals(20D, ((Long) values.get("p50_dead_watchers_cleaner_latency")).doubleValue(), 5);
-        assertEquals(20D, ((Long) values.get("p95_dead_watchers_cleaner_latency")).doubleValue(), 5);
-        assertEquals(20D, ((Long) values.get("p99_dead_watchers_cleaner_latency")).doubleValue(), 5);
+        waitForMetric("avg_dead_watchers_cleaner_latency", closeTo(20, 5));
+        waitForMetric("min_dead_watchers_cleaner_latency", closeTo(20, 5));
+        waitForMetric("max_dead_watchers_cleaner_latency", closeTo(20, 5));
+        waitForMetric("p50_dead_watchers_cleaner_latency", closeTo(20, 5));
+        waitForMetric("p95_dead_watchers_cleaner_latency", closeTo(20, 5));
+        waitForMetric("p99_dead_watchers_cleaner_latency", closeTo(20, 5));
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatcherOrBitSetTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatcherOrBitSetTest.java
index ee105dfa650..6e4220a77bd 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatcherOrBitSetTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatcherOrBitSetTest.java
@@ -17,22 +17,22 @@
 
 package org.apache.zookeeper.server.watch;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.HashSet;
 import java.util.Set;
 import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.server.DumbWatcher;
 import org.apache.zookeeper.server.util.BitHashSet;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class WatcherOrBitSetTest extends ZKTestCase {
 
     @Test
     public void testWatcherSet() {
-        Set<Watcher> wset = new HashSet<Watcher>();
+        Set<Watcher> wset = new HashSet<>();
         WatcherOrBitSet hashSet = new WatcherOrBitSet(wset);
         assertEquals(0, hashSet.size());
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchesPathReportTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchesPathReportTest.java
index 123b49bd595..37efedab9b1 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchesPathReportTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchesPathReportTest.java
@@ -17,30 +17,30 @@
 
 package org.apache.zookeeper.server.watch;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.Map;
 import java.util.Set;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class WatchesPathReportTest extends ZKTestCase {
 
     private Map<String, Set<Long>> m;
     private WatchesPathReport r;
-    @Before
+    @BeforeEach
     public void setUp() {
         m = new HashMap<String, Set<Long>>();
-        Set<Long> s = new HashSet<Long>();
+        Set<Long> s = new HashSet<>();
         s.add(101L);
         s.add(102L);
         m.put("path1", s);
-        s = new HashSet<Long>();
+        s = new HashSet<>();
         s.add(201L);
         m.put("path2", s);
         r = new WatchesPathReport(m);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchesReportTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchesReportTest.java
index 05c0547d93b..3b0d0e2ae07 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchesReportTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchesReportTest.java
@@ -17,30 +17,30 @@
 
 package org.apache.zookeeper.server.watch;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.Map;
 import java.util.Set;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class WatchesReportTest extends ZKTestCase {
 
     private Map<Long, Set<String>> m;
     private WatchesReport r;
-    @Before
+    @BeforeEach
     public void setUp() {
         m = new HashMap<Long, Set<String>>();
-        Set<String> s = new HashSet<String>();
+        Set<String> s = new HashSet<>();
         s.add("path1a");
         s.add("path1b");
         m.put(1L, s);
-        s = new HashSet<String>();
+        s = new HashSet<>();
         s.add("path2a");
         m.put(2L, s);
         r = new WatchesReport(m);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchesSummaryTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchesSummaryTest.java
index 9d53281ed3b..e1ac736148b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchesSummaryTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/watch/WatchesSummaryTest.java
@@ -17,16 +17,16 @@
 
 package org.apache.zookeeper.server.watch;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.util.Map;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class WatchesSummaryTest extends ZKTestCase {
 
     private WatchesSummary s;
-    @Before
+    @BeforeEach
     public void setUp() {
         s = new WatchesSummary(1, 2, 3);
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLCountTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLCountTest.java
index 6b8f9ff3885..a81f4f1bb00 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLCountTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLCountTest.java
@@ -19,8 +19,8 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.util.ArrayList;
 import java.util.List;
@@ -35,7 +35,8 @@
 import org.apache.zookeeper.server.ServerCnxnFactory;
 import org.apache.zookeeper.server.SyncRequestProcessor;
 import org.apache.zookeeper.server.ZooKeeperServer;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -58,8 +59,7 @@ public class ACLCountTest extends ZKTestCase {
      * since there are only 2 *unique* ACL values.
      */
     @Test
-    public void testAclCount() throws Exception {
-        File tmpDir = ClientBase.createTmpDir();
+    public void testAclCount(@TempDir File tmpDir) throws Exception {
         ClientBase.setupTestEnv();
         ZooKeeperServer zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
         SyncRequestProcessor.setSnapCount(1000);
@@ -79,7 +79,7 @@ public void testAclCount() throws Exception {
 
         try {
             LOG.info("starting up the zookeeper server .. waiting");
-            assertTrue("waiting for server being up", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up");
             zk = ClientBase.createZKClient(HOSTPORT);
 
             zk.addAuthInfo("digest", "pat:test".getBytes());
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLRootTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLRootTest.java
index 3f4b9d40a32..256dd1b82d3 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLRootTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLRootTest.java
@@ -18,12 +18,12 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class ACLRootTest extends ClientBase {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLTest.java
index df94e3a18a2..d1f7c00de2c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ACLTest.java
@@ -19,30 +19,43 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
 import java.util.List;
+import java.util.Properties;
 import java.util.concurrent.CountDownLatch;
 import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.KeeperException.InvalidACLException;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.WatchedEvent;
 import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.Watcher.Event.KeeperState;
 import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooDefs.Ids;
+import org.apache.zookeeper.ZooDefs.Perms;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Id;
+import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.server.ServerCnxn;
 import org.apache.zookeeper.server.ServerCnxnFactory;
 import org.apache.zookeeper.server.SyncRequestProcessor;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.auth.IPAuthenticationProvider;
-import org.junit.Test;
+import org.apache.zookeeper.server.embedded.ZooKeeperServerEmbedded;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -55,19 +68,50 @@ public class ACLTest extends ZKTestCase implements Watcher {
     @Test
     public void testIPAuthenticationIsValidCIDR() throws Exception {
         IPAuthenticationProvider prov = new IPAuthenticationProvider();
-        assertTrue("testing no netmask", prov.isValid("127.0.0.1"));
-        assertTrue("testing single ip netmask", prov.isValid("127.0.0.1/32"));
-        assertTrue("testing lowest netmask possible", prov.isValid("127.0.0.1/0"));
-        assertFalse("testing netmask too high", prov.isValid("127.0.0.1/33"));
-        assertFalse("testing netmask too low", prov.isValid("10.0.0.1/-1"));
+        assertTrue(prov.isValid("127.0.0.1"), "testing no netmask");
+        assertTrue(prov.isValid("127.0.0.1/32"), "testing single ip netmask");
+        assertTrue(prov.isValid("127.0.0.1/0"), "testing lowest netmask possible");
+        assertFalse(prov.isValid("127.0.0.1/33"), "testing netmask too high");
+        assertFalse(prov.isValid("10.0.0.1/-1"), "testing netmask too low");
     }
 
     @Test
-    public void testNettyIpAuthDefault() throws Exception {
+    public void testIPAuthenticationIsValidIpv6CIDR() throws Exception {
+        IPAuthenticationProvider prov = new IPAuthenticationProvider();
+        assertTrue(prov.isValid("2001:0db8:85a3:0000:0000:8a2e:0370:7334"), "full address no netmask");
+        assertTrue(prov.isValid("2001:db8:85a3::8a2e:370:7334"), "compressed zeros");
+        assertTrue(prov.isValid("::1"), "loopback with compression");
+        assertTrue(prov.isValid("1::"), "Start with compression");
+        assertTrue(prov.isValid("2001:db8::/4"), "end with compression");
+        assertTrue(prov.isValid("0:0:0:0:0:0:0::/8"), "all zeros");
+        assertTrue(prov.isValid("2001:db8:85a3:0:0:0:0::/32"), "Explicit zeros");
+        assertTrue(prov.isValid("1234:5678:9abc:def0:1234:5678:9abc:def0"), "max hex value");
+        assertFalse(prov.isValid("2001:db8:85a3:0000:0000:8a2e:0370:7334:extra"), "too many address segments");
+        assertFalse(prov.isValid("2001:db8:85a3:0000:0000:8a2e:0370"), "too few address segments");
+        assertFalse(prov.isValid("2001:db8:85a3::8a2e::0370:7334"), "multiple '::' not valid");
+        assertFalse(prov.isValid("2001:db8:85a3:G::8a2e:0370:7334"), "Invalid hex character");
+        assertFalse(prov.isValid(""), "empty string");
+        assertFalse(prov.isValid("2001:db8:85a3:0:0:0:0:1:2"), "too many segments post compression");
+        assertFalse(prov.isValid("2001:db8:85a3::8a2e:0370:7334:"), "trailing colon");
+        assertFalse(prov.isValid(":2001:db8:85a3::8a2e:0370:7334"), "Leading colon");
+        assertFalse(prov.isValid("::FFFF:192.168.1.1"), "IPv4-mapped");
+        assertTrue(prov.isValid("2001:db8:1234::/64"), "IPv6 address for multiple clients");
+    }
+
+    @Test
+    public void testIPAuthenticationIsValidIpv6Mask() throws Exception {
+        IPAuthenticationProvider prov = new IPAuthenticationProvider();
+        assertTrue(prov.matches("2001:db8:1234::", "2001:db8:1234::/64"));
+        assertTrue(prov.matches("2001:0db8:85a3:0000:0000:8a2e:0370:7334", "2001:0db8:85a3:0000:0000:8a2e:0370::/2"));
+        assertFalse(prov.matches("22001:db8:85a3:0:0:0:0::0", "2001:db8:85a3:0:0:0:0::/32"));
+        assertFalse(prov.matches("2001:db8::/4", "2001:db8::/4"));
+    }
+
+    @Test
+    public void testNettyIpAuthDefault(@TempDir File tmpDir) throws Exception {
         String HOSTPORT = "127.0.0.1:" + PortAssignment.unique();
         System.setProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY, "org.apache.zookeeper.server.NettyServerCnxnFactory");
         ClientBase.setupTestEnv();
-        File tmpDir = ClientBase.createTmpDir();
         ZooKeeperServer zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
         SyncRequestProcessor.setSnapCount(1000);
         final int PORT = Integer.parseInt(HOSTPORT.split(":")[1]);
@@ -75,7 +119,7 @@ public void testNettyIpAuthDefault() throws Exception {
         f.startup(zks);
         try {
             LOG.info("starting up the zookeeper server .. waiting");
-            assertTrue("waiting for server being up", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up");
             ClientBase.createZKClient(HOSTPORT);
             for (ServerCnxn cnxn : f.getConnections()) {
                 boolean foundID = false;
@@ -90,14 +134,139 @@ public void testNettyIpAuthDefault() throws Exception {
         } finally {
             f.shutdown();
             zks.shutdown();
-            assertTrue("waiting for server down", ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server down");
             System.clearProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY);
         }
     }
 
     @Test
-    public void testDisconnectedAddAuth() throws Exception {
-        File tmpDir = ClientBase.createTmpDir();
+    public void testAuthWithIPV6Server(@TempDir File tmpDir) throws Exception {
+        Properties properties = new Properties();
+        properties.setProperty("clientPortAddress", "::1");
+        properties.setProperty("clientPort", "0");
+
+        ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded.builder()
+            .baseDir(tmpDir.toPath())
+            .configuration(properties)
+            .build();
+        server.start();
+
+        String connectionString = server.getConnectionString();
+        String port = connectionString.substring(connectionString.lastIndexOf(':') + 1);
+
+        String hostport = String.format("[::1]:%s", port);
+        assertTrue(ClientBase.waitForServerUp(hostport, CONNECTION_TIMEOUT), "waiting for server being up");
+
+        // given: ipv6 client
+        ZooKeeper zk = ClientBase.createZKClient(hostport);
+
+        // when: invalid ipv6 network acl
+        // then: InvalidACL
+        assertThrows(KeeperException.InvalidACLException.class, () ->
+            zk.create("/invalid-ipv6-network-acl", null, Collections.singletonList(new ACL(Perms.ALL, new Id("ip", "::1/256"))), CreateMode.PERSISTENT));
+
+        // given: ipv4 network acl
+        zk.create("/unmatched-ipv4-network-acl", null, Collections.singletonList(new ACL(Perms.ALL, new Id("ip", "127.0.0.1/16"))), CreateMode.PERSISTENT);
+        // when: access with v6 ip
+        // then: NoAuth
+        assertThrows(KeeperException.NoAuthException.class, () -> zk.setData("/unmatched-ipv4-network-acl", null, -1));
+
+        // given: prefix matched ipv4 acl
+        zk.create("/prefix-matched-ipv4-acl", null, Collections.singletonList(new ACL(Perms.ALL, new Id("ip", "0.0.0.1/16"))), CreateMode.PERSISTENT);
+        // when: access with v6 ip
+        // then: NoAuth
+        assertThrows(KeeperException.NoAuthException.class, () -> zk.setData("/prefix-matched-ipv4-acl", null, -1));
+
+        // given: ipv6 with network acl
+        zk.create("/ipv6-network-acl", null, Collections.singletonList(new ACL(Perms.ALL, new Id("ip", "::1/64"))), CreateMode.PERSISTENT);
+        // when: access with valid ip
+        // then: ok
+        zk.setData("/ipv6-network-acl", null, -1);
+
+        // given: ipv6 acl
+        zk.create("/ipv6-acl", null, Collections.singletonList(new ACL(Perms.ALL, new Id("ip", "::1"))), CreateMode.PERSISTENT);
+        // when: access with valid ip
+        // then: ok
+        zk.setData("/ipv6-acl", null, -1);
+
+        // given: mismatched ipv6 with network acl
+        zk.create("/mismatched-ipv6-network-acl", null, Collections.singletonList(new ACL(Perms.ALL, new Id("ip", "0000:0001::/32"))), CreateMode.PERSISTENT);
+        // when: access with invalid ip
+        // then: NoAuth
+        assertThrows(KeeperException.NoAuthException.class, () -> zk.setData("/mismatched-ipv6-network-acl", null, -1));
+
+        // given: mismatched ipv6 acl
+        zk.create("/mismatched-ipv6-acl", null, Collections.singletonList(new ACL(Perms.ALL, new Id("ip", "::2"))), CreateMode.PERSISTENT);
+        // when: access with invalid ip
+        // then: NoAuth
+        assertThrows(KeeperException.NoAuthException.class, () -> zk.setData("/mismatched-ipv6-acl", null, -1));
+
+        server.close();
+    }
+
+    @Test
+    public void testAuthWithIPV4Server(@TempDir File tmpDir) throws Exception {
+        Properties properties = new Properties();
+        properties.setProperty("clientPortAddress", "127.0.0.1");
+        properties.setProperty("clientPort", "0");
+
+        ZooKeeperServerEmbedded server = ZooKeeperServerEmbedded.builder()
+            .baseDir(tmpDir.toPath())
+            .configuration(properties)
+            .build();
+        server.start();
+
+        assertTrue(ClientBase.waitForServerUp(server.getConnectionString(), CONNECTION_TIMEOUT), "waiting for server being up");
+
+        // given: ipv4 client
+        ZooKeeper zk = ClientBase.createZKClient(server.getConnectionString());
+
+        // when: invalid ipv4 network acl
+        // then: InvalidACL
+        assertThrows(KeeperException.InvalidACLException.class, () ->
+            zk.create("/invalid-ipv4-network-acl", new byte[]{}, Arrays.asList(new ACL(Perms.ALL, new Id("ip", "127.0.0.1/64"))), CreateMode.PERSISTENT));
+
+        // given: ipv6 acl
+        zk.create("/mismatched-ipv6-acl", new byte[]{}, Arrays.asList(new ACL(Perms.ALL, new Id("ip", "::1"))), CreateMode.PERSISTENT);
+        // when: access with v4 ip
+        // then: NoAuth
+        assertThrows(KeeperException.NoAuthException.class, () -> zk.setData("/mismatched-ipv6-acl", null, -1));
+
+        // given: prefix matched ipv6 network acl
+        zk.create("/prefix-matched-ipv6-network-acl", new byte[]{}, Arrays.asList(new ACL(Perms.ALL, new Id("ip", "7f::/16"))), CreateMode.PERSISTENT);
+        // when: access with v4 ip
+        // then: NoAuth
+        assertThrows(KeeperException.NoAuthException.class, () -> zk.setData("/prefix-matched-ipv6-network-acl", null, -1));
+
+        // given: ipv4 with network acl
+        zk.create("/matched-ipv4-network-acl", new byte[]{}, Arrays.asList(new ACL(Perms.ALL, new Id("ip", "127.0.0.1/16"))), CreateMode.PERSISTENT);
+        // when: access with valid ip
+        // then: ok
+        zk.setData("/matched-ipv4-network-acl", null, -1);
+
+        // given: matched ipv4 acl
+        zk.create("/matched-ipv4-acl", new byte[]{}, Arrays.asList(new ACL(Perms.ALL, new Id("ip", "127.0.0.1"))), CreateMode.PERSISTENT);
+        // when: access with valid ip
+        // then: ok
+        zk.setData("/matched-ipv4-acl", null, -1);
+
+        // given: mismatched ipv4 network acl
+        zk.create("/mismatched-ipv4-network-acl", new byte[]{}, Arrays.asList(new ACL(Perms.ALL, new Id("ip", "192.168.0.2/16"))), CreateMode.PERSISTENT);
+        // when: access with invalid ip
+        // then: NoAuth
+        assertThrows(KeeperException.NoAuthException.class, () -> zk.setData("/mismatched-ipv4-network-acl", null, -1));
+
+        // given: mismatched ipv4 acl
+        zk.create("/mismatched-ipv4-acl", new byte[]{}, Arrays.asList(new ACL(Perms.ALL, new Id("ip", "127.0.0.2"))), CreateMode.PERSISTENT);
+        // when: access with invalid ip
+        // then: NoAuth
+        assertThrows(KeeperException.NoAuthException.class, () -> zk.setData("/mismatched-ipv4-acl", null, -1));
+
+        server.close();
+    }
+
+    @Test
+    public void testDisconnectedAddAuth(@TempDir File tmpDir) throws Exception {
         ClientBase.setupTestEnv();
         ZooKeeperServer zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
         SyncRequestProcessor.setSnapCount(1000);
@@ -106,7 +275,7 @@ public void testDisconnectedAddAuth() throws Exception {
         f.startup(zks);
         try {
             LOG.info("starting up the zookeeper server .. waiting");
-            assertTrue("waiting for server being up", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up");
             ZooKeeper zk = ClientBase.createZKClient(HOSTPORT);
             try {
                 zk.addAuthInfo("digest", "pat:test".getBytes());
@@ -117,7 +286,7 @@ public void testDisconnectedAddAuth() throws Exception {
         } finally {
             f.shutdown();
             zks.shutdown();
-            assertTrue("waiting for server down", ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT), "waiting for server down");
         }
     }
 
@@ -127,8 +296,7 @@ public void testDisconnectedAddAuth() throws Exception {
      * node is actually working.
      */
     @Test
-    public void testAcls() throws Exception {
-        File tmpDir = ClientBase.createTmpDir();
+    public void testAcls(@TempDir File tmpDir) throws Exception {
         ClientBase.setupTestEnv();
         ZooKeeperServer zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
         SyncRequestProcessor.setSnapCount(1000);
@@ -139,7 +307,7 @@ public void testAcls() throws Exception {
         String path;
         try {
             LOG.info("starting up the zookeeper server .. waiting");
-            assertTrue("waiting for server being up", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up");
             zk = ClientBase.createZKClient(HOSTPORT);
             LOG.info("starting creating acls");
             for (int i = 0; i < 100; i++) {
@@ -147,7 +315,7 @@ public void testAcls() throws Exception {
                 zk.create(path, path.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
             }
             int size = zks.getZKDatabase().getAclSize();
-            assertTrue("size of the acl map ", (2 == zks.getZKDatabase().getAclSize()));
+            assertTrue((2 == zks.getZKDatabase().getAclSize()), "size of the acl map ");
             for (int j = 100; j < 200; j++) {
                 path = "/" + j;
                 ACL acl = new ACL();
@@ -156,16 +324,16 @@ public void testAcls() throws Exception {
                 id.setId("1.1.1." + j);
                 id.setScheme("ip");
                 acl.setId(id);
-                List<ACL> list = new ArrayList<ACL>();
+                List<ACL> list = new ArrayList<>();
                 list.add(acl);
                 zk.create(path, path.getBytes(), list, CreateMode.PERSISTENT);
             }
-            assertTrue("size of the acl map ", (102 == zks.getZKDatabase().getAclSize()));
+            assertTrue((102 == zks.getZKDatabase().getAclSize()), "size of the acl map ");
         } finally {
             // now shutdown the server and restart it
             f.shutdown();
             zks.shutdown();
-            assertTrue("waiting for server down", ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server down");
         }
 
         zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
@@ -173,9 +341,9 @@ public void testAcls() throws Exception {
 
         f.startup(zks);
         try {
-            assertTrue("waiting for server up", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server up");
             zk = ClientBase.createZKClient(HOSTPORT);
-            assertTrue("acl map ", (102 == zks.getZKDatabase().getAclSize()));
+            assertTrue((102 == zks.getZKDatabase().getAclSize()), "acl map ");
             for (int j = 200; j < 205; j++) {
                 path = "/" + j;
                 ACL acl = new ACL();
@@ -184,17 +352,17 @@ public void testAcls() throws Exception {
                 id.setId("1.1.1." + j);
                 id.setScheme("ip");
                 acl.setId(id);
-                ArrayList<ACL> list = new ArrayList<ACL>();
+                ArrayList<ACL> list = new ArrayList<>();
                 list.add(acl);
                 zk.create(path, path.getBytes(), list, CreateMode.PERSISTENT);
             }
-            assertTrue("acl map ", (107 == zks.getZKDatabase().getAclSize()));
+            assertTrue((107 == zks.getZKDatabase().getAclSize()), "acl map ");
 
             zk.close();
         } finally {
             f.shutdown();
             zks.shutdown();
-            assertTrue("waiting for server down", ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT), "waiting for server down");
         }
 
     }
@@ -217,8 +385,7 @@ public void process(WatchedEvent event) {
     }
 
     @Test
-    public void testNullACL() throws Exception {
-        File tmpDir = ClientBase.createTmpDir();
+    public void testNullACL(@TempDir File tmpDir) throws Exception {
         ClientBase.setupTestEnv();
         ZooKeeperServer zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
         final int PORT = Integer.parseInt(HOSTPORT.split(":")[1]);
@@ -253,13 +420,12 @@ public void testNullACL() throws Exception {
             zk.close();
             f.shutdown();
             zks.shutdown();
-            assertTrue("waiting for server down", ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT), "waiting for server down");
         }
     }
 
     @Test
-    public void testNullValueACL() throws Exception {
-        File tmpDir = ClientBase.createTmpDir();
+    public void testNullValueACL(@TempDir File tmpDir) throws Exception {
         ClientBase.setupTestEnv();
         ZooKeeperServer zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
         final int PORT = Integer.parseInt(HOSTPORT.split(":")[1]);
@@ -268,7 +434,7 @@ public void testNullValueACL() throws Exception {
         ZooKeeper zk = ClientBase.createZKClient(HOSTPORT);
         try {
 
-            List<ACL> acls = new ArrayList<ACL>();
+            List<ACL> acls = new ArrayList<>();
             acls.add(null);
 
             // case 1 : null value in ACL list with create
@@ -298,8 +464,93 @@ public void testNullValueACL() throws Exception {
             zk.close();
             f.shutdown();
             zks.shutdown();
-            assertTrue("waiting for server down", ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT), "waiting for server down");
         }
     }
 
+    @Test
+    public void testExistACLCheck(@TempDir File tmpDir) throws Exception {
+        ClientBase.setupTestEnv();
+        ZooKeeperServer zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
+        final int PORT = Integer.parseInt(HOSTPORT.split(":")[1]);
+        ServerCnxnFactory f = ServerCnxnFactory.createFactory(PORT, -1);
+        f.startup(zks);
+        String path = "/testExistACLCheck";
+        String data = "/testExistACLCheck-data";
+        try {
+            LOG.info("starting up the zookeeper server .. waiting");
+            assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up");
+            ZooKeeper zk = ClientBase.createZKClient(HOSTPORT);
+            try {
+                Stat stat = zk.exists(path, false);
+                assertNull(stat);
+                zk.create(path, data.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+                stat = zk.exists(path, false);
+                assertNotNull(stat);
+                assertEquals(data.length(), stat.getDataLength());
+
+                zk.delete(path, -1);
+                ArrayList<ACL> acls = new ArrayList<>();
+                acls.add(new ACL(ZooDefs.Perms.WRITE, Ids.ANYONE_ID_UNSAFE));
+                zk.create(path, data.getBytes(), acls, CreateMode.PERSISTENT);
+                try {
+                    stat = zk.exists(path, false);
+                    fail("exists should throw NoAuthException when don't have read permission");
+                } catch (KeeperException.NoAuthException e) {
+                    //expected
+                }
+
+                zk.delete(path, -1);
+                acls = new ArrayList<>();
+                acls.add(new ACL(ZooDefs.Perms.READ, Ids.ANYONE_ID_UNSAFE));
+                zk.create(path, data.getBytes(), acls, CreateMode.PERSISTENT);
+                stat = zk.exists(path, false);
+                assertNotNull(stat);
+                assertEquals(data.length(), stat.getDataLength());
+            } finally {
+                zk.close();
+            }
+        } finally {
+            f.shutdown();
+            zks.shutdown();
+            assertTrue(ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT), "waiting for server down");
+        }
+    }
+
+    @Test
+    public void testExistACLCheckAtRootPath(@TempDir File tmpDir) throws Exception {
+        ClientBase.setupTestEnv();
+        ZooKeeperServer zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
+        final int PORT = Integer.parseInt(HOSTPORT.split(":")[1]);
+        ServerCnxnFactory f = ServerCnxnFactory.createFactory(PORT, -1);
+        f.startup(zks);
+        try {
+            LOG.info("starting up the zookeeper server .. waiting");
+            assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up");
+            ZooKeeper zk = ClientBase.createZKClient(HOSTPORT);
+            try {
+                String data = "/testExistACLCheckAtRootPath-data";
+                zk.create("/a", data.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+                ArrayList<ACL> acls = new ArrayList<>();
+                acls.add(new ACL(0, Ids.ANYONE_ID_UNSAFE));
+                zk.setACL("/", acls, -1);
+
+                Stat stat = zk.exists("/a", false);
+                assertNotNull(stat);
+                assertEquals(data.length(), stat.getDataLength());
+                try {
+                    stat = zk.exists("/", false);
+                    fail("exists should throw NoAuthException when removing root path's ACL permission");
+                } catch (KeeperException.NoAuthException e) {
+                    //expected
+                }
+            } finally {
+                zk.close();
+            }
+        } finally {
+            f.shutdown();
+            zks.shutdown();
+            assertTrue(ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT), "waiting for server down");
+        }
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncHammerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncHammerTest.java
index 0112ba2567b..108b21c0f09 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncHammerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncHammerTest.java
@@ -20,8 +20,8 @@
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
 import static org.apache.zookeeper.test.ClientBase.verifyThreadTerminated;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.LinkedList;
 import org.apache.zookeeper.AsyncCallback.DataCallback;
 import org.apache.zookeeper.AsyncCallback.StringCallback;
@@ -34,7 +34,7 @@
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -47,7 +47,7 @@ public class AsyncHammerTest extends ZKTestCase implements StringCallback, VoidC
     private volatile boolean bang;
 
     public void setUp(boolean withObservers) throws Exception {
-        qb.setUp(withObservers);
+        qb.setUp(withObservers, false);
     }
 
     protected void restart() throws Exception {
@@ -120,7 +120,7 @@ private synchronized void incOutstanding() throws InterruptedException {
 
         private synchronized void decOutstanding() {
             outstanding--;
-            assertTrue("outstanding >= 0", outstanding >= 0);
+            assertTrue(outstanding >= 0, "outstanding >= 0");
             notifyAll();
         }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncOps.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncOps.java
index d5f2310c331..f55e9675e91 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncOps.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncOps.java
@@ -18,12 +18,12 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertSame;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
@@ -281,7 +281,7 @@ public String toString() {
 
     public static class ChildrenCB extends AsyncCB implements ChildrenCallback {
 
-        List<String> children = new ArrayList<String>();
+        List<String> children = new ArrayList<>();
 
         ChildrenCB(ZooKeeper zk) {
             this(zk, new CountDownLatch(1));
@@ -366,7 +366,7 @@ public String toString() {
 
     public static class Children2CB extends AsyncCB implements Children2Callback {
 
-        List<String> children = new ArrayList<String>();
+        List<String> children = new ArrayList<>();
 
         Children2CB(ZooKeeper zk) {
             this(zk, new CountDownLatch(1));
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncOpsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncOpsTest.java
index 9a9fe35ffc8..174df3fac05 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncOpsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncOpsTest.java
@@ -29,9 +29,9 @@
 import org.apache.zookeeper.test.AsyncOps.StatCB;
 import org.apache.zookeeper.test.AsyncOps.StringCB;
 import org.apache.zookeeper.test.AsyncOps.VoidCB;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -41,7 +41,7 @@ public class AsyncOpsTest extends ClientBase {
 
     private ZooKeeper zk;
 
-    @Before
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         super.setUp();
@@ -52,7 +52,7 @@ public void setUp() throws Exception {
         zk.addAuthInfo("digest", "ben:passwd".getBytes());
     }
 
-    @After
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         zk.close();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncTest.java
index 26db2702d96..f1667db1086 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AsyncTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.LinkedList;
 import java.util.List;
 import org.apache.zookeeper.AsyncCallback.DataCallback;
@@ -32,9 +32,9 @@
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.data.Stat;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -44,12 +44,12 @@ public class AsyncTest extends ZKTestCase implements StringCallback, VoidCallbac
 
     private QuorumBase qb = new QuorumBase();
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         qb.setUp();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         LOG.info("Test clients shutting down");
         qb.tearDown();
@@ -64,7 +64,7 @@ private ZooKeeper createClient(String hp) throws Exception {
         return zk;
     }
 
-    List<Integer> results = new LinkedList<Integer>();
+    List<Integer> results = new LinkedList<>();
 
     @Test
     public void testAsync() throws Exception {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AtomicFileOutputStreamTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AtomicFileOutputStreamTest.java
index a91bf355998..a3d7096c6bf 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AtomicFileOutputStreamTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AtomicFileOutputStreamTest.java
@@ -18,20 +18,22 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static java.nio.charset.StandardCharsets.UTF_8;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.FileNotFoundException;
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.OutputStream;
+import java.nio.file.Files;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.common.AtomicFileOutputStream;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class AtomicFileOutputStreamTest extends ZKTestCase {
 
@@ -41,12 +43,12 @@ public class AtomicFileOutputStreamTest extends ZKTestCase {
     private File testDir;
     private File dstFile;
 
-    @Before
+    @BeforeEach
     public void setupTestDir() throws IOException {
         testDir = ClientBase.createEmptyTestDir();
         dstFile = new File(testDir, "test.txt");
     }
-    @After
+    @AfterEach
     public void cleanupTestDir() throws IOException {
         ClientBase.recursiveDelete(testDir);
     }
@@ -64,7 +66,7 @@ public void testWriteNewFile() throws IOException {
         fos.close();
         assertTrue(dstFile.exists());
 
-        String readBackData = ClientBase.readFile(dstFile);
+        String readBackData = new String(Files.readAllBytes(dstFile.toPath()), UTF_8);
         assertEquals(TEST_STRING, readBackData);
     }
 
@@ -73,21 +75,21 @@ public void testWriteNewFile() throws IOException {
      */
     @Test
     public void testOverwriteFile() throws IOException {
-        assertTrue("Creating empty dst file", dstFile.createNewFile());
+        assertTrue(dstFile.createNewFile(), "Creating empty dst file");
 
         OutputStream fos = new AtomicFileOutputStream(dstFile);
 
-        assertTrue("Empty file still exists", dstFile.exists());
+        assertTrue(dstFile.exists(), "Empty file still exists");
         fos.write(TEST_STRING.getBytes());
         fos.flush();
 
         // Original contents still in place
-        assertEquals("", ClientBase.readFile(dstFile));
+        assertEquals("", new String(Files.readAllBytes(dstFile.toPath()), UTF_8));
 
         fos.close();
 
         // New contents replace original file
-        String readBackData = ClientBase.readFile(dstFile);
+        String readBackData = new String(Files.readAllBytes(dstFile.toPath()), UTF_8);
         assertEquals(TEST_STRING, readBackData);
     }
 
@@ -112,9 +114,9 @@ public void testFailToFlush() throws IOException {
         }
 
         // Should not have touched original file
-        assertEquals(TEST_STRING_2, ClientBase.readFile(dstFile));
+        assertEquals(TEST_STRING_2, new String(Files.readAllBytes(dstFile.toPath()), UTF_8));
 
-        assertEquals("Temporary file should have been cleaned up", dstFile.getName(), ClientBase.join(",", testDir.list()));
+        assertEquals(dstFile.getName(), String.join(",", testDir.list()), "Temporary file should have been cleaned up");
     }
 
     /**
@@ -172,7 +174,7 @@ public void testAbortExistingFile() throws IOException {
         fos2.abort();
 
         // Should not have touched original file
-        assertEquals(TEST_STRING, ClientBase.readFile(dstFile));
+        assertEquals(TEST_STRING, new String(Files.readAllBytes(dstFile.toPath()), UTF_8));
         assertEquals(1, testDir.list().length);
     }
 
@@ -193,7 +195,7 @@ public void testAbortExistingFileAfterFlush() throws IOException {
         fos2.abort();
 
         // Should not have touched original file
-        assertEquals(TEST_STRING, ClientBase.readFile(dstFile));
+        assertEquals(TEST_STRING, new String(Files.readAllBytes(dstFile.toPath()), UTF_8));
         assertEquals(1, testDir.list().length);
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthFailX509AuthenticationProvider.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthFailX509AuthenticationProvider.java
new file mode 100644
index 00000000000..32121e6ef7a
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthFailX509AuthenticationProvider.java
@@ -0,0 +1,51 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import javax.net.ssl.X509KeyManager;
+import javax.net.ssl.X509TrustManager;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.common.X509Exception;
+import org.apache.zookeeper.server.ServerCnxn;
+import org.apache.zookeeper.server.auth.X509AuthenticationProvider;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class AuthFailX509AuthenticationProvider extends X509AuthenticationProvider {
+  private static final Logger LOG = LoggerFactory.getLogger(AuthFailX509AuthenticationProvider.class);
+
+  public AuthFailX509AuthenticationProvider() throws X509Exception {
+    super();
+  }
+
+  public AuthFailX509AuthenticationProvider(X509TrustManager trustManager, X509KeyManager keyManager) {
+    super(trustManager, keyManager);
+  }
+
+  @Override
+  public KeeperException.Code handleAuthentication(ServerCnxn cnxn, byte[] authData) {
+    LOG.info("Authentication failed");
+    return KeeperException.Code.AUTHFAILED;
+  }
+
+  @Override
+  public String getScheme() {
+    return "authfail";
+  }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthSHA2Test.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthSHA2Test.java
new file mode 100644
index 00000000000..298e4fb5a20
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthSHA2Test.java
@@ -0,0 +1,89 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import java.security.NoSuchAlgorithmException;
+import java.security.Security;
+import org.apache.zookeeper.server.auth.DigestAuthenticationProvider;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+
+public class AuthSHA2Test extends AuthTest {
+
+    @BeforeAll
+    public static void setup() {
+        // use the BouncyCastle's Provider for testing
+        Security.addProvider(new BouncyCastleProvider());
+        // password is test
+        System.setProperty(DigestAuthenticationProvider.DIGEST_ALGORITHM_KEY, DigestAlgEnum.SHA_256.getName());
+        System.setProperty("zookeeper.DigestAuthenticationProvider.superDigest", "super:wjySwxg860UATFtciuZ1lpzrCHrPeov6SPu/ZD56uig=");
+        System.setProperty("zookeeper.authProvider.1", "org.apache.zookeeper.test.InvalidAuthProvider");
+    }
+
+    @AfterAll
+    public static void teardown() {
+        Security.removeProvider(BouncyCastleProvider.PROVIDER_NAME);
+        System.clearProperty("zookeeper.DigestAuthenticationProvider.superDigest");
+        System.clearProperty(DigestAuthenticationProvider.DIGEST_ALGORITHM_KEY);
+    }
+
+    @Test
+    public void testBadAuthNotifiesWatch() throws Exception {
+        super.testBadAuthNotifiesWatch();
+    }
+
+    @Test
+    public void testBadAuthThenSendOtherCommands() throws Exception {
+        super.testBadAuthThenSendOtherCommands();
+    }
+
+    @Test
+    public void testSuper() throws Exception {
+        super.testSuper();
+    }
+
+    @Test
+    public void testSuperACL() throws Exception {
+        super.testSuperACL();
+    }
+
+    @Test
+    public void testOrdinaryACL() throws Exception {
+        super.testOrdinaryACL();
+    }
+
+    @Test
+    public void testGenerateDigest() throws NoSuchAlgorithmException {
+        assertEquals("super:wjySwxg860UATFtciuZ1lpzrCHrPeov6SPu/ZD56uig=", DigestAuthenticationProvider.generateDigest("super:test"));
+        assertEquals("super:Ie58Fw6KA4ucTEDj23imIltKrXNDxQg8Rwtu0biQFcU=", DigestAuthenticationProvider.generateDigest("super:zookeeper"));
+        assertEquals("super:rVOiTPnqEqlpIRXqSoE6+7h6SzbHUrfAe34i8n/gmRU=", DigestAuthenticationProvider.generateDigest(("super:foo")));
+        assertEquals("super:vs70GBagNcqIhGR4R6rXP8E3lvJPYhzMpAMx8ghbTUk=", DigestAuthenticationProvider.generateDigest(("super:bar")));
+    }
+
+    @Test
+    public void testDigest() throws NoSuchAlgorithmException {
+        assertEquals("9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08", getGeneratedDigestStr(DigestAuthenticationProvider.digest("test")));
+        assertEquals("456831beef3fc1500939995d7369695f48642664a02d5eab9d807592a08b2384", getGeneratedDigestStr(DigestAuthenticationProvider.digest("zookeeper")));
+        assertEquals("2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae", getGeneratedDigestStr(DigestAuthenticationProvider.digest(("foo"))));
+        assertEquals("fcde2b2edba56bf408601fb721fe9b5c338d10ee429ea04fae5511b68fbf8fb9", getGeneratedDigestStr(DigestAuthenticationProvider.digest(("bar"))));
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthSHA3Test.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthSHA3Test.java
new file mode 100644
index 00000000000..38b070f6eaa
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthSHA3Test.java
@@ -0,0 +1,89 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import java.security.NoSuchAlgorithmException;
+import java.security.Security;
+import org.apache.zookeeper.server.auth.DigestAuthenticationProvider;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+
+public class AuthSHA3Test extends AuthTest {
+
+    @BeforeAll
+    public static void setup() {
+        // use the BouncyCastle's Provider for testing
+        Security.addProvider(new BouncyCastleProvider());
+        // password is test
+        System.setProperty(DigestAuthenticationProvider.DIGEST_ALGORITHM_KEY, DigestAlgEnum.SHA3_256.getName());
+        System.setProperty("zookeeper.DigestAuthenticationProvider.superDigest", "super:cRy/KPYuDpW/dtsepniTMpuiuupnWgdU9txltIfv3hA=");
+        System.setProperty("zookeeper.authProvider.1", "org.apache.zookeeper.test.InvalidAuthProvider");
+    }
+
+    @AfterAll
+    public static void teardown() {
+        Security.removeProvider(BouncyCastleProvider.PROVIDER_NAME);
+        System.clearProperty("zookeeper.DigestAuthenticationProvider.superDigest");
+        System.clearProperty(DigestAuthenticationProvider.DIGEST_ALGORITHM_KEY);
+    }
+
+    @Test
+    public void testBadAuthNotifiesWatch() throws Exception {
+        super.testBadAuthNotifiesWatch();
+    }
+
+    @Test
+    public void testBadAuthThenSendOtherCommands() throws Exception {
+        super.testBadAuthThenSendOtherCommands();
+    }
+
+    @Test
+    public void testSuper() throws Exception {
+        super.testSuper();
+    }
+
+    @Test
+    public void testSuperACL() throws Exception {
+        super.testSuperACL();
+    }
+
+    @Test
+    public void testOrdinaryACL() throws Exception {
+        super.testOrdinaryACL();
+    }
+
+    @Test
+    public void testGenerateDigest() throws NoSuchAlgorithmException {
+        assertEquals("super:cRy/KPYuDpW/dtsepniTMpuiuupnWgdU9txltIfv3hA=", DigestAuthenticationProvider.generateDigest("super:test"));
+        assertEquals("super:gM3M1QcrKC6b+h4oZ5Ixc4GTVaAsggI+AqkUaF6E1Is=", DigestAuthenticationProvider.generateDigest("super:zookeeper"));
+        assertEquals("super:2Ww7VUqTohd3lX/Vf4Nvw+GxbmOsX1p337L7Bnks4L8=", DigestAuthenticationProvider.generateDigest(("super:foo")));
+        assertEquals("super:Ft5s2Rtxr8zyz16feKiFR/8yqa6JoNEJ0In73aXojE8=", DigestAuthenticationProvider.generateDigest(("super:bar")));
+    }
+
+    @Test
+    public void testDigest() throws NoSuchAlgorithmException {
+        assertEquals("36f028580bb02cc8272a9a020f4200e346e276ae664e45ee80745574e2f5ab80", getGeneratedDigestStr(DigestAuthenticationProvider.digest("test")));
+        assertEquals("af4c1abc2deaa6edffc7ce34edeb8c03ee9a1488b64fd318ddb93b4b7f1c0746", getGeneratedDigestStr(DigestAuthenticationProvider.digest("zookeeper")));
+        assertEquals("76d3bc41c9f588f7fcd0d5bf4718f8f84b1c41b20882703100b9eb9413807c01", getGeneratedDigestStr(DigestAuthenticationProvider.digest(("foo"))));
+        assertEquals("cceefd7e0545bcf8b6d19f3b5750c8a3ee8350418877bc6fb12e32de28137355", getGeneratedDigestStr(DigestAuthenticationProvider.digest(("bar"))));
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthTest.java
index c78f6202b3d..a1c95d83b66 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/AuthTest.java
@@ -18,8 +18,12 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
+import java.security.NoSuchAlgorithmException;
+import java.util.ArrayList;
+import java.util.List;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
 import org.apache.zookeeper.CreateMode;
@@ -27,18 +31,32 @@
 import org.apache.zookeeper.TestableZooKeeper;
 import org.apache.zookeeper.WatchedEvent;
 import org.apache.zookeeper.Watcher.Event.KeeperState;
+import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
-import org.junit.Test;
+import org.apache.zookeeper.data.ACL;
+import org.apache.zookeeper.data.Id;
+import org.apache.zookeeper.server.auth.DigestAuthenticationProvider;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
 
 public class AuthTest extends ClientBase {
 
-    static {
+    @BeforeAll
+    public static void setup() {
         // password is test
+        // the default digestAlg is: SHA1
         System.setProperty("zookeeper.DigestAuthenticationProvider.superDigest", "super:D/InIHSb7yEEbrWz8b9l71RjZJU=");
         System.setProperty("zookeeper.authProvider.1", "org.apache.zookeeper.test.InvalidAuthProvider");
     }
 
+    @AfterAll
+    public static void teardown() {
+        System.clearProperty("zookeeper.DigestAuthenticationProvider.superDigest");
+        System.clearProperty(DigestAuthenticationProvider.DIGEST_ALGORITHM_KEY);
+    }
+
     private final CountDownLatch authFailed = new CountDownLatch(1);
 
     @Override
@@ -160,4 +178,97 @@ public void testSuperACL() throws Exception {
         }
     }
 
+    @Test
+    public void testOrdinaryACL() throws Exception {
+        ZooKeeper zk = createClient();
+        try {
+            String path = "/path1";
+            zk.create(path, null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            zk.addAuthInfo("digest", "username1:password1".getBytes());
+            List<ACL> list = new ArrayList<>();
+            int perm = ZooDefs.Perms.ALL;
+            String userPassword = "username1:password1";
+            Id id = new Id("auth", userPassword);
+            list.add(new ACL(perm, id));
+            zk.setACL(path, list, -1);
+            zk.close();
+
+            zk = createClient();
+            zk.addAuthInfo("digest", "super:test".getBytes());
+            zk.getData(path, false, null);
+            zk.close();
+
+            zk = createClient();
+            try {
+                zk.getData(path, false, null);
+                fail("should have NoAuthException");
+            } catch (KeeperException.NoAuthException e) {
+                // expected
+            }
+            zk.addAuthInfo("digest", "username1:password1".getBytes());
+            zk.getData(path, false, null);
+        } finally {
+            zk.close();
+        }
+    }
+
+    @Test
+    public void testGenerateDigest() throws NoSuchAlgorithmException {
+        assertEquals("super:D/InIHSb7yEEbrWz8b9l71RjZJU=", DigestAuthenticationProvider.generateDigest("super:test"));
+        assertEquals("super:yyuhPKumRtNj4r8GnSbbwuq1vhE=", DigestAuthenticationProvider.generateDigest("super:zookeeper"));
+        assertEquals("super:t6lQTvqID/Gl5Or0n4FYE6kKP8w=", DigestAuthenticationProvider.generateDigest(("super:foo")));
+        assertEquals("super:hTdNN4QH4isoRvCrQ1Jf7REREQ4=", DigestAuthenticationProvider.generateDigest(("super:bar")));
+    }
+
+    // This test is used to check the correctness of the algorithm
+    // For the same digest algorithm and input, the output of digest hash is the constant.
+    @Test
+    public void testDigest() throws NoSuchAlgorithmException {
+        assertEquals("a94a8fe5ccb19ba61c4c0873d391e987982fbbd3", getGeneratedDigestStr(DigestAuthenticationProvider.digest("test")));
+        assertEquals("8a0444ded963cf1118dd34aa1acaafec268c654d", getGeneratedDigestStr(DigestAuthenticationProvider.digest("zookeeper")));
+        assertEquals("0beec7b5ea3f0fdbc95d0dd47f3c5bc275da8a33", getGeneratedDigestStr(DigestAuthenticationProvider.digest(("foo"))));
+        assertEquals("62cdb7020ff920e5aa642c3d4066950dd1f01f4d", getGeneratedDigestStr(DigestAuthenticationProvider.digest(("bar"))));
+    }
+
+    // this method is used to generate the digest String to help us to compare the result generated by some online tool easily
+    protected static String getGeneratedDigestStr(byte[] bytes) {
+        StringBuilder stringBuilder = new StringBuilder("");
+        if (bytes == null || bytes.length <= 0) {
+            return null;
+        }
+        for (int i = 0; i < bytes.length; i++) {
+            int v = bytes[i] & 0xFF;
+            String hv = Integer.toHexString(v);
+            if (hv.length() < 2) {
+                stringBuilder.append(0);
+            }
+            stringBuilder.append(hv);
+        }
+        return stringBuilder.toString();
+    }
+
+    public enum DigestAlgEnum {
+        SHA_1("SHA1"),
+        SHA_256("SHA-256"),
+        SHA3_256("SHA3-256");
+
+        private String name;
+
+        DigestAlgEnum(String name) {
+            this.name = name;
+        }
+
+        public String getName() {
+            return this.name;
+        }
+
+        public static List<String> getValues() {
+            List<String> digestList = new ArrayList<>();
+            for (DigestAlgEnum digest : values()) {
+                digestList.add(digest.getName());
+            }
+            return digestList;
+        }
+    }
+
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/BufferSizeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/BufferSizeTest.java
index 8a4dd54a5d0..410b51033fe 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/BufferSizeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/BufferSizeTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.IOException;
 import org.apache.jute.BinaryInputArchive;
@@ -27,8 +27,8 @@
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class BufferSizeTest extends ClientBase {
 
@@ -37,10 +37,10 @@ public class BufferSizeTest extends ClientBase {
 
     private ZooKeeper zk;
 
-    @Before
+    @BeforeEach
     public void setMaxBuffer() throws IOException, InterruptedException {
         System.setProperty("jute.maxbuffer", "" + TEST_MAXBUFFER);
-        assertEquals("Can't set jute.maxbuffer!", TEST_MAXBUFFER, BinaryInputArchive.maxBuffer);
+        assertEquals(TEST_MAXBUFFER, BinaryInputArchive.maxBuffer, "Can't set jute.maxbuffer!");
         zk = createClient();
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/CheckTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/CheckTest.java
new file mode 100644
index 00000000000..0e2a1a4eca4
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/CheckTest.java
@@ -0,0 +1,141 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import java.io.File;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.TestableZooKeeper;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.data.Stat;
+import org.apache.zookeeper.proto.CheckVersionRequest;
+import org.apache.zookeeper.proto.ReplyHeader;
+import org.apache.zookeeper.proto.RequestHeader;
+import org.apache.zookeeper.server.ZKDatabase;
+import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
+import org.apache.zookeeper.server.quorum.QuorumPeer;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.TestInfo;
+
+public class CheckTest extends ClientBase {
+
+    @BeforeEach
+    public void setUp(TestInfo testInfo) throws Exception {
+        System.setProperty(ZKClientConfig.ZOOKEEPER_REQUEST_TIMEOUT, "2000");
+        if (testInfo.getDisplayName().contains("Cluster")) {
+            return;
+        }
+        super.setUp();
+    }
+
+    @AfterEach
+    public void tearDown(TestInfo testInfo) throws Exception {
+        System.clearProperty(ZKClientConfig.ZOOKEEPER_REQUEST_TIMEOUT);
+        if (testInfo.getDisplayName().contains("Cluster")) {
+            return;
+        }
+        super.tearDown();
+    }
+
+    @Override
+    public void setUp() throws Exception {
+    }
+
+    @Override
+    public void tearDown() throws Exception {
+    }
+
+    private static void checkVersion(TestableZooKeeper zk, String path, int version) throws Exception {
+        RequestHeader header = new RequestHeader();
+        header.setType(ZooDefs.OpCode.check);
+        CheckVersionRequest request = new CheckVersionRequest(path, version);
+        ReplyHeader replyHeader = zk.submitRequest(header, request, null, null);
+        if (replyHeader.getErr() != 0) {
+            throw KeeperException.create(KeeperException.Code.get(replyHeader.getErr()), path);
+        }
+    }
+
+    private void testOperations(TestableZooKeeper zk) throws Exception {
+        Stat stat = new Stat();
+        zk.getData("/", false, stat);
+        assertThrows(KeeperException.UnimplementedException.class, () -> checkVersion(zk, "/", -1));
+    }
+
+    @Test
+    public void testStandalone() throws Exception {
+        testOperations(createClient());
+    }
+
+    @Test
+    public void testStandaloneDatabaseReloadAfterCheck() throws Exception {
+        try {
+            testOperations(createClient());
+        } catch (Throwable ignored) {
+            // Ignore to test database reload after check
+        }
+        stopServer();
+        startServer();
+    }
+
+    @Test
+    public void testCluster() throws Exception {
+        QuorumBase qb = new QuorumBase();
+        try {
+            qb.setUp(true, true);
+            testOperations(qb.createClient(new CountdownWatcher(), QuorumPeer.ServerState.OBSERVING));
+            testOperations(qb.createClient(new CountdownWatcher(), QuorumPeer.ServerState.FOLLOWING));
+            testOperations(qb.createClient(new CountdownWatcher(), QuorumPeer.ServerState.LEADING));
+        } finally {
+            try {
+                qb.tearDown();
+            } catch (Exception ignored) {}
+        }
+    }
+
+    @Test
+    public void testClusterDatabaseReloadAfterCheck() throws Exception {
+        QuorumBase qb = new QuorumBase();
+        try {
+            qb.setUp(true, true);
+
+            // Get leader before possible damaging operations to
+            // reduce chance of leader migration and log truncation.
+            File dataDir = qb.getLeaderDataDir();
+            QuorumPeer leader = qb.getLeaderQuorumPeer();
+
+            try {
+                testOperations(qb.createClient(new CountdownWatcher(), QuorumPeer.ServerState.LEADING));
+            } catch (Throwable ignored) {
+                // Ignore to test database reload after check
+            }
+            qb.shutdown(leader);
+
+            FileTxnSnapLog txnSnapLog = new FileTxnSnapLog(dataDir, dataDir);
+            ZKDatabase database = new ZKDatabase(txnSnapLog);
+            database.loadDataBase();
+        } finally {
+            try {
+                qb.tearDown();
+            } catch (Exception ignored) {}
+        }
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ChrootAsyncTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ChrootAsyncTest.java
index bb421b328b3..62e2cc1111b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ChrootAsyncTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ChrootAsyncTest.java
@@ -21,6 +21,7 @@
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
+import org.junit.jupiter.api.BeforeEach;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -28,6 +29,7 @@ public class ChrootAsyncTest extends AsyncOpsTest {
 
     private static final Logger LOG = LoggerFactory.getLogger(ChrootAsyncTest.class);
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         String hp = hostPort;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ChrootClientTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ChrootClientTest.java
index 70cd2c684c9..5845ec95180 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ChrootClientTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ChrootClientTest.java
@@ -21,7 +21,8 @@
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -29,6 +30,7 @@ public class ChrootClientTest extends ClientTest {
 
     private static final Logger LOG = LoggerFactory.getLogger(ChrootClientTest.class);
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         String hp = hostPort;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ChrootTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ChrootTest.java
index ddf206324d4..0b156156d0d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ChrootTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ChrootTest.java
@@ -18,11 +18,11 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.Arrays;
 import java.util.concurrent.CountDownLatch;
@@ -33,7 +33,7 @@
 import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class ChrootTest extends ClientBase {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java
index 4235b6b6349..3021421b5e4 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientBase.java
@@ -19,14 +19,11 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.client.FourLetterWordMain.send4LetterWord;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
-import java.io.BufferedInputStream;
-import java.io.ByteArrayOutputStream;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
-import java.io.FileInputStream;
 import java.io.IOException;
 import java.net.ConnectException;
 import java.net.ProtocolException;
@@ -43,6 +40,7 @@
 import java.util.concurrent.TimeoutException;
 import javax.management.MBeanServerConnection;
 import javax.management.ObjectName;
+import javax.net.ssl.SSLContext;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.TestableZooKeeper;
@@ -51,17 +49,20 @@
 import org.apache.zookeeper.Watcher.Event.KeeperState;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.ZooKeeper;
-import org.apache.zookeeper.common.IOUtils;
+import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.common.ClientX509Util;
 import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.common.X509Exception.SSLContextException;
+import org.apache.zookeeper.common.X509Util;
+import org.apache.zookeeper.common.ZKConfig;
 import org.apache.zookeeper.server.ServerCnxnFactory;
 import org.apache.zookeeper.server.ZKDatabase;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.persistence.FilePadding;
 import org.apache.zookeeper.server.quorum.QuorumPeer;
 import org.apache.zookeeper.server.util.OSMXBean;
-import org.junit.After;
-import org.junit.Before;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -127,6 +128,12 @@ public synchronized void process(WatchedEvent event) {
         public synchronized boolean isConnected() {
             return connected;
         }
+
+        protected synchronized String connectionDescription() {
+            return String.format("connected(%s), syncConnected(%s), readOnlyConnected(%s)",
+                connected, syncConnected, readOnlyConnected);
+        }
+
         public synchronized void waitForConnected(long timeout) throws InterruptedException, TimeoutException {
             long expire = Time.currentElapsedTime() + timeout;
             long left = timeout;
@@ -135,8 +142,7 @@ public synchronized void waitForConnected(long timeout) throws InterruptedExcept
                 left = expire - Time.currentElapsedTime();
             }
             if (!connected) {
-                throw new TimeoutException("Failed to connect to ZooKeeper server.");
-
+                throw new TimeoutException("Failed to connect to ZooKeeper server: " + connectionDescription());
             }
         }
         public synchronized void waitForSyncConnected(long timeout) throws InterruptedException, TimeoutException {
@@ -147,18 +153,22 @@ public synchronized void waitForSyncConnected(long timeout) throws InterruptedEx
                 left = expire - Time.currentElapsedTime();
             }
             if (!syncConnected) {
-                throw new TimeoutException("Failed to connect to read-write ZooKeeper server.");
+                throw new TimeoutException(
+                    "Failed to connect to read-write ZooKeeper server: "
+                        + connectionDescription());
             }
         }
         public synchronized void waitForReadOnlyConnected(long timeout) throws InterruptedException, TimeoutException {
-            long expire = System.currentTimeMillis() + timeout;
+            long expire = Time.currentElapsedTime() + timeout;
             long left = timeout;
             while (!readOnlyConnected && left > 0) {
                 wait(left);
-                left = expire - System.currentTimeMillis();
+                left = expire - Time.currentElapsedTime();
             }
             if (!readOnlyConnected) {
-                throw new TimeoutException("Failed to connect in read-only mode to ZooKeeper server.");
+                throw new TimeoutException(
+                    "Failed to connect in read-only mode to ZooKeeper server: "
+                        + connectionDescription());
             }
         }
         public synchronized void waitForDisconnected(long timeout) throws InterruptedException, TimeoutException {
@@ -169,8 +179,7 @@ public synchronized void waitForDisconnected(long timeout) throws InterruptedExc
                 left = expire - Time.currentElapsedTime();
             }
             if (connected) {
-                throw new TimeoutException("Did not disconnect");
-
+                throw new TimeoutException("Did not disconnect: " + connectionDescription());
             }
         }
 
@@ -192,6 +201,10 @@ protected TestableZooKeeper createClient(CountdownWatcher watcher) throws IOExce
     private List<ZooKeeper> allClients;
     private boolean allClientsSetup = false;
 
+    protected TestableZooKeeper createClient(String hp, int timeout) throws IOException, InterruptedException {
+        return createClient(new CountdownWatcher(), hp, timeout);
+    }
+
     protected TestableZooKeeper createClient(CountdownWatcher watcher, String hp) throws IOException, InterruptedException {
         return createClient(watcher, hp, CONNECTION_TIMEOUT);
     }
@@ -233,7 +246,7 @@ public HostPort(String host, int port) {
 
     }
     public static List<HostPort> parseHostPortList(String hplist) {
-        ArrayList<HostPort> alist = new ArrayList<HostPort>();
+        ArrayList<HostPort> alist = new ArrayList<>();
         for (String hp : hplist.split(",")) {
             int idx = hp.lastIndexOf(':');
             String host = hp.substring(0, idx);
@@ -249,16 +262,27 @@ public static List<HostPort> parseHostPortList(String hplist) {
     }
 
     public static boolean waitForServerUp(String hp, long timeout) {
-        return waitForServerUp(hp, timeout, false);
+        return waitForServerUp(hp, timeout, false, null);
     }
 
     public static boolean waitForServerUp(String hp, long timeout, boolean secure) {
+        return waitForServerUp(hp, timeout, secure, null);
+    }
+
+    public static boolean waitForServerUp(String hp, long timeout, boolean secure, ZKConfig zkConfig) {
         long start = Time.currentElapsedTime();
         while (true) {
             try {
                 // if there are multiple hostports, just take the first one
                 HostPort hpobj = parseHostPortList(hp).get(0);
-                String result = send4LetterWord(hpobj.host, hpobj.port, "stat", secure);
+                SSLContext sslContext = null;
+                String result;
+                if (zkConfig != null) {
+                    try (X509Util x509Util = new ClientX509Util()) {
+                        sslContext = x509Util.createSSLContext(zkConfig);
+                    }
+                }
+                result = send4LetterWord(hpobj.host, hpobj.port, "stat", secure, 5000, sslContext);
                 if (result.startsWith("Zookeeper version:") && !result.contains("READ-ONLY")) {
                     return true;
                 }
@@ -281,6 +305,7 @@ public static boolean waitForServerUp(String hp, long timeout, boolean secure) {
                 // ignore
             }
         }
+        LOG.error("server failed to come up: {}", hp);
         return false;
     }
 
@@ -338,7 +363,7 @@ static void verifyThreadTerminated(Thread thread, long millis) throws Interrupte
         thread.join(millis);
         if (thread.isAlive()) {
             LOG.error("Thread {} : {}", thread.getName(), Arrays.toString(thread.getStackTrace()));
-            assertFalse("thread " + thread.getName() + " still alive after join", true);
+            assertFalse(true, "thread " + thread.getName() + " still alive after join");
         }
     }
 
@@ -351,6 +376,9 @@ public static File createTmpDir() throws IOException {
     }
 
     static File createTmpDir(File parentDir, boolean createInitFile) throws IOException {
+        if (!parentDir.exists()) {
+            parentDir.mkdir();
+        }
         File tmpFile = File.createTempFile("test", ".junit", parentDir);
         // don't delete tmpFile - this ensures we don't attempt to create
         // a tmpDir with a duplicate name
@@ -383,22 +411,29 @@ private static int getPort(String hostPort) {
         return Integer.parseInt(portstr);
     }
 
+    public static void startServerInstance(File dataDir,
+        ServerCnxnFactory factory,
+        String hostPort,
+        int serverId) throws IOException, InterruptedException {
+        startServerInstance(dataDir, factory, hostPort, serverId, null);
+    }
+
     /**
      * Starting the given server instance
      */
     public static void startServerInstance(
-            File dataDir,
-            ServerCnxnFactory factory,
-            String hostPort,
-            int serverId) throws IOException, InterruptedException {
+        File dataDir,
+        ServerCnxnFactory factory,
+        String hostPort,
+        int serverId, ZKConfig zkConfig) throws IOException, InterruptedException {
         final int port = getPort(hostPort);
         LOG.info("STARTING server instance 127.0.0.1:{}", port);
         ZooKeeperServer zks = new ZooKeeperServer(dataDir, dataDir, 3000);
         zks.setCreateSessionTrackerServerId(serverId);
         factory.startup(zks);
         assertTrue(
-                "waiting for server up",
-                ClientBase.waitForServerUp("127.0.0.1:" + port, CONNECTION_TIMEOUT, factory.isSecure()));
+            ClientBase.waitForServerUp("127.0.0.1:" + port, CONNECTION_TIMEOUT, factory.isSecure(), zkConfig),
+            "waiting for server up");
     }
 
     /**
@@ -416,9 +451,9 @@ public static void startServerInstance(
      *      for more information.
      */
     public static ServerCnxnFactory createNewServerInstance(
-            ServerCnxnFactory factory,
-            String hostPort,
-            int maxCnxns) throws IOException, InterruptedException {
+        ServerCnxnFactory factory,
+        String hostPort,
+        int maxCnxns) throws IOException, InterruptedException {
         final int port = getPort(hostPort);
         LOG.info("CREATING server instance 127.0.0.1:{}", port);
         if (factory == null) {
@@ -447,8 +482,8 @@ static void shutdownServerInstance(ServerCnxnFactory factory, String hostPort) {
             final int PORT = getPort(hostPort);
 
             assertTrue(
-                    "waiting for server down",
-                    ClientBase.waitForServerDown("127.0.0.1:" + PORT, CONNECTION_TIMEOUT, factory.isSecure()));
+                ClientBase.waitForServerDown("127.0.0.1:" + PORT, CONNECTION_TIMEOUT, factory.isSecure()),
+                "waiting for server down");
         }
     }
 
@@ -465,11 +500,11 @@ public static void setupTestEnv() {
     }
 
     protected void setUpAll() throws Exception {
-        allClients = new LinkedList<ZooKeeper>();
+        allClients = new LinkedList<>();
         allClientsSetup = true;
     }
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         setUpWithServerId(1);
     }
@@ -518,7 +553,7 @@ private void startServer(int serverId) throws Exception {
         Set<ObjectName> children = JMXEnv.ensureParent("InMemoryDataTree", "StandaloneServer_port");
         // Remove beans which are related to zk client sessions. Strong
         // assertions cannot be done for these client sessions because
-        // registeration of these beans with server will happen only on their
+        // registration of these beans with server will happen only on their
         // respective reconnection interval
         verifyUnexpectedBeans(children);
     }
@@ -539,7 +574,7 @@ private void verifyUnexpectedBeans(Set<ObjectName> children) {
         for (ObjectName bean : children) {
             LOG.info("unexpected:{}", bean.toString());
         }
-        assertEquals("Unexpected bean exists!", 0, children.size());
+        assertEquals(0, children.size(), "Unexpected bean exists!");
     }
 
     /**
@@ -578,7 +613,7 @@ protected void tearDownAll() throws Exception {
         }
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         LOG.info("tearDown starting");
 
@@ -587,7 +622,7 @@ public void tearDown() throws Exception {
         stopServer();
 
         if (tmpDir != null) {
-            assertTrue("delete " + tmpDir.toString(), recursiveDelete(tmpDir));
+            assertTrue(recursiveDelete(tmpDir), "delete " + tmpDir.toString());
         }
 
         // This has to be set to null when the same instance of this class is reused between test cases
@@ -696,30 +731,6 @@ void verifyRootOfAllServersMatch(String hostPort) throws InterruptedException, K
         }
     }
 
-    public static String readFile(File file) throws IOException {
-        ByteArrayOutputStream os = new ByteArrayOutputStream();
-        BufferedInputStream is = new BufferedInputStream(new FileInputStream(file));
-        try {
-            IOUtils.copyBytes(is, os, 1024, true);
-        } finally {
-            is.close();
-        }
-        return os.toString();
-    }
-
-    public static String join(String separator, Object[] parts) {
-        StringBuilder sb = new StringBuilder();
-        boolean first = true;
-        for (Object part : parts) {
-            if (!first) {
-                sb.append(separator);
-                first = false;
-            }
-            sb.append(part);
-        }
-        return sb.toString();
-    }
-
     public static ZooKeeper createZKClient(String cxnString) throws Exception {
         return createZKClient(cxnString, CONNECTION_TIMEOUT);
     }
@@ -735,10 +746,20 @@ public static ZooKeeper createZKClient(String cxnString) throws Exception {
      *             in cases of network failure
      */
     public static ZooKeeper createZKClient(String cxnString, int sessionTimeout) throws IOException {
+        return createZKClient(cxnString, sessionTimeout, CONNECTION_TIMEOUT);
+    }
+
+    public static ZooKeeper createZKClient(String cxnString, int sessionTimeout,
+        long connectionTimeout) throws IOException {
+        return createZKClient(cxnString, sessionTimeout, connectionTimeout, new ZKClientConfig());
+    }
+
+    public static ZooKeeper createZKClient(String cxnString, int sessionTimeout,
+        long connectionTimeout, ZKClientConfig config) throws IOException {
         CountdownWatcher watcher = new CountdownWatcher();
-        ZooKeeper zk = new ZooKeeper(cxnString, sessionTimeout, watcher);
+        ZooKeeper zk = new ZooKeeper(cxnString, sessionTimeout, watcher, config);
         try {
-            watcher.waitForConnected(CONNECTION_TIMEOUT);
+            watcher.waitForConnected(connectionTimeout);
         } catch (InterruptedException | TimeoutException e) {
             fail("ZooKeeper client can not connect to " + cxnString);
         }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientHammerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientHammerTest.java
index 14e6ba5fbe4..1a85862d907 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientHammerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientHammerTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.io.IOException;
 import java.util.Date;
 import java.util.List;
@@ -27,7 +27,7 @@
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.common.Time;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientPortBindTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientPortBindTest.java
index 2daf6f3f9b6..99f195b3606 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientPortBindTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientPortBindTest.java
@@ -19,7 +19,7 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.net.Inet6Address;
 import java.net.InetAddress;
@@ -32,7 +32,8 @@
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.server.ServerCnxnFactory;
 import org.apache.zookeeper.server.ZooKeeperServer;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -44,7 +45,7 @@ public class ClientPortBindTest extends ZKTestCase {
      * Verify that the server binds to the specified address
      */
     @Test
-    public void testBindByAddress() throws Exception {
+    public void testBindByAddress(@TempDir File tmpDir) throws Exception {
         String bindAddress = null;
         Enumeration<NetworkInterface> intfs = NetworkInterface.getNetworkInterfaces();
         // if we have a loopback and it has an address use it
@@ -78,16 +79,14 @@ public void testBindByAddress() throws Exception {
         final String HOSTPORT = bindAddress + ":" + PORT;
         LOG.info("Using {} as the host/port", HOSTPORT);
 
-        File tmpDir = ClientBase.createTmpDir();
-
         ClientBase.setupTestEnv();
         ZooKeeperServer zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
 
         ServerCnxnFactory f = ServerCnxnFactory.createFactory(new InetSocketAddress(bindAddress, PORT), -1);
         f.startup(zks);
-        LOG.info("starting up the the server, waiting");
+        LOG.info("starting up the server, waiting");
 
-        assertTrue("waiting for server up", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server up");
         ZooKeeper zk = ClientBase.createZKClient(HOSTPORT);
         try {
             zk.close();
@@ -95,7 +94,7 @@ public void testBindByAddress() throws Exception {
             f.shutdown();
             zks.shutdown();
 
-            assertTrue("waiting for server down", ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server down");
         }
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientRetryTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientRetryTest.java
index 48c01822100..50540c83cda 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientRetryTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientRetryTest.java
@@ -18,15 +18,17 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertSame;
+import static org.junit.jupiter.api.Assertions.assertSame;
 import java.io.IOException;
 import java.util.concurrent.TimeoutException;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.ZooKeeper.States;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class ClientRetryTest extends ClientBase {
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         maxCnxns = 1;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSSLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSSLTest.java
index 1d3233fe6b9..f23f7c7d4da 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSSLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSSLTest.java
@@ -22,25 +22,63 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertTrue;
+import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
+import static org.hamcrest.CoreMatchers.startsWith;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.Assert.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assumptions.assumeFalse;
+import io.netty.handler.ssl.SslProvider;
+import java.io.IOException;
+import java.net.InetAddress;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.stream.Stream;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.common.ClientX509Util;
+import org.apache.zookeeper.common.SecretUtilsTest;
 import org.apache.zookeeper.server.NettyServerCnxnFactory;
 import org.apache.zookeeper.server.ServerCnxnFactory;
+import org.apache.zookeeper.server.auth.ProviderRegistry;
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
 
 public class ClientSSLTest extends QuorumPeerTestBase {
 
     private ClientX509Util clientX509Util;
 
-    @Before
+    public static Stream<Arguments> positiveTestData() {
+        ArrayList<Arguments> result = new ArrayList<>();
+        for (SslProvider sslProvider : SslProvider.values()) {
+            for (String fipsEnabled : new String[] { "true", "false" }) {
+                for (String hostnameverification : new String[] { "true", "false" }) {
+                    result.add(Arguments.of(sslProvider, fipsEnabled, hostnameverification));
+                }
+            }
+        }
+        return result.stream();
+    }
+
+    public static Stream<Arguments> negativeTestData() {
+        ArrayList<Arguments> result = new ArrayList<>();
+        for (SslProvider sslProvider : SslProvider.values()) {
+            for (String fipsEnabled : new String[] { "true", "false" }) {
+                result.add(Arguments.of(sslProvider, fipsEnabled));
+            }
+        }
+        return result.stream();
+    }
+
+    @BeforeEach
     public void setup() {
         System.setProperty(NettyServerCnxnFactory.PORT_UNIFICATION_KEY, Boolean.TRUE.toString());
         clientX509Util = new ClientX509Util();
@@ -54,7 +92,7 @@ public void setup() {
         System.setProperty(clientX509Util.getSslTruststorePasswdProperty(), "testpass");
     }
 
-    @After
+    @AfterEach
     public void teardown() {
         System.clearProperty(NettyServerCnxnFactory.PORT_UNIFICATION_KEY);
         System.clearProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY);
@@ -62,8 +100,13 @@ public void teardown() {
         System.clearProperty(ZKClientConfig.SECURE_CLIENT);
         System.clearProperty(clientX509Util.getSslKeystoreLocationProperty());
         System.clearProperty(clientX509Util.getSslKeystorePasswdProperty());
+        System.clearProperty(clientX509Util.getSslKeystorePasswdPathProperty());
         System.clearProperty(clientX509Util.getSslTruststoreLocationProperty());
         System.clearProperty(clientX509Util.getSslTruststorePasswdProperty());
+        System.clearProperty(clientX509Util.getSslTruststorePasswdPathProperty());
+        System.clearProperty(clientX509Util.getFipsModeProperty());
+        System.clearProperty(clientX509Util.getSslHostnameVerificationEnabledProperty());
+        System.clearProperty(clientX509Util.getSslProviderProperty());
         clientX509Util.close();
     }
 
@@ -79,21 +122,78 @@ public void testClientServerUnifiedPort() throws Exception {
         testClientServerSSL(false);
     }
 
+    @Test
+    public void testClientServerUnifiedPortWithCnxnClassName() throws Exception {
+        System.setProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET, "ClientCnxnSocketNIO");
+        testClientServerSSL(false);
+    }
+
+    @Test
+    public void testClientServerSSLWithCnxnClassName() throws Exception {
+        System.setProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET, "ClientCnxnSocketNetty");
+        testClientServerSSL(true);
+    }
+
     /**
      * This test checks that client - server SSL works in cluster setup of ZK servers, which includes:
      * 1. setting "secureClientPort" in "zoo.cfg" file.
      * 2. setting jvm flags for serverCnxn, keystore, truststore.
      * Finally, a zookeeper client should be able to connect to the secure port and
      * communicate with server via secure connection.
-     * <p>
+     * <p/>
      * Note that in this test a ZK server has two ports -- clientPort and secureClientPort.
+     * <p/>
+     * This test covers the positive scenarios for hostname verification.
+     */
+    @ParameterizedTest(name = "sslProvider={0}, fipsEnabled={1}, hostnameVerification={2}")
+    @MethodSource("positiveTestData")
+    public void testClientServerSSL_positive(SslProvider sslProvider, String fipsEnabled, String hostnameVerification) throws Exception {
+        //Skipping this test for s390x arch as netty-tc-native is not supported
+        assumeFalse(System.getProperty("os.arch").contains("s390x"), " Skipping for s390x arch as netty-tcnative is not yet supported.");
+        // Arrange
+        System.setProperty(clientX509Util.getSslProviderProperty(), sslProvider.toString());
+        System.setProperty(clientX509Util.getFipsModeProperty(), fipsEnabled);
+        System.setProperty(clientX509Util.getSslHostnameVerificationEnabledProperty(), hostnameVerification);
+
+        // Act & Assert
+        testClientServerSSL(hostnameVerification.equals("true") ? "localhost" : InetAddress.getLocalHost().getHostName(),
+            true, CONNECTION_TIMEOUT);
+    }
+
+    /**
+     * This test covers the negative scenarios for hostname verification.
      */
+    @ParameterizedTest(name = "sslProvider={0}, fipsEnabled={1}")
+    @MethodSource("negativeTestData")
+    public void testClientServerSSL_negative(SslProvider sslProvider, boolean fipsEnabled) {
+        // Arrange
+        System.setProperty(clientX509Util.getSslProviderProperty(), sslProvider.toString());
+        System.setProperty(clientX509Util.getFipsModeProperty(), Boolean.toString(fipsEnabled));
+        System.setProperty(clientX509Util.getSslHostnameVerificationEnabledProperty(), "true");
+
+        // Act & Assert
+        assertThrows(AssertionError.class, () ->
+            testClientServerSSL(InetAddress.getLocalHost().getHostName(), true, 5000));
+    }
+
     @Test
-    public void testClientServerSSL() throws Exception {
+    public void testClientServerSSL_withPasswordFromFile() throws Exception {
+        final Path secretFile = SecretUtilsTest.createSecretFile("testpass");
+
+        System.clearProperty(clientX509Util.getSslKeystorePasswdProperty());
+        System.setProperty(clientX509Util.getSslKeystorePasswdPathProperty(), secretFile.toString());
+
+        System.clearProperty(clientX509Util.getSslTruststorePasswdProperty());
+        System.setProperty(clientX509Util.getSslTruststorePasswdPathProperty(), secretFile.toString());
+
         testClientServerSSL(true);
     }
 
     public void testClientServerSSL(boolean useSecurePort) throws Exception {
+        testClientServerSSL("localhost", useSecurePort, CONNECTION_TIMEOUT);
+    }
+
+    public void testClientServerSSL(String hostname, boolean useSecurePort, long connectTimeout) throws Exception {
         final int SERVER_COUNT = 3;
         final int[] clientPorts = new int[SERVER_COUNT];
         final Integer[] secureClientPorts = new Integer[SERVER_COUNT];
@@ -122,15 +222,14 @@ public void testClientServerSSL(boolean useSecurePort) throws Exception {
 
         // Servers have been set up. Now go test if secure connection is successful.
         for (int i = 0; i < SERVER_COUNT; i++) {
-            assertTrue(
-                    "waiting for server " + i + " being up",
-                    ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], TIMEOUT),
+                    "waiting for server " + i + " being up");
             final int port = useSecurePort ? secureClientPorts[i] : clientPorts[i];
-            ZooKeeper zk = ClientBase.createZKClient("127.0.0.1:" + port, TIMEOUT);
-            // Do a simple operation to make sure the connection is fine.
-            zk.create("/test", "".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-            zk.delete("/test", -1);
-            zk.close();
+            try (ZooKeeper zk = ClientBase.createZKClient(hostname + ":" + port, TIMEOUT, connectTimeout)) {
+                // Do a simple operation to make sure the connection is fine.
+                zk.create("/test", "".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+                zk.delete("/test", -1);
+            }
         }
 
         for (int i = 0; i < mt.length; i++) {
@@ -157,4 +256,26 @@ public void testSecureStandaloneServer() throws Exception {
         mt.shutdown();
     }
 
+    @Test
+    public void testSecureStandaloneServerAuthFail() throws IOException {
+        try {
+            System.setProperty(ProviderRegistry.AUTHPROVIDER_PROPERTY_PREFIX + "authfail",
+                AuthFailX509AuthenticationProvider.class.getName());
+            System.setProperty(clientX509Util.getSslAuthProviderProperty(), "authfail");
+
+            Integer secureClientPort = PortAssignment.unique();
+            MainThread mt = new MainThread(MainThread.UNSET_MYID, "", secureClientPort, false);
+            mt.start();
+
+            AssertionError ex = assertThrows("Client should not able to connect when authentication fails", AssertionError.class,
+                () -> {
+                    ClientBase.createZKClient("localhost:" + secureClientPort, TIMEOUT, 3000);
+                });
+            assertThat("Exception message does not match (different exception caught?)",
+                ex.getMessage(), startsWith("ZooKeeper client can not connect to"));
+        } finally {
+            System.clearProperty(ProviderRegistry.AUTHPROVIDER_PROPERTY_PREFIX + "authfail");
+            System.clearProperty(clientX509Util.getSslAuthProviderProperty());
+        }
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSkipACLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSkipACLTest.java
index d9b8cdddd7e..b6971858636 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSkipACLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientSkipACLTest.java
@@ -18,17 +18,17 @@
 
 package org.apache.zookeeper.test;
 
-import org.junit.AfterClass;
-import org.junit.BeforeClass;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
 
 public class ClientSkipACLTest extends ClientTest {
 
-    @BeforeClass
+    @BeforeAll
     public static void setup() {
         System.setProperty("zookeeper.skipACL", "yes");
     }
 
-    @AfterClass
+    @AfterAll
     public static void teardown() {
         System.clearProperty("zookeeper.skipACL");
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientTest.java
index 6bd483b49f3..faf5c260ea7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ClientTest.java
@@ -18,12 +18,12 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNotSame;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNotSame;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Collections;
@@ -53,7 +53,7 @@
 import org.apache.zookeeper.proto.RequestHeader;
 import org.apache.zookeeper.server.PrepRequestProcessor;
 import org.apache.zookeeper.server.util.OSMXBean;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -135,7 +135,7 @@ public void testACLs() throws Exception {
             }
 
             try {
-                ArrayList<ACL> testACL = new ArrayList<ACL>();
+                ArrayList<ACL> testACL = new ArrayList<>();
                 testACL.add(new ACL(Perms.ALL | Perms.ADMIN, Ids.AUTH_IDS));
                 testACL.add(new ACL(Perms.ALL | Perms.ADMIN, new Id("ip", "127.0.0.1/8")));
                 zk.create("/acltest", new byte[0], testACL, CreateMode.PERSISTENT);
@@ -145,7 +145,7 @@ public void testACLs() throws Exception {
             }
 
             try {
-                ArrayList<ACL> testACL = new ArrayList<ACL>();
+                ArrayList<ACL> testACL = new ArrayList<>();
                 testACL.add(new ACL(Perms.ALL | Perms.ADMIN, new Id()));
                 zk.create("/nullidtest", new byte[0], testACL, CreateMode.PERSISTENT);
                 fail("Should have received an invalid acl error");
@@ -154,7 +154,7 @@ public void testACLs() throws Exception {
             }
 
             zk.addAuthInfo("digest", "ben:passwd".getBytes());
-            ArrayList<ACL> testACL = new ArrayList<ACL>();
+            ArrayList<ACL> testACL = new ArrayList<>();
             testACL.add(new ACL(Perms.ALL, new Id("auth", "")));
             testACL.add(new ACL(Perms.WRITE, new Id("ip", "127.0.0.1")));
             zk.create("/acltest", new byte[0], testACL, CreateMode.PERSISTENT);
@@ -204,7 +204,7 @@ public void testNullAuthId() throws Exception {
         try {
             zk = createClient();
             zk.addAuthInfo("digest", "ben:passwd".getBytes());
-            ArrayList<ACL> testACL = new ArrayList<ACL>();
+            ArrayList<ACL> testACL = new ArrayList<>();
             testACL.add(new ACL(Perms.ALL, new Id("auth", null)));
             zk.create("/acltest", new byte[0], testACL, CreateMode.PERSISTENT);
             zk.close();
@@ -242,7 +242,7 @@ public void testNullAuthId() throws Exception {
 
     private class MyWatcher extends CountdownWatcher {
 
-        LinkedBlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<WatchedEvent>();
+        LinkedBlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<>();
 
         public void process(WatchedEvent event) {
             super.process(event);
@@ -262,7 +262,7 @@ public void process(WatchedEvent event) {
      * in the right order.
      */
     @Test
-    public void testMutipleWatcherObjs() throws IOException, InterruptedException, KeeperException {
+    public void testMultipleWatcherObjs() throws IOException, InterruptedException, KeeperException {
         ZooKeeper zk = createClient(new CountdownWatcher(), hostPort);
         try {
             MyWatcher[] watchers = new MyWatcher[100];
@@ -445,7 +445,7 @@ private void performClientTest(boolean withWatcherObj) throws IOException, Inter
             assertEquals(10, children.size());
             for (int i = 0; i < 10; i++) {
                 final String name = children.get(i);
-                assertTrue("starts with -", name.startsWith(i + "-"));
+                assertTrue(name.startsWith(i + "-"), "starts with -");
                 byte[] b;
                 if (withWatcherObj) {
                     b = zk.getData("/pat/ben/" + name, watcher, stat);
@@ -512,12 +512,12 @@ public void testSequentialNodeNames() throws IOException, InterruptedException,
             zk.create(filepath, new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_SEQUENTIAL);
             children = zk.getChildren(path, false);
             assertEquals(2, children.size());
-            assertTrue("contains child 1", children.contains(file + "0000000001"));
+            assertTrue(children.contains(file + "0000000001"), "contains child 1");
 
             zk.create(filepath, new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_SEQUENTIAL);
             children = zk.getChildren(path, false);
             assertEquals(3, children.size());
-            assertTrue("contains child 2", children.contains(file + "0000000002"));
+            assertTrue(children.contains(file + "0000000002"), "contains child 2");
 
             // The pattern is holding so far.  Let's run the counter a bit
             // to be sure it continues to spit out the correct answer
@@ -526,7 +526,7 @@ public void testSequentialNodeNames() throws IOException, InterruptedException,
             }
 
             children = zk.getChildren(path, false);
-            assertTrue("contains child 104", children.contains(file + "0000000104"));
+            assertTrue(children.contains(file + "0000000104"), "contains child 104");
 
         } finally {
             if (zk != null) {
@@ -805,7 +805,7 @@ public synchronized void process(WatchedEvent event) {
         assertEquals(r.getErr(), Code.UNIMPLEMENTED.intValue());
 
         // Sending a nonexisting opcode should cause the server to disconnect
-        assertTrue("failed to disconnect", clientDisconnected.await(5000, TimeUnit.MILLISECONDS));
+        assertTrue(clientDisconnected.await(5000, TimeUnit.MILLISECONDS), "failed to disconnect");
         zk.close();
     }
 
@@ -835,11 +835,11 @@ public void testCXidRollover() throws Exception {
                     rc.set(retcode);
                     latch.countDown();
                 }, null);
-                assertTrue("setData should complete within 5s", latch.await(zk.getSessionTimeout(), TimeUnit.MILLISECONDS));
-                assertEquals("setData should have succeeded", Code.OK.intValue(), rc.get());
+                assertTrue(latch.await(zk.getSessionTimeout(), TimeUnit.MILLISECONDS), "setData should complete within 5s");
+                assertEquals(Code.OK.intValue(), rc.get(), "setData should have succeeded");
             }
             zk.delete("/testnode", -1);
-            assertTrue("xid should be positive", zk.checkXid() > 0);
+            assertTrue(zk.checkXid() > 0, "xid should be positive");
         } finally {
             if (zk != null) {
                 zk.close();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ConnectStringParserTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ConnectStringParserTest.java
index 066e0f35849..d7d55a4b135 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ConnectStringParserTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ConnectStringParserTest.java
@@ -18,10 +18,15 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import java.util.HashMap;
+import java.util.Map;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.client.ConnectStringParser;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class ConnectStringParserTest extends ZKTestCase {
 
@@ -85,4 +90,110 @@ private void assertChrootPath(String expected, ConnectStringParser parser) {
         assertEquals(expected, parser.getChrootPath());
     }
 
+    @Test
+    public void testParseIPV6ConnectionString() {
+        String servers = "[127::1],127.0.10.2";
+        ConnectStringParser parser = new ConnectStringParser(servers);
+
+        assertEquals("127::1", parser.getServerAddresses().get(0).getHostString());
+        assertEquals("127.0.10.2", parser.getServerAddresses().get(1).getHostString());
+        assertEquals(2181, parser.getServerAddresses().get(0).getPort());
+        assertEquals(2181, parser.getServerAddresses().get(1).getPort());
+
+        servers = "[127::1]:2181,[127::2]:2182,[127::3]:2183";
+        parser = new ConnectStringParser(servers);
+
+        assertEquals("127::1", parser.getServerAddresses().get(0).getHostString());
+        assertEquals("127::2", parser.getServerAddresses().get(1).getHostString());
+        assertEquals("127::3", parser.getServerAddresses().get(2).getHostString());
+        assertEquals(2181, parser.getServerAddresses().get(0).getPort());
+        assertEquals(2182, parser.getServerAddresses().get(1).getPort());
+        assertEquals(2183, parser.getServerAddresses().get(2).getPort());
+    }
+
+    @Test
+    public void testDnsSrvFormatNoChroot() {
+        testDnsSrvFormat("dns-srv://zookeeper.myapp.com", "zookeeper.myapp.com", null);
+    }
+
+    @Test
+    public void testDnsSrvFormatWithChroot() {
+        testDnsSrvFormat("dns-srv://zookeeper.myapp.com/myapp", "zookeeper.myapp.com", "/myapp");
+    }
+
+    @Test
+    public void testDnsSrvFormatWithNestedChroot() {
+        testDnsSrvFormat("dns-srv://zookeeper.shared.com/services/auth", "zookeeper.shared.com", "/services/auth");
+    }
+
+    @Test
+    public void testDnsSrvFormatWithRootChroot() {
+        testDnsSrvFormat("dns-srv://zookeeper.myapp.com/", "zookeeper.myapp.com", null);
+    }
+
+    @Test
+    public void testDnsSrvFormatWithSubdomain() {
+        testDnsSrvFormat("dns-srv://zk.prod.myapp.com/production", "zk.prod.myapp.com", "/production");
+    }
+
+    @Test
+    public void testDnsSrvFormatInvalidChroot() {
+        final String connectString = "dns-srv://zookeeper.myapp.com/invalid/";
+        assertThrows(IllegalArgumentException.class, () -> new ConnectStringParser(connectString));
+    }
+
+    @Test
+    public void testMixedFormatsComparison() {
+        final String hostPortFormat = "zk1:2181,zk2:2181/myapp";
+        final String dnsSrvFormat = "dns-srv://zookeeper.myapp.com/myapp";
+
+        final ConnectStringParser hostPortParser = new ConnectStringParser(hostPortFormat);
+        final ConnectStringParser dnsSrvParser = new ConnectStringParser(dnsSrvFormat);
+
+        // Both should have the same chroot path
+        assertEquals("/myapp", hostPortParser.getChrootPath());
+        assertEquals("/myapp", dnsSrvParser.getChrootPath());
+
+        // Host:Port format should have multiple server addresses
+        assertEquals(2, hostPortParser.getServerAddresses().size());
+        assertEquals("zk1", hostPortParser.getServerAddresses().get(0).getHostString());
+        assertEquals("zk2", hostPortParser.getServerAddresses().get(1).getHostString());
+
+        // DNS SRV format should have single DNS service name
+        assertEquals(1, dnsSrvParser.getServerAddresses().size());
+        assertEquals("zookeeper.myapp.com", dnsSrvParser.getServerAddresses().get(0).getHostString());
+    }
+
+    @Test
+    public void testBackwardCompatibility() {
+        final Map<String, Integer> testCases = new HashMap<>();
+
+        testCases.put("localhost:2181", 1);
+        testCases.put("zk1:2181,zk2:2181,zk3:2181", 3);
+        testCases.put("zk1:2181,zk2:2181/myapp", 2);
+        testCases.put("[::1]:2181", 1);
+        testCases.put("[2001:db8::1]:2181,[2001:db8::2]:2181/test", 2);
+
+        for (final Map.Entry<String, Integer> testCase : testCases.entrySet()) {
+            final String connectString = testCase.getKey();
+            final int expectedSize = testCase.getValue();
+
+            final ConnectStringParser parser = new ConnectStringParser(connectString);
+            assertNotNull(parser.getServerAddresses());
+            assertEquals(expectedSize, parser.getServerAddresses().size());
+        }
+    }
+
+    private void testDnsSrvFormat(final String connectString, final String expectedHostName, final String expectedChrootPath) {
+        final ConnectStringParser parser = new ConnectStringParser(connectString);
+
+        if (expectedChrootPath == null) {
+            assertNull(parser.getChrootPath());
+        } else {
+            assertEquals(expectedChrootPath, parser.getChrootPath());
+        }
+        assertEquals(1, parser.getServerAddresses().size());
+        assertEquals(expectedHostName, parser.getServerAddresses().get(0).getHostString());
+        assertEquals(2181, parser.getServerAddresses().get(0).getPort());
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/CreateModeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/CreateModeTest.java
index d2e908b58b3..ee2e4f4f75e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/CreateModeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/CreateModeTest.java
@@ -18,16 +18,16 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.EnumSet;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.KeeperException.Code;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class CreateModeTest extends ZKTestCase {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/CreateTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/CreateTest.java
index a3d5ccf8cf2..953c174434c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/CreateTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/CreateTest.java
@@ -18,17 +18,19 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
 import java.io.IOException;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.data.Stat;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 /**
  * Test suite for validating the Create API.
@@ -37,12 +39,14 @@ public class CreateTest extends ClientBase {
 
     private ZooKeeper zk;
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         super.setUp();
         zk = createClient();
     }
 
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         super.tearDown();
@@ -61,7 +65,7 @@ public void testCreateWithStat() throws IOException, KeeperException, Interrupte
         Stat stat = createWithStatVerifyResult("/foo");
         Stat childStat = createWithStatVerifyResult("/foo/child");
         // Don't expect to get the same stats for different creates.
-        assertFalse(stat.equals(childStat));
+        assertNotEquals(stat, childStat);
     }
 
     @Test
@@ -78,21 +82,21 @@ public void testCreateWithNullStat() throws IOException, KeeperException, Interr
     }
 
     private void createNoStatVerifyResult(String newName) throws KeeperException, InterruptedException {
-        assertNull("Node existed before created", zk.exists(newName, false));
+        assertNull(zk.exists(newName, false), "Node existed before created");
         String path = zk.create(newName, newName.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         assertEquals(path, newName);
-        assertNotNull("Node was not created as expected", zk.exists(newName, false));
+        assertNotNull(zk.exists(newName, false), "Node was not created as expected");
     }
 
     private Stat createWithStatVerifyResult(String newName) throws KeeperException, InterruptedException {
-        assertNull("Node existed before created", zk.exists(newName, false));
+        assertNull(zk.exists(newName, false), "Node existed before created");
         Stat stat = new Stat();
         String path = zk.create(newName, newName.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
         assertEquals(path, newName);
         validateCreateStat(stat, newName);
 
         Stat referenceStat = zk.exists(newName, false);
-        assertNotNull("Node was not created as expected", referenceStat);
+        assertNotNull(referenceStat, "Node was not created as expected");
         assertEquals(referenceStat, stat);
 
         return stat;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/DigestAuthDisabledTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/DigestAuthDisabledTest.java
new file mode 100644
index 00000000000..bbbc63f964b
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/DigestAuthDisabledTest.java
@@ -0,0 +1,82 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import static org.junit.jupiter.api.Assertions.fail;
+import java.io.IOException;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.TimeUnit;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.TestableZooKeeper;
+import org.apache.zookeeper.WatchedEvent;
+import org.apache.zookeeper.Watcher.Event.KeeperState;
+import org.apache.zookeeper.ZooKeeper;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+
+public class DigestAuthDisabledTest extends ClientBase {
+
+    @BeforeAll
+    public static void setUpEnvironment() {
+        System.setProperty("zookeeper.DigestAuthenticationProvider.enabled", "false");
+    }
+
+    @AfterAll
+    public static void cleanUpEnvironment() {
+        System.clearProperty("zookeeper.DigestAuthenticationProvider.enabled");
+    }
+
+    private final CountDownLatch authFailed = new CountDownLatch(1);
+
+    @Override
+    protected TestableZooKeeper createClient(String hp) throws IOException, InterruptedException {
+        MyWatcher watcher = new MyWatcher();
+        return createClient(watcher, hp);
+    }
+
+    private class MyWatcher extends CountdownWatcher {
+
+        @Override
+        public synchronized void process(WatchedEvent event) {
+            if (event.getState() == KeeperState.AuthFailed) {
+                authFailed.countDown();
+            } else {
+                super.process(event);
+            }
+        }
+
+    }
+
+    @Test
+    public void testDigestAuthDisabledTriggersAuthFailed() throws Exception {
+        ZooKeeper zk = createClient();
+        try {
+            zk.addAuthInfo("digest", "roger:muscadet".getBytes());
+            zk.getData("/path1", false, null);
+            fail("Should get auth state error");
+        } catch (KeeperException.AuthFailedException e) {
+            if (!authFailed.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS)) {
+                fail("Should have called my watcher");
+            }
+        } finally {
+            zk.close();
+        }
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/DisconnectedWatcherTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/DisconnectedWatcherTest.java
index dcff76cca86..aacede199c7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/DisconnectedWatcherTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/DisconnectedWatcherTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.concurrent.LinkedBlockingQueue;
@@ -29,9 +29,10 @@
 import org.apache.zookeeper.Watcher.Event.EventType;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -42,7 +43,7 @@ public class DisconnectedWatcherTest extends ClientBase {
 
     private class MyWatcher extends CountdownWatcher {
 
-        LinkedBlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<WatchedEvent>();
+        LinkedBlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<>();
 
         public void process(WatchedEvent event) {
             super.process(event);
@@ -62,7 +63,7 @@ public void process(WatchedEvent event) {
     private MyWatcher watcher2;
     private ZooKeeper zk2;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         super.setUp();
         watcher1 = new CountdownWatcher();
@@ -70,7 +71,7 @@ public void setUp() throws Exception {
         watcher2 = new MyWatcher();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         if (zk2 != null) {
             zk2.close();
@@ -186,19 +187,20 @@ public void testDeepChildWatcherAutoResetWithChroot() throws Exception {
 
     // @see jira issue ZOOKEEPER-706. Test auto reset of a large number of
     // watches which require multiple SetWatches calls.
-    @Test(timeout = 840000)
+    @Test
+    @Timeout(value = 14, unit = TimeUnit.MINUTES)
     public void testManyChildWatchersAutoReset() throws Exception {
         zk2 = createClient(watcher2);
 
         // 110 character base path
         String pathBase = "/long-path-000000000-111111111-222222222-333333333-444444444-"
-                                  + "555555555-666666666-777777777-888888888-999999999";
+                + "555555555-666666666-777777777-888888888-999999999";
 
         zk1.create(pathBase, null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
         // Create 10,000 nodes. This should ensure the length of our
         // watches set below exceeds 1MB.
-        List<String> paths = new ArrayList<String>();
+        List<String> paths = new ArrayList<>();
         for (int i = 0; i < 10000; i++) {
             String path = zk1.create(pathBase + "/ch-", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT_SEQUENTIAL);
             paths.add(path);
@@ -245,7 +247,7 @@ public void testManyChildWatchersAutoReset() throws Exception {
                 assertEquals(EventType.NodeCreated, e.getType());
                 assertEquals(path + "/foo", e.getPath());
             } else if (i % 3 == 2) {
-                zk1.setData(path, new byte[]{1, 2, 3}, -1);
+                zk1.setData(path, new byte[] { 1, 2, 3 }, -1);
 
                 WatchedEvent e = childWatcher.events.poll(TIMEOUT, TimeUnit.MILLISECONDS);
                 assertNotNull(e);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/DuplicateLocalSessionUpgradeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/DuplicateLocalSessionUpgradeTest.java
index 8e2b53053da..0723f3fcb92 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/DuplicateLocalSessionUpgradeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/DuplicateLocalSessionUpgradeTest.java
@@ -18,18 +18,18 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -47,7 +47,7 @@ public class DuplicateLocalSessionUpgradeTest extends ZKTestCase {
 
     private static final int CONNECTION_TIMEOUT = ClientBase.CONNECTION_TIMEOUT;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         LOG.info("STARTING quorum {}", getClass().getName());
         qb.localSessionsEnabled = true;
@@ -56,7 +56,7 @@ public void setUp() throws Exception {
         ClientBase.waitForServerUp(qb.hostPort, 10000);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         LOG.info("STOPPING quorum {}", getClass().getName());
         qb.tearDown();
@@ -75,7 +75,7 @@ public void testLocalSessionUpgradeOnLeader() throws Exception {
     private void testLocalSessionUpgrade(boolean testLeader) throws Exception {
 
         int leaderIdx = qb.getLeaderIndex();
-        assertFalse("No leader in quorum?", leaderIdx == -1);
+        assertFalse(leaderIdx == -1, "No leader in quorum?");
         int followerIdx = (leaderIdx + 1) % 5;
         int testPeerIdx = testLeader ? leaderIdx : followerIdx;
         String[] hostPorts = qb.hostPort.split(",");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/EmptiedSnapshotRecoveryTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/EmptiedSnapshotRecoveryTest.java
index da50a9c17e7..b9020cc9adf 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/EmptiedSnapshotRecoveryTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/EmptiedSnapshotRecoveryTest.java
@@ -18,12 +18,14 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.IOException;
 import java.io.PrintWriter;
+import java.nio.file.Files;
 import java.util.List;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.PortAssignment;
@@ -36,7 +38,7 @@
 import org.apache.zookeeper.server.SyncRequestProcessor;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -61,7 +63,7 @@ public void runTest(boolean leaveEmptyFile, boolean trustEmptySnap) throws Excep
         final int PORT = Integer.parseInt(HOSTPORT.split(":")[1]);
         ServerCnxnFactory f = ServerCnxnFactory.createFactory(PORT, -1);
         f.startup(zks);
-        assertTrue("waiting for server being up ", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up ");
         ZooKeeper zk = new ZooKeeper(HOSTPORT, CONNECTION_TIMEOUT, this);
         try {
             for (int i = 0; i < N_TRANSACTIONS; i++) {
@@ -72,20 +74,20 @@ public void runTest(boolean leaveEmptyFile, boolean trustEmptySnap) throws Excep
         }
         f.shutdown();
         zks.shutdown();
-        assertTrue("waiting for server to shutdown", ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server to shutdown");
 
         // start server again with intact database
         zks = new ZooKeeperServer(tmpSnapDir, tmpLogDir, 3000);
         zks.startdata();
         long zxid = zks.getZKDatabase().getDataTreeLastProcessedZxid();
         LOG.info("After clean restart, zxid = {}", zxid);
-        assertTrue("zxid > 0", zxid > 0);
+        assertTrue(zxid > 0, "zxid > 0");
         zks.shutdown();
 
         // Make all snapshots empty
         FileTxnSnapLog txnLogFactory = zks.getTxnLogFactory();
         List<File> snapshots = txnLogFactory.findNRecentSnapshots(10);
-        assertTrue("We have a snapshot to corrupt", snapshots.size() > 0);
+        assertTrue(snapshots.size() > 0, "We have a snapshot to corrupt");
         for (File file : snapshots) {
             if (leaveEmptyFile) {
                 new PrintWriter(file).close();
@@ -105,7 +107,7 @@ public void runTest(boolean leaveEmptyFile, boolean trustEmptySnap) throws Excep
             if (!trustEmptySnap) {
                 fail("Should have gotten exception for corrupted database");
             }
-            assertEquals("zxid mismatch after restoring database", currentZxid, zxid);
+            assertEquals(currentZxid, zxid, "zxid mismatch after restoring database");
         } catch (IOException e) {
             // expected behavior
             if (trustEmptySnap) {
@@ -143,6 +145,54 @@ public void testRestoreWithTrustedEmptySnapFiles() throws Exception {
         runTest(false, true);
     }
 
+    @Test
+    public void testRestoreWithTrustedEmptySnapFilesWhenFollowing() throws Exception {
+        QuorumUtil qu = new QuorumUtil(1);
+        try {
+            qu.startAll();
+            String connString = qu.getConnectionStringForServer(1);
+            try (ZooKeeper zk = new ZooKeeper(connString, CONNECTION_TIMEOUT, this)) {
+                for (int i = 0; i < N_TRANSACTIONS; i++) {
+                    zk.create("/node-" + i, new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+                }
+            }
+            int leaderIndex = qu.getLeaderServer();
+            //Shut down the cluster and delete the snapshots from the followers
+            for (int i = 1; i <= qu.ALL; i++) {
+                qu.shutdown(i);
+                if (i != leaderIndex) {
+                    FileTxnSnapLog txnLogFactory = qu.getPeer(i).peer.getTxnFactory();
+                    List<File> snapshots = txnLogFactory.findNRecentSnapshots(10);
+                    assertTrue(snapshots.size() > 0, "We have a snapshot to corrupt");
+                    for (File file : snapshots) {
+                        Files.delete(file.toPath());
+                    }
+                    assertEquals(txnLogFactory.findNRecentSnapshots(10).size(), 0);
+                }
+            }
+            //Start while trusting empty snapshots, verify that the followers save snapshots
+            System.setProperty(FileTxnSnapLog.ZOOKEEPER_SNAPSHOT_TRUST_EMPTY, "true");
+            qu.start(leaderIndex);
+            for (int i = 1; i <= qu.ALL; i++) {
+                if (i != leaderIndex) {
+                    qu.restart(i);
+                    FileTxnSnapLog txnLogFactory = qu.getPeer(i).peer.getTxnFactory();
+                    List<File> snapshots = txnLogFactory.findNRecentSnapshots(10);
+                    assertTrue(snapshots.size() > 0, "A snapshot should have been created on follower " + i);
+                }
+            }
+            //Check that the created nodes are still there
+            try (ZooKeeper zk = new ZooKeeper(connString, CONNECTION_TIMEOUT, this)) {
+                for (int i = 0; i < N_TRANSACTIONS; i++) {
+                    assertNotNull(zk.exists("/node-" + i, false));
+                }
+            }
+        } finally {
+            System.clearProperty(FileTxnSnapLog.ZOOKEEPER_SNAPSHOT_TRUST_EMPTY);
+            qu.tearDown();
+        }
+    }
+
     public void process(WatchedEvent event) {
         // do nothing
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/EnforceQuotaTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/EnforceQuotaTest.java
new file mode 100644
index 00000000000..c489618bf57
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/EnforceQuotaTest.java
@@ -0,0 +1,92 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import static org.junit.Assert.fail;
+import java.util.UUID;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.StatsTrack;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.cli.SetQuotaCommand;
+import org.apache.zookeeper.server.ZooKeeperServer;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+/**
+ * An unit case when Enforce Quota disables by default
+ */
+public class EnforceQuotaTest extends ClientBase {
+
+    private ZooKeeper zk;
+
+    @BeforeEach
+    @Override
+    public void setUp() throws Exception {
+        super.setUp();
+        zk = createClient();
+    }
+
+    @AfterEach
+    @Override
+    public void tearDown() throws Exception {
+        System.clearProperty(ZooKeeperServer.ENFORCE_QUOTA);
+        super.tearDown();
+        zk.close();
+    }
+
+    @Test
+    public void testSetQuotaDisableWhenExceedBytesHardQuota() throws Exception {
+        final String namespace = UUID.randomUUID().toString();
+        final String path = "/" + namespace;
+        zk.create(path, "12345".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        StatsTrack st = new StatsTrack();
+        st.setByteHardLimit(5L);
+        SetQuotaCommand.createQuota(zk, path, st);
+
+        try {
+            zk.setData(path, "123456".getBytes(), -1);
+            ZooKeeperQuotaTest.validateNoQuotaExceededMetrics(namespace);
+        } catch (KeeperException.QuotaExceededException e) {
+            fail("should not throw Byte Quota Exceeded Exception when enforce quota disables");
+        }
+    }
+
+    @Test
+    public void testSetQuotaDisableWhenExceedCountHardQuota() throws Exception {
+
+        final String namespace = UUID.randomUUID().toString();
+        final String path = "/" + namespace;
+        zk.create(path, "data".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        int count = 2;
+        StatsTrack st = new StatsTrack();
+        st.setCountHardLimit(count);
+        SetQuotaCommand.createQuota(zk, path, st);
+        zk.create(path + "/c2", "data".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+        try {
+            zk.create(path + "/c2" + "/c3", "data".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            ZooKeeperQuotaTest.validateNoQuotaExceededMetrics(namespace);
+        } catch (KeeperException.QuotaExceededException e) {
+            fail("should not throw Count Quota Exceeded Exception when enforce quota disables");
+        }
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/EnsembleAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/EnsembleAuthTest.java
index dcd7ee6f1e5..8fbe79011be 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/EnsembleAuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/EnsembleAuthTest.java
@@ -18,24 +18,25 @@
 
 package org.apache.zookeeper.test;
 
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import java.io.IOException;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.server.auth.EnsembleAuthenticationProvider;
 import org.apache.zookeeper.server.auth.ProviderRegistry;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class EnsembleAuthTest extends ClientBase {
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         System.setProperty("zookeeper.authProvider.1", "org.apache.zookeeper.server.auth.EnsembleAuthenticationProvider");
         super.setUp();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         super.tearDown();
         System.clearProperty("zookeeper.authProvider.1");
@@ -76,16 +77,20 @@ public void passAuthCSV() throws Exception {
         connectToEnsemble("baz");
     }
 
-    @Test(expected = KeeperException.ConnectionLossException.class)
-    public void failAuth() throws Exception {
-        resetEnsembleAuth("woo", true);
-        connectToEnsemble("goo");
+    @Test
+    public void failAuth() {
+        assertThrows(KeeperException.ConnectionLossException.class, () -> {
+            resetEnsembleAuth("woo", true);
+            connectToEnsemble("goo");
+        });
     }
 
-    @Test(expected = KeeperException.AuthFailedException.class)
-    public void removeEnsembleAuthProvider() throws Exception {
-        resetEnsembleAuth(null, false);
-        connectToEnsemble("goo");
+    @Test
+    public void removeEnsembleAuthProvider() {
+        assertThrows(KeeperException.AuthFailedException.class, () -> {
+            resetEnsembleAuth(null, false);
+            connectToEnsemble("goo");
+        });
     }
 
     private void connectToEnsemble(final String auth) throws IOException, InterruptedException, KeeperException {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/EventTypeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/EventTypeTest.java
index cf9807dd354..b7ff295d933 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/EventTypeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/EventTypeTest.java
@@ -18,12 +18,12 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.EnumSet;
 import org.apache.zookeeper.Watcher.Event.EventType;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class EventTypeTest extends ZKTestCase {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLENewEpochTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLENewEpochTest.java
index 64af39737be..eb62dd65364 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLENewEpochTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLENewEpochTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.net.InetSocketAddress;
 import java.util.ArrayList;
@@ -30,9 +30,9 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.server.quorum.Vote;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -50,12 +50,12 @@ public class FLENewEpochTest extends ZKTestCase {
     Semaphore start0;
     Semaphore finish3, finish0;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         count = 3;
 
-        peers = new HashMap<Long, QuorumServer>(count);
-        threads = new ArrayList<LEThread>(count);
+        peers = new HashMap<>(count);
+        threads = new ArrayList<>(count);
         tmpdir = new File[count];
         port = new int[count];
 
@@ -69,7 +69,7 @@ public void setUp() throws Exception {
         finish3 = new Semaphore(0);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         for (int i = 0; i < threads.size(); i++) {
             threads.get(i).peer.getElectionAlg().shutdown();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLEPredicateTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLEPredicateTest.java
index 3fcb83bed03..5c372b9dc7d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLEPredicateTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLEPredicateTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.IOException;
 import java.net.InetSocketAddress;
@@ -30,7 +30,7 @@
 import org.apache.zookeeper.server.quorum.FastLeaderElection;
 import org.apache.zookeeper.server.quorum.QuorumPeer;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -55,7 +55,7 @@ boolean predicate(long newId, long newZxid, long newEpoch, long curId, long curZ
     @Test
     public void testPredicate() throws IOException {
 
-        peers = new HashMap<Long, QuorumServer>(3);
+        peers = new HashMap<>(3);
 
         /*
          * Creates list of peers.
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLERestartTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLERestartTest.java
index 3563019ea9b..07ac68b782d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLERestartTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLERestartTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.net.InetSocketAddress;
 import java.util.ArrayList;
@@ -33,9 +33,9 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.server.quorum.Vote;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -71,17 +71,17 @@ int countVotes(HashSet<TestVote> hs, long id) {
         return counter;
     }
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         count = 3;
-        peers = new HashMap<Long, QuorumServer>(count);
-        restartThreads = new ArrayList<FLERestartThread>(count);
+        peers = new HashMap<>(count);
+        restartThreads = new ArrayList<>(count);
         tmpdir = new File[count];
         port = new int[count];
         finish = new Semaphore(0);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         for (int i = 0; i < restartThreads.size(); i++) {
             restartThreads.get(i).peer.getElectionAlg().shutdown();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLETest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLETest.java
index 8583f64d8bf..b147f7ae82e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLETest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLETest.java
@@ -18,10 +18,10 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.net.InetSocketAddress;
 import java.util.ArrayList;
@@ -38,9 +38,9 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.server.quorum.Vote;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -86,21 +86,21 @@ int countVotes(HashSet<TestVote> hs, long id) {
     Random rand = new Random();
     Set<Long> joinedThreads;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         count = 7;
 
-        peers = new HashMap<Long, QuorumServer>(count);
-        threads = new ArrayList<LEThread>(count);
+        peers = new HashMap<>(count);
+        threads = new ArrayList<>(count);
         voteMap = new HashMap<Integer, HashSet<TestVote>>();
         votes = new Vote[count];
         tmpdir = new File[count];
         port = new int[count];
         successCount = 0;
-        joinedThreads = new HashSet<Long>();
+        joinedThreads = new HashSet<>();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         for (int i = 0; i < threads.size(); i++) {
             leThread = threads.get(i);
@@ -191,7 +191,7 @@ public void run() {
                          * we first update it with the vote of this peer.
                          */
                         if (quora.get(v.getId()) == null) {
-                            quora.put(v.getId(), new HashSet<Integer>());
+                            quora.put(v.getId(), new HashSet<>());
                         }
                         quora.get(v.getId()).add(i);
 
@@ -205,12 +205,10 @@ public void run() {
                                  * Assert that the state of the thread is the one expected.
                                  */
                                 if (v.getId() == i) {
-                                    assertTrue("Wrong state" + peer.getPeerState(), peer.getPeerState()
-                                                                                                   == ServerState.LEADING);
+                                    assertTrue(peer.getPeerState() == ServerState.LEADING, "Wrong state" + peer.getPeerState());
                                     leader = i;
                                 } else {
-                                    assertTrue("Wrong state" + peer.getPeerState(), peer.getPeerState()
-                                                                                                   == ServerState.FOLLOWING);
+                                    assertTrue(peer.getPeerState() == ServerState.FOLLOWING, "Wrong state" + peer.getPeerState());
                                 }
 
                                 /*
@@ -298,7 +296,7 @@ public void testTripleElection() throws Exception {
      * @throws Exception
      */
     private void runElection(int rounds) throws Exception {
-        ConcurrentHashMap<Long, HashSet<Integer>> quora = new ConcurrentHashMap<Long, HashSet<Integer>>();
+        ConcurrentHashMap<Long, HashSet<Integer>> quora = new ConcurrentHashMap<>();
 
         LOG.info("TestLE: {}, {}", getTestName(), count);
 
@@ -370,7 +368,7 @@ public VerifyState(QuorumPeer peer) {
             this.peer = peer;
         }
         public void run() {
-            setName("VerifyState-" + peer.getId());
+            setName("VerifyState-" + peer.getMyId());
             while (true) {
                 if (peer.getPeerState() == ServerState.FOLLOWING) {
                     LOG.info("I am following");
@@ -403,7 +401,7 @@ public void testJoin() throws Exception {
         int sid;
         QuorumPeer peer;
         int waitTime = 10 * 1000;
-        ArrayList<QuorumPeer> peerList = new ArrayList<QuorumPeer>();
+        ArrayList<QuorumPeer> peerList = new ArrayList<>();
         for (sid = 0; sid < 3; sid++) {
             port[sid] = PortAssignment.unique();
             peers.put(Long.valueOf(sid), new QuorumServer(sid, new InetSocketAddress("127.0.0.1", PortAssignment.unique()), new InetSocketAddress("127.0.0.1", PortAssignment.unique()), new InetSocketAddress("127.0.0.1", port[sid])));
@@ -412,7 +410,7 @@ public void testJoin() throws Exception {
         // start 2 peers and verify if they form the cluster
         for (sid = 0; sid < 2; sid++) {
             peer = new QuorumPeer(peers, tmpdir[sid], tmpdir[sid], port[sid], 3, sid, 2000, 2, 2, 2);
-            LOG.info("Starting peer {}", peer.getId());
+            LOG.info("Starting peer {}", peer.getMyId());
             peer.start();
             peerList.add(sid, peer);
         }
@@ -420,19 +418,19 @@ public void testJoin() throws Exception {
         VerifyState v1 = new VerifyState(peerList.get(0));
         v1.start();
         v1.join(waitTime);
-        assertFalse("Unable to form cluster in " + waitTime + " ms", !v1.isSuccess());
+        assertFalse(!v1.isSuccess(), "Unable to form cluster in " + waitTime + " ms");
         // Start 3rd peer and check if it goes in LEADING state
         peer = new QuorumPeer(peers, tmpdir[sid], tmpdir[sid], port[sid], 3, sid, 2000, 2, 2, 2);
-        LOG.info("Starting peer {}", peer.getId());
+        LOG.info("Starting peer {}", peer.getMyId());
         peer.start();
         peerList.add(sid, peer);
         v1 = new VerifyState(peer);
         v1.start();
         v1.join(waitTime);
         if (v1.isAlive()) {
-            fail("Peer " + peer.getId() + " failed to join the cluster " + "within " + waitTime + " ms");
+            fail("Peer " + peer.getMyId() + " failed to join the cluster " + "within " + waitTime + " ms");
         } else if (!v1.isSuccess()) {
-            fail("Incorrect LEADING state for peer " + peer.getId());
+            fail("Incorrect LEADING state for peer " + peer.getMyId());
         }
         // cleanup
         for (int id = 0; id < 3; id++) {
@@ -452,7 +450,7 @@ public void testJoinInconsistentEnsemble() throws Exception {
         int sid;
         QuorumPeer peer;
         int waitTime = 10 * 1000;
-        ArrayList<QuorumPeer> peerList = new ArrayList<QuorumPeer>();
+        ArrayList<QuorumPeer> peerList = new ArrayList<>();
         for (sid = 0; sid < 3; sid++) {
             peers.put(Long.valueOf(sid), new QuorumServer(sid, new InetSocketAddress("127.0.0.1", PortAssignment.unique()), new InetSocketAddress("127.0.0.1", PortAssignment.unique())));
             tmpdir[sid] = ClientBase.createTmpDir();
@@ -461,7 +459,7 @@ public void testJoinInconsistentEnsemble() throws Exception {
         // start 2 peers and verify if they form the cluster
         for (sid = 0; sid < 2; sid++) {
             peer = new QuorumPeer(peers, tmpdir[sid], tmpdir[sid], port[sid], 3, sid, 2000, 2, 2, 2);
-            LOG.info("Starting peer {}", peer.getId());
+            LOG.info("Starting peer {}", peer.getMyId());
             peer.start();
             peerList.add(sid, peer);
         }
@@ -469,7 +467,7 @@ public void testJoinInconsistentEnsemble() throws Exception {
         VerifyState v1 = new VerifyState(peerList.get(0));
         v1.start();
         v1.join(waitTime);
-        assertFalse("Unable to form cluster in " + waitTime + " ms", !v1.isSuccess());
+        assertFalse(!v1.isSuccess(), "Unable to form cluster in " + waitTime + " ms");
         // Change the election round for one of the members of the ensemble
         long leaderSid = peer.getCurrentVote().getId();
         long zxid = peer.getCurrentVote().getZxid();
@@ -480,14 +478,14 @@ public void testJoinInconsistentEnsemble() throws Exception {
         peer.setCurrentVote(newVote);
         // Start 3rd peer and check if it joins the quorum
         peer = new QuorumPeer(peers, tmpdir[2], tmpdir[2], port[2], 3, 2, 2000, 2, 2, 2);
-        LOG.info("Starting peer {}", peer.getId());
+        LOG.info("Starting peer {}", peer.getMyId());
         peer.start();
         peerList.add(sid, peer);
         v1 = new VerifyState(peer);
         v1.start();
         v1.join(waitTime);
         if (v1.isAlive()) {
-            fail("Peer " + peer.getId() + " failed to join the cluster " + "within " + waitTime + " ms");
+            fail("Peer " + peer.getMyId() + " failed to join the cluster " + "within " + waitTime + " ms");
         }
         // cleanup
         for (int id = 0; id < 3; id++) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLEZeroWeightTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLEZeroWeightTest.java
index 29f93a62c0e..68bfa312768 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLEZeroWeightTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FLEZeroWeightTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.ByteArrayInputStream;
 import java.io.File;
 import java.net.InetSocketAddress;
@@ -33,9 +33,9 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.server.quorum.Vote;
 import org.apache.zookeeper.server.quorum.flexible.QuorumHierarchical;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -53,12 +53,12 @@ public class FLEZeroWeightTest extends ZKTestCase {
 
     volatile Vote[] votes;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         count = 9;
 
-        peers = new HashMap<Long, QuorumServer>(count);
-        threads = new ArrayList<LEThread>(count);
+        peers = new HashMap<>(count);
+        threads = new ArrayList<>(count);
         votes = new Vote[count];
         tmpdir = new File[count];
         port = new int[count];
@@ -81,7 +81,7 @@ public void setUp() throws Exception {
         qp.load(is);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         for (int i = 0; i < threads.size(); i++) {
             LEThread leThread = threads.get(i);
@@ -128,7 +128,7 @@ public void run() {
                     LOG.info("Finished election: {}, {}", i, v.getId());
                     votes[i] = v;
 
-                    if ((peer.getPeerState() == ServerState.LEADING) && (peer.getId() > 2)) {
+                    if ((peer.getPeerState() == ServerState.LEADING) && (peer.getMyId() > 2)) {
                         fail = true;
                     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FollowerResyncConcurrencyTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FollowerResyncConcurrencyTest.java
index 47a274dc0f8..40cd03bd972 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FollowerResyncConcurrencyTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FollowerResyncConcurrencyTest.java
@@ -18,12 +18,12 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertArrayEquals;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.Collection;
 import java.util.Set;
@@ -44,9 +44,9 @@
 import org.apache.zookeeper.server.ZKDatabase;
 import org.apache.zookeeper.server.quorum.Leader;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -63,20 +63,20 @@ public class FollowerResyncConcurrencyTest extends ZKTestCase {
      */
     private AtomicInteger pending = new AtomicInteger(0);
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         pending.set(0);
         errors.set(0);
         counter.set(0);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         LOG.info("Error count {}", errors.get());
     }
 
     /**
-     * See ZOOKEEPER-1319 - verify that a lagging follwer resyncs correctly
+     * See ZOOKEEPER-1319 - verify that a lagging follower resyncs correctly
      *
      * 1) start with down quorum
      * 2) start leader/follower1, add some data
@@ -97,12 +97,10 @@ public void testLaggingFollowerResyncsUnderNewEpoch() throws Exception {
 
         qu.start(1);
         qu.start(2);
-        assertTrue(
-                "Waiting for server up",
-                ClientBase.waitForServerUp("127.0.0.1:" + qu.getPeer(1).clientPort, ClientBase.CONNECTION_TIMEOUT));
-        assertTrue(
-                "Waiting for server up",
-                ClientBase.waitForServerUp("127.0.0.1:" + qu.getPeer(2).clientPort, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + qu.getPeer(1).clientPort, ClientBase.CONNECTION_TIMEOUT),
+                "Waiting for server up");
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + qu.getPeer(2).clientPort, ClientBase.CONNECTION_TIMEOUT),
+                "Waiting for server up");
 
         ZooKeeper zk1 = createClient(qu.getPeer(1).peer.getClientPort(), watcher1);
         LOG.info("zk1 has session id 0x{}", Long.toHexString(zk1.getSessionId()));
@@ -113,41 +111,36 @@ public void testLaggingFollowerResyncsUnderNewEpoch() throws Exception {
 
         qu.shutdown(1);
         qu.shutdown(2);
-        assertTrue(
-                "Waiting for server down",
-                ClientBase.waitForServerDown("127.0.0.1:" + qu.getPeer(1).clientPort, ClientBase.CONNECTION_TIMEOUT));
-        assertTrue(
-                "Waiting for server down",
-                ClientBase.waitForServerDown("127.0.0.1:" + qu.getPeer(2).clientPort, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + qu.getPeer(1).clientPort, ClientBase.CONNECTION_TIMEOUT),
+                "Waiting for server down");
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + qu.getPeer(2).clientPort, ClientBase.CONNECTION_TIMEOUT),
+                "Waiting for server down");
 
         qu.start(1);
         qu.start(2);
-        assertTrue(
-                "Waiting for server up",
-                ClientBase.waitForServerUp("127.0.0.1:" + qu.getPeer(1).clientPort, ClientBase.CONNECTION_TIMEOUT));
-        assertTrue(
-                "Waiting for server up",
-                ClientBase.waitForServerUp("127.0.0.1:" + qu.getPeer(2).clientPort, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + qu.getPeer(1).clientPort, ClientBase.CONNECTION_TIMEOUT),
+                "Waiting for server up");
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + qu.getPeer(2).clientPort, ClientBase.CONNECTION_TIMEOUT),
+                "Waiting for server up");
 
         qu.start(3);
-        assertTrue(
-                "Waiting for server up",
-                ClientBase.waitForServerUp("127.0.0.1:" + qu.getPeer(3).clientPort, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + qu.getPeer(3).clientPort, ClientBase.CONNECTION_TIMEOUT),
+                "Waiting for server up");
 
         zk1 = createClient(qu.getPeer(1).peer.getClientPort(), watcher1);
         LOG.info("zk1 has session id 0x{}", Long.toHexString(zk1.getSessionId()));
 
-        assertNotNull("zk1 has data", zk1.exists(resyncPath, false));
+        assertNotNull(zk1.exists(resyncPath, false), "zk1 has data");
 
         final ZooKeeper zk2 = createClient(qu.getPeer(2).peer.getClientPort(), watcher2);
         LOG.info("zk2 has session id 0x{}", Long.toHexString(zk2.getSessionId()));
 
-        assertNotNull("zk2 has data", zk2.exists(resyncPath, false));
+        assertNotNull(zk2.exists(resyncPath, false), "zk2 has data");
 
         final ZooKeeper zk3 = createClient(qu.getPeer(3).peer.getClientPort(), watcher3);
         LOG.info("zk3 has session id 0x{}", Long.toHexString(zk3.getSessionId()));
 
-        assertNotNull("zk3 has data", zk3.exists(resyncPath, false));
+        assertNotNull(zk3.exists(resyncPath, false), "zk3 has data");
 
         zk1.close();
         zk2.close();
@@ -321,7 +314,7 @@ public void run() {
 
         // Wait until all updates return
         if (!sem.tryAcquire(ClientBase.CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS)) {
-            LOG.warn("Did not aquire semaphore fast enough");
+            LOG.warn("Did not acquire semaphore fast enough");
         }
         mytestfooThread.join(ClientBase.CONNECTION_TIMEOUT);
         if (mytestfooThread.isAlive()) {
@@ -478,7 +471,7 @@ public void run() {
 
         // Wait until all updates return
         if (!sem.tryAcquire(ClientBase.CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS)) {
-            LOG.warn("Did not aquire semaphore fast enough");
+            LOG.warn("Did not acquire semaphore fast enough");
         }
         mytestfooThread.join(ClientBase.CONNECTION_TIMEOUT);
         if (mytestfooThread.isAlive()) {
@@ -525,7 +518,7 @@ private boolean waitForPendingRequests(int timeout) throws InterruptedException
     }
 
     /**
-     * Wait for all server to have the same lastProccessedZxid. Timeout in seconds
+     * Wait for all server to have the same lastProcessedZxid. Timeout in seconds
      */
     private boolean waitForSync(QuorumUtil qu, int index, int timeout) throws InterruptedException {
         LOG.info("Wait for server to sync");
@@ -568,29 +561,26 @@ private static TestableZooKeeper createTestableClient(
 
     private void verifyState(QuorumUtil qu, int index, Leader leader) {
         LOG.info("Verifying state");
-        assertTrue("Not following", qu.getPeer(index).peer.follower != null);
+        assertTrue(qu.getPeer(index).peer.follower != null, "Not following");
         long epochF = (qu.getPeer(index).peer.getActiveServer().getZxid() >> 32L);
         long epochL = (leader.getEpoch() >> 32L);
-        assertTrue("Zxid: "
-                           + qu.getPeer(index).peer.getActiveServer().getZKDatabase().getDataTreeLastProcessedZxid()
-                           + "Current epoch: "
-                           + epochF, epochF == epochL);
+        assertTrue(epochF == epochL,
+                "Zxid: " + qu.getPeer(index).peer.getActiveServer().getZKDatabase().getDataTreeLastProcessedZxid()
+                + "Current epoch: " + epochF);
         int leaderIndex = (index == 1) ? 2 : 1;
         Collection<Long> sessionsRestarted = qu.getPeer(index).peer.getActiveServer().getZKDatabase().getSessions();
         Collection<Long> sessionsNotRestarted = qu.getPeer(leaderIndex).peer.getActiveServer().getZKDatabase().getSessions();
 
         for (Long l : sessionsRestarted) {
-            assertTrue("Should have same set of sessions in both servers, did not expect: "
-                               + l, sessionsNotRestarted.contains(l));
+            assertTrue(sessionsNotRestarted.contains(l), "Should have same set of sessions in both servers, did not expect: " + l);
         }
-        assertEquals("Should have same number of sessions", sessionsNotRestarted.size(), sessionsRestarted.size());
+        assertEquals(sessionsNotRestarted.size(), sessionsRestarted.size(), "Should have same number of sessions");
         ZKDatabase restarted = qu.getPeer(index).peer.getActiveServer().getZKDatabase();
         ZKDatabase clean = qu.getPeer(3).peer.getActiveServer().getZKDatabase();
         ZKDatabase lead = qu.getPeer(leaderIndex).peer.getActiveServer().getZKDatabase();
         for (Long l : sessionsRestarted) {
             LOG.info("Validating ephemeral for session id 0x{}", Long.toHexString(l));
-            assertTrue("Should have same set of sessions in both servers, did not expect: "
-                               + l, sessionsNotRestarted.contains(l));
+            assertTrue(sessionsNotRestarted.contains(l), "Should have same set of sessions in both servers, did not expect: " + l);
             Set<String> ephemerals = restarted.getEphemerals(l);
             Set<String> cleanEphemerals = clean.getEphemerals(l);
             for (String o : cleanEphemerals) {
@@ -614,8 +604,8 @@ private void verifyState(QuorumUtil qu, int index, Leader leader) {
                     LOG.info("Leader doesn't contain ephemeral from follower {} zxid 0x{}", o, Long.toHexString(clean.getDataTree().getNode(o).stat.getMzxid()));
                 }
             }
-            assertEquals("Should have same number of ephemerals in both followers", ephemerals.size(), cleanEphemerals.size());
-            assertEquals("Leader should equal follower", lead.getEphemerals(l).size(), cleanEphemerals.size());
+            assertEquals(ephemerals.size(), cleanEphemerals.size(), "Should have same number of ephemerals in both followers");
+            assertEquals(lead.getEphemerals(l).size(), cleanEphemerals.size(), "Leader should equal follower");
         }
     }
 
@@ -638,14 +628,14 @@ public void testFollowerSendsLastZxid() throws Exception {
         assertEquals(0L, zk.testableLastZxid());
         zk.exists("/", false);
         long lzxid = zk.testableLastZxid();
-        assertTrue("lzxid:" + lzxid + " > 0", lzxid > 0);
+        assertTrue(lzxid > 0, "lzxid:" + lzxid + " > 0");
         zk.close();
         qu.shutdownAll();
     }
 
     private class MyWatcher extends CountdownWatcher {
 
-        LinkedBlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<WatchedEvent>();
+        LinkedBlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<>();
 
         public void process(WatchedEvent event) {
             super.process(event);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FourLetterWordsQuorumTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FourLetterWordsQuorumTest.java
index 747cb1c6a02..2136f4592ec 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FourLetterWordsQuorumTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FourLetterWordsQuorumTest.java
@@ -19,11 +19,11 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.client.FourLetterWordMain.send4LetterWord;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
 import org.apache.zookeeper.TestableZooKeeper;
 import org.apache.zookeeper.common.X509Exception.SSLContextException;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FourLetterWordsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FourLetterWordsTest.java
index a48f4bcf572..a65cfb410ef 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FourLetterWordsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FourLetterWordsTest.java
@@ -19,9 +19,9 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.client.FourLetterWordMain.send4LetterWord;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.BufferedReader;
 import java.io.ByteArrayOutputStream;
 import java.io.DataOutputStream;
@@ -32,9 +32,8 @@
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.common.IOUtils;
 import org.apache.zookeeper.common.X509Exception.SSLContextException;
-import org.junit.Rule;
-import org.junit.Test;
-import org.junit.rules.Timeout;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -42,11 +41,9 @@ public class FourLetterWordsTest extends ClientBase {
 
     protected static final Logger LOG = LoggerFactory.getLogger(FourLetterWordsTest.class);
 
-    @Rule
-    public Timeout timeout = Timeout.millis(30000);
-
     /** Test the various four letter words */
     @Test
+    @Timeout(value = 30)
     public void testFourLetterWords() throws Exception {
         verify("ruok", "imok");
         verify("envi", "java.version");
@@ -130,6 +127,7 @@ private void verify(String cmd, String expected) throws IOException, SSLContextE
     }
 
     @Test
+    @Timeout(value = 30)
     public void testValidateStatOutput() throws Exception {
         ZooKeeper zk1 = createClient();
         ZooKeeper zk2 = createClient();
@@ -173,6 +171,7 @@ public void testValidateStatOutput() throws Exception {
     }
 
     @Test
+    @Timeout(value = 30)
     public void testValidateConsOutput() throws Exception {
         ZooKeeper zk1 = createClient();
         ZooKeeper zk2 = createClient();
@@ -184,7 +183,7 @@ public void testValidateConsOutput() throws Exception {
         int count = 0;
         while ((line = in.readLine()) != null && line.length() > 0) {
             count++;
-            assertTrue(line, Pattern.matches("^ /.*:\\d+\\[\\d+\\]\\(queued=\\d+,recved=\\d+,sent=\\d+.*\\)$", line));
+            assertTrue(Pattern.matches("^ /.*:\\d+\\[\\d+\\]\\(queued=\\d+,recved=\\d+,sent=\\d+.*\\)$", line), line);
         }
         // ensure at least the two clients we created are accounted for
         assertTrue(count >= 2);
@@ -193,7 +192,8 @@ public void testValidateConsOutput() throws Exception {
         zk2.close();
     }
 
-    @Test(timeout = 60000)
+    @Test
+    @Timeout(value = 60)
     public void testValidateSocketTimeout() throws Exception {
         /**
          * testing positive scenario that even with timeout parameter the
@@ -204,6 +204,7 @@ public void testValidateSocketTimeout() throws Exception {
     }
 
     @Test
+    @Timeout(value = 30)
     public void testSetTraceMask() throws Exception {
         String gtmkResp = sendRequest("gtmk");
         assertNotNull(gtmkResp);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FourLetterWordsWhiteListTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FourLetterWordsWhiteListTest.java
index 8fb0a72d83a..06ca325579d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/FourLetterWordsWhiteListTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/FourLetterWordsWhiteListTest.java
@@ -19,12 +19,13 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.client.FourLetterWordMain.send4LetterWord;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
 import org.apache.zookeeper.TestableZooKeeper;
 import org.apache.zookeeper.common.X509Exception.SSLContextException;
 import org.apache.zookeeper.server.command.FourLetterCommands;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -38,7 +39,8 @@ public class FourLetterWordsWhiteListTest extends ClientBase {
      * the case (except 'stat' command which is enabled in ClientBase
      * which other tests depend on.).
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testFourLetterWordsAllDisabledByDefault() throws Exception {
         stopServer();
         FourLetterCommands.resetWhiteList();
@@ -62,7 +64,8 @@ public void testFourLetterWordsAllDisabledByDefault() throws Exception {
         verifyAllCommandsFail();
     }
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testFourLetterWordsEnableSomeCommands() throws Exception {
         stopServer();
         FourLetterCommands.resetWhiteList();
@@ -89,7 +92,8 @@ public void testFourLetterWordsEnableSomeCommands() throws Exception {
         verifyExactMatch("mntr", generateExpectedMessage("mntr"));
     }
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testISROEnabledWhenReadOnlyModeEnabled() throws Exception {
         stopServer();
         FourLetterCommands.resetWhiteList();
@@ -100,13 +104,14 @@ public void testISROEnabledWhenReadOnlyModeEnabled() throws Exception {
         System.clearProperty("readonlymode.enabled");
     }
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testFourLetterWordsInvalidConfiguration() throws Exception {
         stopServer();
         FourLetterCommands.resetWhiteList();
         System.setProperty("zookeeper.4lw.commands.whitelist", "foo bar"
-                                                                       + " foo,,, "
-                                                                       + "bar :.,@#$%^&*() , , , , bar, bar, stat,        ");
+                + " foo,,, "
+                + "bar :.,@#$%^&*() , , , , bar, bar, stat,        ");
         startServer();
 
         // Just make sure we are good when admin made some mistakes in config file.
@@ -115,7 +120,8 @@ public void testFourLetterWordsInvalidConfiguration() throws Exception {
         verifyFuzzyMatch("stat", "Outstanding");
     }
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testFourLetterWordsEnableAllCommandsThroughAsterisk() throws Exception {
         stopServer();
         FourLetterCommands.resetWhiteList();
@@ -124,13 +130,14 @@ public void testFourLetterWordsEnableAllCommandsThroughAsterisk() throws Excepti
         verifyAllCommandsSuccess();
     }
 
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testFourLetterWordsEnableAllCommandsThroughExplicitList() throws Exception {
         stopServer();
         FourLetterCommands.resetWhiteList();
         System.setProperty("zookeeper.4lw.commands.whitelist", "ruok, envi, conf, stat, srvr, cons, dump,"
-                                                                       + "wchs, wchp, wchc, srst, crst, "
-                                                                       + "dirs, mntr, gtmk, isro, stmk");
+                + "wchs, wchp, wchc, srst, crst, "
+                + "dirs, mntr, gtmk, isro, stmk");
         startServer();
         verifyAllCommandsSuccess();
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/GetChildren2Test.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/GetChildren2Test.java
index 1d8c0fd3df3..0ea8053dc4c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/GetChildren2Test.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/GetChildren2Test.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Collections;
@@ -28,12 +28,15 @@
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.data.Stat;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class GetChildren2Test extends ClientBase {
 
     private ZooKeeper zk;
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         super.setUp();
@@ -41,6 +44,7 @@ public void setUp() throws Exception {
         zk = createClient();
     }
 
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         super.tearDown();
@@ -89,8 +93,8 @@ public void testChildren() throws IOException, KeeperException, InterruptedExcep
         String name = "/foo";
         zk.create(name, name.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
-        List<String> children = new ArrayList<String>();
-        List<String> children_s = new ArrayList<String>();
+        List<String> children = new ArrayList<>();
+        List<String> children_s = new ArrayList<>();
 
         for (int i = 0; i < 10; i++) {
             String childname = name + "/bar" + i;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/GetProposalFromTxnTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/GetProposalFromTxnTest.java
index 207caf5b53c..e9e5b184241 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/GetProposalFromTxnTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/GetProposalFromTxnTest.java
@@ -18,11 +18,11 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.util.ArrayList;
-import java.util.Arrays;
 import java.util.Iterator;
 import org.apache.jute.Record;
 import org.apache.zookeeper.CreateMode;
@@ -40,7 +40,7 @@
 import org.apache.zookeeper.server.quorum.Leader.Proposal;
 import org.apache.zookeeper.server.util.SerializeUtils;
 import org.apache.zookeeper.txn.TxnHeader;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 /**
  * Test loading committed proposal from txnlog. Learner uses these proposals to
@@ -68,7 +68,7 @@ public void testGetProposalFromTxn() throws Exception {
         final int PORT = Integer.parseInt(HOSTPORT.split(":")[1]);
         ServerCnxnFactory f = ServerCnxnFactory.createFactory(PORT, -1);
         f.startup(zks);
-        assertTrue("waiting for server being up ", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up ");
         ZooKeeper zk = ClientBase.createZKClient(HOSTPORT);
 
         // Generate transaction so we will have some txnlog
@@ -90,7 +90,7 @@ public void testGetProposalFromTxn() throws Exception {
         // shutdown and start zookeeper again
         f.shutdown();
         zks.shutdown();
-        assertTrue("waiting for server to shutdown", ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server to shutdown");
         zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
         zks.startdata();
 
@@ -101,13 +101,13 @@ public void testGetProposalFromTxn() throws Exception {
         Iterator<Proposal> itr = db.getProposalsFromTxnLog(zxids[0], 10000000);
 
         int createCount = 0;
-        ArrayList<Long> retrievedZxids = new ArrayList<Long>(MSG_COUNT);
+        ArrayList<Long> retrievedZxids = new ArrayList<>(MSG_COUNT);
 
         // Get zxid of create requests
         while (itr.hasNext()) {
             Proposal proposal = itr.next();
             TxnLogEntry logEntry = SerializeUtils.deserializeTxn(
-                    proposal.packet.getData());
+                    proposal.getQuorumPacket().getData());
             TxnHeader hdr = logEntry.getHeader();
             Record rec = logEntry.getTxn();
             if (hdr.getType() == OpCode.create) {
@@ -117,10 +117,10 @@ public void testGetProposalFromTxn() throws Exception {
         }
 
         // All zxid should match what we created
-        assertTrue("Zxids missmatches", Arrays.equals(zxids, retrievedZxids.toArray(new Long[0])));
+        assertArrayEquals(zxids, retrievedZxids.toArray(new Long[0]), "Zxids mismatches");
 
         // There should be 2000 create requests
-        assertTrue("create proposal count == " + MSG_COUNT, (createCount == MSG_COUNT));
+        assertTrue((createCount == MSG_COUNT), "create proposal count == " + MSG_COUNT);
 
         // We are requesting half the number of transaction from the snapshot
         // this should exceed threshold (ZKDatabase.snapshotSizeFactor)
@@ -128,7 +128,7 @@ public void testGetProposalFromTxn() throws Exception {
         long sizeLimit = db.calculateTxnLogSizeLimit();
 
         itr = db.getProposalsFromTxnLog(zxids[MSG_COUNT / 2], sizeLimit);
-        assertFalse("Expect empty proposal", (itr.hasNext()));
+        assertFalse((itr.hasNext()), "Expect empty proposal");
         f.shutdown();
         zks.shutdown();
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/HierarchicalQuorumTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/HierarchicalQuorumTest.java
index 26a963fb6ef..e91261ed39f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/HierarchicalQuorumTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/HierarchicalQuorumTest.java
@@ -17,8 +17,8 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.ByteArrayInputStream;
 import java.io.File;
 import java.io.IOException;
@@ -33,7 +33,9 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer;
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
 import org.apache.zookeeper.server.quorum.flexible.QuorumHierarchical;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 public class HierarchicalQuorumTest extends ClientBase {
@@ -63,6 +65,7 @@ public class HierarchicalQuorumTest extends ClientBase {
     Properties qp;
     protected final ClientHammerTest cht = new ClientHammerTest();
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         setupTestEnv();
@@ -204,14 +207,14 @@ void startServers(boolean withObservers) throws Exception {
 
         LOG.info("Closing ports {}", hostPort);
         for (String hp : hostPort.split(",")) {
-            assertTrue("waiting for server up", ClientBase.waitForServerUp(hp, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp(hp, CONNECTION_TIMEOUT), "waiting for server up");
             LOG.info("{} is accepting client connections", hp);
         }
         final int numberOfPeers = 5;
         // interesting to see what's there...
         JMXEnv.dump();
         // make sure we have these 5 servers listed
-        Set<String> ensureNames = new LinkedHashSet<String>();
+        Set<String> ensureNames = new LinkedHashSet<>();
         for (int i = 1; i <= numberOfPeers; i++) {
             ensureNames.add("InMemoryDataTree");
         }
@@ -254,6 +257,7 @@ void startServers(boolean withObservers) throws Exception {
         }
     }
 
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         LOG.info("TearDown started");
@@ -271,7 +275,7 @@ public void tearDown() throws Exception {
         shutdown(s5);
 
         for (String hp : hostPort.split(",")) {
-            assertTrue("waiting for server down", ClientBase.waitForServerDown(hp, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown(hp, ClientBase.CONNECTION_TIMEOUT), "waiting for server down");
             LOG.info("{} is no longer accepting client connections", hp);
         }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/IPAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/IPAuthTest.java
new file mode 100644
index 00000000000..b50b8ed76be
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/IPAuthTest.java
@@ -0,0 +1,70 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.mockito.Mockito.mock;
+import java.util.Arrays;
+import java.util.List;
+import javax.servlet.http.HttpServletRequest;
+import org.apache.zookeeper.data.Id;
+import org.apache.zookeeper.server.auth.IPAuthenticationProvider;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.mockito.Mockito;
+
+public class IPAuthTest {
+    @Before
+    public void setUp() {
+        System.setProperty(IPAuthenticationProvider.USE_X_FORWARDED_FOR_KEY, "true");
+    }
+
+    @After
+    public void tearDown() {
+        System.clearProperty(IPAuthenticationProvider.USE_X_FORWARDED_FOR_KEY);
+    }
+
+    @Test
+    public void testHandleAuthentication_Forwarded() {
+        final IPAuthenticationProvider provider = new IPAuthenticationProvider();
+
+        final HttpServletRequest mockRequest = mock(HttpServletRequest.class);
+        final String forwardedForHeader = "fc00:0:0:0:0:0:0:4, 192.168.0.6, 10.0.0.8, 172.16.0.9";
+        Mockito.doReturn(forwardedForHeader).when(mockRequest).getHeader(IPAuthenticationProvider.X_FORWARDED_FOR_HEADER_NAME);
+        Mockito.doReturn("192.168.0.5").when(mockRequest).getRemoteAddr();
+
+        // validate it returns the leftmost IP from the X-Forwarded-For header
+        final List<Id> expectedIds = Arrays.asList(new Id(provider.getScheme(), "fc00:0:0:0:0:0:0:4"));
+        assertEquals(expectedIds, provider.handleAuthentication(mockRequest, null));
+    }
+
+    @Test
+    public void testHandleAuthentication_NoForwarded() {
+        final IPAuthenticationProvider provider = new IPAuthenticationProvider();
+
+        final HttpServletRequest mockRequest = mock(HttpServletRequest.class);
+        Mockito.doReturn(null).when(mockRequest).getHeader(IPAuthenticationProvider.X_FORWARDED_FOR_HEADER_NAME);
+        Mockito.doReturn("192.168.0.6").when(mockRequest).getRemoteAddr();
+
+        // validate it returns the remote address
+        final List<Id> expectedIds = Arrays.asList(new Id(provider.getScheme(), "192.168.0.6"));
+        assertEquals(expectedIds, provider.handleAuthentication(mockRequest, null));
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/IntegrityCheck.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/IntegrityCheck.java
index 1a238dfe7dc..1fc467cc290 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/IntegrityCheck.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/IntegrityCheck.java
@@ -52,7 +52,7 @@ public class IntegrityCheck implements StatCallback, DataCallback {
 
     ZooKeeper zk;
 
-    Map<String, byte[]> lastValue = new HashMap<String, byte[]>();
+    Map<String, byte[]> lastValue = new HashMap<>();
 
     int count;
 
@@ -194,7 +194,7 @@ public void run() {
     }
 
     public void processResult(int rc, String path, Object ctx, Stat stat) {
-        if (rc == 0) {
+        if (rc == KeeperException.Code.OK.intValue()) {
             lastValue.put(path, (byte[]) ctx);
         }
         decOutstanding();
@@ -202,7 +202,7 @@ public void processResult(int rc, String path, Object ctx, Stat stat) {
 
     public void processResult(
             int rc, String path, Object ctx, byte[] data, Stat stat) {
-        if (rc == 0) {
+        if (rc == KeeperException.Code.OK.intValue()) {
             String string = new String(data);
             String lastString = null;
             byte[] v = lastValue.get(path);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/InvalidSnapshotTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/InvalidSnapshotTest.java
index 9003bb63c6c..c47a60f357c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/InvalidSnapshotTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/InvalidSnapshotTest.java
@@ -19,8 +19,11 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
+import java.io.IOException;
+import org.apache.commons.io.FileUtils;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.ZooKeeper;
@@ -28,7 +31,7 @@
 import org.apache.zookeeper.server.SnapshotFormatter;
 import org.apache.zookeeper.server.SyncRequestProcessor;
 import org.apache.zookeeper.server.ZooKeeperServer;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -61,20 +64,43 @@ public void testSnapshotFormatterWithNull() throws Exception {
         SnapshotFormatter.main(args);
     }
 
+    /**
+     * Verify the SnapshotFormatter fails as expected on corrupted snapshot.
+     */
+    @Test
+    public void testSnapshotFormatterWithInvalidSnap() throws Exception {
+        File snapDir = new File(testData, "invalidsnap");
+        // Broken snapshot introduced by ZOOKEEPER-367, and used to
+        // demonstrate recovery in testSnapshot below.
+        File snapfile = new File(new File(snapDir, "version-2"), "snapshot.83f");
+        String[] args = {snapfile.getCanonicalFile().toString()};
+        try {
+            SnapshotFormatter.main(args);
+            fail("Snapshot '" + snapfile + "' unexpectedly parsed without error.");
+        } catch (IOException e) {
+            assertTrue(e.getMessage().contains("Unreasonable length = 977468229"));
+        }
+    }
+
     /**
      * test the snapshot
      * @throws Exception an exception could be expected
      */
     @Test
     public void testSnapshot() throws Exception {
-        File snapDir = new File(testData, "invalidsnap");
+        File origSnapDir = new File(testData, "invalidsnap");
+
+        // This test otherwise updates the resources directory.
+        File snapDir = ClientBase.createTmpDir();
+        FileUtils.copyDirectory(origSnapDir, snapDir);
+
         ZooKeeperServer zks = new ZooKeeperServer(snapDir, snapDir, 3000);
         SyncRequestProcessor.setSnapCount(1000);
         final int PORT = Integer.parseInt(HOSTPORT.split(":")[1]);
         ServerCnxnFactory f = ServerCnxnFactory.createFactory(PORT, -1);
         f.startup(zks);
         LOG.info("starting up the zookeeper server .. waiting");
-        assertTrue("waiting for server being up", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up");
         ZooKeeper zk = ClientBase.createZKClient(HOSTPORT);
         try {
             // we know this from the data files
@@ -86,7 +112,7 @@ public void testSnapshot() throws Exception {
         }
         f.shutdown();
         zks.shutdown();
-        assertTrue("waiting for server down", ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT), "waiting for server down");
 
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/JMXEnv.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/JMXEnv.java
index 76845edd163..49db1707814 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/JMXEnv.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/JMXEnv.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -111,7 +111,7 @@ public static Set<ObjectName> ensureAll(String... expectedNames) throws IOExcept
                 throw new RuntimeException(e);
             }
 
-            found = new HashSet<ObjectName>();
+            found = new HashSet<>();
             for (String name : expectedNames) {
                 LOG.info("expect:{}", name);
                 for (ObjectName bean : beans) {
@@ -124,7 +124,7 @@ public static Set<ObjectName> ensureAll(String... expectedNames) throws IOExcept
                 beans.removeAll(found);
             }
         } while ((expectedNames.length != found.size()) && (nTry < 600));
-        assertEquals("expected " + Arrays.toString(expectedNames), expectedNames.length, found.size());
+        assertEquals(expectedNames.length, found.size(), "expected " + Arrays.toString(expectedNames));
         return beans;
     }
 
@@ -220,7 +220,7 @@ public static Set<ObjectName> ensureParent(String... expectedNames) throws IOExc
 
         Set<ObjectName> beans;
         int nTry = 0;
-        Set<ObjectName> found = new HashSet<ObjectName>();
+        Set<ObjectName> found = new HashSet<>();
         do {
             if (nTry++ > 0) {
                 Thread.sleep(500);
@@ -244,7 +244,7 @@ public static Set<ObjectName> ensureParent(String... expectedNames) throws IOExc
                 beans.removeAll(found);
             }
         } while (expectedNames.length != found.size() && nTry < 120);
-        assertEquals("expected " + Arrays.toString(expectedNames), expectedNames.length, found.size());
+        assertEquals(expectedNames.length, found.size(), "expected " + Arrays.toString(expectedNames));
         return beans;
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/KeeperStateTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/KeeperStateTest.java
index 15b945566f3..9d0833205c9 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/KeeperStateTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/KeeperStateTest.java
@@ -18,14 +18,14 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.EnumSet;
 import org.apache.zookeeper.KeeperException.Code;
 import org.apache.zookeeper.Watcher.Event.KeeperState;
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class KeeperStateTest extends ZKTestCase {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/KeyAuthClientTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/KeyAuthClientTest.java
index ffa90e1c9ea..009415c3d9a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/KeyAuthClientTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/KeyAuthClientTest.java
@@ -18,14 +18,14 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.List;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.data.ACL;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LeaderSessionTrackerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LeaderSessionTrackerTest.java
index dd6e4cdd739..a619866d91c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LeaderSessionTrackerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LeaderSessionTrackerTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.ByteArrayOutputStream;
 import java.nio.ByteBuffer;
 import java.util.ArrayList;
@@ -33,10 +33,11 @@
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.proto.CreateRequest;
 import org.apache.zookeeper.server.Request;
+import org.apache.zookeeper.server.RequestRecord;
 import org.apache.zookeeper.server.quorum.QuorumPeer;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -51,12 +52,12 @@ public class LeaderSessionTrackerTest extends ZKTestCase {
 
     QuorumUtil qu;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         qu = new QuorumUtil(1);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         qu.shutdownAll();
     }
@@ -100,7 +101,7 @@ public void testCreateEphemeral(boolean localSessionEnabled) throws Exception {
 
         LOG.info("Fake session Id: {}", Long.toHexString(fakeSessionId));
 
-        Request request = new Request(null, fakeSessionId, 0, OpCode.create, bb, new ArrayList<Id>());
+        Request request = new Request(null, fakeSessionId, 0, OpCode.create, RequestRecord.fromBytes(bb), new ArrayList<Id>());
 
         // Submit request directly to leader
         leader.getActiveServer().submitRequest(request);
@@ -109,7 +110,7 @@ public void testCreateEphemeral(boolean localSessionEnabled) throws Exception {
         zk.create("/ok", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
         Stat stat = zk.exists("/impossible", null);
-        assertEquals("Node from fake session get created", null, stat);
+        assertEquals(null, stat, "Node from fake session get created");
 
     }
 
@@ -138,7 +139,7 @@ public void testCreatePersistent() throws Exception {
 
         LOG.info("Local session Id: {}", Long.toHexString(locallSession));
 
-        Request request = new Request(null, locallSession, 0, OpCode.create, bb, new ArrayList<Id>());
+        Request request = new Request(null, locallSession, 0, OpCode.create, RequestRecord.fromBytes(bb), new ArrayList<Id>());
 
         // Submit request directly to leader
         leader.getActiveServer().submitRequest(request);
@@ -147,7 +148,7 @@ public void testCreatePersistent() throws Exception {
         zk.create("/ok", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
         Stat stat = zk.exists("/success", null);
-        assertTrue("Request from local sesson failed", stat != null);
+        assertTrue(stat != null, "Request from local sesson failed");
 
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoadFromLogNoServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoadFromLogNoServerTest.java
index a48ce0819bc..32a99fa38fb 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoadFromLogNoServerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoadFromLogNoServerTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertNotEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.FileInputStream;
@@ -34,6 +34,7 @@
 import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.server.DataNode;
 import org.apache.zookeeper.server.DataTree;
+import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.persistence.FileHeader;
 import org.apache.zookeeper.server.persistence.FileTxnLog;
@@ -43,7 +44,7 @@
 import org.apache.zookeeper.txn.MultiTxn;
 import org.apache.zookeeper.txn.Txn;
 import org.apache.zookeeper.txn.TxnHeader;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -103,7 +104,7 @@ public void testTxnFailure() throws Exception {
 
     /*
      * Does create/delete depending on the type and verifies
-     * if cversion before the operation is 1 less than cversion afer.
+     * if cversion before the operation is 1 less than cversion after.
      */
     private void doOp(FileTxnSnapLog logFile, int type, String path, DataTree dt, DataNode parent, int cversion) throws Exception {
         int lastSlash = path.lastIndexOf('/');
@@ -130,7 +131,7 @@ private void doOp(FileTxnSnapLog logFile, int type, String path, DataTree dt, Da
         } else if (type == ZooDefs.OpCode.multi) {
             txnHeader = new TxnHeader(0xabcd, 0x123, prevPzxid + 1, Time.currentElapsedTime(), ZooDefs.OpCode.create);
             txn = new CreateTxn(path, new byte[0], null, false, cversion);
-            List<Txn> txnList = new ArrayList<Txn>();
+            List<Txn> txnList = new ArrayList<>();
             ByteArrayOutputStream baos = new ByteArrayOutputStream();
             BinaryOutputArchive boa = BinaryOutputArchive.getArchive(baos);
             txn.serialize(boa, "request");
@@ -151,17 +152,9 @@ private void doOp(FileTxnSnapLog logFile, int type, String path, DataTree dt, Da
         }
         LOG.info("Children: {} for {}", childStr, parentName);
         LOG.info("(cverions, pzxid): {}, {}", newCversion, newPzxid);
-        assertTrue(type
-                                  + " <cversion, pzxid> verification failed. Expected: <"
-                                  + (prevCversion + 1)
-                                  + ", "
-                                  + (prevPzxid
-                                             + 1)
-                                  + ">, found: <"
-                                  + newCversion
-                                  + ", "
-                                  + newPzxid
-                                  + ">", (newCversion == prevCversion + 1 && newPzxid == prevPzxid + 1));
+        assertTrue((newCversion == prevCversion + 1 && newPzxid == prevPzxid + 1),
+                type + " <cversion, pzxid> verification failed. Expected: <" + (prevCversion + 1) + ", "
+                        + (prevPzxid + 1) + ">, found: <" + newCversion + ", " + newPzxid + ">");
     }
 
     /**
@@ -174,13 +167,13 @@ public void testPad() throws Exception {
         FileTxnLog txnLog = new FileTxnLog(tmpDir);
         TxnHeader txnHeader = new TxnHeader(0xabcd, 0x123, 0x123, Time.currentElapsedTime(), ZooDefs.OpCode.create);
         Record txn = new CreateTxn("/Test", new byte[0], null, false, 1);
-        txnLog.append(txnHeader, txn);
+        txnLog.append(new Request(0, 0, 0, txnHeader, txn, 0));
         FileInputStream in = new FileInputStream(tmpDir.getPath() + "/log." + Long.toHexString(txnHeader.getZxid()));
         BinaryInputArchive ia = BinaryInputArchive.getArchive(in);
         FileHeader header = new FileHeader();
         header.deserialize(ia, "fileheader");
         LOG.info("Received magic : {} Expected : {}", header.getMagic(), FileTxnLog.TXNLOG_MAGIC);
-        assertTrue("Missing magic number ", header.getMagic() == FileTxnLog.TXNLOG_MAGIC);
+        assertTrue(header.getMagic() == FileTxnLog.TXNLOG_MAGIC, "Missing magic number ");
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoadFromLogTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoadFromLogTest.java
index 949cb0f961e..af597735353 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoadFromLogTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoadFromLogTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.IOException;
 import org.apache.zookeeper.CreateMode;
@@ -36,8 +36,8 @@
 import org.apache.zookeeper.server.persistence.TxnLog.TxnIterator;
 import org.apache.zookeeper.server.persistence.Util;
 import org.apache.zookeeper.txn.TxnHeader;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -50,7 +50,7 @@ public class LoadFromLogTest extends ClientBase {
     private static final int TRANSACTION_OVERHEAD = 2;
     private static final int TOTAL_TRANSACTIONS = NUM_MESSAGES + TRANSACTION_OVERHEAD;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         SyncRequestProcessor.setSnapCount(50);
         super.setUp();
@@ -82,7 +82,7 @@ public void testLoad() throws Exception {
         FileTxnIterator fileItr = (FileTxnIterator) itr;
         long storageSize = fileItr.getStorageSize();
         LOG.info("Txnlog size: {} bytes", storageSize);
-        assertTrue("Storage size is greater than zero ", (storageSize > 0));
+        assertTrue((storageSize > 0), "Storage size is greater than zero ");
 
         long expectedZxid = 0;
         long lastZxid = 0;
@@ -90,16 +90,12 @@ public void testLoad() throws Exception {
         do {
             hdr = itr.getHeader();
             expectedZxid++;
-            assertTrue("not the same transaction. lastZxid=" + lastZxid + ", zxid=" + hdr.getZxid(), lastZxid
-                                                                                                                    != hdr.getZxid());
-            assertTrue("excepting next transaction. expected=" + expectedZxid + ", retrieved=" + hdr.getZxid(), (
-                    hdr.getZxid()
-                            == expectedZxid));
+            assertTrue(lastZxid != hdr.getZxid(), "not the same transaction. lastZxid=" + lastZxid + ", zxid=" + hdr.getZxid());
+            assertTrue((hdr.getZxid() == expectedZxid), "excepting next transaction. expected=" + expectedZxid + ", retrieved=" + hdr.getZxid());
             lastZxid = hdr.getZxid();
         } while (itr.next());
 
-        assertTrue("processed all transactions. " + expectedZxid + " == " + TOTAL_TRANSACTIONS, (expectedZxid
-                                                                                                                == TOTAL_TRANSACTIONS));
+        assertTrue((expectedZxid == TOTAL_TRANSACTIONS), "processed all transactions. " + expectedZxid + " == " + TOTAL_TRANSACTIONS);
     }
 
     /**
@@ -125,7 +121,7 @@ public void testLoadFailure() throws Exception {
         // Verify that we have at least NUM_MESSAGES / SNAPCOUNT txnlog
         assertTrue(logFiles.length > NUM_MESSAGES / 100);
         // Delete the first log file, so we will fail to read it back from disk
-        assertTrue("delete the first log file", logFiles[0].delete());
+        assertTrue(logFiles[0].delete(), "delete the first log file");
 
         // Find zxid for the second log
         long secondStartZxid = Util.getZxidFromName(logFiles[1].getName(), "log");
@@ -194,7 +190,7 @@ public void testRestore() throws Exception {
         long fZxid = zks.getZKDatabase().getDataTreeLastProcessedZxid();
 
         // Verify lastProcessedZxid is set correctly
-        assertTrue("Restore failed expected zxid=" + eZxid + " found=" + fZxid, fZxid == eZxid);
+        assertTrue(fZxid == eZxid, "Restore failed expected zxid=" + eZxid + " found=" + fZxid);
         zk = createZKClient(hostPort);
 
         // Verify correctness of data and whether sequential znode creation
@@ -208,15 +204,10 @@ public void testRestore() throws Exception {
             zk.close();
         }
         LOG.info("Expected {} found {}", expectedPath, path);
-        assertTrue("Error in sequential znode creation expected "
-                                  + expectedPath
-                                  + " found "
-                                  + path, path.equals(expectedPath));
-        assertTrue("Unexpected number of children "
-                                  + children.length
-                                  + " expected "
-                                  + NUM_MESSAGES, (children.length
-                                                           == NUM_MESSAGES));
+        assertTrue(path.equals(expectedPath),
+                "Error in sequential znode creation expected " + expectedPath + " found " + path);
+        assertTrue((children.length == NUM_MESSAGES),
+                "Unexpected number of children " + children.length + " expected " + NUM_MESSAGES);
     }
 
     /**
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LocalSessionRequestTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LocalSessionRequestTest.java
index d24faa64484..45b5da4a11f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LocalSessionRequestTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LocalSessionRequestTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertFalse;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.server.Request;
@@ -26,9 +26,9 @@
 import org.apache.zookeeper.server.quorum.Leader.Proposal;
 import org.apache.zookeeper.server.quorum.QuorumPeer;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -45,7 +45,7 @@ public class LocalSessionRequestTest extends ZKTestCase {
 
     private final QuorumBase qb = new QuorumBase();
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         LOG.info("STARTING quorum {}", getClass().getName());
         qb.localSessionsEnabled = true;
@@ -54,7 +54,7 @@ public void setUp() throws Exception {
         ClientBase.waitForServerUp(qb.hostPort, 10000);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         LOG.info("STOPPING quorum {}", getClass().getName());
         qb.tearDown();
@@ -71,7 +71,7 @@ public void testLocalSessionsOnLeader() throws Exception {
     }
 
     /**
-     * Walk through the target peer commmittedLog.
+     * Walk through the target peer committedLog.
      * @param sessionId
      * @param peerId
      */
@@ -82,12 +82,9 @@ private void validateRequestLog(long sessionId, int peerId) {
         QuorumPeer peer = qb.getPeerList().get(peerId);
         ZKDatabase db = peer.getActiveServer().getZKDatabase();
         for (Proposal p : db.getCommittedLog()) {
-            assertFalse("Should not see "
-                                       + Request.op2String(p.request.type)
-                                       + " request from local session 0x"
-                                       + session
-                                       + " on the "
-                                       + peerType, p.request.sessionId == sessionId);
+            assertFalse(p.getRequest().sessionId == sessionId,
+                    "Should not see " + Request.op2String(p.getRequest().type)
+                            + " request from local session 0x" + session + " on the " + peerType);
         }
     }
 
@@ -98,7 +95,7 @@ private void validateRequestLog(long sessionId, int peerId) {
      */
     public void testOpenCloseSession(boolean onLeader) throws Exception {
         int leaderIdx = qb.getLeaderIndex();
-        assertFalse("No leader in quorum?", leaderIdx == -1);
+        assertFalse(leaderIdx == -1, "No leader in quorum?");
         int followerIdx = (leaderIdx + 1) % 5;
         int testPeerIdx = onLeader ? leaderIdx : followerIdx;
         int verifyPeerIdx = onLeader ? followerIdx : leaderIdx;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LocalSessionsOnlyTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LocalSessionsOnlyTest.java
index 2bd00d836de..cf6d46a6df0 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LocalSessionsOnlyTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LocalSessionsOnlyTest.java
@@ -18,10 +18,10 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Map.Entry;
@@ -31,9 +31,9 @@
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -50,7 +50,7 @@ public class LocalSessionsOnlyTest extends ZKTestCase {
 
     private final QuorumBase qb = new QuorumBase();
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         LOG.info("STARTING quorum {}", getClass().getName());
         qb.localSessionsEnabled = true;
@@ -59,7 +59,7 @@ public void setUp() throws Exception {
         ClientBase.waitForServerUp(qb.hostPort, 10000);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         LOG.info("STOPPING quorum {}", getClass().getName());
         qb.tearDown();
@@ -78,7 +78,7 @@ public void testLocalSessionsOnLeader() throws Exception {
     private void testLocalSessions(boolean testLeader) throws Exception {
         String nodePrefix = "/testLocalSessions-" + (testLeader ? "leaderTest-" : "followerTest-");
         int leaderIdx = qb.getLeaderIndex();
-        assertFalse("No leader in quorum?", leaderIdx == -1);
+        assertFalse(leaderIdx == -1, "No leader in quorum?");
         int followerIdx = (leaderIdx + 1) % 5;
         int testPeerIdx = testLeader ? leaderIdx : followerIdx;
         String[] hostPorts = qb.hostPort.split(",");
@@ -106,7 +106,7 @@ private void testLocalSessions(boolean testLeader) throws Exception {
         zk.close();
 
         // Validate data on both follower and leader
-        Map<String, Integer> peers = new HashMap<String, Integer>();
+        Map<String, Integer> peers = new HashMap<>();
         peers.put("leader", leaderIdx);
         peers.put("follower", followerIdx);
         for (Entry<String, Integer> entry : peers.entrySet()) {
@@ -120,11 +120,11 @@ private void testLocalSessions(boolean testLeader) throws Exception {
             assertFalse(newSessionId == localSessionId);
 
             for (int i = 0; i < 5; i++) {
-                assertNotNull("Data not exists in " + entry.getKey(), zk.exists(nodePrefix + i, null));
+                assertNotNull(zk.exists(nodePrefix + i, null), "Data not exists in " + entry.getKey());
             }
 
             // We may get the correct exception but the txn may go through
-            assertNull("Data exists in " + entry.getKey(), zk.exists(nodePrefix + "ephemeral", null));
+            assertNull(zk.exists(nodePrefix + "ephemeral", null), "Data exists in " + entry.getKey());
 
             zk.close();
         }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LogChopperTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LogChopperTest.java
index c836e8314b4..fbe96d9f6f7 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LogChopperTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LogChopperTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.FileOutputStream;
@@ -31,12 +31,13 @@
 import java.nio.file.SimpleFileVisitor;
 import java.nio.file.attribute.BasicFileAttributes;
 import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.server.Request;
 import org.apache.zookeeper.server.persistence.FileTxnLog;
 import org.apache.zookeeper.server.persistence.TxnLog;
 import org.apache.zookeeper.server.util.LogChopper;
 import org.apache.zookeeper.txn.DeleteTxn;
 import org.apache.zookeeper.txn.TxnHeader;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 class Pair<V1, V2> {
 
@@ -85,7 +86,7 @@ Pair<Long, Long> getFirstLastZxid(File logFile) throws IOException {
         }
         txnLog.close();
         rmr(tmp);
-        return new Pair<Long, Long>(firstZxid, lastZxid);
+        return new Pair<>(firstZxid, lastZxid);
     }
 
     @Test
@@ -101,12 +102,12 @@ public void testChopper() throws IOException {
 
         for (int i = 0; i < 100; i++) {
             TxnHeader hdr = new TxnHeader(clientId, cxid, ++zxid, ++time, type);
-            txnLog.append(hdr, txn);
+            txnLog.append(new Request(0, 0, 0, hdr, txn, 0));
         }
 
         // append a txn with gap
         TxnHeader hdr = new TxnHeader(clientId, cxid, zxid + 10, ++time, type);
-        txnLog.append(hdr, txn);
+        txnLog.append(new Request(0, 0, 0, hdr, txn, 0));
 
         txnLog.commit();
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoggerTestTool.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoggerTestTool.java
new file mode 100644
index 00000000000..5633c08b0e1
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/LoggerTestTool.java
@@ -0,0 +1,113 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import ch.qos.logback.classic.Level;
+import ch.qos.logback.classic.Logger;
+import ch.qos.logback.classic.LoggerContext;
+import ch.qos.logback.classic.spi.ILoggingEvent;
+import ch.qos.logback.core.Appender;
+import ch.qos.logback.core.Layout;
+import ch.qos.logback.core.OutputStreamAppender;
+import ch.qos.logback.core.encoder.LayoutWrappingEncoder;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.LineNumberReader;
+import java.io.StringReader;
+import org.slf4j.LoggerFactory;
+
+public class LoggerTestTool implements AutoCloseable {
+  private final ByteArrayOutputStream os;
+  private Appender<ILoggingEvent> appender;
+  private Logger qlogger;
+  private Level logLevel = Level.INFO;
+
+  public LoggerTestTool(Class<?> cls) {
+    os = createLoggingStream(cls);
+  }
+
+  public LoggerTestTool(Class<?> cls, Level logLevel) {
+    this.logLevel = logLevel;
+    this.os = createLoggingStream(cls);
+  }
+
+  public LoggerTestTool(String cls) {
+    os = createLoggingStream(cls);
+  }
+
+  public ByteArrayOutputStream getOutputStream() {
+    return os;
+  }
+
+  private ByteArrayOutputStream createLoggingStream(Class<?> cls) {
+    ByteArrayOutputStream os = new ByteArrayOutputStream();
+    appender = getConsoleAppender(os);
+    qlogger = (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(cls);
+    qlogger.addAppender(appender);
+    qlogger.setLevel(logLevel);
+    appender.start();
+    return os;
+  }
+
+  private ByteArrayOutputStream createLoggingStream(String cls) {
+    ByteArrayOutputStream os = new ByteArrayOutputStream();
+    appender = getConsoleAppender(os);
+    qlogger = (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(cls);
+    qlogger.addAppender(appender);
+    qlogger.setLevel(logLevel);
+    appender.start();
+    return os;
+  }
+
+  private OutputStreamAppender<ILoggingEvent> getConsoleAppender(ByteArrayOutputStream os) {
+    Logger rootLogger =
+        (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(org.slf4j.Logger.ROOT_LOGGER_NAME);
+    rootLogger.setLevel(logLevel);
+    Layout<ILoggingEvent> layout = ((LayoutWrappingEncoder<ILoggingEvent>)
+        ((OutputStreamAppender<ILoggingEvent>) rootLogger.getAppender("CONSOLE")).getEncoder()).getLayout();
+
+    OutputStreamAppender<ILoggingEvent> appender = new OutputStreamAppender<>();
+    appender.setContext((LoggerContext) LoggerFactory.getILoggerFactory());
+    appender.setOutputStream(os);
+    appender.setLayout(layout);
+
+    return appender;
+  }
+
+  public String readLogLine(String search) throws IOException {
+    try {
+      LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
+      String line;
+      while ((line = r.readLine()) != null) {
+        if (line.contains(search)) {
+          return line;
+        }
+      }
+      return null;
+    } finally {
+      os.reset();
+    }
+  }
+
+  @Override
+  public void close() throws Exception {
+    qlogger.detachAppender(appender);
+    os.close();
+  }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/MaxCnxnsTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/MaxCnxnsTest.java
index a927e3ef977..0034fd6d04a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/MaxCnxnsTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/MaxCnxnsTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertSame;
+import static org.junit.jupiter.api.Assertions.assertSame;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.net.InetSocketAddress;
@@ -27,7 +27,8 @@
 import java.util.concurrent.atomic.AtomicInteger;
 import org.apache.jute.BinaryOutputArchive;
 import org.apache.zookeeper.proto.ConnectRequest;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class MaxCnxnsTest extends ClientBase {
 
@@ -36,6 +37,7 @@ public class MaxCnxnsTest extends ClientBase {
     String host;
     int port;
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         maxCnxns = numCnxns;
@@ -49,18 +51,16 @@ public CnxnThread(int i) {
         }
 
         public void run() {
-            SocketChannel sChannel = null;
-            try {
+            try (SocketChannel sChannel = SocketChannel.open()) {
                 /*
                  * For future unwary socket programmers: although connect 'blocks' it
                  * does not require an accept on the server side to return. Therefore
                  * you can not assume that all the sockets are connected at the end of
                  * this for loop.
                  */
-                sChannel = SocketChannel.open();
                 sChannel.connect(new InetSocketAddress(host, port));
                 // Construct a connection request
-                ConnectRequest conReq = new ConnectRequest(0, 0, 10000, 0, "password".getBytes());
+                ConnectRequest conReq = new ConnectRequest(0, 0, 10000, 0, "password".getBytes(), false);
                 ByteArrayOutputStream baos = new ByteArrayOutputStream();
                 BinaryOutputArchive boa = BinaryOutputArchive.getArchive(baos);
                 boa.writeInt(-1, "len");
@@ -93,14 +93,6 @@ public void run() {
                 }
             } catch (IOException io) {
                 // "Connection reset by peer"
-            } finally {
-                if (sChannel != null) {
-                    try {
-                        sChannel.close();
-                    } catch (Exception e) {
-                        // Do nothing
-                    }
-                }
             }
         }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiAsyncTransactionTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiAsyncTransactionTest.java
index 5a94649de0d..fada1c479be 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiAsyncTransactionTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiAsyncTransactionTest.java
@@ -17,8 +17,8 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
@@ -32,15 +32,15 @@
 import org.apache.zookeeper.OpResult.ErrorResult;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class MultiAsyncTransactionTest extends ClientBase {
 
     private ZooKeeper zk;
     private final AtomicInteger pendingOps = new AtomicInteger(0);
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         super.setUp();
         zk = createClient();
@@ -82,7 +82,7 @@ private void waitForPendingOps(int timeout) throws Exception {
     @Test
     public void testSequentialNodeCreateInAsyncMulti() throws Exception {
         final int iteration = 4;
-        final List<MultiResult> results = new ArrayList<MultiResult>();
+        final List<MultiResult> results = new ArrayList<>();
 
         pendingOps.set(iteration);
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiOperationTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiOperationTest.java
index 6e23bd62572..7157966c977 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiOperationTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/MultiOperationTest.java
@@ -18,17 +18,17 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertArrayEquals;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertSame;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.ArrayList;
 import java.util.Arrays;
-import java.util.Collection;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
@@ -39,7 +39,9 @@
 import java.util.stream.Collectors;
 import org.apache.zookeeper.AsyncCallback;
 import org.apache.zookeeper.AsyncCallback.MultiCallback;
+import org.apache.zookeeper.ClientCnxn;
 import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.CreateOptions;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.Op;
 import org.apache.zookeeper.OpResult;
@@ -51,7 +53,6 @@
 import org.apache.zookeeper.Transaction;
 import org.apache.zookeeper.WatchedEvent;
 import org.apache.zookeeper.Watcher;
-import org.apache.zookeeper.ZKParameterized;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
@@ -59,34 +60,20 @@
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.server.SyncRequestProcessor;
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
-import org.junit.runners.Parameterized.Parameters;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Timeout;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-@RunWith(Parameterized.class)
-@Parameterized.UseParametersRunnerFactory(ZKParameterized.RunnerFactory.class)
 public class MultiOperationTest extends ClientBase {
 
     private static final Logger LOG = LoggerFactory.getLogger(MultiOperationTest.class);
     private ZooKeeper zk;
     private ZooKeeper zk_chroot;
 
-    private final boolean useAsync;
-
-    public MultiOperationTest(boolean useAsync) {
-        this.useAsync = useAsync;
-    }
-
-    @Parameters
-    public static Collection<Object[]> configs() {
-        return Arrays.asList(new Object[][]{{false}, {true}});
-    }
-
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         SyncRequestProcessor.setSnapCount(150);
         super.setUp();
@@ -101,12 +88,15 @@ static class MultiResult {
 
     }
 
-    private List<OpResult> multi(ZooKeeper zk, Iterable<Op> ops) throws KeeperException, InterruptedException {
+    private List<OpResult> multi(ZooKeeper zk, Iterable<Op> ops, boolean useAsync) throws KeeperException, InterruptedException {
         if (useAsync) {
             final MultiResult res = new MultiResult();
             zk.multi(ops, new MultiCallback() {
                 @Override
                 public void processResult(int rc, String path, Object ctx, List<OpResult> opResults) {
+                    if (!ClientCnxn.isInEventThread()) {
+                        throw new RuntimeException("not in event thread");
+                    }
                     synchronized (res) {
                         res.rc = rc;
                         res.results = opResults;
@@ -131,7 +121,7 @@ public void processResult(int rc, String path, Object ctx, List<OpResult> opResu
         }
     }
 
-    private void multiHavingErrors(ZooKeeper zk, Iterable<Op> ops, List<Integer> expectedResultCodes, String expectedErr) throws KeeperException, InterruptedException {
+    private void multiHavingErrors(ZooKeeper zk, Iterable<Op> ops, List<Integer> expectedResultCodes, String expectedErr, boolean useAsync) throws KeeperException, InterruptedException {
         if (useAsync) {
             final MultiResult res = new MultiResult();
             zk.multi(ops, new MultiCallback() {
@@ -152,23 +142,23 @@ public void processResult(int rc, String path, Object ctx, List<OpResult> opResu
             }
             for (int i = 0; i < res.results.size(); i++) {
                 OpResult opResult = res.results.get(i);
-                assertTrue("Did't receive proper error response", opResult instanceof ErrorResult);
+                assertTrue(opResult instanceof ErrorResult, "Did't receive proper error response");
                 ErrorResult errRes = (ErrorResult) opResult;
-                assertEquals("Did't receive proper error code", expectedResultCodes.get(i).intValue(), errRes.getErr());
+                assertEquals(expectedResultCodes.get(i).intValue(), errRes.getErr(), "Did't receive proper error code");
             }
         } else {
             try {
                 zk.multi(ops);
                 fail("Shouldn't have validated in ZooKeeper client!");
             } catch (KeeperException e) {
-                assertEquals("Wrong exception", expectedErr, e.code().name());
+                assertEquals(expectedErr, e.code().name(), "Wrong exception");
             } catch (IllegalArgumentException e) {
-                assertEquals("Wrong exception", expectedErr, e.getMessage());
+                assertEquals(expectedErr, e.getMessage(), "Wrong exception");
             }
         }
     }
 
-    private List<OpResult> commit(Transaction txn) throws KeeperException, InterruptedException {
+    private List<OpResult> commit(Transaction txn, boolean useAsync) throws KeeperException, InterruptedException {
         if (useAsync) {
             final MultiResult res = new MultiResult();
             txn.commit(new MultiCallback() {
@@ -200,9 +190,11 @@ public void processResult(int rc, String path, Object ctx, List<OpResult> opResu
     /**
      * Test verifies the multi calls with invalid znode path
      */
-    @Test(timeout = 90000)
-    public void testInvalidPath() throws Exception {
-        List<Integer> expectedResultCodes = new ArrayList<Integer>();
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testInvalidPath(boolean useAsync) throws Exception {
+        List<Integer> expectedResultCodes = new ArrayList<>();
         expectedResultCodes.add(KeeperException.Code.RUNTIMEINCONSISTENCY.intValue());
         expectedResultCodes.add(KeeperException.Code.BADARGUMENTS.intValue());
         expectedResultCodes.add(KeeperException.Code.RUNTIMEINCONSISTENCY.intValue());
@@ -212,7 +204,7 @@ public void testInvalidPath() throws Exception {
                 Op.create("/multi1/", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
                 Op.create("/multi2", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT));
         String expectedErr = "Path must not end with / character";
-        multiHavingErrors(zk, opList, expectedResultCodes, expectedErr);
+        multiHavingErrors(zk, opList, expectedResultCodes, expectedErr, useAsync);
 
         // create with valid sequential flag
         opList = Arrays.asList(
@@ -220,21 +212,21 @@ public void testInvalidPath() throws Exception {
                 Op.create("multi1/", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL_SEQUENTIAL.toFlag()),
                 Op.create("/multi2", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT));
         expectedErr = "Path must start with / character";
-        multiHavingErrors(zk, opList, expectedResultCodes, expectedErr);
+        multiHavingErrors(zk, opList, expectedResultCodes, expectedErr, useAsync);
 
         // check
         opList = Arrays.asList(
                 Op.check("/multi0", -1), Op.check("/multi1/", 100),
                 Op.check("/multi2", 5));
         expectedErr = "Path must not end with / character";
-        multiHavingErrors(zk, opList, expectedResultCodes, expectedErr);
+        multiHavingErrors(zk, opList, expectedResultCodes, expectedErr, useAsync);
 
         // delete
         opList = Arrays.asList(
                 Op.delete("/multi0", -1),
                 Op.delete("/multi1/", 100),
                 Op.delete("/multi2", 5));
-        multiHavingErrors(zk, opList, expectedResultCodes, expectedErr);
+        multiHavingErrors(zk, opList, expectedResultCodes, expectedErr, useAsync);
 
         // Multiple bad arguments
         expectedResultCodes.add(KeeperException.Code.BADARGUMENTS.intValue());
@@ -245,7 +237,7 @@ public void testInvalidPath() throws Exception {
                 Op.setData("/multi1/", new byte[0], -1),
                 Op.setData("/multi2", new byte[0], -1),
                 Op.setData("multi3", new byte[0], -1));
-        multiHavingErrors(zk, opList, expectedResultCodes, expectedErr);
+        multiHavingErrors(zk, opList, expectedResultCodes, expectedErr, useAsync);
     }
 
     /**
@@ -256,8 +248,9 @@ public void testInvalidPath() throws Exception {
      * 2. ephemeral nodes under that directory are deleted
      * 3. multi delete should succeed.
      */
-    @Test
-    public void testMultiRollback() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testMultiRollback(boolean useAsync) throws Exception {
         zk.create("/foo", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
         ZooKeeper epheZk = createClient();
@@ -300,9 +293,11 @@ public void testMultiRollback() throws Exception {
     /**
      * Test verifies the multi calls with blank znode path
      */
-    @Test(timeout = 90000)
-    public void testBlankPath() throws Exception {
-        List<Integer> expectedResultCodes = new ArrayList<Integer>();
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testBlankPath(boolean useAsync) throws Exception {
+        List<Integer> expectedResultCodes = new ArrayList<>();
         expectedResultCodes.add(KeeperException.Code.RUNTIMEINCONSISTENCY.intValue());
         expectedResultCodes.add(KeeperException.Code.BADARGUMENTS.intValue());
         expectedResultCodes.add(KeeperException.Code.RUNTIMEINCONSISTENCY.intValue());
@@ -315,15 +310,17 @@ public void testBlankPath() throws Exception {
                 Op.delete(null, 100),
                 Op.delete("/multi2", 5),
                 Op.delete("", -1));
-        multiHavingErrors(zk, opList, expectedResultCodes, expectedErr);
+        multiHavingErrors(zk, opList, expectedResultCodes, expectedErr, useAsync);
     }
 
     /**
      * Test verifies the multi.create with invalid createModeFlag
      */
-    @Test(timeout = 90000)
-    public void testInvalidCreateModeFlag() throws Exception {
-        List<Integer> expectedResultCodes = new ArrayList<Integer>();
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Timeout(value = 90)
+    public void testInvalidCreateModeFlag(boolean useAsync) throws Exception {
+        List<Integer> expectedResultCodes = new ArrayList<>();
         expectedResultCodes.add(KeeperException.Code.RUNTIMEINCONSISTENCY.intValue());
         expectedResultCodes.add(KeeperException.Code.BADARGUMENTS.intValue());
         expectedResultCodes.add(KeeperException.Code.RUNTIMEINCONSISTENCY.intValue());
@@ -334,58 +331,61 @@ public void testInvalidCreateModeFlag() throws Exception {
                 Op.create("/multi1", new byte[0], Ids.OPEN_ACL_UNSAFE, createModeFlag),
                 Op.create("/multi2", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT));
         String expectedErr = KeeperException.Code.BADARGUMENTS.name();
-        multiHavingErrors(zk, opList, expectedResultCodes, expectedErr);
+        multiHavingErrors(zk, opList, expectedResultCodes, expectedErr, useAsync);
     }
 
-    @Test
-    public void testChRootCreateDelete() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testChRootCreateDelete(boolean useAsync) throws Exception {
         // creating the subtree for chRoot clients.
-        String chRoot = createNameSpace();
+        String chRoot = createNameSpace(useAsync);
         // Creating child using chRoot client.
         zk_chroot = createClient(this.hostPort + chRoot);
         Op createChild = Op.create("/myid", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        multi(zk_chroot, Arrays.asList(createChild));
+        multi(zk_chroot, Arrays.asList(createChild), useAsync);
 
-        assertNotNull("zNode is not created under chroot:" + chRoot, zk.exists(chRoot + "/myid", false));
-        assertNotNull("zNode is not created under chroot:" + chRoot, zk_chroot.exists("/myid", false));
-        assertNull("zNode is created directly under '/', ignored configured chroot", zk.exists("/myid", false));
+        assertNotNull(zk.exists(chRoot + "/myid", false), "zNode is not created under chroot:" + chRoot);
+        assertNotNull(zk_chroot.exists("/myid", false), "zNode is not created under chroot:" + chRoot);
+        assertNull(zk.exists("/myid", false), "zNode is created directly under '/', ignored configured chroot");
 
         // Deleting child using chRoot client.
         Op deleteChild = Op.delete("/myid", 0);
-        multi(zk_chroot, Arrays.asList(deleteChild));
-        assertNull("zNode exists under chroot:" + chRoot, zk.exists(chRoot + "/myid", false));
-        assertNull("zNode exists under chroot:" + chRoot, zk_chroot.exists("/myid", false));
+        multi(zk_chroot, Arrays.asList(deleteChild), useAsync);
+        assertNull(zk.exists(chRoot + "/myid", false), "zNode exists under chroot:" + chRoot);
+        assertNull(zk_chroot.exists("/myid", false), "zNode exists under chroot:" + chRoot);
     }
 
-    @Test
-    public void testChRootSetData() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testChRootSetData(boolean useAsync) throws Exception {
         // creating the subtree for chRoot clients.
-        String chRoot = createNameSpace();
+        String chRoot = createNameSpace(useAsync);
         // setData using chRoot client.
         zk_chroot = createClient(this.hostPort + chRoot);
         String[] names = {"/multi0", "/multi1", "/multi2"};
-        List<Op> ops = new ArrayList<Op>();
+        List<Op> ops = new ArrayList<>();
 
         for (int i = 0; i < names.length; i++) {
             ops.add(Op.create(names[i], new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT));
             ops.add(Op.setData(names[i], names[i].getBytes(), 0));
         }
 
-        multi(zk_chroot, ops);
+        multi(zk_chroot, ops, useAsync);
 
         for (int i = 0; i < names.length; i++) {
-            assertArrayEquals("zNode data not matching", names[i].getBytes(), zk_chroot.getData(names[i], false, null));
+            assertArrayEquals(names[i].getBytes(), zk_chroot.getData(names[i], false, null), "zNode data not matching");
         }
     }
 
-    @Test
-    public void testChRootCheck() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testChRootCheck(boolean useAsync) throws Exception {
         // creating the subtree for chRoot clients.
-        String chRoot = createNameSpace();
+        String chRoot = createNameSpace(useAsync);
         // checking the child version using chRoot client.
         zk_chroot = createClient(this.hostPort + chRoot);
         String[] names = {"/multi0", "/multi1", "/multi2"};
-        List<Op> ops = new ArrayList<Op>();
+        List<Op> ops = new ArrayList<>();
 
         for (int i = 0; i < names.length; i++) {
             zk.create(chRoot + names[i], new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
@@ -393,13 +393,14 @@ public void testChRootCheck() throws Exception {
         for (int i = 0; i < names.length; i++) {
             ops.add(Op.check(names[i], 0));
         }
-        multi(zk_chroot, ops);
+        multi(zk_chroot, ops, useAsync);
     }
 
-    @Test
-    public void testChRootTransaction() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testChRootTransaction(boolean useAsync) throws Exception {
         // creating the subtree for chRoot clients.
-        String chRoot = createNameSpace();
+        String chRoot = createNameSpace(useAsync);
         // checking the child version using chRoot client.
         zk_chroot = createClient(this.hostPort + chRoot);
         String childPath = "/myid";
@@ -407,74 +408,109 @@ public void testChRootTransaction() throws Exception {
         transaction.create(childPath, new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         transaction.check(childPath, 0);
         transaction.setData(childPath, childPath.getBytes(), 0);
-        commit(transaction);
+        commit(transaction, useAsync);
 
-        assertNotNull("zNode is not created under chroot:" + chRoot, zk.exists(chRoot + childPath, false));
-        assertNotNull("zNode is not created under chroot:" + chRoot, zk_chroot.exists(childPath, false));
-        assertNull("zNode is created directly under '/', ignored configured chroot", zk.exists(childPath, false));
-        assertArrayEquals("zNode data not matching", childPath.getBytes(), zk_chroot.getData(childPath, false, null));
+        assertNotNull(zk.exists(chRoot + childPath, false), "zNode is not created under chroot:" + chRoot);
+        assertNotNull(zk_chroot.exists(childPath, false), "zNode is not created under chroot:" + chRoot);
+        assertNull(zk.exists(childPath, false), "zNode is created directly under '/', ignored configured chroot");
+        assertArrayEquals(childPath.getBytes(), zk_chroot.getData(childPath, false, null), "zNode data not matching");
 
         transaction = zk_chroot.transaction();
         // Deleting child using chRoot client.
         transaction.delete(childPath, 1);
-        commit(transaction);
+        commit(transaction, useAsync);
 
-        assertNull("chroot:" + chRoot + " exists after delete", zk.exists(chRoot + "/myid", false));
-        assertNull("chroot:" + chRoot + " exists after delete", zk_chroot.exists("/myid", false));
+        assertNull(zk.exists(chRoot + "/myid", false), "chroot:" + chRoot + " exists after delete");
+        assertNull(zk_chroot.exists("/myid", false), "chroot:" + chRoot + " exists after delete");
     }
 
-    private String createNameSpace() throws InterruptedException, KeeperException {
+    private String createNameSpace(boolean useAsync) throws InterruptedException, KeeperException {
         // creating the subtree for chRoot clients.
         String chRoot = "/appsX";
         Op createChRoot = Op.create(chRoot, new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        multi(zk, Arrays.asList(createChRoot));
+        multi(zk, Arrays.asList(createChRoot), useAsync);
         return chRoot;
     }
 
-    @Test
-    public void testCreate() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testCreate(boolean useAsync) throws Exception {
         multi(zk, Arrays.asList(
                 Op.create("/multi0", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
                 Op.create("/multi1", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
-                Op.create("/multi2", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT)));
+                Op.create("/multi2", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT)),
+                useAsync);
+        zk.getData("/multi0", false, null);
+        zk.getData("/multi1", false, null);
+        zk.getData("/multi2", false, null);
+    }
+
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testCreate2(boolean useAsync) throws Exception {
+        CreateOptions options = CreateOptions.newBuilder(Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT).build();
+        List<Op> ops = Arrays.asList(
+            Op.create("/multi0", new byte[0], options),
+            Op.create("/multi1", new byte[0], options),
+            Op.create("/multi2", new byte[0], options));
+        List<OpResult> results = multi(zk, ops, useAsync);
+        for (int i = 0; i < ops.size(); i++) {
+            CreateResult createResult = (CreateResult) results.get(i);
+            assertEquals(ops.get(i).getPath(), createResult.getPath());
+            assertEquals(ZooDefs.OpCode.create2, createResult.getType(), createResult.getPath());
+            assertNotNull(createResult.getStat(), createResult.getPath());
+            assertNotEquals(0, createResult.getStat().getCzxid(), createResult.getPath());
+        }
+
         zk.getData("/multi0", false, null);
         zk.getData("/multi1", false, null);
         zk.getData("/multi2", false, null);
     }
 
-    @Test
-    public void testCreateDelete() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testEmpty(boolean useAsync) throws Exception {
+        multi(zk, Arrays.asList(), useAsync);
+    }
 
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testCreateDelete(boolean useAsync) throws Exception {
         multi(zk, Arrays.asList(
                 Op.create("/multi", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
-                Op.delete("/multi", 0)));
+                Op.delete("/multi", 0)),
+                useAsync);
 
         // '/multi' should have been deleted
         assertNull(zk.exists("/multi", null));
     }
 
-    @Test
-    public void testInvalidVersion() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testInvalidVersion(boolean useAsync) throws Exception {
 
         try {
             multi(zk, Arrays.asList(
                     Op.create("/multi", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
-                    Op.delete("/multi", 1)));
+                    Op.delete("/multi", 1)),
+                    useAsync);
             fail("delete /multi should have failed");
         } catch (KeeperException e) {
             /* PASS */
         }
     }
 
-    @Test
-    public void testNestedCreate() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testNestedCreate(boolean useAsync) throws Exception {
 
         multi(zk, Arrays.asList(
                 /* Create */
-                Op.create("/multi", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT), Op.create("/multi/a", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT), Op.create("/multi/a/1", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
-
+                Op.create("/multi", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
+                Op.create("/multi/a", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
+                Op.create("/multi/a/1", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
                 /* Delete */
-                Op.delete("/multi/a/1", 0), Op.delete("/multi/a", 0), Op.delete("/multi", 0)));
+                Op.delete("/multi/a/1", 0), Op.delete("/multi/a", 0), Op.delete("/multi", 0)), useAsync);
 
         //Verify tree deleted
         assertNull(zk.exists("/multi/a/1", null));
@@ -482,26 +518,28 @@ public void testNestedCreate() throws Exception {
         assertNull(zk.exists("/multi", null));
     }
 
-    @Test
-    public void testSetData() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testSetData(boolean useAsync) throws Exception {
 
         String[] names = {"/multi0", "/multi1", "/multi2"};
-        List<Op> ops = new ArrayList<Op>();
+        List<Op> ops = new ArrayList<>();
 
         for (int i = 0; i < names.length; i++) {
             ops.add(Op.create(names[i], new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT));
             ops.add(Op.setData(names[i], names[i].getBytes(), 0));
         }
 
-        multi(zk, ops);
+        multi(zk, ops, useAsync);
 
         for (int i = 0; i < names.length; i++) {
             assertArrayEquals(names[i].getBytes(), zk.getData(names[i], false, null));
         }
     }
 
-    @Test
-    public void testUpdateConflict() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testUpdateConflict(boolean useAsync) throws Exception {
 
         assertNull(zk.exists("/multi", null));
 
@@ -509,7 +547,8 @@ public void testUpdateConflict() throws Exception {
             multi(zk, Arrays.asList(
                     Op.create("/multi", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
                     Op.setData("/multi", "X".getBytes(), 0),
-                    Op.setData("/multi", "Y".getBytes(), 0)));
+                    Op.setData("/multi", "Y".getBytes(), 0)),
+                    useAsync);
             fail("Should have thrown a KeeperException for invalid version");
         } catch (KeeperException e) {
             //PASS
@@ -522,20 +561,23 @@ public void testUpdateConflict() throws Exception {
         multi(zk, Arrays.asList(
                 Op.create("/multi", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
                 Op.setData("/multi", "X".getBytes(), 0),
-                Op.setData("/multi", "Y".getBytes(), 1)));
+                Op.setData("/multi", "Y".getBytes(), 1)),
+                useAsync);
 
         assertArrayEquals(zk.getData("/multi", false, null), "Y".getBytes());
     }
 
-    @Test
-    public void testDeleteUpdateConflict() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testDeleteUpdateConflict(boolean useAsync) throws Exception {
 
-        /* Delete of a node folowed by an update of the (now) deleted node */
+        /* Delete of a node followed by an update of the (now) deleted node */
         try {
             multi(zk, Arrays.asList(
                     Op.create("/multi", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
                     Op.delete("/multi", 0),
-                    Op.setData("/multi", "Y".getBytes(), 0)));
+                    Op.setData("/multi", "Y".getBytes(), 0)),
+                    useAsync);
             fail("/multi should have been deleted so setData should have failed");
         } catch (KeeperException e) {
             /* PASS */
@@ -545,9 +587,10 @@ public void testDeleteUpdateConflict() throws Exception {
         assertNull(zk.exists("/multi", null));
     }
 
-    @Test
-    public void testGetResults() throws Exception {
-        /* Delete of a node folowed by an update of the (now) deleted node */
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testGetResults(boolean useAsync) throws Exception {
+        /* Delete of a node followed by an update of the (now) deleted node */
         Iterable<Op> ops = Arrays.asList(
                 Op.create("/multi", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
                 Op.delete("/multi", 0),
@@ -572,8 +615,8 @@ public void processResult(int rc, String path, Object ctx, List<OpResult> opResu
                     res.wait();
                 }
             }
-            assertFalse("/multi should have been deleted so setData should have failed", KeeperException.Code.OK.intValue()
-                                                                                                        == res.rc);
+            assertFalse(KeeperException.Code.OK.intValue() == res.rc,
+                    "/multi should have been deleted so setData should have failed");
             assertNull(zk.exists("/multi", null));
             results = res.results;
         } else {
@@ -600,8 +643,9 @@ public void processResult(int rc, String path, Object ctx, List<OpResult> opResu
     /**
      * Exercise the equals methods of OpResult classes.
      */
-    @Test
-    public void testOpResultEquals() {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testOpResultEquals(boolean useAsync) {
         opEquals(new CreateResult("/foo"), new CreateResult("/foo"), new CreateResult("nope"));
 
         opEquals(new CreateResult("/foo"), new CreateResult("/foo"), new CreateResult("/foo", new Stat(1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11)));
@@ -623,30 +667,34 @@ public void testOpResultEquals() {
 
     private void opEquals(OpResult expected, OpResult value, OpResult near) {
         assertEquals(value, value);
-        assertFalse(value.equals(new Object()));
-        assertFalse(value.equals(near));
-        assertFalse(value.equals(value instanceof CreateResult ? new ErrorResult(1) : new CreateResult("nope2")));
+        assertNotEquals(value, new Object());
+        assertNotEquals(value, near);
+        assertNotEquals(value, (value instanceof CreateResult ? new ErrorResult(1) : new CreateResult("nope2")));
         assertTrue(value.equals(expected));
     }
 
-    @Test
-    public void testWatchesTriggered() throws KeeperException, InterruptedException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testWatchesTriggered(boolean useAsync) throws KeeperException, InterruptedException {
         HasTriggeredWatcher watcher = new HasTriggeredWatcher();
         zk.getChildren("/", watcher);
         multi(zk, Arrays.asList(
                 Op.create("/t", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
-                Op.delete("/t", -1)));
+                Op.delete("/t", -1)),
+                useAsync);
         assertTrue(watcher.triggered.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS));
     }
 
-    @Test
-    public void testNoWatchesTriggeredForFailedMultiRequest() throws InterruptedException, KeeperException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testNoWatchesTriggeredForFailedMultiRequest(boolean useAsync) throws InterruptedException, KeeperException {
         HasTriggeredWatcher watcher = new HasTriggeredWatcher();
         zk.getChildren("/", watcher);
         try {
             multi(zk, Arrays.asList(
                     Op.create("/t", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
-                    Op.delete("/nonexisting", -1)));
+                    Op.delete("/nonexisting", -1)),
+                    useAsync);
             fail("expected previous multi op to fail!");
         } catch (KeeperException.NoNodeException e) {
             // expected
@@ -659,9 +707,14 @@ public void testNoWatchesTriggeredForFailedMultiRequest() throws InterruptedExce
         assertEquals(1, watcher.triggered.getCount());
     }
 
-    @Test
-    public void testTransactionBuilder() throws Exception {
-        List<OpResult> results = commit(zk.transaction().create("/t1", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT).create("/t1/child", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT).create("/t2", null, Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL));
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testTransactionBuilder(boolean useAsync) throws Exception {
+        List<OpResult> results = commit(
+                zk.transaction()
+                        .create("/t1", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT)
+                        .create("/t1/child", new byte[0], Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT)
+                        .create("/t2", null, Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL), useAsync);
         assertEquals(3, results.size());
         for (OpResult r : results) {
             CreateResult c = (CreateResult) r;
@@ -672,7 +725,7 @@ public void testTransactionBuilder() throws Exception {
         assertNotNull(zk.exists("/t1/child", false));
         assertNotNull(zk.exists("/t2", false));
 
-        results = commit(zk.transaction().check("/t1", 0).check("/t1/child", 0).check("/t2", 0));
+        results = commit(zk.transaction().check("/t1", 0).check("/t1/child", 0).check("/t2", 0), useAsync);
         assertEquals(3, results.size());
         for (OpResult r : results) {
             CheckResult c = (CheckResult) r;
@@ -680,29 +733,29 @@ public void testTransactionBuilder() throws Exception {
         }
 
         try {
-            results = commit(zk.transaction().check("/t1", 0).check("/t1/child", 0).check("/t2", 1));
+            results = commit(zk.transaction().check("/t1", 0).check("/t1/child", 0).check("/t2", 1), useAsync);
             fail();
         } catch (KeeperException.BadVersionException e) {
             // expected
         }
 
-        results = commit(zk.transaction().check("/t1", 0).setData("/t1", new byte[0], 0));
+        results = commit(zk.transaction().check("/t1", 0).setData("/t1", new byte[0], 0), useAsync);
         assertEquals(2, results.size());
         for (OpResult r : results) {
             assertNotNull(r.toString());
         }
 
         try {
-            results = commit(zk.transaction().check("/t1", 1).setData("/t1", new byte[0], 2));
+            results = commit(zk.transaction().check("/t1", 1).setData("/t1", new byte[0], 2), useAsync);
             fail();
         } catch (KeeperException.BadVersionException e) {
             // expected
         }
 
-        results = commit(zk.transaction().check("/t1", 1).check("/t1/child", 0).check("/t2", 0));
+        results = commit(zk.transaction().check("/t1", 1).check("/t1/child", 0).check("/t2", 0), useAsync);
         assertEquals(3, results.size());
 
-        results = commit(zk.transaction().delete("/t2", -1).delete("/t1/child", -1));
+        results = commit(zk.transaction().delete("/t2", -1).delete("/t1/child", -1), useAsync);
         assertEquals(2, results.size());
         for (OpResult r : results) {
             DeleteResult d = (DeleteResult) r;
@@ -713,10 +766,11 @@ public void testTransactionBuilder() throws Exception {
         assertNull(zk.exists("/t2", false));
     }
 
-    @Test
-    public void testMultiGetChildren() throws Exception {
-        List<String> topLevelNodes = new ArrayList<String>();
-        Map<String, List<String>> childrenNodes = new HashMap<String, List<String>>();
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testMultiGetChildren(boolean useAsync) throws Exception {
+        List<String> topLevelNodes = new ArrayList<>();
+        Map<String, List<String>> childrenNodes = new HashMap<>();
         // Creating a database where '/fooX' nodes has 'barXY' named children.
         for (int i = 0; i < 10; i++) {
             String name = "/foo" + i;
@@ -731,7 +785,7 @@ public void testMultiGetChildren() throws Exception {
             }
         }
         // Create a multi operation, which queries the children of the nodes in topLevelNodes.
-        List<OpResult> multiChildrenList = multi(zk, topLevelNodes.stream().map(Op::getChildren).collect(Collectors.toList()));
+        List<OpResult> multiChildrenList = multi(zk, topLevelNodes.stream().map(Op::getChildren).collect(Collectors.toList()), useAsync);
         for (int i = 0; i < topLevelNodes.size(); i++) {
             String nodeName = topLevelNodes.get(i);
             assertTrue(multiChildrenList.get(i) instanceof OpResult.GetChildrenResult);
@@ -744,9 +798,10 @@ public void testMultiGetChildren() throws Exception {
         }
     }
 
-    @Test
-    public void testMultiGetChildrenSameNode() throws Exception {
-        List<String> childrenNodes = new ArrayList<String>();
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testMultiGetChildrenSameNode(boolean useAsync) throws Exception {
+        List<String> childrenNodes = new ArrayList<>();
         // Creating a database where '/foo' node has 'barX' named children.
         String topLevelNode = "/foo";
         zk.create(topLevelNode, topLevelNode.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
@@ -760,7 +815,8 @@ public void testMultiGetChildrenSameNode() throws Exception {
         // Check for getting the children of the same node twice.
         List<OpResult> sameChildrenList = multi(zk, Arrays.asList(
                 Op.getChildren(topLevelNode),
-                Op.getChildren(topLevelNode)));
+                Op.getChildren(topLevelNode)),
+                useAsync);
         // The response should contain two elements which are the same.
         assertEquals(sameChildrenList.size(), 2);
         assertEquals(sameChildrenList.get(0), sameChildrenList.get(1));
@@ -771,15 +827,16 @@ public void testMultiGetChildrenSameNode() throws Exception {
         assertEquals(new TreeSet<String>(gcr.getChildren()), new TreeSet<String>(childrenNodes));
     }
 
-    @Test
-    public void testMultiGetChildrenAuthentication() throws KeeperException, InterruptedException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testMultiGetChildrenAuthentication(boolean useAsync) throws KeeperException, InterruptedException {
         List<ACL> writeOnly = Collections.singletonList(new ACL(ZooDefs.Perms.WRITE, new Id("world", "anyone")));
         zk.create("/foo_auth", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         zk.create("/foo_auth/bar", null, Ids.READ_ACL_UNSAFE, CreateMode.PERSISTENT);
         zk.create("/foo_no_auth", null, writeOnly, CreateMode.PERSISTENT);
 
         // Check for normal behaviour.
-        List<OpResult> multiChildrenList = multi(zk, Arrays.asList(Op.getChildren("/foo_auth")));
+        List<OpResult> multiChildrenList = multi(zk, Arrays.asList(Op.getChildren("/foo_auth")), useAsync);
         assertEquals(multiChildrenList.size(), 1);
         assertTrue(multiChildrenList.get(0) instanceof OpResult.GetChildrenResult);
         List<String> childrenList = ((OpResult.GetChildrenResult) multiChildrenList.get(0)).getChildren();
@@ -787,16 +844,18 @@ public void testMultiGetChildrenAuthentication() throws KeeperException, Interru
         assertEquals(childrenList.get(0), "bar");
 
         // Check for authentication violation.
-        multiChildrenList = multi(zk, Arrays.asList(Op.getChildren("/foo_no_auth")));
+        multiChildrenList = multi(zk, Arrays.asList(Op.getChildren("/foo_no_auth")), useAsync);
 
         assertEquals(multiChildrenList.size(), 1);
         assertTrue(multiChildrenList.get(0) instanceof OpResult.ErrorResult);
-        assertEquals("Expected NoAuthException for getting the children of a write only node", ((OpResult.ErrorResult) multiChildrenList.get(0)).getErr(), KeeperException.Code.NOAUTH.intValue());
+        assertEquals(((OpResult.ErrorResult) multiChildrenList.get(0)).getErr(), KeeperException.Code.NOAUTH.intValue(),
+                "Expected NoAuthException for getting the children of a write only node");
 
     }
 
-    @Test
-    public void testMultiGetChildrenMixedAuthenticationErrorFirst() throws KeeperException, InterruptedException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testMultiGetChildrenMixedAuthenticationErrorFirst(boolean useAsync) throws KeeperException, InterruptedException {
         List<ACL> writeOnly = Collections.singletonList(new ACL(ZooDefs.Perms.WRITE, new Id("world", "anyone")));
         zk.create("/foo_auth", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         zk.create("/foo_auth/bar", null, Ids.READ_ACL_UNSAFE, CreateMode.PERSISTENT);
@@ -804,11 +863,12 @@ public void testMultiGetChildrenMixedAuthenticationErrorFirst() throws KeeperExc
         List<OpResult> multiChildrenList;
 
         // Mixed nodes, the operation after the error should return RuntimeInconsistency error.
-        multiChildrenList = multi(zk, Arrays.asList(Op.getChildren("/foo_no_auth"), Op.getChildren("/foo_auth")));
+        multiChildrenList = multi(zk, Arrays.asList(Op.getChildren("/foo_no_auth"), Op.getChildren("/foo_auth")), useAsync);
 
         assertEquals(multiChildrenList.size(), 2);
         assertTrue(multiChildrenList.get(0) instanceof OpResult.ErrorResult);
-        assertEquals("Expected NoAuthException for getting the children of a write only node", ((OpResult.ErrorResult) multiChildrenList.get(0)).getErr(), KeeperException.Code.NOAUTH.intValue());
+        assertEquals(((OpResult.ErrorResult) multiChildrenList.get(0)).getErr(), KeeperException.Code.NOAUTH.intValue(),
+                "Expected NoAuthException for getting the children of a write only node");
 
         assertTrue(multiChildrenList.get(1) instanceof OpResult.GetChildrenResult);
         List<String> childrenList = ((OpResult.GetChildrenResult) multiChildrenList.get(1)).getChildren();
@@ -816,8 +876,9 @@ public void testMultiGetChildrenMixedAuthenticationErrorFirst() throws KeeperExc
         assertEquals(childrenList.get(0), "bar");
     }
 
-    @Test
-    public void testMultiGetChildrenMixedAuthenticationCorrectFirst() throws KeeperException, InterruptedException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testMultiGetChildrenMixedAuthenticationCorrectFirst(boolean useAsync) throws KeeperException, InterruptedException {
         List<ACL> writeOnly = Collections.singletonList(new ACL(ZooDefs.Perms.WRITE, new Id("world", "anyone")));
         zk.create("/foo_auth", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         zk.create("/foo_auth/bar", null, Ids.READ_ACL_UNSAFE, CreateMode.PERSISTENT);
@@ -826,7 +887,7 @@ public void testMultiGetChildrenMixedAuthenticationCorrectFirst() throws KeeperE
         // Check for getting the children of the nodes with mixed authentication.
         // The getChildren operation returns GetChildrenResult if it happened before the error.
         List<OpResult> multiChildrenList;
-        multiChildrenList = multi(zk, Arrays.asList(Op.getChildren("/foo_auth"), Op.getChildren("/foo_no_auth")));
+        multiChildrenList = multi(zk, Arrays.asList(Op.getChildren("/foo_auth"), Op.getChildren("/foo_no_auth")), useAsync);
         assertSame(multiChildrenList.size(), 2);
 
         assertTrue(multiChildrenList.get(0) instanceof OpResult.GetChildrenResult);
@@ -835,22 +896,25 @@ public void testMultiGetChildrenMixedAuthenticationCorrectFirst() throws KeeperE
         assertEquals(childrenList.get(0), "bar");
 
         assertTrue(multiChildrenList.get(1) instanceof OpResult.ErrorResult);
-        assertEquals("Expected NoAuthException for getting the children of a write only node", ((OpResult.ErrorResult) multiChildrenList.get(1)).getErr(), KeeperException.Code.NOAUTH.intValue());
+        assertEquals(((OpResult.ErrorResult) multiChildrenList.get(1)).getErr(), KeeperException.Code.NOAUTH.intValue(),
+                "Expected NoAuthException for getting the children of a write only node");
     }
 
-    @Test
-    public void testMultiGetData() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testMultiGetData(boolean useAsync) throws Exception {
         zk.create("/node1", "data1".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         zk.create("/node2", "data2".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
-        List<OpResult> multiData = multi(zk, Arrays.asList(Op.getData("/node1"), Op.getData("/node2")));
+        List<OpResult> multiData = multi(zk, Arrays.asList(Op.getData("/node1"), Op.getData("/node2")), useAsync);
         assertEquals(multiData.size(), 2);
         assertArrayEquals(((OpResult.GetDataResult) multiData.get(0)).getData(), "data1".getBytes());
         assertArrayEquals(((OpResult.GetDataResult) multiData.get(1)).getData(), "data2".getBytes());
     }
 
-    @Test
-    public void testMultiRead() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testMultiRead(boolean useAsync) throws Exception {
         zk.create("/node1", "data1".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         zk.create("/node2", "data2".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL);
         zk.create("/node1/node1", "data11".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
@@ -860,7 +924,8 @@ public void testMultiRead() throws Exception {
                 Op.getChildren("/node1"),
                 Op.getData("/node1"),
                 Op.getChildren("/node2"),
-                Op.getData("/node2")));
+                Op.getData("/node2")),
+                useAsync);
         assertEquals(multiRead.size(), 4);
         assertTrue(multiRead.get(0) instanceof OpResult.GetChildrenResult);
         List<String> childrenList = ((OpResult.GetChildrenResult) multiRead.get(0)).getChildren();
@@ -895,13 +960,15 @@ public void testMultiRead() throws Exception {
         assertEquals(0, stat.getNumChildren());
     }
 
-    @Test
-    public void testMixedReadAndTransaction() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testMixedReadAndTransaction(boolean useAsync) throws Exception {
         zk.create("/node", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         try {
             List<OpResult> multiRead = multi(zk, Arrays.asList(
                     Op.setData("/node1", "data1".getBytes(), -1),
-                    Op.getData("/node1")));
+                    Op.getData("/node1")),
+                    useAsync);
             fail("Mixed kind of operations are not allowed");
         } catch (IllegalArgumentException e) {
             // expected
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/NIOConnectionFactoryFdLeakTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/NIOConnectionFactoryFdLeakTest.java
index 7ea295a5579..3feadfdafe0 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/NIOConnectionFactoryFdLeakTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/NIOConnectionFactoryFdLeakTest.java
@@ -18,13 +18,13 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.net.InetSocketAddress;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.server.NIOServerCnxnFactory;
 import org.apache.zookeeper.server.util.OSMXBean;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -60,7 +60,7 @@ public void testFileDescriptorLeak() throws Exception {
         LOG.info("End fdcount is: {}", endFdCount);
 
         // On my box, if selector.close() is not called fd diff is > 700.
-        assertTrue("Possible fd leakage", ((endFdCount - startFdCount) < 50));
+        assertTrue(((endFdCount - startFdCount) < 50), "Possible fd leakage");
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/NettyNettySuiteBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/NettyNettySuiteBase.java
index ffc2b76134d..2964926fb75 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/NettyNettySuiteBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/NettyNettySuiteBase.java
@@ -22,10 +22,10 @@
 import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.server.NettyServerCnxnFactory;
 import org.apache.zookeeper.server.ServerCnxnFactory;
-import org.junit.After;
-import org.junit.AfterClass;
-import org.junit.Before;
-import org.junit.BeforeClass;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.runner.RunWith;
 import org.junit.runners.Suite;
 
@@ -35,25 +35,25 @@
 @RunWith(Suite.class)
 public class NettyNettySuiteBase {
 
-    @BeforeClass
+    @BeforeAll
     public static void setUp() {
         System.setProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY, NettyServerCnxnFactory.class.getName());
         System.setProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET, ClientCnxnSocketNetty.class.getName());
         System.setProperty("zookeeper.admin.enableServer", "false");
     }
 
-    @AfterClass
+    @AfterAll
     public static void tearDown() {
         System.clearProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY);
         System.clearProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET);
     }
 
-    @Before
+    @BeforeEach
     public void setUpTest() throws Exception {
         TestByteBufAllocatorTestHelper.setTestAllocator(TestByteBufAllocator.getInstance());
     }
 
-    @After
+    @AfterEach
     public void tearDownTest() throws Exception {
         TestByteBufAllocatorTestHelper.clearTestAllocator();
         TestByteBufAllocator.checkForLeaks();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/NettyNettySuiteTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/NettyNettySuiteTest.java
index 074d5868b5a..411aae24a47 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/NettyNettySuiteTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/NettyNettySuiteTest.java
@@ -18,12 +18,15 @@
 
 package org.apache.zookeeper.test;
 
-import org.junit.runners.Suite;
+import org.junit.platform.runner.JUnitPlatform;
+import org.junit.platform.suite.api.SelectClasses;
+import org.junit.runner.RunWith;
 
 /**
  * Run tests with: Netty Client against Netty server
  */
-@Suite.SuiteClasses({ACLTest.class, AsyncOpsTest.class, ChrootClientTest.class, ClientTest.class, FourLetterWordsTest.class, NullDataTest.class, ReconfigTest.class, SessionTest.class, WatcherTest.class})
+@RunWith(JUnitPlatform.class)
+@SelectClasses({ACLTest.class, AsyncOpsTest.class, ChrootClientTest.class, ClientTest.class, FourLetterWordsTest.class, NullDataTest.class, SessionTest.class, WatcherTest.class, ReconfigTest.class})
 public class NettyNettySuiteTest extends NettyNettySuiteBase {
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/NioNettySuiteBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/NioNettySuiteBase.java
index 1d6b821831a..d3d6b9bca3f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/NioNettySuiteBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/NioNettySuiteBase.java
@@ -20,10 +20,10 @@
 
 import org.apache.zookeeper.server.NettyServerCnxnFactory;
 import org.apache.zookeeper.server.ServerCnxnFactory;
-import org.junit.After;
-import org.junit.AfterClass;
-import org.junit.Before;
-import org.junit.BeforeClass;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.runner.RunWith;
 import org.junit.runners.Suite;
 
@@ -33,23 +33,23 @@
 @RunWith(Suite.class)
 public class NioNettySuiteBase {
 
-    @BeforeClass
+    @BeforeAll
     public static void setUp() {
         System.setProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY, NettyServerCnxnFactory.class.getName());
         System.setProperty("zookeeper.admin.enableServer", "false");
     }
 
-    @AfterClass
+    @AfterAll
     public static void tearDown() {
         System.clearProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY);
     }
 
-    @Before
+    @BeforeEach
     public void setUpTest() throws Exception {
         TestByteBufAllocatorTestHelper.setTestAllocator(TestByteBufAllocator.getInstance());
     }
 
-    @After
+    @AfterEach
     public void tearDownTest() throws Exception {
         TestByteBufAllocatorTestHelper.clearTestAllocator();
         TestByteBufAllocator.checkForLeaks();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/NioNettySuiteTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/NioNettySuiteTest.java
index 397eb487066..24fc60a2d36 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/NioNettySuiteTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/NioNettySuiteTest.java
@@ -23,7 +23,7 @@
 /**
  * Run tests with: Nio Client against Netty server
  */
-@Suite.SuiteClasses({ACLTest.class, AsyncOpsTest.class, ChrootClientTest.class, ClientTest.class, FourLetterWordsTest.class, NullDataTest.class, ReconfigTest.class, SessionTest.class, WatcherTest.class})
+@Suite.SuiteClasses({ACLTest.class, AsyncOpsTest.class, ChrootClientTest.class, ClientTest.class, FourLetterWordsTest.class, NullDataTest.class, SessionTest.class, WatcherTest.class, ReconfigTest.class})
 public class NioNettySuiteTest extends NioNettySuiteBase {
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/NonRecoverableErrorTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/NonRecoverableErrorTest.java
index f729920e443..ed592df6f7c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/NonRecoverableErrorTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/NonRecoverableErrorTest.java
@@ -19,11 +19,11 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.UUID;
 import org.apache.zookeeper.CreateMode;
@@ -36,7 +36,8 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 /**
  * This class tests the non-recoverable error behavior of quorum server.
@@ -50,7 +51,8 @@ public class NonRecoverableErrorTest extends QuorumPeerTestBase {
      * Test to verify that even after non recoverable error (error while
      * writing transaction log), ZooKeeper is still available.
      */
-    @Test(timeout = 30000)
+    @Test
+    @Timeout(value = 30)
     public void testZooKeeperServiceAvailableOnLeader() throws Exception {
         int SERVER_COUNT = 3;
         final int[] clientPorts = new int[SERVER_COUNT];
@@ -74,8 +76,8 @@ public void testZooKeeperServiceAvailableOnLeader() throws Exception {
         // ensure server started
         for (int i = 0; i < SERVER_COUNT; i++) {
             assertTrue(
-                    "waiting for server " + i + " being up",
-                    ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+                    ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                    "waiting for server " + i + " being up");
         }
 
         CountdownWatcher watcher = new CountdownWatcher();
@@ -87,11 +89,11 @@ public void testZooKeeperServiceAvailableOnLeader() throws Exception {
 
         // get information of current leader
         QuorumPeer leader = getLeaderQuorumPeer(mt);
-        assertNotNull("Leader must have been elected by now", leader);
+        assertNotNull(leader, "Leader must have been elected by now");
 
         // inject problem in leader
         FileTxnSnapLog snapLog = leader.getActiveServer().getTxnLogFactory();
-        FileTxnSnapLog fileTxnSnapLogWithError = new FileTxnSnapLog(snapLog.getDataDir(), snapLog.getSnapDir()) {
+        FileTxnSnapLog fileTxnSnapLogWithError = new FileTxnSnapLog(snapLog.getDataLogDir(), snapLog.getSnapDir()) {
             @Override
             public void commit() throws IOException {
                 throw new IOException("Input/output error");
@@ -121,8 +123,8 @@ public void commit() throws IOException {
         // takes place
         for (int i = 0; i < SERVER_COUNT; i++) {
             assertTrue(
-                    "waiting for server " + i + " being up",
-                    ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT));
+                    ClientBase.waitForServerUp("127.0.0.1:" + clientPorts[i], CONNECTION_TIMEOUT),
+                    "waiting for server " + i + " being up");
         }
 
         // revert back the error
@@ -130,14 +132,14 @@ public void commit() throws IOException {
 
         // verify that now ZooKeeper service is up and running
         leader = getLeaderQuorumPeer(mt);
-        assertNotNull("New leader must have been elected by now", leader);
+        assertNotNull(leader, "New leader must have been elected by now");
 
         String uniqueNode = uniqueZnode();
         watcher.waitForConnected(ClientBase.CONNECTION_TIMEOUT);
         String createNode = zk.create(uniqueNode, data.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         // if node is created successfully then it means that ZooKeeper service
         // is available
-        assertEquals("Failed to create znode", uniqueNode, createNode);
+        assertEquals(uniqueNode, createNode, "Failed to create znode");
         zk.close();
         // stop all severs
         for (int i = 0; i < SERVER_COUNT; i++) {
@@ -154,7 +156,7 @@ private void waitForNewLeaderElection(QuorumPeer peer, long leaderCurrentEpoch)
             }
             count--;
         }
-        assertNotEquals("New LE cycle must have triggered", leaderCurrentEpoch, peer.getCurrentEpoch());
+        assertNotEquals(leaderCurrentEpoch, peer.getCurrentEpoch(), "New LE cycle must have triggered");
     }
 
     private QuorumPeer getLeaderQuorumPeer(MainThread[] mt) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/NullDataTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/NullDataTest.java
index 9356ee47dea..39cde4fd26e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/NullDataTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/NullDataTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertSame;
+import static org.junit.jupiter.api.Assertions.assertSame;
 import java.io.IOException;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
@@ -28,13 +28,16 @@
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.data.Stat;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class NullDataTest extends ClientBase implements StatCallback {
 
     String snapCount;
     CountDownLatch cn = new CountDownLatch(1);
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         // Change the snapcount to happen more often
@@ -43,6 +46,7 @@ public void setUp() throws Exception {
         super.setUp();
     }
 
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         System.setProperty("zookeeper.snapCount", snapCount);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/OOMTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/OOMTest.java
index 05d02ae0d4d..4585a0558ee 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/OOMTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/OOMTest.java
@@ -19,7 +19,7 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.IOException;
 import java.util.ArrayList;
@@ -34,15 +34,15 @@
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.server.ServerCnxnFactory;
 import org.apache.zookeeper.server.ZooKeeperServer;
-import org.junit.Ignore;
-import org.junit.Test;
+import org.junit.jupiter.api.Disabled;
+import org.junit.jupiter.api.Test;
 
 public class OOMTest extends ZKTestCase {
 
     private static final Watcher TEST_WATCHER = event -> System.err.println("Got event: " + event);
 
     @Test
-    @Ignore
+    @Disabled
     public void testOOM() throws IOException, InterruptedException, KeeperException {
         File tmpDir = ClientBase.createTmpDir();
         // Grab some memory so that it is easier to cause an
@@ -62,7 +62,7 @@ public void testOOM() throws IOException, InterruptedException, KeeperException
         final int PORT = PortAssignment.unique();
         ServerCnxnFactory f = ServerCnxnFactory.createFactory(PORT, -1);
         f.startup(zks);
-        assertTrue("waiting for server up", ClientBase.waitForServerUp("127.0.0.1:" + PORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + PORT, CONNECTION_TIMEOUT), "waiting for server up");
 
         System.err.println("OOM Stage 0");
         utestPrep(PORT);
@@ -97,9 +97,8 @@ public void testOOM() throws IOException, InterruptedException, KeeperException
 
         f.shutdown();
         zks.shutdown();
-        assertTrue(
-                "waiting for server down",
-                ClientBase.waitForServerDown("127.0.0.1:" + PORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + PORT, CONNECTION_TIMEOUT),
+                "waiting for server down");
     }
 
     private void utestExists(int port) throws IOException, InterruptedException, KeeperException {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/OSMXBeanTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/OSMXBeanTest.java
index edc90fe0eee..7222d4f1a6f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/OSMXBeanTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/OSMXBeanTest.java
@@ -18,12 +18,12 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.server.util.OSMXBean;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -34,10 +34,10 @@ public class OSMXBeanTest extends ZKTestCase {
     private Long mfdc = 0L;
     protected static final Logger LOG = LoggerFactory.getLogger(OSMXBeanTest.class);
 
-    @Before
+    @BeforeEach
     public void initialize() {
         this.osMbean = new OSMXBean();
-        assertNotNull("Could not initialize OSMXBean object!", osMbean);
+        assertNotNull(osMbean, "Could not initialize OSMXBean object!");
     }
 
     @Test
@@ -56,7 +56,7 @@ public final void testGetOpenFileDescriptorCount() {
             ofdc = osMbean.getOpenFileDescriptorCount();
             LOG.info("open fdcount is: {}", ofdc);
         }
-        assertFalse("The number of open file descriptor is negative", (ofdc < 0));
+        assertFalse((ofdc < 0), "The number of open file descriptor is negative");
     }
 
     @Test
@@ -65,7 +65,7 @@ public final void testGetMaxFileDescriptorCount() {
             mfdc = osMbean.getMaxFileDescriptorCount();
             LOG.info("max fdcount is: {}", mfdc);
         }
-        assertFalse("The max file descriptor number is negative", (mfdc < 0));
+        assertFalse((mfdc < 0), "The max file descriptor number is negative");
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverHierarchicalQuorumTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverHierarchicalQuorumTest.java
index fd1609118e7..ea5f863395b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverHierarchicalQuorumTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverHierarchicalQuorumTest.java
@@ -18,7 +18,7 @@
 package org.apache.zookeeper.test;
 
 import org.apache.zookeeper.server.quorum.QuorumPeer;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class ObserverHierarchicalQuorumTest extends HierarchicalQuorumTest {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverLETest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverLETest.java
index 273b05e5384..67aa5959263 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverLETest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverLETest.java
@@ -18,30 +18,30 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.Arrays;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.server.quorum.QuorumPeer;
 import org.apache.zookeeper.server.quorum.QuorumStats;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class ObserverLETest extends ZKTestCase {
 
     final QuorumBase qb = new QuorumBase();
     final ClientTest ct = new ClientTest();
 
-    @Before
+    @BeforeEach
     public void establishThreeParticipantOneObserverEnsemble() throws Exception {
-        qb.setUp(true);
+        qb.setUp(true, false);
         ct.hostPort = qb.hostPort;
         ct.setUpAll();
         qb.s5.shutdown();
     }
 
-    @After
+    @AfterEach
     public void shutdownQuorum() throws Exception {
         ct.tearDownAll();
         qb.tearDown();
@@ -59,17 +59,15 @@ public void testLEWithObserver() throws Exception {
         for (QuorumPeer server : Arrays.asList(qb.s1, qb.s2, qb.s3)) {
             if (server.getServerState().equals(QuorumStats.Provider.FOLLOWING_STATE)) {
                 server.shutdown();
-                assertTrue(
-                        "Waiting for server down",
-                        ClientBase.waitForServerDown("127.0.0.1:" + server.getClientPort(), ClientBase.CONNECTION_TIMEOUT));
+                assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + server.getClientPort(), ClientBase.CONNECTION_TIMEOUT),
+                        "Waiting for server down");
             } else {
-                assertNull("More than one leader found", leader);
+                assertNull(leader, "More than one leader found");
                 leader = server;
             }
         }
-        assertTrue(
-                "Leader is not in Looking state",
-                ClientBase.waitForServerState(leader, ClientBase.CONNECTION_TIMEOUT, QuorumStats.Provider.LOOKING_STATE));
+        assertTrue(ClientBase.waitForServerState(leader, ClientBase.CONNECTION_TIMEOUT, QuorumStats.Provider.LOOKING_STATE),
+                "Leader is not in Looking state");
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java
index 620953a2db5..f6ad52ce5db 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTest.java
@@ -19,18 +19,16 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNotSame;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNotSame;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.ArrayList;
-import java.util.Arrays;
 import java.util.Collections;
-import java.util.List;
 import java.util.Map;
 import java.util.Set;
 import java.util.concurrent.CountDownLatch;
@@ -50,8 +48,6 @@
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.KeeperException.ConnectionLossException;
 import org.apache.zookeeper.PortAssignment;
-import org.apache.zookeeper.WatchedEvent;
-import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.Watcher.Event.KeeperState;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
@@ -59,214 +55,20 @@
 import org.apache.zookeeper.admin.ZooKeeperAdmin;
 import org.apache.zookeeper.jmx.MBeanRegistry;
 import org.apache.zookeeper.jmx.ZKMBeanInfo;
+import org.apache.zookeeper.metrics.MetricsUtils;
 import org.apache.zookeeper.server.admin.Commands;
-import org.apache.zookeeper.server.quorum.DelayRequestProcessor;
-import org.apache.zookeeper.server.quorum.FollowerZooKeeperServer;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
-import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
 import org.apache.zookeeper.server.util.PortForwarder;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
+import org.junit.jupiter.api.Disabled;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-@RunWith(Parameterized.class)
-public class ObserverMasterTest extends QuorumPeerTestBase implements Watcher {
+public class ObserverMasterTest extends ObserverMasterTestBase {
 
     protected static final Logger LOG = LoggerFactory.getLogger(ObserverMasterTest.class);
 
-    public ObserverMasterTest(Boolean testObserverMaster) {
-        this.testObserverMaster = testObserverMaster;
-    }
-
-    @Parameterized.Parameters
-    public static List<Object[]> data() {
-        return Arrays.asList(new Object[][]{{Boolean.TRUE}, {Boolean.FALSE}});
-    }
-
-    private Boolean testObserverMaster;
-
-    private CountDownLatch latch;
-    ZooKeeper zk;
-    private WatchedEvent lastEvent = null;
-
-    private int CLIENT_PORT_QP1;
-    private int CLIENT_PORT_QP2;
-    private int CLIENT_PORT_OBS;
-    private int OM_PORT;
-    private MainThread q1;
-    private MainThread q2;
-    private MainThread q3;
-
-    private PortForwarder setUp(final int omProxyPort) throws IOException {
-        ClientBase.setupTestEnv();
-
-        final int PORT_QP1 = PortAssignment.unique();
-        final int PORT_QP2 = PortAssignment.unique();
-        final int PORT_OBS = PortAssignment.unique();
-        final int PORT_QP_LE1 = PortAssignment.unique();
-        final int PORT_QP_LE2 = PortAssignment.unique();
-        final int PORT_OBS_LE = PortAssignment.unique();
-
-        CLIENT_PORT_QP1 = PortAssignment.unique();
-        CLIENT_PORT_QP2 = PortAssignment.unique();
-        CLIENT_PORT_OBS = PortAssignment.unique();
-
-        OM_PORT = PortAssignment.unique();
-
-        String quorumCfgSection = "server.1=127.0.0.1:" + (PORT_QP1) + ":" + (PORT_QP_LE1) + ";" + CLIENT_PORT_QP1
-                                  + "\nserver.2=127.0.0.1:" + (PORT_QP2) + ":" + (PORT_QP_LE2) + ";" + CLIENT_PORT_QP2
-                                  + "\nserver.3=127.0.0.1:" + (PORT_OBS) + ":" + (PORT_OBS_LE) + ":observer" + ";" + CLIENT_PORT_OBS;
-        String extraCfgs = testObserverMaster
-                ? String.format("observerMasterPort=%d%n", OM_PORT)
-                : "";
-        String extraCfgsObs = testObserverMaster
-            ? String.format("observerMasterPort=%d%n", omProxyPort <= 0 ? OM_PORT : omProxyPort)
-            : "";
-
-        PortForwarder forwarder = null;
-        if (testObserverMaster && omProxyPort >= 0) {
-            forwarder = new PortForwarder(omProxyPort, OM_PORT);
-        }
-
-        q1 = new MainThread(1, CLIENT_PORT_QP1, quorumCfgSection, extraCfgs);
-        q2 = new MainThread(2, CLIENT_PORT_QP2, quorumCfgSection, extraCfgs);
-        q3 = new MainThread(3, CLIENT_PORT_OBS, quorumCfgSection, extraCfgsObs);
-        q1.start();
-        q2.start();
-        assertTrue(
-            "waiting for server 1 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, CONNECTION_TIMEOUT));
-        assertTrue(
-            "waiting for server 2 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT));
-        return forwarder;
-    }
-
-    private void shutdown() throws InterruptedException {
-        LOG.info("Shutting down all servers");
-        zk.close();
-
-        q1.shutdown();
-        q2.shutdown();
-        q3.shutdown();
-
-        assertTrue(
-            "Waiting for server 1 to shut down",
-            ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT));
-        assertTrue(
-            "Waiting for server 2 to shut down",
-            ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT));
-        assertTrue(
-            "Waiting for server 3 to shut down",
-            ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_OBS, ClientBase.CONNECTION_TIMEOUT));
-    }
-
-    @Test
-    public void testLaggingObserverMaster() throws Exception {
-        final int OM_PROXY_PORT = PortAssignment.unique();
-        PortForwarder forwarder = setUp(OM_PROXY_PORT);
-
-        // find the leader and observer master
-        int leaderPort;
-        MainThread leader;
-        MainThread follower;
-        if (q1.getQuorumPeer().leader != null) {
-            leaderPort = CLIENT_PORT_QP1;
-            leader = q1;
-            follower = q2;
-        } else if (q2.getQuorumPeer().leader != null) {
-            leaderPort = CLIENT_PORT_QP2;
-            leader = q2;
-            follower = q1;
-        } else {
-            throw new RuntimeException("No leader");
-        }
-
-        // ensure the observer master has commits in the queue before observer sync
-        zk = new ZooKeeper("127.0.0.1:" + leaderPort, ClientBase.CONNECTION_TIMEOUT, this);
-        for (int i = 0; i < 10; i++) {
-            zk.create("/bulk" + i, ("initial data of some size").getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        }
-        zk.close();
-
-        q3.start();
-        assertTrue(
-            "waiting for server 3 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT));
-
-        latch = new CountDownLatch(1);
-        zk = new ZooKeeper("127.0.0.1:" + leaderPort, ClientBase.CONNECTION_TIMEOUT, this);
-        latch.await();
-        assertEquals(zk.getState(), States.CONNECTED);
-
-        zk.create("/init", "first".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        final long lastLoggedZxid = leader.getQuorumPeer().getLastLoggedZxid();
-
-        // wait for change to propagate
-        waitFor("Timeout waiting for observer sync", new WaitForCondition() {
-            public boolean evaluate() {
-                return lastLoggedZxid == q3.getQuorumPeer().getLastLoggedZxid();
-            }
-        }, 30);
-
-        // simulate network fault
-        if (forwarder != null) {
-            forwarder.shutdown();
-        }
-
-        for (int i = 0; i < 10; i++) {
-            zk.create("/basic" + i, "second".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        }
-
-        DelayRequestProcessor delayRequestProcessor = null;
-        if (testObserverMaster) {
-            FollowerZooKeeperServer followerZooKeeperServer = (FollowerZooKeeperServer) follower.getQuorumPeer().getActiveServer();
-            delayRequestProcessor = DelayRequestProcessor.injectDelayRequestProcessor(followerZooKeeperServer);
-        }
-
-        zk.create("/target1", "third".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        zk.create("/target2", "third".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-
-        LOG.info(
-            "observer zxid {}{} leader zxid {}",
-            Long.toHexString(q3.getQuorumPeer().getLastLoggedZxid()),
-            (testObserverMaster ? "" : " observer master zxid " + Long.toHexString(follower.getQuorumPeer().getLastLoggedZxid())),
-            Long.toHexString(leader.getQuorumPeer().getLastLoggedZxid()));
-
-        // restore network
-        forwarder = testObserverMaster ? new PortForwarder(OM_PROXY_PORT, OM_PORT) : null;
-
-        assertTrue(
-            "waiting for server 3 being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT));
-        assertNotNull("Leader switched", leader.getQuorumPeer().leader);
-
-        if (delayRequestProcessor != null) {
-            delayRequestProcessor.unblockQueue();
-        }
-
-        latch = new CountDownLatch(1);
-        ZooKeeper obsZk = new ZooKeeper("127.0.0.1:" + CLIENT_PORT_OBS, ClientBase.CONNECTION_TIMEOUT, this);
-        latch.await();
-        zk.create("/finalop", "fourth".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-
-        assertEquals("first", new String(obsZk.getData("/init", null, null)));
-        assertEquals("third", new String(obsZk.getData("/target1", null, null)));
-
-        obsZk.close();
-        shutdown();
-
-        try {
-            if (forwarder != null) {
-                forwarder.shutdown();
-            }
-        } catch (Exception e) {
-            // ignore
-        }
-    }
-
     /**
      * This test ensures two things:
      * 1. That Observers can successfully proxy requests to the ensemble.
@@ -274,20 +76,22 @@ public boolean evaluate() {
      * The second is tested by constructing an ensemble where a leader would
      * be elected if and only if an Observer voted.
      */
-    @Test
-    public void testObserver() throws Exception {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testObserver(boolean testObserverMaster) throws Exception {
         // We expect two notifications before we want to continue
         latch = new CountDownLatch(2);
-        setUp(-1);
+        setUp(-1, testObserverMaster);
         q3.start();
-        assertTrue(
-                "waiting for server 3 being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT),
+                "waiting for server 3 being up");
+
+        validateObserverSyncTimeMetrics();
 
         if (testObserverMaster) {
             int masterPort = q3.getQuorumPeer().observer.getSocket().getPort();
             LOG.info("port {} {}", masterPort, OM_PORT);
-            assertEquals("observer failed to connect to observer master", masterPort, OM_PORT);
+            assertEquals(masterPort, OM_PORT, "observer failed to connect to observer master");
         }
 
         zk = new ZooKeeper("127.0.0.1:" + CLIENT_PORT_OBS, ClientBase.CONNECTION_TIMEOUT, this);
@@ -307,15 +111,14 @@ public void testObserver() throws Exception {
         // Now kill one of the other real servers
         q2.shutdown();
 
-        assertTrue(
-                "Waiting for server 2 to shut down",
-                ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT),
+                "Waiting for server 2 to shut down");
 
         LOG.info("Server 2 down");
 
         // Now the resulting ensemble shouldn't be quorate
         latch.await();
-        assertNotSame("Client is still connected to non-quorate cluster", KeeperState.SyncConnected, lastEvent.getState());
+        assertNotSame(KeeperState.SyncConnected, lastEvent.getState(), "Client is still connected to non-quorate cluster");
 
         LOG.info("Latch returned");
 
@@ -334,19 +137,16 @@ public void testObserver() throws Exception {
         q2.start();
 
         LOG.info("Waiting for server 2 to come up");
-        assertTrue(
-                "waiting for server 2 being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT),
+                "waiting for server 2 being up");
 
         LOG.info("Server 2 started, waiting for latch");
 
         latch.await();
         // It's possible our session expired - but this is ok, shows we
         // were able to talk to the ensemble
-        assertTrue("Client didn't reconnect to quorate ensemble (state was"
-                                  + lastEvent.getState()
-                                  + ")", (KeeperState.SyncConnected == lastEvent.getState()
-                                                  || KeeperState.Expired == lastEvent.getState()));
+        assertTrue((KeeperState.SyncConnected == lastEvent.getState() || KeeperState.Expired == lastEvent.getState()),
+                "Client didn't reconnect to quorate ensemble (state was" + lastEvent.getState() + ")");
 
         LOG.info("perform a revalidation test");
         int leaderProxyPort = PortAssignment.unique();
@@ -358,7 +158,7 @@ public void testObserver() throws Exception {
         ZooKeeper client = new ZooKeeper(String.format("127.0.0.1:%d,127.0.0.1:%d", leaderProxyPort, obsProxyPort), ClientBase.CONNECTION_TIMEOUT, this);
         latch.await();
         client.create("/revalidtest", "test".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL);
-        assertNotNull("Read-after write failed", client.exists("/revalidtest", null));
+        assertNotNull(client.exists("/revalidtest", null), "Read-after write failed");
 
         latch = new CountDownLatch(2);
         PortForwarder obsPF = new PortForwarder(obsProxyPort, CLIENT_PORT_OBS);
@@ -375,13 +175,13 @@ public void testObserver() throws Exception {
         shutdown();
     }
 
-    @Test
-    public void testRevalidation() throws Exception {
-        setUp(-1);
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testRevalidation(boolean testObserverMaster) throws Exception {
+        setUp(-1, testObserverMaster);
         q3.start();
-        assertTrue(
-                "waiting for server 3 being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT),
+                "waiting for server 3 being up");
         final int leaderProxyPort = PortAssignment.unique();
         final int obsProxyPort = PortAssignment.unique();
 
@@ -392,7 +192,7 @@ public void testRevalidation() throws Exception {
         zk = new ZooKeeper(String.format("127.0.0.1:%d,127.0.0.1:%d", leaderProxyPort, obsProxyPort), ClientBase.CONNECTION_TIMEOUT, this);
         latch.await();
         zk.create("/revalidtest", "test".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL);
-        assertNotNull("Read-after write failed", zk.exists("/revalidtest", null));
+        assertNotNull(zk.exists("/revalidtest", null), "Read-after write failed");
 
         latch = new CountDownLatch(2);
         PortForwarder obsPF = new PortForwarder(obsProxyPort, CLIENT_PORT_OBS);
@@ -408,9 +208,10 @@ public void testRevalidation() throws Exception {
         shutdown();
     }
 
-    @Test
-    public void testInOrderCommits() throws Exception {
-        setUp(-1);
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testInOrderCommits(boolean testObserverMaster) throws Exception {
+        setUp(-1, testObserverMaster);
 
         zk = new ZooKeeper("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT, null);
         for (int i = 0; i < 10; i++) {
@@ -420,9 +221,8 @@ public void testInOrderCommits() throws Exception {
         zk.close();
 
         q3.start();
-        assertTrue(
-                "waiting for observer to be up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT),
+                "waiting for observer to be up");
 
         latch = new CountDownLatch(1);
         zk = new ZooKeeper("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT, this);
@@ -472,19 +272,19 @@ public boolean evaluate() {
         shutdown();
     }
 
-    @Test
-    public void testAdminCommands() throws IOException, MBeanException, InstanceNotFoundException, ReflectionException, InterruptedException, MalformedObjectNameException, AttributeNotFoundException, InvalidAttributeValueException, KeeperException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    public void testAdminCommands(boolean testObserverMaster) throws IOException, MBeanException, InstanceNotFoundException, ReflectionException, InterruptedException, MalformedObjectNameException, AttributeNotFoundException, InvalidAttributeValueException, KeeperException {
         // flush all beans, then start
         for (ZKMBeanInfo beanInfo : MBeanRegistry.getInstance().getRegisteredBeans()) {
             MBeanRegistry.getInstance().unregister(beanInfo);
         }
 
         JMXEnv.setUp();
-        setUp(-1);
+        setUp(-1, testObserverMaster);
         q3.start();
-        assertTrue(
-                "waiting for observer to be up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT),
+                "waiting for observer to be up");
 
         // Assert that commands are getting forwarded correctly
         zk = new ZooKeeper("127.0.0.1:" + CLIENT_PORT_OBS, ClientBase.CONNECTION_TIMEOUT, this);
@@ -493,8 +293,8 @@ public void testAdminCommands() throws IOException, MBeanException, InstanceNotF
 
         // test stats collection
         final Map<String, String> emptyMap = Collections.emptyMap();
-        Map<String, Object> stats = Commands.runCommand("mntr", q3.getQuorumPeer().getActiveServer(), emptyMap).toMap();
-        assertTrue("observer not emitting observer_master_id", stats.containsKey("observer_master_id"));
+        Map<String, Object> stats = Commands.runGetCommand("mntr", q3.getQuorumPeer().getActiveServer(), emptyMap, null, null).toMap();
+        assertTrue(stats.containsKey("observer_master_id"), "observer not emitting observer_master_id");
 
         // check the stats for the first peer
         if (testObserverMaster) {
@@ -530,24 +330,23 @@ public void testAdminCommands() throws IOException, MBeanException, InstanceNotF
         ObjectName connBean = null;
         for (ObjectName bean : JMXEnv.conn().queryNames(new ObjectName(MBeanRegistry.DOMAIN + ":*"), null)) {
             if (bean.getCanonicalName().contains("Learner_Connections") && bean.getCanonicalName().contains("id:"
-                                                                                                                    + q3.getQuorumPeer().getId())) {
+                                                                                                                    + q3.getQuorumPeer().getMyId())) {
                 connBean = bean;
                 break;
             }
         }
-        assertNotNull("could not find connection bean", connBean);
+        assertNotNull(connBean, "could not find connection bean");
 
         latch = new CountDownLatch(1);
         JMXEnv.conn().invoke(connBean, "terminateConnection", new Object[0], null);
-        assertTrue("server failed to disconnect on terminate", latch.await(CONNECTION_TIMEOUT
-                                                                                          / 2, TimeUnit.MILLISECONDS));
-        assertTrue(
-                "waiting for server 3 being up",
-                ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT));
+        assertTrue(latch.await(CONNECTION_TIMEOUT / 2, TimeUnit.MILLISECONDS),
+                "server failed to disconnect on terminate");
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT),
+                "waiting for server 3 being up");
 
-        final String obsBeanName = String.format("org.apache.ZooKeeperService:name0=ReplicatedServer_id%d,name1=replica.%d,name2=Observer", q3.getQuorumPeer().getId(), q3.getQuorumPeer().getId());
+        final String obsBeanName = String.format("org.apache.ZooKeeperService:name0=ReplicatedServer_id%d,name1=replica.%d,name2=Observer", q3.getQuorumPeer().getMyId(), q3.getQuorumPeer().getMyId());
         Set<ObjectName> names = JMXEnv.conn().queryNames(new ObjectName(obsBeanName), null);
-        assertEquals("expecting singular observer bean", 1, names.size());
+        assertEquals(1, names.size(), "expecting singular observer bean");
         ObjectName obsBean = names.iterator().next();
 
         if (testObserverMaster) {
@@ -555,10 +354,9 @@ public void testAdminCommands() throws IOException, MBeanException, InstanceNotF
             long observerMasterId = q3.getQuorumPeer().observer.getLearnerMasterId();
             latch = new CountDownLatch(1);
             JMXEnv.conn().setAttribute(obsBean, new Attribute("LearnerMaster", Long.toString(3 - observerMasterId)));
-            assertTrue("server failed to disconnect on terminate", latch.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS));
-            assertTrue(
-                    "waiting for server 3 being up",
-                    ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT));
+            assertTrue(latch.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS), "server failed to disconnect on terminate");
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_OBS, CONNECTION_TIMEOUT),
+                    "waiting for server 3 being up");
         } else {
             // show we get an error
             final long leaderId = q1.getQuorumPeer().leader == null ? 2 : 1;
@@ -566,7 +364,7 @@ public void testAdminCommands() throws IOException, MBeanException, InstanceNotF
                 JMXEnv.conn().setAttribute(obsBean, new Attribute("LearnerMaster", Long.toString(3 - leaderId)));
                 fail("should have seen an exception on previous command");
             } catch (RuntimeMBeanException e) {
-                assertEquals("mbean failed for the wrong reason", IllegalArgumentException.class, e.getCause().getClass());
+                assertEquals(IllegalArgumentException.class, e.getCause().getClass(), "mbean failed for the wrong reason");
             }
         }
 
@@ -579,9 +377,8 @@ private String createServerString(String type, long serverId, int clientPort) {
     }
 
     private void waitServerUp(int clientPort) {
-        assertTrue(
-            "waiting for server being up",
-            ClientBase.waitForServerUp("127.0.0.1:" + clientPort, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPort, CONNECTION_TIMEOUT),
+                "waiting for server being up");
     }
 
     private ZooKeeperAdmin createAdmin(int clientPort) throws IOException {
@@ -597,8 +394,10 @@ private ZooKeeperAdmin createAdmin(int clientPort) throws IOException {
 
     // This test is known to be flaky and fail due to "reconfig already in progress".
     // TODO: Investigate intermittent testDynamicReconfig failures.
-    // @Test
-    public void testDynamicReconfig() throws InterruptedException, IOException, KeeperException {
+    @ParameterizedTest
+    @ValueSource(booleans = {true, false})
+    @Disabled
+    public void testDynamicReconfig(boolean testObserverMaster) throws InterruptedException, IOException, KeeperException {
         if (!testObserverMaster) {
             return;
         }
@@ -640,7 +439,7 @@ public void testDynamicReconfig() throws InterruptedException, IOException, Keep
         waitServerUp(observerClientPort);
 
         // create a client to the observer
-        final LinkedBlockingQueue<KeeperState> states = new LinkedBlockingQueue<KeeperState>();
+        final LinkedBlockingQueue<KeeperState> states = new LinkedBlockingQueue<>();
         ZooKeeper observerClient = new ZooKeeper(
             "127.0.0.1:" + observerClientPort,
             ClientBase.CONNECTION_TIMEOUT,
@@ -657,7 +456,7 @@ public void testDynamicReconfig() throws InterruptedException, IOException, Keep
         assertEquals(KeeperState.SyncConnected, state);
 
         // issue reconfig command
-        ArrayList<String> newServers = new ArrayList<String>();
+        ArrayList<String> newServers = new ArrayList<>();
         String server = "server.3=127.0.0.1:" + PortAssignment.unique() + ":" + PortAssignment.unique() + ":participant;localhost:" + PortAssignment.unique();
         newServers.add(server);
         ZooKeeperAdmin admin = createAdmin(clientPort1);
@@ -678,17 +477,6 @@ public void testDynamicReconfig() throws InterruptedException, IOException, Keep
         s1.shutdown();
     }
 
-    /**
-     * Implementation of watcher interface.
-     */
-    public void process(WatchedEvent event) {
-        lastEvent = event;
-        if (latch != null) {
-            latch.countDown();
-        }
-        LOG.info("Latch got event :: {}", event);
-    }
-
     class AsyncWriter implements Runnable {
 
         private final ZooKeeper client;
@@ -737,4 +525,15 @@ public void run() {
 
     }
 
+    private void validateObserverSyncTimeMetrics() {
+        final String name = "observer_sync_time";
+        final Map<String, Object> metrics = MetricsUtils.currentServerMetrics();
+
+        assertEquals(5, metrics.keySet().stream().filter(key -> key.contains(name)).count());
+        assertNotNull(metrics.get(String.format("avg_%s", name)));
+        assertNotNull(metrics.get(String.format("min_%s", name)));
+        assertNotNull(metrics.get(String.format("max_%s", name)));
+        assertNotNull(metrics.get(String.format("cnt_%s", name)));
+        assertNotNull(metrics.get(String.format("sum_%s", name)));
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTestBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTestBase.java
new file mode 100644
index 00000000000..ad1d88f9143
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverMasterTestBase.java
@@ -0,0 +1,115 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.io.IOException;
+import java.util.concurrent.CountDownLatch;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.WatchedEvent;
+import org.apache.zookeeper.Watcher;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
+import org.apache.zookeeper.server.util.PortForwarder;
+
+public class ObserverMasterTestBase extends QuorumPeerTestBase implements Watcher {
+
+    protected CountDownLatch latch;
+    protected ZooKeeper zk;
+    protected int CLIENT_PORT_QP1;
+    protected int CLIENT_PORT_QP2;
+    protected int CLIENT_PORT_OBS;
+    protected int OM_PORT;
+    protected MainThread q1;
+    protected MainThread q2;
+    protected MainThread q3;
+    protected WatchedEvent lastEvent = null;
+
+    protected PortForwarder setUp(final int omProxyPort, final Boolean testObserverMaster) throws IOException {
+        ClientBase.setupTestEnv();
+        final int PORT_QP1 = PortAssignment.unique();
+        final int PORT_QP2 = PortAssignment.unique();
+        final int PORT_OBS = PortAssignment.unique();
+        final int PORT_QP_LE1 = PortAssignment.unique();
+        final int PORT_QP_LE2 = PortAssignment.unique();
+        final int PORT_OBS_LE = PortAssignment.unique();
+
+        CLIENT_PORT_QP1 = PortAssignment.unique();
+        CLIENT_PORT_QP2 = PortAssignment.unique();
+        CLIENT_PORT_OBS = PortAssignment.unique();
+
+        OM_PORT = PortAssignment.unique();
+
+        String quorumCfgSection =
+                "server.1=127.0.0.1:" + (PORT_QP1)
+                        + ":" + (PORT_QP_LE1) + ";" +  CLIENT_PORT_QP1
+                        + "\nserver.2=127.0.0.1:" + (PORT_QP2)
+                        + ":" + (PORT_QP_LE2) + ";" + CLIENT_PORT_QP2
+                        + "\nserver.3=127.0.0.1:" + (PORT_OBS)
+                        + ":" + (PORT_OBS_LE) + ":observer" + ";" + CLIENT_PORT_OBS;
+
+        String extraCfgs = testObserverMaster ? String.format("observerMasterPort=%d%n", OM_PORT) : "";
+        String extraCfgsObs = testObserverMaster ? String.format("observerMasterPort=%d%n", omProxyPort <= 0 ? OM_PORT : omProxyPort) : "";
+
+        PortForwarder forwarder = null;
+        if (testObserverMaster && omProxyPort >= 0) {
+            forwarder = new PortForwarder(omProxyPort, OM_PORT);
+        }
+
+        q1 = new MainThread(1, CLIENT_PORT_QP1, quorumCfgSection, extraCfgs);
+        q2 = new MainThread(2, CLIENT_PORT_QP2, quorumCfgSection, extraCfgs);
+        q3 = new MainThread(3, CLIENT_PORT_OBS, quorumCfgSection, extraCfgsObs);
+        q1.start();
+        q2.start();
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP1, CONNECTION_TIMEOUT),
+                "waiting for server 1 being up");
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + CLIENT_PORT_QP2, CONNECTION_TIMEOUT),
+                "waiting for server 2 being up");
+        return forwarder;
+    }
+
+    protected void shutdown() throws InterruptedException {
+        LOG.info("Shutting down all servers");
+
+        zk.close();
+
+        q1.shutdown();
+        q2.shutdown();
+        q3.shutdown();
+
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP1, ClientBase.CONNECTION_TIMEOUT),
+                "Waiting for server 1 to shut down");
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_QP2, ClientBase.CONNECTION_TIMEOUT),
+                "Waiting for server 2 to shut down");
+        assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + CLIENT_PORT_OBS, ClientBase.CONNECTION_TIMEOUT),
+                "Waiting for server 3 to shut down");
+    }
+
+    /**
+     * Implementation of watcher interface.
+     */
+    public void process(WatchedEvent event) {
+        lastEvent = event;
+        if (latch != null) {
+            latch.countDown();
+        }
+        LOG.info("Latch got event :: {}", event);
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverQuorumHammerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverQuorumHammerTest.java
index 7f81e48ec2e..45e37f2da04 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverQuorumHammerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverQuorumHammerTest.java
@@ -18,17 +18,17 @@
 
 package org.apache.zookeeper.test;
 
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class ObserverQuorumHammerTest extends QuorumHammerTest {
 
     public static final long CONNECTION_TIMEOUT = ClientTest.CONNECTION_TIMEOUT;
 
-    @Before
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
-        qb.setUp(true);
+        qb.setUp(true, false);
         cht.hostPort = qb.hostPort;
         cht.setUpAll();
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverTest.java
index a083c0d2d70..0eed28e7742 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ObserverTest.java
@@ -18,12 +18,12 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertFalse;
 import org.apache.zookeeper.PortAssignment;
 import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -56,7 +56,7 @@ public void testObserverOnly() throws Exception {
      * (and will not come up with standalone server).
      */
     @Test
-    public void testObserverWithStandlone() throws Exception {
+    public void testObserverWithStandalone() throws Exception {
         ClientBase.setupTestEnv();
         final int CLIENT_PORT_QP1 = PortAssignment.unique();
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentRecursiveWatcherTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentRecursiveWatcherTest.java
index 67f19dc0549..be8b90e616a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentRecursiveWatcherTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentRecursiveWatcherTest.java
@@ -18,7 +18,10 @@
 
 package org.apache.zookeeper.test;
 
+import static org.apache.zookeeper.AddWatchMode.PERSISTENT;
 import static org.apache.zookeeper.AddWatchMode.PERSISTENT_RECURSIVE;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
 import java.util.concurrent.BlockingQueue;
 import java.util.concurrent.CountDownLatch;
@@ -29,11 +32,13 @@
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.WatchedEvent;
 import org.apache.zookeeper.Watcher;
+import org.apache.zookeeper.Watcher.Event.EventType;
+import org.apache.zookeeper.Watcher.Event.KeeperState;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
-import org.junit.Assert;
-import org.junit.Before;
-import org.junit.Test;
+import org.apache.zookeeper.data.Stat;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -43,7 +48,7 @@ public class PersistentRecursiveWatcherTest extends ClientBase {
     private Watcher persistentWatcher;
 
     @Override
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         super.setUp();
 
@@ -66,33 +71,40 @@ public void testBasicAsync()
         try (ZooKeeper zk = createClient(new CountdownWatcher(), hostPort)) {
             final CountDownLatch latch = new CountDownLatch(1);
             AsyncCallback.VoidCallback cb = (rc, path, ctx) -> {
-                if (rc == 0) {
+                if (rc == KeeperException.Code.OK.intValue()) {
                     latch.countDown();
                 }
             };
             zk.addWatch("/a/b", persistentWatcher, PERSISTENT_RECURSIVE, cb, null);
-            Assert.assertTrue(latch.await(5, TimeUnit.SECONDS));
+            assertTrue(latch.await(5, TimeUnit.SECONDS));
             internalTestBasic(zk);
         }
     }
 
     private void internalTestBasic(ZooKeeper zk) throws KeeperException, InterruptedException {
         zk.create("/a", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        zk.create("/a/b", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        zk.create("/a/b/c", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        zk.create("/a/b/c/d", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        zk.create("/a/b/c/d/e", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        zk.setData("/a/b/c/d/e", new byte[0], -1);
+
+        Stat stat = new Stat();
+        zk.create("/a/b", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+        assertEvent(events, EventType.NodeCreated, "/a/b", stat);
+
+        zk.create("/a/b/c", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+        assertEvent(events, EventType.NodeCreated, "/a/b/c", stat);
+
+        zk.create("/a/b/c/d", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+        assertEvent(events, EventType.NodeCreated, "/a/b/c/d", stat);
+
+        zk.create("/a/b/c/d/e", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+        assertEvent(events, EventType.NodeCreated, "/a/b/c/d/e", stat);
+
+        stat = zk.setData("/a/b/c/d/e", new byte[0], -1);
+        assertEvent(events, EventType.NodeDataChanged, "/a/b/c/d/e", stat);
+
         zk.delete("/a/b/c/d/e", -1);
-        zk.create("/a/b/c/d/e", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-
-        assertEvent(events, Watcher.Event.EventType.NodeCreated, "/a/b");
-        assertEvent(events, Watcher.Event.EventType.NodeCreated, "/a/b/c");
-        assertEvent(events, Watcher.Event.EventType.NodeCreated, "/a/b/c/d");
-        assertEvent(events, Watcher.Event.EventType.NodeCreated, "/a/b/c/d/e");
-        assertEvent(events, Watcher.Event.EventType.NodeDataChanged, "/a/b/c/d/e");
-        assertEvent(events, Watcher.Event.EventType.NodeDeleted, "/a/b/c/d/e");
-        assertEvent(events, Watcher.Event.EventType.NodeCreated, "/a/b/c/d/e");
+        assertEvent(events, EventType.NodeDeleted, "/a/b/c/d/e", zk.exists("/a/b/c/d", false).getPzxid());
+
+        zk.create("/a/b/c/d/e", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+        assertEvent(events, EventType.NodeCreated, "/a/b/c/d/e", stat);
     }
 
     @Test
@@ -101,14 +113,38 @@ public void testRemoval()
         try (ZooKeeper zk = createClient(new CountdownWatcher(), hostPort)) {
             zk.addWatch("/a/b", persistentWatcher, PERSISTENT_RECURSIVE);
             zk.create("/a", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-            zk.create("/a/b", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-            zk.create("/a/b/c", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-            assertEvent(events, Watcher.Event.EventType.NodeCreated, "/a/b");
-            assertEvent(events, Watcher.Event.EventType.NodeCreated, "/a/b/c");
+            Stat stat = new Stat();
+            zk.create("/a/b", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+            assertEvent(events, EventType.NodeCreated, "/a/b", stat);
+            zk.create("/a/b/c", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+            assertEvent(events, EventType.NodeCreated, "/a/b/c", stat);
 
             zk.removeWatches("/a/b", persistentWatcher, Watcher.WatcherType.Any, false);
             zk.create("/a/b/c/d", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-            assertEvent(events, Watcher.Event.EventType.PersistentWatchRemoved, "/a/b");
+            assertEvent(events, EventType.PersistentWatchRemoved, "/a/b", WatchedEvent.NO_ZXID);
+        }
+    }
+
+    @Test
+    public void testNoChildEvents() throws Exception {
+        try (ZooKeeper zk = createClient()) {
+            zk.create("/a", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+            zk.addWatch("/", persistentWatcher, PERSISTENT_RECURSIVE);
+
+            BlockingQueue<WatchedEvent> childEvents = new LinkedBlockingQueue<>();
+            zk.getChildren("/a", childEvents::add);
+
+            Stat createABStat = new Stat();
+            zk.create("/a/b", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, createABStat);
+            Stat createABCStat = new Stat();
+            zk.create("/a/b/c", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, createABCStat);
+
+            assertEvent(childEvents, Watcher.Event.EventType.NodeChildrenChanged, "/a", createABStat.getPzxid());
+
+            assertEvent(events, Watcher.Event.EventType.NodeCreated, "/a/b", createABStat);
+            assertEvent(events, Watcher.Event.EventType.NodeCreated, "/a/b/c", createABCStat);
+            assertTrue(events.isEmpty());
         }
     }
 
@@ -117,9 +153,9 @@ public void testDisconnect() throws Exception {
         try (ZooKeeper zk = createClient(new CountdownWatcher(), hostPort)) {
             zk.addWatch("/a/b", persistentWatcher, PERSISTENT_RECURSIVE);
             stopServer();
-            assertEvent(events, Watcher.Event.EventType.None, null);
+            assertEvent(events, EventType.None, KeeperState.Disconnected, null, WatchedEvent.NO_ZXID);
             startServer();
-            assertEvent(events, Watcher.Event.EventType.None, null);
+            assertEvent(events, EventType.None, KeeperState.SyncConnected, null, WatchedEvent.NO_ZXID);
             internalTestBasic(zk);
         }
     }
@@ -134,17 +170,65 @@ public void testMultiClient()
             zk1.create("/a/b/c", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
             zk1.addWatch("/a/b", persistentWatcher, PERSISTENT_RECURSIVE);
-            zk1.setData("/a/b/c", "one".getBytes(), -1);
-            Thread.sleep(1000); // give some time for the event to arrive
+            Stat stat = zk1.setData("/a/b/c", "one".getBytes(), -1);
+            assertEvent(events, EventType.NodeDataChanged, "/a/b/c", stat.getMzxid());
 
-            zk2.setData("/a/b/c", "two".getBytes(), -1);
-            zk2.setData("/a/b/c", "three".getBytes(), -1);
-            zk2.setData("/a/b/c", "four".getBytes(), -1);
+            stat = zk2.setData("/a/b/c", "two".getBytes(), -1);
+            assertEvent(events, EventType.NodeDataChanged, "/a/b/c", stat.getMzxid());
+            stat = zk2.setData("/a/b/c", "three".getBytes(), -1);
+            assertEvent(events, EventType.NodeDataChanged, "/a/b/c", stat.getMzxid());
+            stat = zk2.setData("/a/b/c", "four".getBytes(), -1);
+            assertEvent(events, EventType.NodeDataChanged, "/a/b/c", stat.getMzxid());
+        }
+    }
+
+    @Test
+    public void testSamePathWithDifferentWatchModes() throws Exception {
+        try (ZooKeeper zk = createClient()) {
+            BlockingQueue<WatchedEvent> dataEvents = new LinkedBlockingQueue<>();
+            BlockingQueue<WatchedEvent> childEvents = new LinkedBlockingQueue<>();
+            BlockingQueue<WatchedEvent> persistentEvents = new LinkedBlockingQueue<>();
+            BlockingQueue<WatchedEvent> recursiveEvents = new LinkedBlockingQueue<>();
+
+            zk.addWatch("/a", persistentEvents::add, PERSISTENT);
+            zk.addWatch("/a", recursiveEvents::add, PERSISTENT_RECURSIVE);
+            zk.exists("/a", dataEvents::add);
+
+            Stat stat = new Stat();
+            zk.create("/a", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+            assertEvent(dataEvents, Watcher.Event.EventType.NodeCreated, "/a", stat);
+            assertEvent(persistentEvents, Watcher.Event.EventType.NodeCreated, "/a", stat);
+            assertEvent(recursiveEvents, Watcher.Event.EventType.NodeCreated, "/a", stat);
+
+            zk.getData("/a", dataEvents::add, null);
+            stat = zk.setData("/a", new byte[0], -1);
+            assertEvent(dataEvents, Watcher.Event.EventType.NodeDataChanged, "/a", stat);
+            assertEvent(persistentEvents, Watcher.Event.EventType.NodeDataChanged, "/a", stat);
+            assertEvent(recursiveEvents, Watcher.Event.EventType.NodeDataChanged, "/a", stat);
+
+            zk.getChildren("/a", childEvents::add);
+            zk.create("/a/b", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+            assertEvent(childEvents, Watcher.Event.EventType.NodeChildrenChanged, "/a", stat);
+            assertEvent(persistentEvents, Watcher.Event.EventType.NodeChildrenChanged, "/a", stat);
+            assertEvent(recursiveEvents, Watcher.Event.EventType.NodeCreated, "/a/b", stat);
+
+            zk.getChildren("/a", childEvents::add);
+            zk.delete("/a/b", -1);
+            stat = zk.exists("/a", false);
+            assertEvent(childEvents, Watcher.Event.EventType.NodeChildrenChanged, "/a", stat.getPzxid());
+            assertEvent(persistentEvents, Watcher.Event.EventType.NodeChildrenChanged, "/a", stat.getPzxid());
+            assertEvent(recursiveEvents, Watcher.Event.EventType.NodeDeleted, "/a/b", stat.getPzxid());
 
-            assertEvent(events, Watcher.Event.EventType.NodeDataChanged, "/a/b/c");
-            assertEvent(events, Watcher.Event.EventType.NodeDataChanged, "/a/b/c");
-            assertEvent(events, Watcher.Event.EventType.NodeDataChanged, "/a/b/c");
-            assertEvent(events, Watcher.Event.EventType.NodeDataChanged, "/a/b/c");
+            zk.getChildren("/a", childEvents::add);
+            zk.getData("/a", dataEvents::add, null);
+            zk.exists("/a", dataEvents::add);
+            zk.delete("/a", -1);
+            stat = zk.exists("/", false);
+            assertEvent(childEvents, Watcher.Event.EventType.NodeDeleted, "/a", stat.getPzxid());
+            assertEvent(dataEvents, Watcher.Event.EventType.NodeDeleted, "/a", stat.getPzxid());
+            assertEvent(dataEvents, Watcher.Event.EventType.NodeDeleted, "/a", stat.getPzxid());
+            assertEvent(persistentEvents, Watcher.Event.EventType.NodeDeleted, "/a", stat.getPzxid());
+            assertEvent(recursiveEvents, Watcher.Event.EventType.NodeDeleted, "/a", stat.getPzxid());
         }
     }
 
@@ -153,22 +237,42 @@ public void testRootWatcher()
             throws IOException, InterruptedException, KeeperException {
         try (ZooKeeper zk = createClient(new CountdownWatcher(), hostPort)) {
             zk.addWatch("/", persistentWatcher, PERSISTENT_RECURSIVE);
-            zk.create("/a", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-            zk.create("/a/b", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-            zk.create("/b", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-            zk.create("/b/c", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-            assertEvent(events, Watcher.Event.EventType.NodeCreated, "/a");
-            assertEvent(events, Watcher.Event.EventType.NodeCreated, "/a/b");
-            assertEvent(events, Watcher.Event.EventType.NodeCreated, "/b");
-            assertEvent(events, Watcher.Event.EventType.NodeCreated, "/b/c");
+            Stat stat = new Stat();
+
+            zk.create("/a", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+            assertEvent(events, EventType.NodeCreated, "/a", stat.getMzxid());
+
+            zk.create("/a/b", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+            assertEvent(events, EventType.NodeCreated, "/a/b", stat.getMzxid());
+
+            zk.create("/b", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+            assertEvent(events, EventType.NodeCreated, "/b", stat.getMzxid());
+
+            zk.create("/b/c", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+            assertEvent(events, EventType.NodeCreated, "/b/c", stat.getMzxid());
         }
     }
 
-    private void assertEvent(BlockingQueue<WatchedEvent> events, Watcher.Event.EventType eventType, String path)
-            throws InterruptedException {
-        WatchedEvent event = events.poll(5, TimeUnit.SECONDS);
-        Assert.assertNotNull(event);
-        Assert.assertEquals(eventType, event.getType());
-        Assert.assertEquals(path, event.getPath());
+    private void assertEvent(BlockingQueue<WatchedEvent> events, EventType eventType, String path, Stat stat)
+        throws InterruptedException {
+        assertEvent(events, eventType, path, stat.getMzxid());
+    }
+
+    private void assertEvent(BlockingQueue<WatchedEvent> events, EventType eventType, String path, long zxid)
+        throws InterruptedException {
+        assertEvent(events, eventType, KeeperState.SyncConnected, path, zxid);
+    }
+
+    private void assertEvent(BlockingQueue<WatchedEvent> events, EventType eventType, KeeperState keeperState,
+        String path, long zxid) throws InterruptedException {
+        WatchedEvent actualEvent = events.poll(5, TimeUnit.SECONDS);
+        assertNotNull(actualEvent);
+        WatchedEvent expectedEvent = new WatchedEvent(
+            eventType,
+            keeperState,
+            path,
+            zxid
+        );
+        TestUtils.assertWatchedEventEquals(expectedEvent, actualEvent);
     }
 }
\ No newline at end of file
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentWatcherACLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentWatcherACLTest.java
new file mode 100644
index 00000000000..1597a4850e9
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentWatcherACLTest.java
@@ -0,0 +1,629 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import static org.apache.zookeeper.AddWatchMode.PERSISTENT;
+import static org.apache.zookeeper.AddWatchMode.PERSISTENT_RECURSIVE;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.fail;
+import java.io.IOException;
+import java.util.Collections;
+import java.util.List;
+import java.util.concurrent.BlockingQueue;
+import java.util.concurrent.LinkedBlockingQueue;
+import java.util.concurrent.TimeUnit;
+import org.apache.zookeeper.AddWatchMode;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.WatchedEvent;
+import org.apache.zookeeper.Watcher;
+import org.apache.zookeeper.Watcher.Event.EventType;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.data.ACL;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * This class encodes a set of tests corresponding to a "truth table"
+ * of interactions between persistent watchers and znode ACLs:
+ *
+ * <a href="https://docs.google.com/spreadsheets/d/1eMH2aimrrMc_b6McU8CHm2yCj2X-w30Fy4fCBOHn7NA/edit#gid=0">https://docs.google.com/spreadsheets/d/1eMH2aimrrMc_b6McU8CHm2yCj2X-w30Fy4fCBOHn7NA/edit#gid=0</a>
+ */
+public class PersistentWatcherACLTest extends ClientBase {
+    private static final Logger LOG = LoggerFactory.getLogger(PersistentWatcherACLTest.class);
+    /** An ACL denying READ. */
+    private static final List<ACL> ACL_NO_READ = Collections.singletonList(new ACL(ZooDefs.Perms.ALL & ~ZooDefs.Perms.READ, ZooDefs.Ids.ANYONE_ID_UNSAFE));
+    private BlockingQueue<WatchedEvent> events;
+    private Watcher persistentWatcher;
+
+    @Override
+    @BeforeEach
+    public void setUp() throws Exception {
+        super.setUp();
+
+        events = new LinkedBlockingQueue<>();
+        persistentWatcher = event -> {
+            events.add(event);
+            LOG.info("Added event: {}; total: {}", event, events.size());
+        };
+    }
+
+    /**
+     * This Step class, with the Round class below, is used to encode
+     * the contents of the truth table.
+     *
+     * (These should become Records once we target JDK 14+.)
+     */
+    private static class Step {
+        Step(int opCode, String target) {
+            this(opCode, target, null, null);
+        }
+        Step(int opCode, String target, EventType eventType, String eventPath) {
+            this.opCode = opCode;
+            this.target = target;
+            this.eventType = eventType;
+            this.eventPath = eventPath;
+        }
+        /** Action: create, setData or delete */
+        final int opCode;
+        /** Target path */
+        final String target;
+        /** Expected event type, {@code null} if no event is expected */
+        final EventType eventType;
+        /** Expected event path, {@code null} if no event is expected */
+        final String eventPath;
+    }
+
+    /**
+     * This Round class, with the Step class above, is used to encode
+     * the contents of the truth table.
+     *
+     * (These should become Records once we target JDK 14+.)
+     */
+    private static class Round {
+        Round(String summary, Boolean allowA, Boolean allowB, Boolean allowC, String watchTarget, AddWatchMode watchMode, Step[] steps) {
+            this.summary = summary;
+            this.allowA = allowA;
+            this.allowB = allowB;
+            this.allowC = allowC;
+            this.watchTarget = watchTarget;
+            this.watchMode = watchMode;
+            this.steps = steps;
+        }
+        /** Notes/summary */
+        final String summary;
+        /** Should /a's ACL leave it readable? */
+        final Boolean allowA;
+        /** Should /a/b's ACL leave it readable? */
+        final Boolean allowB;
+        /** Should /a/b/c's ACL leave it readable? */
+        final Boolean allowC;
+        /** Watch path */
+        final String watchTarget;
+        /** Watch mode */
+        final AddWatchMode watchMode;
+        /** Actions and expected events */
+        final Step[] steps;
+    }
+
+    /**
+     * A "round" of tests from the table encoded as Java objects.
+     *
+     * Note that the set of rounds is collected in a {@code ROUNDS}
+     * array below, and that this test class includes a {@code main}
+     * method which produces a "CSV" rendition of the table, for ease
+     * of comparison with the original.
+     *
+     * @see #ROUNDS
+     */
+    private static final Round roundNothingAsAIsWatchedButDeniedBIsNotWatched =
+        new Round(
+            "Nothing as a is watched but denied. b is not watched",
+            false, true, null, "/a", PERSISTENT, new Step[] {
+                new Step(ZooDefs.OpCode.setData, "/a"),
+                new Step(ZooDefs.OpCode.create, "/a/b"),
+                new Step(ZooDefs.OpCode.setData, "/a/b"),
+                new Step(ZooDefs.OpCode.delete, "/a/b"),
+                new Step(ZooDefs.OpCode.delete, "/a"),
+            }
+        );
+
+    /**
+     * @see #roundNothingAsAIsWatchedButDeniedBIsNotWatched
+     */
+    private static final Round roundNothingAsBothAAndBDenied =
+        new Round(
+            "Nothing as both a and b denied",
+            false, false, null, "/a", PERSISTENT, new Step[] {
+                new Step(ZooDefs.OpCode.setData, "/a"),
+                new Step(ZooDefs.OpCode.create, "/a/b"),
+                new Step(ZooDefs.OpCode.delete, "/a/b"),
+                new Step(ZooDefs.OpCode.delete, "/a"),
+            }
+        );
+
+    /**
+     * @see #roundNothingAsAIsWatchedButDeniedBIsNotWatched
+     */
+    private static final Round roundAChangesInclChildrenAreSeen =
+        new Round(
+            "a changes, incl children, are seen",
+            true, false, null, "/a", PERSISTENT, new Step[] {
+                new Step(ZooDefs.OpCode.create, "/a", EventType.NodeCreated, "/a"),
+                new Step(ZooDefs.OpCode.setData, "/a", EventType.NodeDataChanged, "/a"),
+                new Step(ZooDefs.OpCode.create, "/a/b", EventType.NodeChildrenChanged, "/a"),
+                new Step(ZooDefs.OpCode.setData, "/a/b"),
+                new Step(ZooDefs.OpCode.delete, "/a/b", EventType.NodeChildrenChanged, "/a"),
+                new Step(ZooDefs.OpCode.delete, "/a", EventType.NodeDeleted, "/a"),
+            }
+        );
+
+    /**
+     * @see #roundNothingAsAIsWatchedButDeniedBIsNotWatched
+     */
+    private static final Round roundNothingForAAsItSDeniedBChangesSeen =
+        new Round(
+            "Nothing for a as it's denied, b changes allowed/seen",
+            false, true, null, "/a", PERSISTENT_RECURSIVE, new Step[] {
+                new Step(ZooDefs.OpCode.setData, "/a"),
+                new Step(ZooDefs.OpCode.create, "/a/b", EventType.NodeCreated, "/a/b"),
+                new Step(ZooDefs.OpCode.setData, "/a/b", EventType.NodeDataChanged, "/a/b"),
+                new Step(ZooDefs.OpCode.delete, "/a/b", EventType.NodeDeleted, "/a/b"),
+                new Step(ZooDefs.OpCode.delete, "/a"),
+            }
+        );
+
+    /**
+     * @see #roundNothingAsAIsWatchedButDeniedBIsNotWatched
+     */
+    private static final Round roundNothingBothDenied =
+        new Round(
+            "Nothing - both denied",
+            false, false, null, "/a", PERSISTENT_RECURSIVE, new Step[] {
+                new Step(ZooDefs.OpCode.setData, "/a"),
+                new Step(ZooDefs.OpCode.create, "/a/b"),
+                new Step(ZooDefs.OpCode.setData, "/a/b"),
+                new Step(ZooDefs.OpCode.delete, "/a/b"),
+                new Step(ZooDefs.OpCode.delete, "/a"),
+            }
+        );
+
+    /**
+     * @see #roundNothingAsAIsWatchedButDeniedBIsNotWatched
+     */
+    private static final Round roundNothingAllDenied =
+        new Round(
+            "Nothing - all denied",
+            false, false, false, "/a", PERSISTENT_RECURSIVE, new Step[] {
+                new Step(ZooDefs.OpCode.create, "/a/b"),
+                new Step(ZooDefs.OpCode.setData, "/a/b"),
+                new Step(ZooDefs.OpCode.create, "/a/b/c"),
+                new Step(ZooDefs.OpCode.setData, "/a/b/c"),
+                new Step(ZooDefs.OpCode.delete, "/a/b/c"),
+                new Step(ZooDefs.OpCode.delete, "/a/b"),
+            }
+        );
+
+    /**
+     * @see #roundNothingAsAIsWatchedButDeniedBIsNotWatched
+     */
+    private static final Round roundADeniesSeeAllChangesForBAndCIncludingBChildren =
+        new Round(
+            "a denies, see all changes for b and c, including b's children",
+            false, true, true, "/a", PERSISTENT_RECURSIVE, new Step[] {
+                new Step(ZooDefs.OpCode.create, "/a/b", EventType.NodeCreated, "/a/b"),
+                new Step(ZooDefs.OpCode.setData, "/a/b", EventType.NodeDataChanged, "/a/b"),
+                new Step(ZooDefs.OpCode.create, "/a/b/c", EventType.NodeCreated, "/a/b/c"),
+                new Step(ZooDefs.OpCode.setData, "/a/b/c", EventType.NodeDataChanged, "/a/b/c"),
+                new Step(ZooDefs.OpCode.delete, "/a/b/c", EventType.NodeDeleted, "/a/b/c"),
+                new Step(ZooDefs.OpCode.delete, "/a/b", EventType.NodeDeleted, "/a/b"),
+            }
+        );
+
+    /**
+     * @see #roundNothingAsAIsWatchedButDeniedBIsNotWatched
+     */
+    private static final Round roundADeniesSeeAllBChangesAndBChildrenNothingForC =
+        new Round(
+            "a denies, see all b changes and b's children, nothing for c",
+            false, true, false, "/a", PERSISTENT_RECURSIVE, new Step[] {
+                new Step(ZooDefs.OpCode.create, "/a/b", EventType.NodeCreated, "/a/b"),
+                new Step(ZooDefs.OpCode.setData, "/a/b", EventType.NodeDataChanged, "/a/b"),
+                new Step(ZooDefs.OpCode.create, "/a/b/c"),
+                new Step(ZooDefs.OpCode.setData, "/a/b/c"),
+                new Step(ZooDefs.OpCode.delete, "/a/b/c"),
+                new Step(ZooDefs.OpCode.delete, "/a/b", EventType.NodeDeleted, "/a/b"),
+            }
+        );
+
+    /**
+     * @see #roundNothingAsAIsWatchedButDeniedBIsNotWatched
+     */
+    private static final Round roundNothingTheWatchIsOnC =
+        new Round(
+            "Nothing - the watch is on c",
+            false, true, false, "/a/b/c", PERSISTENT_RECURSIVE, new Step[] {
+                new Step(ZooDefs.OpCode.create, "/a/b"),
+                new Step(ZooDefs.OpCode.setData, "/a/b"),
+                new Step(ZooDefs.OpCode.create, "/a/b/c"),
+                new Step(ZooDefs.OpCode.setData, "/a/b/c"),
+                new Step(ZooDefs.OpCode.delete, "/a/b/c"),
+                new Step(ZooDefs.OpCode.delete, "/a/b"),
+            }
+        );
+
+    /**
+     * @see #roundNothingAsAIsWatchedButDeniedBIsNotWatched
+     */
+    private static final Round roundTheWatchIsOnlyOnCBAndCAllowed =
+        new Round(
+            "The watch is only on c (b and c allowed)",
+            false, true, true, "/a/b/c", PERSISTENT_RECURSIVE, new Step[] {
+                new Step(ZooDefs.OpCode.create, "/a/b"),
+                new Step(ZooDefs.OpCode.setData, "/a/b"),
+                new Step(ZooDefs.OpCode.create, "/a/b/c", EventType.NodeCreated, "/a/b/c"),
+                new Step(ZooDefs.OpCode.setData, "/a/b/c", EventType.NodeDataChanged, "/a/b/c"),
+                new Step(ZooDefs.OpCode.delete, "/a/b/c", EventType.NodeDeleted, "/a/b/c"),
+                new Step(ZooDefs.OpCode.delete, "/a/b"),
+            }
+        );
+
+    /**
+     * Transform the "tristate" {@code allow} property to a concrete
+     * ACL which can be passed to the ZooKeeper API.
+     *
+     * @param allow "tristate" value: {@code null}/don't care, {@code
+     * true}, {@code false}
+     * @return the ACL
+     */
+    private static List<ACL> selectAcl(Boolean allow) {
+        if (allow == null) {
+            return null;
+        } else if (!allow) {
+            return ACL_NO_READ;
+        } else {
+            return ZooDefs.Ids.OPEN_ACL_UNSAFE;
+        }
+    }
+
+    /**
+     * Executes one "round" of tests from the Java object encoding of
+     * the table.
+     *
+     * @param round the "round"
+     *
+     * @see #roundNothingAsAIsWatchedButDeniedBIsNotWatched
+     * @see PersistentWatcherACLTest.Round
+     * @see PersistentWatcherACLTest.Step
+     */
+    private void execRound(Round round)
+        throws IOException, InterruptedException, KeeperException {
+        try (ZooKeeper zk = createClient(new CountdownWatcher(), hostPort)) {
+            List<ACL> aclForA = selectAcl(round.allowA);
+            List<ACL> aclForB = selectAcl(round.allowB);
+            List<ACL> aclForC = selectAcl(round.allowC);
+
+            boolean firstStepCreatesA = round.steps.length > 0
+                && round.steps[0].opCode == ZooDefs.OpCode.create
+                && round.steps[0].target.equals("/a");
+
+            // Assume /a always exists (except if it's about to be created)
+            if (!firstStepCreatesA) {
+                zk.create("/a", new byte[0], aclForA, CreateMode.PERSISTENT);
+            }
+
+            zk.addWatch(round.watchTarget, persistentWatcher, round.watchMode);
+
+            for (int i = 0; i < round.steps.length; i++) {
+                Step step = round.steps[i];
+
+                switch (step.opCode) {
+                case ZooDefs.OpCode.create:
+                    List<ACL> acl = step.target.endsWith("/c")
+                        ? aclForC
+                        : step.target.endsWith("/b")
+                        ? aclForB
+                        : aclForA;
+                    zk.create(step.target, new byte[0], acl, CreateMode.PERSISTENT);
+                    break;
+                case ZooDefs.OpCode.delete:
+                    zk.delete(step.target, -1);
+                    break;
+                case ZooDefs.OpCode.setData:
+                    zk.setData(step.target, new byte[0], -1);
+                    break;
+                default:
+                    fail("Unexpected opCode " + step.opCode + " in step " + i);
+                    break;
+                }
+
+                WatchedEvent actualEvent = events.poll(500, TimeUnit.MILLISECONDS);
+                if (step.eventType == null) {
+                    assertNull(actualEvent, "Unexpected event " + actualEvent + " at step " + i);
+                } else {
+                    String m = "In event " + actualEvent + " at step " + i;
+                    assertNotNull(actualEvent, m);
+                    assertEquals(step.eventType,  actualEvent.getType(), m);
+                    assertEquals(step.eventPath, actualEvent.getPath(), m);
+                }
+            }
+        }
+    }
+
+    /**
+     * A test method, wrapping the definition of a "round."  This
+     * should really use JUnit 5's runtime test case generation
+     * facilities, but that would prevent backporting this suite to
+     * JUnit 4.
+     *
+     * @see #roundNothingAsAIsWatchedButDeniedBIsNotWatched
+     * @see <a href="https://junit.org/junit5/docs/5.0.2/api/org/junit/jupiter/api/DynamicTest.html">JUnit 5 runtime test case generation</a>
+     */
+    @Test
+    public void testNothingAsAIsWatchedButDeniedBIsNotWatched()
+        throws IOException, InterruptedException, KeeperException {
+        execRound(roundNothingAsAIsWatchedButDeniedBIsNotWatched);
+    }
+
+    /**
+     * @see #testNothingAsAIsWatchedButDeniedBIsNotWatched
+     * @see #roundNothingAsBothAAndBDenied
+     */
+    @Test
+    public void testNothingAsBothAAndBDenied()
+        throws IOException, InterruptedException, KeeperException {
+        execRound(roundNothingAsBothAAndBDenied);
+    }
+
+    /**
+     * @see #testNothingAsAIsWatchedButDeniedBIsNotWatched
+     * @see #roundAChangesInclChildrenAreSeen
+     */
+    @Test
+    public void testAChangesInclChildrenAreSeen()
+        throws IOException, InterruptedException, KeeperException {
+        execRound(roundAChangesInclChildrenAreSeen);
+    }
+
+    /**
+     * @see #testNothingAsAIsWatchedButDeniedBIsNotWatched
+     * @see #roundNothingForAAsItSDeniedBChangesSeen
+     */
+    @Test
+    public void testNothingForAAsItSDeniedBChangesSeen()
+        throws IOException, InterruptedException, KeeperException {
+        execRound(roundNothingForAAsItSDeniedBChangesSeen);
+    }
+
+    /**
+     * @see #testNothingAsAIsWatchedButDeniedBIsNotWatched
+     * @see #roundNothingBothDenied
+     */
+    @Test
+    public void testNothingBothDenied()
+        throws IOException, InterruptedException, KeeperException {
+        execRound(roundNothingBothDenied);
+    }
+
+    /**
+     * @see #testNothingAsAIsWatchedButDeniedBIsNotWatched
+     * @see #roundNothingAllDenied
+     */
+    @Test
+    public void testNothingAllDenied()
+        throws IOException, InterruptedException, KeeperException {
+        execRound(roundNothingAllDenied);
+    }
+
+    /**
+     * @see #testNothingAsAIsWatchedButDeniedBIsNotWatched
+     * @see #roundADeniesSeeAllChangesForBAndCIncludingBChildren
+     */
+    @Test
+    public void testADeniesSeeAllChangesForBAndCIncludingBChildren()
+        throws IOException, InterruptedException, KeeperException {
+        execRound(roundADeniesSeeAllChangesForBAndCIncludingBChildren);
+    }
+
+    /**
+     * @see #testNothingAsAIsWatchedButDeniedBIsNotWatched
+     * @see #roundADeniesSeeAllBChangesAndBChildrenNothingForC
+     */
+    @Test
+    public void testADeniesSeeAllBChangesAndBChildrenNothingForC()
+        throws IOException, InterruptedException, KeeperException {
+        execRound(roundADeniesSeeAllBChangesAndBChildrenNothingForC);
+    }
+
+    /**
+     * @see #testNothingAsAIsWatchedButDeniedBIsNotWatched
+     * @see #roundNothingTheWatchIsOnC
+     */
+    @Test
+    public void testNothingTheWatchIsOnC()
+        throws IOException, InterruptedException, KeeperException {
+        execRound(roundNothingTheWatchIsOnC);
+    }
+
+    /**
+     * @see #testNothingAsAIsWatchedButDeniedBIsNotWatched
+     * @see #roundTheWatchIsOnlyOnCBAndCAllowed
+     */
+    @Test
+    public void testTheWatchIsOnlyOnCBAndCAllowed()
+        throws IOException, InterruptedException, KeeperException {
+        execRound(roundTheWatchIsOnlyOnCBAndCAllowed);
+    }
+
+    // The rest of this class is the world's lamest "CSV" encoder.
+
+    /**
+     * The set of rounds.  This array includes one entry for each
+     * {@code private static final Round round*} member variable
+     * defined above.
+     *
+     * @see #roundNothingAsAIsWatchedButDeniedBIsNotWatched
+     */
+    private static final Round[] ROUNDS = new Round[] {
+        roundNothingAsAIsWatchedButDeniedBIsNotWatched,
+        roundNothingAsBothAAndBDenied,
+        roundAChangesInclChildrenAreSeen,
+        roundNothingForAAsItSDeniedBChangesSeen,
+        roundNothingBothDenied,
+        roundNothingAllDenied,
+        roundADeniesSeeAllChangesForBAndCIncludingBChildren,
+        roundADeniesSeeAllBChangesAndBChildrenNothingForC,
+        roundNothingTheWatchIsOnC,
+        roundTheWatchIsOnlyOnCBAndCAllowed,
+    };
+
+    private static String allowString(String prefix, Boolean allow) {
+        if (allow == null) {
+            return "";
+        } else {
+            return prefix + (allow ? "allow" : "deny");
+        }
+    }
+
+    private static String watchModeString(AddWatchMode watchMode) {
+        switch (watchMode) {
+        case PERSISTENT:
+            return "PERSISTENT";
+        case PERSISTENT_RECURSIVE:
+            return "PRECURSIVE";
+        default:
+            return "?";
+        }
+    }
+
+    private static String actionString(int opCode) {
+        switch (opCode) {
+        case ZooDefs.OpCode.create:
+            return "create";
+        case ZooDefs.OpCode.delete:
+            return "delete";
+        case ZooDefs.OpCode.setData:
+            return "modify";
+        default:
+            return "?";
+        }
+    }
+
+    private static String eventPathString(String eventPath) {
+        if (eventPath == null) {
+            return "?";
+        } else if (eventPath.length() <= 1) {
+            return eventPath;
+        } else {
+            return eventPath.substring(eventPath.lastIndexOf('/') + 1);
+        }
+    }
+
+    /**
+     * Generates a "CSV" rendition of the table in sb.
+     *
+     * @param sb the target string builder
+     */
+    private static void genCsv(StringBuilder sb) {
+        sb.append("Initial State,")
+            .append("Action,")
+            .append("NodeCreated,")
+            .append("NodeDeleted,")
+            .append("NodeDataChanged,")
+            .append("NodeChildrenChanged,")
+            .append("Notes/summary\n");
+        sb.append("Assume /a always exists\n\n");
+
+        for (Round round : ROUNDS) {
+            sb.append("\"ACL")
+                .append(allowString(": a ", round.allowA))
+                .append(allowString(", b ", round.allowB))
+                .append(allowString(", c ", round.allowC))
+                .append("\"")
+                .append(",,,,,,\"")
+                .append(round.summary)
+                .append("\"\n");
+            for (int i = 0; i < round.steps.length; i++) {
+                Step step = round.steps[i];
+
+                if (i == 0) {
+                    sb.append("\"addWatch(")
+                        .append(round.watchTarget)
+                        .append(", ")
+                        .append(watchModeString(round.watchMode))
+                        .append(")\"");
+                }
+
+                sb.append(",")
+                    .append(actionString(step.opCode))
+                    .append(" ")
+                    .append(step.target)
+                    .append(",");
+
+                if (step.eventType == EventType.NodeCreated) {
+                    sb.append("y - ")
+                        .append(eventPathString(step.eventPath));
+                }
+
+                sb.append(",");
+
+                if (step.eventType == EventType.NodeDeleted) {
+                    sb.append("y - ")
+                        .append(eventPathString(step.eventPath));
+                }
+
+                sb.append(",");
+
+                if (step.eventType == EventType.NodeDataChanged) {
+                    sb.append("y - ")
+                        .append(eventPathString(step.eventPath));
+                }
+
+                sb.append(",");
+
+                if (round.watchMode == PERSISTENT_RECURSIVE) {
+                    sb.append("n");
+                } else if (step.eventType == EventType.NodeChildrenChanged) {
+                    sb.append("y - ")
+                        .append(eventPathString(step.eventPath));
+                }
+
+                sb.append("\n");
+            }
+
+            sb.append("\n");
+        }
+    }
+
+    /**
+     * Generates a "CSV" rendition of the table to standard output.
+     *
+     * @see #ROUNDS
+     */
+    public static void main(String[] args) {
+        StringBuilder sb = new StringBuilder();
+        genCsv(sb);
+        System.out.println(sb);
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentWatcherTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentWatcherTest.java
index bffa8e0a2db..cad260c1230 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentWatcherTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/PersistentWatcherTest.java
@@ -19,6 +19,10 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.AddWatchMode.PERSISTENT;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.IOException;
 import java.util.concurrent.BlockingQueue;
 import java.util.concurrent.CountDownLatch;
@@ -31,9 +35,8 @@
 import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
-import org.junit.Assert;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -43,7 +46,7 @@ public class PersistentWatcherTest extends ClientBase {
     private Watcher persistentWatcher;
 
     @Override
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         super.setUp();
 
@@ -60,6 +63,20 @@ public void testBasic()
         }
     }
 
+    @Test
+    public void testNullWatch()
+            throws IOException, InterruptedException, KeeperException {
+        try (ZooKeeper zk = createClient(new CountdownWatcher(), hostPort)) {
+            assertThrows(IllegalArgumentException.class, () -> {
+                zk.addWatch("/a/b", null, PERSISTENT);
+            });
+            assertThrows(IllegalArgumentException.class, () -> {
+                AsyncCallback.VoidCallback cb = (rc, path, ctx) -> {};
+                zk.addWatch("/a/b", null, PERSISTENT, cb, null);
+            });
+        }
+    }
+
     @Test
     public void testDefaultWatcher()
             throws IOException, InterruptedException, KeeperException {
@@ -90,12 +107,12 @@ public synchronized void process(WatchedEvent event) {
         try (ZooKeeper zk = createClient(watcher, hostPort)) {
             final CountDownLatch latch = new CountDownLatch(1);
             AsyncCallback.VoidCallback cb = (rc, path, ctx) -> {
-                if (rc == 0) {
+                if (rc == KeeperException.Code.OK.intValue()) {
                     latch.countDown();
                 }
             };
             zk.addWatch("/a/b", persistentWatcher, PERSISTENT, cb, null);
-            Assert.assertTrue(latch.await(5, TimeUnit.SECONDS));
+            assertTrue(latch.await(5, TimeUnit.SECONDS));
             events.clear(); // clear any events added during client connection
             internalTestBasic(zk);
         }
@@ -107,12 +124,12 @@ public void testAsyncDefaultWatcher()
         try (ZooKeeper zk = createClient(new CountdownWatcher(), hostPort)) {
             final CountDownLatch latch = new CountDownLatch(1);
             AsyncCallback.VoidCallback cb = (rc, path, ctx) -> {
-                if (rc == 0) {
+                if (rc == KeeperException.Code.OK.intValue()) {
                     latch.countDown();
                 }
             };
             zk.addWatch("/a/b", persistentWatcher, PERSISTENT, cb, null);
-            Assert.assertTrue(latch.await(5, TimeUnit.SECONDS));
+            assertTrue(latch.await(5, TimeUnit.SECONDS));
             internalTestBasic(zk);
         }
     }
@@ -204,8 +221,8 @@ public void testRootWatcher()
     private void assertEvent(BlockingQueue<WatchedEvent> events, Watcher.Event.EventType eventType, String path)
             throws InterruptedException {
         WatchedEvent event = events.poll(5, TimeUnit.SECONDS);
-        Assert.assertNotNull(event);
-        Assert.assertEquals(eventType, event.getType());
-        Assert.assertEquals(path, event.getPath());
+        assertNotNull(event);
+        assertEquals(eventType, event.getType());
+        assertEquals(path, event.getPath());
     }
 }
\ No newline at end of file
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBase.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBase.java
index b91aa19e915..46f14d74939 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBase.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBase.java
@@ -18,10 +18,11 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
+import java.io.FileWriter;
 import java.io.IOException;
 import java.net.InetSocketAddress;
 import java.util.ArrayList;
@@ -37,7 +38,8 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
 import org.apache.zookeeper.server.util.OSMXBean;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -45,7 +47,15 @@ public class QuorumBase extends ClientBase {
 
     private static final Logger LOG = LoggerFactory.getLogger(QuorumBase.class);
 
-    private static final String LOCALADDR = "127.0.0.1";
+    protected static final String LOCALADDR = "127.0.0.1";
+
+    private File oracleDir;
+    private static final String oraclePath_0 = "/oraclePath/0/mastership/";
+    private static final String oraclePath_1 = "/oraclePath/1/mastership/";
+    private static final String oraclePath_2 = "/oraclePath/0/mastership/";
+    private static final String oraclePath_3 = "/oraclePath/1/mastership/";
+    private static final String oraclePath_4 = "/oraclePath/0/mastership/";
+    private static final String mastership = "value";
 
     File s1dir, s2dir, s3dir, s4dir, s5dir;
     QuorumPeer s1, s2, s3, s4, s5;
@@ -70,17 +80,14 @@ public class QuorumBase extends ClientBase {
     protected boolean localSessionsEnabled = false;
     protected boolean localSessionsUpgradingEnabled = false;
 
-    @Test
-    // This just avoids complaints by junit
-    public void testNull() {
-    }
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
-        setUp(false);
+        setUp(false, true);
     }
 
-    protected void setUp(boolean withObservers) throws Exception {
+    protected void setUp(boolean withObservers, boolean withOracle) throws Exception {
         LOG.info("QuorumBase.setup {}", getTestName());
         setupTestEnv();
 
@@ -124,7 +131,7 @@ protected void setUp(boolean withObservers) throws Exception {
         s4dir = ClientBase.createTmpDir();
         s5dir = ClientBase.createTmpDir();
 
-        startServers(withObservers);
+        startServers(withObservers, withOracle);
 
         OSMXBean osMbean = new OSMXBean();
         if (osMbean.getUnix()) {
@@ -134,16 +141,49 @@ protected void setUp(boolean withObservers) throws Exception {
         LOG.info("Setup finished");
     }
 
+    private void createOraclePath() throws IOException {
+        oracleDir = ClientBase.createTmpDir();
+        File directory = new File(oracleDir, oraclePath_0);
+        directory.mkdirs();
+        FileWriter fw = new FileWriter(oracleDir.getAbsolutePath() + oraclePath_0 + mastership);
+        fw.write("1");
+        fw.close();
+
+        directory = new File(oracleDir, oraclePath_1);
+        directory.mkdirs();
+        fw = new FileWriter(oracleDir.getAbsolutePath() + oraclePath_1 + mastership);
+        fw.write("0");
+        fw.close();
+
+        directory = new File(oracleDir, oraclePath_2);
+        directory.mkdirs();
+        fw = new FileWriter(oracleDir.getAbsolutePath() + oraclePath_2 + mastership);
+        fw.write("0");
+        fw.close();
+
+        directory = new File(oracleDir, oraclePath_3);
+        directory.mkdirs();
+        fw = new FileWriter(oracleDir.getAbsolutePath() + oraclePath_3 + mastership);
+        fw.write("1");
+        fw.close();
+
+        directory = new File(oracleDir, oraclePath_4);
+        directory.mkdirs();
+        fw = new FileWriter(oracleDir.getAbsolutePath()  + oraclePath_4 + mastership);
+        fw.write("0");
+        fw.close();
+    }
+
     void startServers() throws Exception {
-        startServers(false);
+        startServers(false, true);
     }
 
-    void startServers(boolean withObservers) throws Exception {
+    void startServers(boolean withObservers, boolean withOracle) throws Exception {
         int tickTime = 2000;
         int initLimit = 3;
         int syncLimit = 3;
         int connectToLearnerMasterLimit = 3;
-        Map<Long, QuorumServer> peers = new HashMap<Long, QuorumServer>();
+        Map<Long, QuorumServer> peers = new HashMap<>();
         peers.put(Long.valueOf(1), new QuorumServer(1, new InetSocketAddress(LOCALADDR, port1), new InetSocketAddress(LOCALADDR, portLE1), new InetSocketAddress(LOCALADDR, portClient1), LearnerType.PARTICIPANT));
         peers.put(Long.valueOf(2), new QuorumServer(2, new InetSocketAddress(LOCALADDR, port2), new InetSocketAddress(LOCALADDR, portLE2), new InetSocketAddress(LOCALADDR, portClient2), LearnerType.PARTICIPANT));
         peers.put(Long.valueOf(3), new QuorumServer(3, new InetSocketAddress(LOCALADDR, port3), new InetSocketAddress(LOCALADDR, portLE3), new InetSocketAddress(LOCALADDR, portClient3), LearnerType.PARTICIPANT));
@@ -155,21 +195,46 @@ void startServers(boolean withObservers) throws Exception {
             peers.get(Long.valueOf(5)).type = LearnerType.OBSERVER;
         }
 
-        LOG.info("creating QuorumPeer 1 port {}", portClient1);
-        s1 = new QuorumPeer(peers, s1dir, s1dir, portClient1, 3, 1, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit);
-        assertEquals(portClient1, s1.getClientPort());
-        LOG.info("creating QuorumPeer 2 port {}", portClient2);
-        s2 = new QuorumPeer(peers, s2dir, s2dir, portClient2, 3, 2, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit);
-        assertEquals(portClient2, s2.getClientPort());
-        LOG.info("creating QuorumPeer 3 port {}", portClient3);
-        s3 = new QuorumPeer(peers, s3dir, s3dir, portClient3, 3, 3, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit);
-        assertEquals(portClient3, s3.getClientPort());
-        LOG.info("creating QuorumPeer 4 port {}", portClient4);
-        s4 = new QuorumPeer(peers, s4dir, s4dir, portClient4, 3, 4, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit);
-        assertEquals(portClient4, s4.getClientPort());
-        LOG.info("creating QuorumPeer 5 port {}", portClient5);
-        s5 = new QuorumPeer(peers, s5dir, s5dir, portClient5, 3, 5, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit);
-        assertEquals(portClient5, s5.getClientPort());
+        if (!withOracle) {
+            LOG.info("creating QuorumPeer 1 port {}", portClient1);
+            s1 = new QuorumPeer(peers, s1dir, s1dir, portClient1, 3, 1, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit);
+            assertEquals(portClient1, s1.getClientPort());
+            LOG.info("creating QuorumPeer 2 port {}", portClient2);
+            s2 = new QuorumPeer(peers, s2dir, s2dir, portClient2, 3, 2, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit);
+            assertEquals(portClient2, s2.getClientPort());
+            LOG.info("creating QuorumPeer 3 port {}", portClient3);
+            s3 = new QuorumPeer(peers, s3dir, s3dir, portClient3, 3, 3, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit);
+            assertEquals(portClient3, s3.getClientPort());
+            LOG.info("creating QuorumPeer 4 port {}", portClient4);
+            s4 = new QuorumPeer(peers, s4dir, s4dir, portClient4, 3, 4, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit);
+            assertEquals(portClient4, s4.getClientPort());
+            LOG.info("creating QuorumPeer 5 port {}", portClient5);
+            s5 = new QuorumPeer(peers, s5dir, s5dir, portClient5, 3, 5, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit);
+            assertEquals(portClient5, s5.getClientPort());
+        } else {
+            createOraclePath();
+
+            LOG.info("creating QuorumPeer 1 port {}", portClient1);
+            s1 = new QuorumPeer(peers, s1dir, s1dir, portClient1, 3, 1, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit, oracleDir
+                    .getAbsolutePath()  + oraclePath_0 + mastership);
+            assertEquals(portClient1, s1.getClientPort());
+            LOG.info("creating QuorumPeer 2 port {}", portClient2);
+            s2 = new QuorumPeer(peers, s2dir, s2dir, portClient2, 3, 2, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit, oracleDir
+                    .getAbsolutePath()  + oraclePath_1 + mastership);
+            assertEquals(portClient2, s2.getClientPort());
+            LOG.info("creating QuorumPeer 3 port {}", portClient3);
+            s3 = new QuorumPeer(peers, s3dir, s3dir, portClient3, 3, 3, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit, oracleDir
+                    .getAbsolutePath()  + oraclePath_2 + mastership);
+            assertEquals(portClient3, s3.getClientPort());
+            LOG.info("creating QuorumPeer 4 port {}", portClient4);
+            s4 = new QuorumPeer(peers, s4dir, s4dir, portClient4, 3, 4, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit, oracleDir
+                    .getAbsolutePath()  + oraclePath_3 + mastership);
+            assertEquals(portClient4, s4.getClientPort());
+            LOG.info("creating QuorumPeer 5 port {}", portClient5);
+            s5 = new QuorumPeer(peers, s5dir, s5dir, portClient5, 3, 5, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit, oracleDir
+                    .getAbsolutePath()  + oraclePath_4 + mastership);
+            assertEquals(portClient5, s5.getClientPort());
+        }
 
         if (withObservers) {
             s4.setLearnerType(LearnerType.OBSERVER);
@@ -207,14 +272,14 @@ void startServers(boolean withObservers) throws Exception {
 
         LOG.info("Checking ports {}", hostPort);
         for (String hp : hostPort.split(",")) {
-            assertTrue("waiting for server up", ClientBase.waitForServerUp(hp, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp(hp, CONNECTION_TIMEOUT), "waiting for server up");
             LOG.info("{} is accepting client connections", hp);
         }
 
         // interesting to see what's there...
         JMXEnv.dump();
         // make sure we have these 5 servers listed
-        Set<String> ensureNames = new LinkedHashSet<String>();
+        Set<String> ensureNames = new LinkedHashSet<>();
         for (int i = 1; i <= 5; i++) {
             ensureNames.add("InMemoryDataTree");
         }
@@ -233,18 +298,93 @@ void startServers(boolean withObservers) throws Exception {
     }
 
     public int getLeaderIndex() {
+      if (s1.getPeerState() == ServerState.LEADING) {
+        return 0;
+      } else if (s2.getPeerState() == ServerState.LEADING) {
+        return 1;
+      } else if (s3.getPeerState() == ServerState.LEADING) {
+        return 2;
+      } else if (s4.getPeerState() == ServerState.LEADING) {
+        return 3;
+      } else if (s5.getPeerState() == ServerState.LEADING) {
+        return 4;
+      }
+      return -1;
+    }
+
+    public int getLeaderClientPort() {
+      if (s1.getPeerState() == ServerState.LEADING) {
+        return portClient1;
+      } else if (s2.getPeerState() == ServerState.LEADING) {
+        return portClient2;
+      } else if (s3.getPeerState() == ServerState.LEADING) {
+        return portClient3;
+      } else if (s4.getPeerState() == ServerState.LEADING) {
+        return portClient4;
+      } else if (s5.getPeerState() == ServerState.LEADING) {
+        return portClient5;
+      }
+      return -1;
+    }
+
+    public QuorumPeer getLeaderQuorumPeer() {
+      if (s1.getPeerState() == ServerState.LEADING) {
+        return s1;
+      } else if (s2.getPeerState() == ServerState.LEADING) {
+        return s2;
+      } else if (s3.getPeerState() == ServerState.LEADING) {
+        return s3;
+      } else if (s4.getPeerState() == ServerState.LEADING) {
+        return s4;
+      } else if (s5.getPeerState() == ServerState.LEADING) {
+        return s5;
+      }
+      return null;
+    }
+
+    public File getLeaderDataDir() {
         if (s1.getPeerState() == ServerState.LEADING) {
-            return 0;
+            return s1dir;
         } else if (s2.getPeerState() == ServerState.LEADING) {
-            return 1;
+            return s2dir;
         } else if (s3.getPeerState() == ServerState.LEADING) {
-            return 2;
+            return s3dir;
         } else if (s4.getPeerState() == ServerState.LEADING) {
-            return 3;
+            return s4dir;
         } else if (s5.getPeerState() == ServerState.LEADING) {
-            return 4;
+            return s5dir;
         }
-        return -1;
+        return null;
+    }
+
+    public QuorumPeer getFirstObserver() {
+      if (s1.getLearnerType() == LearnerType.OBSERVER) {
+        return s1;
+      } else if (s2.getLearnerType() == LearnerType.OBSERVER) {
+        return s2;
+      } else if (s3.getLearnerType() == LearnerType.OBSERVER) {
+        return s3;
+      } else if (s4.getLearnerType() == LearnerType.OBSERVER) {
+        return s4;
+      } else if (s5.getLearnerType() == LearnerType.OBSERVER) {
+        return s5;
+      }
+      return null;
+    }
+
+    public int getFirstObserverClientPort() {
+      if (s1.getLearnerType() == LearnerType.OBSERVER) {
+        return portClient1;
+      } else if (s2.getLearnerType() == LearnerType.OBSERVER) {
+        return portClient2;
+      } else if (s3.getLearnerType() == LearnerType.OBSERVER) {
+        return portClient3;
+      } else if (s4.getLearnerType() == LearnerType.OBSERVER) {
+        return portClient4;
+      } else if (s5.getLearnerType() == LearnerType.OBSERVER) {
+        return portClient5;
+      }
+      return -1;
     }
 
     public String getPeersMatching(ServerState state) {
@@ -259,7 +399,7 @@ public String getPeersMatching(ServerState state) {
     }
 
     public ArrayList<QuorumPeer> getPeerList() {
-        ArrayList<QuorumPeer> peers = new ArrayList<QuorumPeer>();
+        ArrayList<QuorumPeer> peers = new ArrayList<>();
         peers.add(s1);
         peers.add(s2);
         peers.add(s3);
@@ -293,7 +433,7 @@ public void setupServer(int i) throws IOException {
         int connectToLearnerMasterLimit = 3;
 
         if (peers == null) {
-            peers = new HashMap<Long, QuorumServer>();
+            peers = new HashMap<>();
 
             peers.put(Long.valueOf(1), new QuorumServer(1, new InetSocketAddress(LOCALADDR, port1), new InetSocketAddress(LOCALADDR, portLE1), new InetSocketAddress(LOCALADDR, portClient1), LearnerType.PARTICIPANT));
             peers.put(Long.valueOf(2), new QuorumServer(2, new InetSocketAddress(LOCALADDR, port2), new InetSocketAddress(LOCALADDR, portLE2), new InetSocketAddress(LOCALADDR, portClient2), LearnerType.PARTICIPANT));
@@ -330,9 +470,13 @@ public void setupServer(int i) throws IOException {
         }
     }
 
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         LOG.info("TearDown started");
+        if (oracleDir != null) {
+            ClientBase.recursiveDelete(oracleDir);
+        }
 
         OSMXBean osMbean = new OSMXBean();
         if (osMbean.getUnix()) {
@@ -342,7 +486,7 @@ public void tearDown() throws Exception {
         shutdownServers();
 
         for (String hp : hostPort.split(",")) {
-            assertTrue("waiting for server down", ClientBase.waitForServerDown(hp, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown(hp, ClientBase.CONNECTION_TIMEOUT), "waiting for server down");
             LOG.info("{} is no longer accepting client connections", hp);
         }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBaseOracle_2Nodes.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBaseOracle_2Nodes.java
new file mode 100644
index 00000000000..a7f4a7e1d10
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumBaseOracle_2Nodes.java
@@ -0,0 +1,360 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+import java.io.File;
+import java.io.FileWriter;
+import java.io.IOException;
+import java.net.InetSocketAddress;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.LinkedHashSet;
+import java.util.Map;
+import java.util.Set;
+import org.apache.zookeeper.PortAssignment;
+import org.apache.zookeeper.TestableZooKeeper;
+import org.apache.zookeeper.server.quorum.Election;
+import org.apache.zookeeper.server.quorum.QuorumPeer;
+import org.apache.zookeeper.server.util.OSMXBean;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+
+public class QuorumBaseOracle_2Nodes extends ClientBase{
+
+    private static final Logger LOG = LoggerFactory.getLogger(QuorumBase.class);
+
+    private static final String LOCALADDR = "127.0.0.1";
+
+    private File oracleDir;
+    private static String oraclePath_0 = "/oraclePath/0/mastership/";
+    private static String oraclePath_1 = "/oraclePath/1/mastership/";
+
+    private static final String mastership = "value";
+
+    File s1dir, s2dir;
+    QuorumPeer s1, s2;
+    protected int port1;
+    protected int port2;
+
+    protected int portLE1;
+    protected int portLE2;
+
+    protected int portClient1;
+    protected int portClient2;
+
+    protected boolean localSessionsEnabled = false;
+    protected boolean localSessionsUpgradingEnabled = false;
+
+
+
+    @BeforeEach
+    @Override
+    public void setUp() throws Exception {
+        LOG.info("QuorumBase.setup {}", getTestName());
+        setupTestEnv();
+
+        JMXEnv.setUp();
+
+        setUpAll();
+
+        port1 = PortAssignment.unique();
+        port2 = PortAssignment.unique();
+
+        portLE1 = PortAssignment.unique();
+        portLE2 = PortAssignment.unique();
+
+        portClient1 = PortAssignment.unique();
+        portClient2 = PortAssignment.unique();
+
+        hostPort = "127.0.0.1:"
+                + portClient1
+                + ",127.0.0.1:"
+                + portClient2;
+        LOG.info("Ports are: {}", hostPort);
+
+        s1dir = ClientBase.createTmpDir();
+        s2dir = ClientBase.createTmpDir();
+
+        createOraclePath();
+
+        startServers();
+
+        OSMXBean osMbean = new OSMXBean();
+        if (osMbean.getUnix()) {
+            LOG.info("Initial fdcount is: {}", osMbean.getOpenFileDescriptorCount());
+        }
+
+        LOG.info("Setup finished");
+    }
+
+    private void createOraclePath() throws IOException {
+        oracleDir = ClientBase.createTmpDir();
+        File directory = new File(oracleDir, oraclePath_0);
+        directory.mkdirs();
+        FileWriter fw = new FileWriter(oracleDir.getAbsolutePath() + oraclePath_0 + mastership);
+        fw.write("0");
+        fw.close();
+
+        directory = new File(oracleDir, oraclePath_1);
+        directory.mkdirs();
+        fw = new FileWriter(oracleDir.getAbsolutePath() + oraclePath_1 + mastership);
+        fw.write("1");
+        fw.close();
+    }
+
+    void startServers() throws Exception {
+        int tickTime = 2000;
+        int initLimit = 3;
+        int syncLimit = 3;
+        int connectToLearnerMasterLimit = 3;
+        Map<Long, QuorumPeer.QuorumServer> peers = new HashMap<>();
+        peers.put(Long.valueOf(1), new QuorumPeer.QuorumServer(1, new InetSocketAddress(LOCALADDR, port1), new InetSocketAddress(LOCALADDR, portLE1), new InetSocketAddress(LOCALADDR, portClient1), QuorumPeer.LearnerType.PARTICIPANT));
+        peers.put(Long.valueOf(2), new QuorumPeer.QuorumServer(2, new InetSocketAddress(LOCALADDR, port2), new InetSocketAddress(LOCALADDR, portLE2), new InetSocketAddress(LOCALADDR, portClient2), QuorumPeer.LearnerType.PARTICIPANT));
+
+        LOG.info("creating QuorumPeer 1 port {}", portClient1);
+        s1 = new QuorumPeer(peers, s1dir, s1dir, portClient1, 3, 1, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit, oracleDir
+                .getAbsolutePath() + oraclePath_0 + mastership);
+        assertEquals(portClient1, s1.getClientPort());
+        LOG.info("creating QuorumPeer 2 port {}", portClient2);
+        s2 = new QuorumPeer(peers, s2dir, s2dir, portClient2, 3, 2, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit, oracleDir
+                .getAbsolutePath() + oraclePath_1 + mastership);
+        assertEquals(portClient2, s2.getClientPort());
+
+
+        LOG.info("QuorumPeer 1 voting view: {}", s1.getVotingView());
+        LOG.info("QuorumPeer 2 voting view: {}", s2.getVotingView());
+
+        s1.enableLocalSessions(localSessionsEnabled);
+        s2.enableLocalSessions(localSessionsEnabled);
+        s1.enableLocalSessionsUpgrading(localSessionsUpgradingEnabled);
+        s2.enableLocalSessionsUpgrading(localSessionsUpgradingEnabled);
+
+        LOG.info("start QuorumPeer 1");
+        s1.start();
+        LOG.info("start QuorumPeer 2");
+        s2.start();
+
+        LOG.info("Checking ports {}", hostPort);
+        for (String hp : hostPort.split(",")) {
+            assertTrue(ClientBase.waitForServerUp(hp, CONNECTION_TIMEOUT), "waiting for server up");
+            LOG.info("{} is accepting client connections", hp);
+        }
+
+        // interesting to see what's there...
+        JMXEnv.dump();
+        // make sure we have these 5 servers listed
+        Set<String> ensureNames = new LinkedHashSet<>();
+        for (int i = 1; i <= 2; i++) {
+            ensureNames.add("InMemoryDataTree");
+        }
+        for (int i = 1; i <= 2; i++) {
+            ensureNames.add("name0=ReplicatedServer_id" + i + ",name1=replica." + i + ",name2=");
+        }
+        for (int i = 1; i <= 2; i++) {
+            for (int j = 1; j <= 2; j++) {
+                ensureNames.add("name0=ReplicatedServer_id" + i + ",name1=replica." + j);
+            }
+        }
+        for (int i = 1; i <= 2; i++) {
+            ensureNames.add("name0=ReplicatedServer_id" + i);
+        }
+        JMXEnv.ensureAll(ensureNames.toArray(new String[ensureNames.size()]));
+    }
+
+    public int getLeaderIndex() {
+        if (s1.getPeerState() == QuorumPeer.ServerState.LEADING) {
+            return 0;
+        } else if (s2.getPeerState() == QuorumPeer.ServerState.LEADING) {
+            return 1;
+        }
+        return -1;
+    }
+
+    public int getLeaderClientPort() {
+        if (s1.getPeerState() == QuorumPeer.ServerState.LEADING) {
+            return portClient1;
+        } else if (s2.getPeerState() == QuorumPeer.ServerState.LEADING) {
+            return portClient2;
+        }
+        return -1;
+    }
+
+    public QuorumPeer getLeaderQuorumPeer() {
+        if (s1.getPeerState() == QuorumPeer.ServerState.LEADING) {
+            return s1;
+        } else if (s2.getPeerState() == QuorumPeer.ServerState.LEADING) {
+            return s2;
+        }
+        return null;
+    }
+
+    public QuorumPeer getFirstObserver() {
+        if (s1.getLearnerType() == QuorumPeer.LearnerType.OBSERVER) {
+            return s1;
+        } else if (s2.getLearnerType() == QuorumPeer.LearnerType.OBSERVER) {
+            return s2;
+        }
+        return null;
+    }
+
+    public int getFirstObserverClientPort() {
+        if (s1.getLearnerType() == QuorumPeer.LearnerType.OBSERVER) {
+            return portClient1;
+        } else if (s2.getLearnerType() == QuorumPeer.LearnerType.OBSERVER) {
+            return portClient2;
+        }
+        return -1;
+    }
+
+    public String getPeersMatching(QuorumPeer.ServerState state) {
+        StringBuilder hosts = new StringBuilder();
+        for (QuorumPeer p : getPeerList()) {
+            if (p.getPeerState() == state) {
+                hosts.append(String.format("%s:%d,", LOCALADDR, p.getClientAddress().getPort()));
+            }
+        }
+        LOG.info("getPeersMatching ports are {}", hosts);
+        return hosts.toString();
+    }
+
+    public ArrayList<QuorumPeer> getPeerList() {
+        ArrayList<QuorumPeer> peers = new ArrayList<>();
+        peers.add(s1);
+        peers.add(s2);
+        return peers;
+    }
+
+    public QuorumPeer getPeerByClientPort(int clientPort) {
+        for (QuorumPeer p : getPeerList()) {
+            if (p.getClientAddress().getPort() == clientPort) {
+                return p;
+            }
+        }
+        return null;
+    }
+
+    public void setupServers() throws IOException {
+        setupServer(1);
+        setupServer(2);
+    }
+
+    Map<Long, QuorumPeer.QuorumServer> peers = null;
+
+    public void setupServer(int i) throws IOException {
+        int tickTime = 2000;
+        int initLimit = 3;
+        int syncLimit = 3;
+        int connectToLearnerMasterLimit = 3;
+
+        if (peers == null) {
+            peers = new HashMap<>();
+
+            peers.put(Long.valueOf(1), new QuorumPeer.QuorumServer(1, new InetSocketAddress(LOCALADDR, port1), new InetSocketAddress(LOCALADDR, portLE1), new InetSocketAddress(LOCALADDR, portClient1), QuorumPeer.LearnerType.PARTICIPANT));
+            peers.put(Long.valueOf(2), new QuorumPeer.QuorumServer(2, new InetSocketAddress(LOCALADDR, port2), new InetSocketAddress(LOCALADDR, portLE2), new InetSocketAddress(LOCALADDR, portClient2), QuorumPeer.LearnerType.PARTICIPANT));
+        }
+
+        switch (i) {
+            case 1:
+                LOG.info("creating QuorumPeer 1 port {}", portClient1);
+                s1 = new QuorumPeer(peers, s1dir, s1dir, portClient1, 3, 1, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit);
+                assertEquals(portClient1, s1.getClientPort());
+                break;
+            case 2:
+                LOG.info("creating QuorumPeer 2 port {}", portClient2);
+                s2 = new QuorumPeer(peers, s2dir, s2dir, portClient2, 3, 2, tickTime, initLimit, syncLimit, connectToLearnerMasterLimit);
+                assertEquals(portClient2, s2.getClientPort());
+                break;
+        }
+    }
+
+    @AfterEach
+    @Override
+    public void tearDown() throws Exception {
+        LOG.info("TearDown started");
+        if (oracleDir != null) {
+            ClientBase.recursiveDelete(oracleDir);
+        }
+
+        OSMXBean osMbean = new OSMXBean();
+        if (osMbean.getUnix()) {
+            LOG.info("fdcount after test is: {}", osMbean.getOpenFileDescriptorCount());
+        }
+
+        shutdownServers();
+
+        for (String hp : hostPort.split(",")) {
+            assertTrue(ClientBase.waitForServerDown(hp, ClientBase.CONNECTION_TIMEOUT), "waiting for server down");
+            LOG.info("{} is no longer accepting client connections", hp);
+        }
+
+        JMXEnv.tearDown();
+    }
+    public void shutdownServers() {
+        shutdown(s1);
+        shutdown(s2);
+    }
+
+    public static void shutdown(QuorumPeer qp) {
+        if (qp == null) {
+            return;
+        }
+        try {
+            LOG.info("Shutting down quorum peer {}", qp.getName());
+            qp.shutdown();
+            Election e = qp.getElectionAlg();
+            if (e != null) {
+                LOG.info("Shutting down leader election {}", qp.getName());
+                e.shutdown();
+            } else {
+                LOG.info("No election available to shutdown {}", qp.getName());
+            }
+            LOG.info("Waiting for {} to exit thread", qp.getName());
+            long readTimeout = qp.getTickTime() * qp.getInitLimit();
+            long connectTimeout = qp.getTickTime() * qp.getSyncLimit();
+            long maxTimeout = Math.max(readTimeout, connectTimeout);
+            maxTimeout = Math.max(maxTimeout, ClientBase.CONNECTION_TIMEOUT);
+            qp.join(maxTimeout * 2);
+            if (qp.isAlive()) {
+                fail("QP failed to shutdown in " + (maxTimeout * 2) + " seconds: " + qp.getName());
+            }
+        } catch (InterruptedException e) {
+            LOG.debug("QP interrupted: {}", qp.getName(), e);
+        }
+    }
+
+    protected TestableZooKeeper createClient() throws IOException, InterruptedException {
+        return createClient(hostPort);
+    }
+
+    protected TestableZooKeeper createClient(String hp) throws IOException, InterruptedException {
+        ClientBase.CountdownWatcher watcher = new ClientBase.CountdownWatcher();
+        return createClient(watcher, hp);
+    }
+
+    protected TestableZooKeeper createClient(ClientBase.CountdownWatcher watcher, QuorumPeer.ServerState state) throws IOException, InterruptedException {
+        return createClient(watcher, getPeersMatching(state));
+    }
+
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumHammerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumHammerTest.java
index 57446ee3767..ff022f3f279 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumHammerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumHammerTest.java
@@ -19,9 +19,9 @@
 package org.apache.zookeeper.test;
 
 import org.apache.zookeeper.ZKTestCase;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -33,14 +33,14 @@ public class QuorumHammerTest extends ZKTestCase {
     protected final QuorumBase qb = new QuorumBase();
     protected final ClientHammerTest cht = new ClientHammerTest();
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         qb.setUp();
         cht.hostPort = qb.hostPort;
         cht.setUpAll();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         cht.tearDownAll();
         qb.tearDown();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumMajorityTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumMajorityTest.java
index 9516d0165c4..4761596736c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumMajorityTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumMajorityTest.java
@@ -18,14 +18,14 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.ArrayList;
 import org.apache.zookeeper.jmx.MBeanRegistry;
 import org.apache.zookeeper.server.quorum.Leader.Proposal;
 import org.apache.zookeeper.server.quorum.QuorumPeer;
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -53,11 +53,11 @@ public void testMajQuorums() throws Throwable {
                 bean = String.format("%s:name0=ReplicatedServer_id%d,name1=replica.%d,name2=Leader", MBeanRegistry.DOMAIN, i, i);
             }
             electionTimeTaken = (Long) JMXEnv.ensureBeanAttribute(bean, "ElectionTimeTaken");
-            assertTrue("Wrong electionTimeTaken value!", electionTimeTaken >= 0);
+            assertTrue(electionTimeTaken >= 0, "Wrong electionTimeTaken value!");
         }
 
         //setup servers 1-5 to be followers
-        setUp(false);
+        setUp(false, true);
 
         Proposal p = new Proposal();
 
@@ -77,7 +77,7 @@ public void testMajQuorums() throws Throwable {
         assertEquals(true, p.hasAllQuorums());
 
         //setup servers 1-3 to be followers and 4 and 5 to be observers
-        setUp(true);
+        setUp(true, true);
 
         p = new Proposal();
         p.addQuorumVerifier(s1.getQuorumVerifier());
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumOracleMajTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumOracleMajTest.java
new file mode 100644
index 00000000000..8cf63900707
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumOracleMajTest.java
@@ -0,0 +1,122 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.zookeeper.test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.util.ArrayList;
+import org.apache.zookeeper.jmx.MBeanRegistry;
+import org.apache.zookeeper.server.quorum.Leader;
+import org.apache.zookeeper.server.quorum.LearnerHandler;
+import org.apache.zookeeper.server.quorum.QuorumPeer;
+import org.junit.jupiter.api.Test;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+
+public class QuorumOracleMajTest extends QuorumBaseOracle_2Nodes {
+
+    protected static final Logger LOG = LoggerFactory.getLogger(QuorumMajorityTest.class);
+    public static final long CONNECTION_TIMEOUT = ClientTest.CONNECTION_TIMEOUT;
+
+    /***************************************************************/
+    /* Test that the majority quorum verifier only counts votes from */
+    /* followers in its view                                    */
+    /***************************************************************/
+    @Test
+    public void testMajQuorums() throws Throwable {
+        LOG.info("Verify QuorumPeer#electionTimeTaken jmx bean attribute");
+
+        ArrayList<QuorumPeer> peers = getPeerList();
+        for (int i = 1; i <= peers.size(); i++) {
+            QuorumPeer qp = peers.get(i - 1);
+            Long electionTimeTaken = -1L;
+            String bean = "";
+            if (qp.getPeerState() == QuorumPeer.ServerState.FOLLOWING) {
+                bean = String.format("%s:name0=ReplicatedServer_id%d,name1=replica.%d,name2=Follower", MBeanRegistry.DOMAIN, i, i);
+            } else if (qp.getPeerState() == QuorumPeer.ServerState.LEADING) {
+                bean = String.format("%s:name0=ReplicatedServer_id%d,name1=replica.%d,name2=Leader", MBeanRegistry.DOMAIN, i, i);
+            }
+            electionTimeTaken = (Long) JMXEnv.ensureBeanAttribute(bean, "ElectionTimeTaken");
+            assertTrue(electionTimeTaken >= 0, "Wrong electionTimeTaken value!");
+        }
+
+        tearDown();
+        //setup servers 1-2 to be followers
+        // id=1, oracle is false; id=2, oracle is true
+        setUp();
+
+        QuorumPeer s;
+        int leader;
+        if ((leader = getLeaderIndex()) == 1) {
+            s = s1;
+        } else {
+            s = s2;
+        }
+
+        noDropConnectionTest(s);
+
+        dropConnectionTest(s, leader);
+
+    }
+
+    private void noDropConnectionTest(QuorumPeer s) {
+        Leader.Proposal p = new Leader.Proposal();
+
+
+        p.addQuorumVerifier(s.getQuorumVerifier());
+
+        // 1 followers out of 2 is not a majority
+        p.addAck(Long.valueOf(1));
+        assertEquals(false, p.hasAllQuorums());
+
+        // 6 is not in the view - its vote shouldn't count
+        p.addAck(Long.valueOf(6));
+        assertEquals(false, p.hasAllQuorums());
+
+        // 2 followers out of 2 is good
+        p.addAck(Long.valueOf(2));
+        assertEquals(true, p.hasAllQuorums());
+
+    }
+
+
+    private void dropConnectionTest(QuorumPeer s, int leader) {
+        Leader.Proposal p = new Leader.Proposal();
+        p.addQuorumVerifier(s.getQuorumVerifier());
+
+        ArrayList<LearnerHandler> fake = new ArrayList<>();
+
+        LearnerHandler f = null;
+        fake.add(f);
+
+        s.getQuorumVerifier().updateNeedOracle(fake);
+        // still have valid followers, the oracle should not take place
+        assertEquals(false, s.getQuorumVerifier().getNeedOracle());
+
+        fake.remove(0);
+        s.getQuorumVerifier().updateNeedOracle(fake);
+        // lose all of followers, the oracle should take place
+        assertEquals(true, s.getQuorumVerifier().getNeedOracle());
+
+
+        // when leader is 1, we expect false.
+        // when leader is 2, we expect true.
+        assertEquals(leader != 1, p.hasAllQuorums());
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumQuotaTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumQuotaTest.java
index 6025a158a3c..ac6319be1bf 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumQuotaTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumQuotaTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.Quotas;
 import org.apache.zookeeper.StatsTrack;
@@ -26,7 +26,7 @@
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.cli.SetQuotaCommand;
 import org.apache.zookeeper.data.Stat;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class QuorumQuotaTest extends QuorumBase {
 
@@ -39,19 +39,23 @@ public void testQuotaWithQuorum() throws Exception {
         for (i = 0; i < 300; i++) {
             zk.create("/a/" + i, "some".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         }
-        SetQuotaCommand.createQuota(zk, "/a", 1000L, 5000);
-        String statPath = Quotas.quotaZookeeper + "/a" + "/" + Quotas.statNode;
+
+        StatsTrack quota = new StatsTrack();
+        quota.setCount(1000);
+        quota.setBytes(5000);
+        SetQuotaCommand.createQuota(zk, "/a", quota);
+        String statPath = Quotas.statPath("/a");
         byte[] data = zk.getData(statPath, false, new Stat());
-        StatsTrack st = new StatsTrack(new String(data));
-        assertTrue("bytes are set", st.getBytes() == 1204L);
-        assertTrue("num count is set", st.getCount() == 301);
+        StatsTrack st = new StatsTrack(data);
+        assertTrue(st.getBytes() == 1204L, "bytes are set");
+        assertTrue(st.getCount() == 301, "num count is set");
         for (i = 300; i < 600; i++) {
             zk.create("/a/" + i, "some".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         }
         data = zk.getData(statPath, false, new Stat());
-        st = new StatsTrack(new String(data));
-        assertTrue("bytes are set", st.getBytes() == 2404L);
-        assertTrue("num count is set", st.getCount() == 601);
+        st = new StatsTrack(data);
+        assertTrue(st.getBytes() == 2404L, "bytes are set");
+        assertTrue(st.getCount() == 601, "num count is set");
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumRestartTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumRestartTest.java
index afdafb790c5..9a3ef6996ab 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumRestartTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumRestartTest.java
@@ -19,12 +19,12 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.client.ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.server.ServerCnxnFactory;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -33,7 +33,7 @@ public class QuorumRestartTest extends ZKTestCase {
     private static final Logger LOG = LoggerFactory.getLogger(QuorumRestartTest.class);
     private QuorumUtil qu;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         System.setProperty(ZOOKEEPER_CLIENT_CNXN_SOCKET, "org.apache.zookeeper.ClientCnxnSocketNetty");
         System.setProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY, "org.apache.zookeeper.server.NettyServerCnxnFactory");
@@ -56,8 +56,8 @@ public void testRollingRestart() throws Exception {
             LOG.info("***** restarting: " + serverToRestart);
             qu.shutdown(serverToRestart);
 
-            assertTrue(String.format("Timeout during waiting for server %d to go down", serverToRestart),
-                    ClientBase.waitForServerDown("127.0.0.1:" + qu.getPeer(serverToRestart).clientPort, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + qu.getPeer(serverToRestart).clientPort, ClientBase.CONNECTION_TIMEOUT),
+                    String.format("Timeout during waiting for server %d to go down", serverToRestart));
 
             qu.restart(serverToRestart);
 
@@ -79,8 +79,8 @@ public void testRollingRestartBackwards() throws Exception {
             LOG.info("***** restarting: " + serverToRestart);
             qu.shutdown(serverToRestart);
 
-            assertTrue(String.format("Timeout during waiting for server %d to go down", serverToRestart),
-                    ClientBase.waitForServerDown("127.0.0.1:" + qu.getPeer(serverToRestart).clientPort, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + qu.getPeer(serverToRestart).clientPort, ClientBase.CONNECTION_TIMEOUT),
+                    String.format("Timeout during waiting for server %d to go down", serverToRestart));
 
             qu.restart(serverToRestart);
 
@@ -104,8 +104,8 @@ public void testRestartingLeaderMultipleTimes() throws Exception {
             LOG.info("***** new leader: " + leaderId);
             qu.shutdown(leaderId);
 
-            assertTrue("Timeout during waiting for current leader to go down",
-                    ClientBase.waitForServerDown("127.0.0.1:" + qu.getPeer(leaderId).clientPort, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown("127.0.0.1:" + qu.getPeer(leaderId).clientPort, ClientBase.CONNECTION_TIMEOUT),
+                    "Timeout during waiting for current leader to go down");
 
             String errorMessage = "No new leader was elected";
             waitFor(errorMessage, () -> qu.leaderExists() && qu.getLeaderServer() != leaderId, 30);
@@ -120,7 +120,7 @@ public void testRestartingLeaderMultipleTimes() throws Exception {
     }
 
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         qu.shutdownAll();
         System.clearProperty(ZOOKEEPER_CLIENT_CNXN_SOCKET);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumTest.java
index c609c5c3fcd..e7e7f99a7bf 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumTest.java
@@ -18,15 +18,16 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.concurrent.TimeoutException;
+import org.apache.zookeeper.AsyncCallback;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.DummyWatcher;
 import org.apache.zookeeper.KeeperException;
@@ -41,10 +42,10 @@
 import org.apache.zookeeper.server.quorum.Leader;
 import org.apache.zookeeper.server.quorum.LearnerHandler;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Ignore;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Disabled;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -57,14 +58,14 @@ public class QuorumTest extends ZKTestCase {
     private final ClientTest ct = new ClientTest();
     private QuorumUtil qu;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         qb.setUp();
         ct.hostPort = qb.hostPort;
         ct.setUpAll();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         ct.tearDownAll();
         qb.tearDown();
@@ -115,12 +116,12 @@ public void testGetView() {
     @Test
     public void testViewContains() {
         // Test view contains self
-        assertTrue(qb.s1.viewContains(qb.s1.getId()));
+        assertTrue(qb.s1.viewContains(qb.s1.getMyId()));
 
         // Test view contains other servers
-        assertTrue(qb.s1.viewContains(qb.s2.getId()));
+        assertTrue(qb.s1.viewContains(qb.s2.getMyId()));
 
-        // Test view does not contain non-existant servers
+        // Test view does not contain non-existent servers
         assertFalse(qb.s1.viewContains(-1L));
     }
 
@@ -178,19 +179,28 @@ public void testLeaderShutdown() throws IOException, InterruptedException, Keepe
 
     @Test
     public void testMultipleWatcherObjs() throws IOException, InterruptedException, KeeperException {
-        ct.testMutipleWatcherObjs();
+        ct.testMultipleWatcherObjs();
     }
 
     /**
-     * Make sure that we can change sessions
-     *  from follower to leader.
-     *
-     * @throws IOException
-     * @throws InterruptedException
-     * @throws KeeperException
+     * Make sure that we can change sessions among servers and maintain consistent view
+     * using {@link ZooKeeper#sync(String)}.
      */
     @Test
-    public void testSessionMoved() throws Exception {
+    public void testSessionMovedWithSynchronousSync() throws Exception {
+        testSessionMoved(true);
+    }
+
+    /**
+     * Make sure that we can change sessions among servers and maintain consistent view
+     * using {@link ZooKeeper#sync(String, AsyncCallback.VoidCallback, Object)}.
+     */
+    @Test
+    public void testSessionMovedWithAsynchronousSync() throws Exception {
+        testSessionMoved(false);
+    }
+
+    public void testSessionMoved(boolean synchronous_sync) throws Exception {
         String[] hostPorts = qb.hostPort.split(",");
         DisconnectableZooKeeper zk = new DisconnectableZooKeeper(
             hostPorts[0],
@@ -208,21 +218,8 @@ public void testSessionMoved() throws Exception {
                 zk.getSessionId(),
                 zk.getSessionPasswd());
             zknew.setData("/", new byte[1], -1);
-            final int[] result = new int[1];
-            result[0] = Integer.MAX_VALUE;
-            zknew.sync("/", (rc, path, ctx) -> {
-                synchronized (result) {
-                    result[0] = rc;
-                    result.notify();
-                }
-            }, null);
-            synchronized (result) {
-                if (result[0] == Integer.MAX_VALUE) {
-                    result.wait(5000);
-                }
-            }
-            LOG.info("{} Sync returned {}", hostPorts[(i + 1) % hostPorts.length], result[0]);
-            assertTrue(result[0] == KeeperException.Code.OK.intValue());
+            syncClient(zknew, synchronous_sync);
+            LOG.info("{} Sync succeed", hostPorts[(i + 1) % hostPorts.length]);
             try {
                 zk.setData("/", new byte[1], -1);
                 fail("Should have lost the connection");
@@ -289,7 +286,7 @@ public void testSessionMovedWithMultiOp() throws Exception {
      * make sure we cannot do any changes.
      */
     @Test
-    @Ignore
+    @Disabled
     public void testSessionMove() throws Exception {
         String[] hps = qb.hostPort.split(",");
         DiscoWatcher oldWatcher = new DiscoWatcher();
@@ -314,7 +311,7 @@ public void testSessionMove() throws Exception {
             assertTrue(oldWatcher.zkDisco);
         }
 
-        ArrayList<ZooKeeper> toClose = new ArrayList<ZooKeeper>();
+        ArrayList<ZooKeeper> toClose = new ArrayList<>();
         toClose.add(zknew);
         // Let's just make sure it can still move
         for (int i = 0; i < 10; i++) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumUtil.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumUtil.java
index f7935851900..865d82b0c7c 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumUtil.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumUtil.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.IOException;
 import java.net.InetSocketAddress;
@@ -65,9 +65,9 @@ public static class PeerStruct {
 
     }
 
-    private final Map<Long, QuorumServer> peersView = new HashMap<Long, QuorumServer>();
+    private final Map<Long, QuorumServer> peersView = new HashMap<>();
 
-    private final Map<Integer, PeerStruct> peers = new HashMap<Integer, PeerStruct>();
+    private final Map<Integer, PeerStruct> peers = new HashMap<>();
 
     public final int N;
 
@@ -152,7 +152,7 @@ public void startAll() throws IOException {
 
         LOG.info("Checking ports {}", hostPort);
         for (String hp : hostPort.split(",")) {
-            assertTrue("waiting for server " + hp + " up", ClientBase.waitForServerUp(hp, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp(hp, ClientBase.CONNECTION_TIMEOUT), "waiting for server " + hp + " up");
             LOG.info("{} is accepting client connections", hp);
         }
 
@@ -165,7 +165,7 @@ public void startAll() throws IOException {
         try {
             JMXEnv.dump();
             // make sure we have all servers listed
-            Set<String> ensureNames = new LinkedHashSet<String>();
+            Set<String> ensureNames = new LinkedHashSet<>();
             for (int i = 1; i <= ALL; ++i) {
                 ensureNames.add("InMemoryDataTree");
             }
@@ -198,8 +198,8 @@ public void startQuorum() throws IOException {
         }
         for (int i = 1; i <= N + 1; ++i) {
             assertTrue(
-                    "Waiting for server up",
-                    ClientBase.waitForServerUp("127.0.0.1:" + getPeer(i).clientPort, ClientBase.CONNECTION_TIMEOUT));
+                    ClientBase.waitForServerUp("127.0.0.1:" + getPeer(i).clientPort, ClientBase.CONNECTION_TIMEOUT),
+                    "Waiting for server up");
         }
     }
 
@@ -218,8 +218,8 @@ public void start(int id) throws IOException {
     public void restart(int id) throws IOException {
         start(id);
         assertTrue(
-                "Waiting for server up",
-                ClientBase.waitForServerUp("127.0.0.1:" + getPeer(id).clientPort, ClientBase.CONNECTION_TIMEOUT));
+                ClientBase.waitForServerUp("127.0.0.1:" + getPeer(id).clientPort, ClientBase.CONNECTION_TIMEOUT),
+                "Waiting for server up");
     }
 
     public void startThenShutdown(int id) throws IOException {
@@ -233,8 +233,8 @@ public void startThenShutdown(int id) throws IOException {
 
         ps.peer.start();
         assertTrue(
-                "Waiting for server up",
-                ClientBase.waitForServerUp("127.0.0.1:" + getPeer(id).clientPort, ClientBase.CONNECTION_TIMEOUT));
+                ClientBase.waitForServerUp("127.0.0.1:" + getPeer(id).clientPort, ClientBase.CONNECTION_TIMEOUT),
+                "Waiting for server up");
         shutdown(id);
     }
 
@@ -243,7 +243,7 @@ public void shutdownAll() {
             shutdown(i);
         }
         for (String hp : hostPort.split(",")) {
-            assertTrue("Waiting for server down", ClientBase.waitForServerDown(hp, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown(hp, ClientBase.CONNECTION_TIMEOUT), "Waiting for server down");
             LOG.info("{} is no longer accepting client connections", hp);
         }
     }
@@ -251,22 +251,22 @@ public void shutdownAll() {
     public void shutdown(int id) {
         QuorumPeer qp = getPeer(id).peer;
         try {
-            LOG.info("Shutting down quorum peer {}", qp.getName());
+            LOG.info("Shutting down quorum peer {} with id {}", qp.getName(), id);
             qp.shutdown();
             Election e = qp.getElectionAlg();
             if (e != null) {
-                LOG.info("Shutting down leader election {}", qp.getName());
+                LOG.info("Shutting down leader election {} with id {}", qp.getName(), id);
                 e.shutdown();
             } else {
-                LOG.info("No election available to shutdown {}", qp.getName());
+                LOG.info("No election available to shutdown {} with id {}", qp.getName(), id);
             }
-            LOG.info("Waiting for {} to exit thread", qp.getName());
+            LOG.info("Waiting for {} with id {} to exit thread", qp.getName(), id);
             qp.join(30000);
             if (qp.isAlive()) {
-                fail("QP failed to shutdown in 30 seconds: " + qp.getName());
+                fail("QP failed to shutdown in 30 seconds: " + qp.getName() + " " + id);
             }
         } catch (InterruptedException e) {
-            LOG.debug("QP interrupted: {}", qp.getName(), e);
+            LOG.debug("QP interrupted: {} {}", qp.getName(), id, e);
         }
     }
 
@@ -294,7 +294,7 @@ public QuorumPeer getLeaderQuorumPeer() {
     }
 
     public List<QuorumPeer> getFollowerQuorumPeers() {
-        List<QuorumPeer> peerList = new ArrayList<QuorumPeer>(ALL - 1);
+        List<QuorumPeer> peerList = new ArrayList<>(ALL - 1);
 
         for (PeerStruct ps : peers.values()) {
             if (ps.peer.leader == null) {
@@ -326,7 +326,7 @@ public int getLeaderServer() {
             }
         }
 
-        assertTrue("Leader server not found.", index > 0);
+        assertTrue(index > 0, "Leader server not found.");
         return index;
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumUtilTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumUtilTest.java
index d02fbd69354..b8ce7f2a6e3 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumUtilTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumUtilTest.java
@@ -18,20 +18,20 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.Set;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.jmx.MBeanRegistry;
 import org.apache.zookeeper.jmx.ZKMBeanInfo;
 import org.apache.zookeeper.server.quorum.QuorumPeer;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 /**
- * This class is intented to ensure the correct functionality of
+ * This class is intended to ensure the correct functionality of
  * {@link QuorumUtil} helper.
  */
 public class QuorumUtilTest extends ZKTestCase {
@@ -41,8 +41,8 @@ public class QuorumUtilTest extends ZKTestCase {
     /**
      * <p>
      * This test ensures that all JXM beans associated to a {@link QuorumPeer}
-     * are unregistered when shuted down ({@link QuorumUtil#shutdown(int)}). It
-     * allows a successfull restarting of several zookeeper servers (
+     * are unregistered when shut down ({@link QuorumUtil#shutdown(int)}). It
+     * allows a successful restarting of several zookeeper servers (
      * {@link QuorumPeer}) running on the same JVM.
      * <p>
      * See ZOOKEEPER-1214 for details.
@@ -77,9 +77,9 @@ public void validateAllMXBeanAreUnregistered() throws IOException {
             break;
         }
 
-        LOG.info(">-->> Shuting down server [{}]", firstFollowerIndex);
+        LOG.info(">-->> Shutting down server [{}]", firstFollowerIndex);
         qU.shutdown(firstFollowerIndex);
-        LOG.info(">-->> Shuting down server [{}]", secondFollowerIndex);
+        LOG.info(">-->> Shutting down server [{}]", secondFollowerIndex);
         qU.shutdown(secondFollowerIndex);
         LOG.info(">-->> Restarting server [{}]", firstFollowerIndex);
         qU.restart(firstFollowerIndex);
@@ -88,7 +88,7 @@ public void validateAllMXBeanAreUnregistered() throws IOException {
 
         qU.shutdownAll();
         Set<ZKMBeanInfo> pending = MBeanRegistry.getInstance().getRegisteredBeans();
-        assertTrue("The following beans should have been unregistered: " + pending, pending.isEmpty());
+        assertTrue(pending.isEmpty(), "The following beans should have been unregistered: " + pending);
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumZxidSyncTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumZxidSyncTest.java
index 80d2b9c64bb..c4c0bdee747 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumZxidSyncTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuorumZxidSyncTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.IOException;
 import org.apache.zookeeper.CreateMode;
@@ -27,15 +27,15 @@
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class QuorumZxidSyncTest extends ZKTestCase {
 
     QuorumBase qb = new QuorumBase();
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         qb.setUp();
     }
@@ -79,10 +79,10 @@ public void testBehindLeader() throws Exception {
         qb.s2.start();
         qb.s3.start();
         qb.s4.start();
-        assertTrue("Servers didn't come up", ClientBase.waitForServerUp(qb.hostPort, 10000));
+        assertTrue(ClientBase.waitForServerUp(qb.hostPort, 10000), "Servers didn't come up");
         qb.s5.start();
         String hostPort = "127.0.0.1:" + qb.s5.getClientPort();
-        assertFalse("Servers came up, but shouldn't have since it's ahead of leader", ClientBase.waitForServerUp(hostPort, 10000));
+        assertFalse(ClientBase.waitForServerUp(hostPort, 10000), "Servers came up, but shouldn't have since it's ahead of leader");
     }
 
     private void cleanAndInitializeDataDir(File f) throws IOException {
@@ -139,7 +139,7 @@ public void testLateLogs() throws Exception {
             }
         }
         zk.close();
-        assertTrue("Didn't see /2 (went back in time)", saw2);
+        assertTrue(saw2, "Didn't see /2 (went back in time)");
     }
 
     private void deleteLogs(File f) {
@@ -151,7 +151,7 @@ private void deleteLogs(File f) {
         }
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         qb.tearDown();
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuotasTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuotasTest.java
new file mode 100644
index 00000000000..b887e28fbaf
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/QuotasTest.java
@@ -0,0 +1,50 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import static org.junit.Assert.assertEquals;
+import org.apache.zookeeper.Quotas;
+import org.junit.Test;
+
+public class QuotasTest {
+
+    @Test
+    public void testStatPath() {
+        assertEquals("/zookeeper/quota/foo/zookeeper_stats", Quotas.statPath("/foo"));
+        assertEquals("/zookeeper/quota/bar/zookeeper_stats", Quotas.statPath("/bar"));
+    }
+
+    @Test
+    public void testLimitPath() {
+        assertEquals("/zookeeper/quota/foo/zookeeper_limits", Quotas.limitPath("/foo"));
+        assertEquals("/zookeeper/quota/bar/zookeeper_limits", Quotas.limitPath("/bar"));
+    }
+
+    @Test
+    public void testQuotaPathPath() {
+        assertEquals("/zookeeper/quota/bar", Quotas.quotaPath("/bar"));
+        assertEquals("/zookeeper/quota/foo", Quotas.quotaPath("/foo"));
+    }
+
+    @Test
+    public void testTrimQuotaPath() {
+        assertEquals("/foo", Quotas.trimQuotaPath("/zookeeper/quota/foo"));
+        assertEquals("/bar", Quotas.trimQuotaPath("/zookeeper/quota/bar"));
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java
index 0bef4c14aad..1a95372c42a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeTest.java
@@ -18,20 +18,17 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertSame;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.ByteArrayOutputStream;
 import java.io.LineNumberReader;
 import java.io.StringReader;
+import java.util.concurrent.TimeoutException;
 import java.util.regex.Pattern;
-import org.apache.log4j.Layout;
-import org.apache.log4j.Level;
-import org.apache.log4j.Logger;
-import org.apache.log4j.WriterAppender;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.KeeperException.NotReadOnlyException;
@@ -40,11 +37,13 @@
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.ZooKeeper.States;
+import org.apache.zookeeper.common.StringUtils;
 import org.apache.zookeeper.common.Time;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 import org.slf4j.LoggerFactory;
 
 public class ReadOnlyModeTest extends ZKTestCase {
@@ -53,13 +52,12 @@ public class ReadOnlyModeTest extends ZKTestCase {
     private static int CONNECTION_TIMEOUT = QuorumBase.CONNECTION_TIMEOUT;
     private QuorumUtil qu = new QuorumUtil(1);
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         System.setProperty("readonlymode.enabled", "true");
-        qu.startQuorum();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         System.setProperty("readonlymode.enabled", "false");
         qu.tearDown();
@@ -68,8 +66,12 @@ public void tearDown() throws Exception {
     /**
      * Test write operations using multi request.
      */
-    @Test(timeout = 90000)
+    @Test
+    @Timeout(value = 90)
     public void testMultiTransaction() throws Exception {
+        qu.enableLocalSession(true);
+        qu.startQuorum();
+
         CountdownWatcher watcher = new CountdownWatcher();
         ZooKeeper zk = new ZooKeeper(qu.getConnString(), CONNECTION_TIMEOUT, watcher, true);
         watcher.waitForConnected(CONNECTION_TIMEOUT); // ensure zk got connected
@@ -78,15 +80,18 @@ public void testMultiTransaction() throws Exception {
         final String node1 = "/tnode1";
         final String node2 = "/tnode2";
         zk.create(node1, data.getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk.close();
+        watcher.waitForDisconnected(CONNECTION_TIMEOUT);
 
         watcher.reset();
         qu.shutdown(2);
+        zk = new ZooKeeper(qu.getConnString(), CONNECTION_TIMEOUT, watcher, true);
         watcher.waitForConnected(CONNECTION_TIMEOUT);
-        assertEquals("Should be in r-o mode", States.CONNECTEDREADONLY, zk.getState());
+        assertEquals(States.CONNECTEDREADONLY, zk.getState(), "Should be in r-o mode");
 
         // read operation during r/o mode
         String remoteData = new String(zk.getData(node1, false, null));
-        assertEquals("Failed to read data in r-o mode", data, remoteData);
+        assertEquals(data, remoteData, "Failed to read data in r-o mode");
 
         try {
             Transaction transaction = zk.transaction();
@@ -98,15 +103,19 @@ public void testMultiTransaction() throws Exception {
             // ok
         }
 
-        assertNull("Should have created the znode:" + node2, zk.exists(node2, false));
+        assertNull(zk.exists(node2, false), "Should have created the znode:" + node2);
     }
 
     /**
      * Basic test of read-only client functionality. Tries to read and write
      * during read-only mode, then regains a quorum and tries to write again.
      */
-    @Test(timeout = 90000)
+    @Test
+    @Timeout(value = 90)
     public void testReadOnlyClient() throws Exception {
+        qu.enableLocalSession(true);
+        qu.startQuorum();
+
         CountdownWatcher watcher = new CountdownWatcher();
         ZooKeeper zk = new ZooKeeper(qu.getConnString(), CONNECTION_TIMEOUT, watcher, true);
         watcher.waitForConnected(CONNECTION_TIMEOUT); // ensure zk got connected
@@ -137,9 +146,8 @@ public void testReadOnlyClient() throws Exception {
 
         watcher.reset();
         qu.start(2);
-        assertTrue(
-                "waiting for server up",
-                ClientBase.waitForServerUp("127.0.0.1:" + qu.getPeer(2).clientPort, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + qu.getPeer(2).clientPort, CONNECTION_TIMEOUT),
+            "waiting for server up");
         zk.close();
         watcher.reset();
 
@@ -156,8 +164,12 @@ public void testReadOnlyClient() throws Exception {
      * Ensures that upon connection to a read-only server client receives
      * ConnectedReadOnly state notification.
      */
-    @Test(timeout = 90000)
+    @Test
+    @Timeout(value = 90)
     public void testConnectionEvents() throws Exception {
+        qu.enableLocalSession(true);
+        qu.startQuorum();
+
         CountdownWatcher watcher = new CountdownWatcher();
         ZooKeeper zk = new ZooKeeper(qu.getConnString(), CONNECTION_TIMEOUT, watcher, true);
         boolean success = false;
@@ -170,8 +182,8 @@ public void testConnectionEvents() throws Exception {
                 Thread.sleep(1000);
             }
         }
-        assertTrue("Did not succeed in connecting in 30s", success);
-        assertFalse("The connection should not be read-only yet", watcher.readOnlyConnected);
+        assertTrue(success, "Did not succeed in connecting in 30s");
+        assertFalse(watcher.readOnlyConnected, "The connection should not be read-only yet");
 
         // kill peer and wait no more than 5 seconds for read-only server
         // to be started (which should take one tickTime (2 seconds))
@@ -179,12 +191,13 @@ public void testConnectionEvents() throws Exception {
 
         // Re-connect the client (in case we were connected to the shut down
         // server and the local session was not persisted).
+        watcher = new CountdownWatcher();
         zk = new ZooKeeper(qu.getConnString(), CONNECTION_TIMEOUT, watcher, true);
         long start = Time.currentElapsedTime();
         while (!(zk.getState() == States.CONNECTEDREADONLY)) {
             Thread.sleep(200);
             // TODO this was originally 5 seconds, but realistically, on random/slow/virt hosts, there is no way to guarantee this
-            assertTrue("Can't connect to the server", Time.currentElapsedTime() - start < 30000);
+            assertTrue(Time.currentElapsedTime() - start < 30000, "Can't connect to the server");
         }
 
         watcher.waitForReadOnlyConnected(5000);
@@ -196,22 +209,25 @@ public void testConnectionEvents() throws Exception {
      * then connects to a majority server. Transition should be transparent for
      * the user.
      */
-    @Test(timeout = 90000)
+    @Test
+    @Timeout(value = 90)
     public void testSessionEstablishment() throws Exception {
+        qu.enableLocalSession(true);
+        qu.startQuorum();
+
         qu.shutdown(2);
 
         CountdownWatcher watcher = new CountdownWatcher();
         ZooKeeper zk = new ZooKeeper(qu.getConnString(), CONNECTION_TIMEOUT, watcher, true);
         watcher.waitForConnected(CONNECTION_TIMEOUT);
-        assertSame("should be in r/o mode", States.CONNECTEDREADONLY, zk.getState());
+        assertSame(States.CONNECTEDREADONLY, zk.getState(), "should be in r/o mode");
         long fakeId = zk.getSessionId();
         LOG.info("Connected as r/o mode with state {} and session id {}", zk.getState(), fakeId);
 
         watcher.reset();
         qu.start(2);
-        assertTrue(
-                "waiting for server up",
-                ClientBase.waitForServerUp("127.0.0.1:" + qu.getPeer(2).clientPort, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + qu.getPeer(2).clientPort, CONNECTION_TIMEOUT),
+            "waiting for server up");
         LOG.info("Server 127.0.0.1:{} is up", qu.getPeer(2).clientPort);
         // ZOOKEEPER-2722: wait until we can connect to a read-write server after the quorum
         // is formed. Otherwise, it is possible that client first connects to a read-only server,
@@ -220,10 +236,48 @@ public void testSessionEstablishment() throws Exception {
         // server. If we happen to execute the zk.create after the read-only server is shutdown and
         // before the quorum is formed, we will get a ConnectLossException.
         watcher.waitForSyncConnected(CONNECTION_TIMEOUT);
-        assertEquals("Should be in read-write mode", States.CONNECTED, zk.getState());
+        assertEquals(States.CONNECTED, zk.getState(), "Should be in read-write mode");
         LOG.info("Connected as rw mode with state {} and session id {}", zk.getState(), zk.getSessionId());
         zk.create("/test", "test".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        assertFalse("fake session and real session have same id", zk.getSessionId() == fakeId);
+        assertFalse(zk.getSessionId() == fakeId, "fake session and real session have same id");
+        zk.close();
+    }
+
+    @Test
+    @Timeout(value = 90)
+    public void testGlobalSessionInRO() throws Exception {
+        qu.startQuorum();
+
+        CountdownWatcher watcher = new CountdownWatcher();
+        ZooKeeper zk = new ZooKeeper(qu.getConnString(), CONNECTION_TIMEOUT, watcher, true);
+        watcher.waitForConnected(CONNECTION_TIMEOUT);
+        LOG.info("global session created 0x{}", Long.toHexString(zk.getSessionId()));
+
+        watcher.reset();
+        qu.shutdown(2);
+        try {
+            watcher.waitForConnected(CONNECTION_TIMEOUT);
+            fail("Should not be able to renew a global session");
+        } catch (TimeoutException e) {
+        }
+        zk.close();
+
+        watcher.reset();
+        zk = new ZooKeeper(qu.getConnString(), CONNECTION_TIMEOUT, watcher, true);
+        try {
+            watcher.waitForConnected(CONNECTION_TIMEOUT);
+            fail("Should not be able to create a global session");
+        } catch (TimeoutException e) {
+        }
+        zk.close();
+
+        qu.getPeer(1).peer.enableLocalSessions(true);
+        zk = new ZooKeeper(qu.getConnString(), CONNECTION_TIMEOUT, watcher, true);
+        try {
+            watcher.waitForConnected(CONNECTION_TIMEOUT);
+        } catch (TimeoutException e) {
+            fail("Should be able to create a local session");
+        }
         zk.close();
     }
 
@@ -231,26 +285,23 @@ public void testSessionEstablishment() throws Exception {
      * Ensures that client seeks for r/w servers while it's connected to r/o
      * server.
      */
-    @SuppressWarnings("deprecation")
-    @Test(timeout = 90000)
+    @Test
+    @Timeout(value = 90)
     public void testSeekForRwServer() throws Exception {
-        // setup the logger to capture all logs
-        Layout layout = Logger.getRootLogger().getAppender("CONSOLE").getLayout();
-        ByteArrayOutputStream os = new ByteArrayOutputStream();
-        WriterAppender appender = new WriterAppender(layout, os);
-        appender.setImmediateFlush(true);
-        appender.setThreshold(Level.INFO);
-        Logger zlogger = Logger.getLogger("org.apache.zookeeper");
-        zlogger.addAppender(appender);
+        qu.enableLocalSession(true);
+        qu.startQuorum();
+
+        try (LoggerTestTool loggerTestTool = new LoggerTestTool("org.apache.zookeeper")) {
+            ByteArrayOutputStream os = loggerTestTool.getOutputStream();
 
-        try {
             qu.shutdown(2);
             CountdownWatcher watcher = new CountdownWatcher();
             ZooKeeper zk = new ZooKeeper(qu.getConnString(), CONNECTION_TIMEOUT, watcher, true);
             watcher.waitForConnected(CONNECTION_TIMEOUT);
 
             // if we don't suspend a peer it will rejoin a quorum
-            qu.getPeer(1).peer.suspend();
+            qu.getPeer(1).peer
+                    .setSuspended(true);
 
             // start two servers to form a quorum; client should detect this and
             // connect to one of them
@@ -262,23 +313,23 @@ public void testSeekForRwServer() throws Exception {
             zk.create("/test", "test".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
             // resume poor fellow
-            qu.getPeer(1).peer.resume();
-        } finally {
-            zlogger.removeAppender(appender);
-        }
-
-        os.close();
-        LineNumberReader r = new LineNumberReader(new StringReader(os.toString()));
-        String line;
-        Pattern p = Pattern.compile(".*Majority server found.*");
-        boolean found = false;
-        while ((line = r.readLine()) != null) {
-            if (p.matcher(line).matches()) {
-                found = true;
-                break;
+            qu.getPeer(1).peer
+                    .setSuspended(false);
+
+            String log = os.toString();
+            assertFalse(StringUtils.isEmpty(log), "OutputStream doesn't have any log messages");
+
+            LineNumberReader r = new LineNumberReader(new StringReader(log));
+            String line;
+            Pattern p = Pattern.compile(".*Majority server found.*");
+            boolean found = false;
+            while ((line = r.readLine()) != null) {
+                if (p.matcher(line).matches()) {
+                    found = true;
+                    break;
+                }
             }
+            assertTrue(found, "Majority server wasn't found while connected to r/o server");
         }
-        assertTrue("Majority server wasn't found while connected to r/o server", found);
     }
-
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeWithSSLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeWithSSLTest.java
new file mode 100644
index 00000000000..701cd0f6d72
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReadOnlyModeWithSSLTest.java
@@ -0,0 +1,137 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.io.ByteArrayOutputStream;
+import java.io.LineNumberReader;
+import java.io.StringReader;
+import java.util.regex.Pattern;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.client.ZKClientConfig;
+import org.apache.zookeeper.common.ClientX509Util;
+import org.apache.zookeeper.common.StringUtils;
+import org.apache.zookeeper.server.NettyServerCnxnFactory;
+import org.apache.zookeeper.server.ServerCnxnFactory;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
+
+public class ReadOnlyModeWithSSLTest extends ZKTestCase {
+
+    private static int CONNECTION_TIMEOUT = QuorumBase.CONNECTION_TIMEOUT;
+    private QuorumUtil qu = new QuorumUtil(1);
+    private ClientX509Util clientX509Util;
+    private ZKClientConfig clientConfig;
+
+    @BeforeEach
+    public void setUp() throws Exception {
+        clientX509Util = new ClientX509Util();
+        String testDataPath = System.getProperty("test.data.dir", "src/test/resources/data");
+        clientConfig = new ZKClientConfig();
+        clientConfig.setProperty(ZKClientConfig.SECURE_CLIENT, "true");
+        clientConfig.setProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET, "org.apache.zookeeper.ClientCnxnSocketNetty");
+        clientConfig.setProperty(clientX509Util.getSslKeystoreLocationProperty(), testDataPath + "/ssl/testKeyStore.jks");
+        clientConfig.setProperty(clientX509Util.getSslKeystorePasswdProperty(), "testpass");
+        clientConfig.setProperty(clientX509Util.getSslTruststoreLocationProperty(), testDataPath + "/ssl/testTrustStore.jks");
+        clientConfig.setProperty(clientX509Util.getSslTruststorePasswdProperty(), "testpass");
+        System.setProperty("readonlymode.enabled", "true");
+        System.setProperty(NettyServerCnxnFactory.PORT_UNIFICATION_KEY, Boolean.TRUE.toString());
+        System.setProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY, "org.apache.zookeeper.server.NettyServerCnxnFactory");
+        System.setProperty(clientX509Util.getSslKeystoreLocationProperty(), testDataPath + "/ssl/testKeyStore.jks");
+        System.setProperty(clientX509Util.getSslKeystorePasswdProperty(), "testpass");
+        System.setProperty(clientX509Util.getSslTruststoreLocationProperty(), testDataPath + "/ssl/testTrustStore.jks");
+        System.setProperty(clientX509Util.getSslTruststorePasswdProperty(), "testpass");
+    }
+
+    @AfterEach
+    public void tearDown() throws Exception {
+        System.clearProperty(NettyServerCnxnFactory.PORT_UNIFICATION_KEY);
+        System.clearProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY);
+        System.clearProperty(clientX509Util.getSslKeystoreLocationProperty());
+        System.clearProperty(clientX509Util.getSslKeystorePasswdProperty());
+        System.clearProperty(clientX509Util.getSslKeystorePasswdPathProperty());
+        System.clearProperty(clientX509Util.getSslTruststoreLocationProperty());
+        System.clearProperty(clientX509Util.getSslTruststorePasswdProperty());
+        System.clearProperty(clientX509Util.getSslTruststorePasswdPathProperty());
+        System.clearProperty(clientX509Util.getFipsModeProperty());
+        System.clearProperty(clientX509Util.getSslHostnameVerificationEnabledProperty());
+        System.clearProperty(clientX509Util.getSslProviderProperty());
+        clientX509Util.close();
+        System.setProperty("readonlymode.enabled", "false");
+        qu.tearDown();
+    }
+
+    /**
+     * Ensures that client seeks for r/w servers while it's connected to r/o
+     * server.
+     */
+    @Test
+    @Timeout(value = 90)
+    public void testSeekForRwServerWithSSL() throws Exception {
+        qu.enableLocalSession(true);
+        qu.startQuorum();
+
+        try (LoggerTestTool loggerTestTool = new LoggerTestTool("org.apache.zookeeper")) {
+            ByteArrayOutputStream os = loggerTestTool.getOutputStream();
+
+            qu.shutdown(2);
+            ClientBase.CountdownWatcher watcher = new ClientBase.CountdownWatcher();
+            ZooKeeper zk = new ZooKeeper(qu.getConnString(), CONNECTION_TIMEOUT, watcher, true, clientConfig);
+            watcher.waitForConnected(CONNECTION_TIMEOUT);
+
+            // if we don't suspend a peer it will rejoin a quorum
+            qu.getPeer(1).peer
+                    .setSuspended(true);
+
+            // start two servers to form a quorum; client should detect this and
+            // connect to one of them
+            watcher.reset();
+            qu.start(2);
+            qu.start(3);
+            ClientBase.waitForServerUp(qu.getConnString(), 2000);
+            watcher.waitForConnected(CONNECTION_TIMEOUT);
+            zk.create("/test", "test".getBytes(), ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+            // resume poor fellow
+            qu.getPeer(1).peer
+                    .setSuspended(false);
+
+            String log = os.toString();
+            assertFalse(StringUtils.isEmpty(log), "OutputStream doesn't have any log messages");
+
+            LineNumberReader r = new LineNumberReader(new StringReader(log));
+            String line;
+            Pattern p = Pattern.compile(".*Majority server found.*");
+            boolean found = false;
+            while ((line = r.readLine()) != null) {
+                if (p.matcher(line).matches()) {
+                    found = true;
+                    break;
+                }
+            }
+            assertTrue(found, "Majority server wasn't found while connected to r/o server");
+        }
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigExceptionTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigExceptionTest.java
index e2cc2a5447d..0d247a99a05 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigExceptionTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigExceptionTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Collections;
@@ -34,9 +34,10 @@
 import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -47,14 +48,14 @@ public class ReconfigExceptionTest extends ZKTestCase {
     // Use DigestAuthenticationProvider.base64Encode or
     // run ZooKeeper jar with org.apache.zookeeper.server.auth.DigestAuthenticationProvider to generate password.
     // An example:
-    // java -cp zookeeper-3.6.0-SNAPSHOT.jar:lib/log4j-1.2.17.jar:lib/slf4j-log4j12-1.7.5.jar:
-    // lib/slf4j-api-1.7.5.jar org.apache.zookeeper.server.auth.DigestAuthenticationProvider super:test
+    // CLASSPATH='lib/*:conf' java
+    // org.apache.zookeeper.server.auth.DigestAuthenticationProvider super:test
     // The password here is 'test'.
     private static String superDigest = "super:D/InIHSb7yEEbrWz8b9l71RjZJU=";
     private QuorumUtil qu;
     private ZooKeeperAdmin zkAdmin;
 
-    @Before
+    @BeforeEach
     public void setup() throws InterruptedException {
         System.setProperty(authProvider, superDigest);
         QuorumPeerConfig.setReconfigEnabled(true);
@@ -72,7 +73,7 @@ public void setup() throws InterruptedException {
         resetZKAdmin();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         System.clearProperty(authProvider);
         try {
@@ -87,9 +88,20 @@ public void tearDown() throws Exception {
         }
     }
 
-    @Test(timeout = 10000)
+    @Test
+    @Timeout(value = 10)
     public void testReconfigDisabled() throws InterruptedException {
         QuorumPeerConfig.setReconfigEnabled(false);
+
+        // for this test we need to restart the quorum peers to get the config change,
+        // as in the setup() we started the quorum with reconfigEnabled=true
+        qu.shutdownAll();
+        try {
+            qu.startAll();
+        } catch (IOException e) {
+            fail("Fail to start quorum servers.");
+        }
+
         try {
             reconfigPort();
             fail("Reconfig should be disabled.");
@@ -98,7 +110,8 @@ public void testReconfigDisabled() throws InterruptedException {
         }
     }
 
-    @Test(timeout = 10000)
+    @Test
+    @Timeout(value = 10)
     public void testReconfigFailWithoutAuth() throws InterruptedException {
         try {
             reconfigPort();
@@ -109,7 +122,8 @@ public void testReconfigFailWithoutAuth() throws InterruptedException {
         }
     }
 
-    @Test(timeout = 10000)
+    @Test
+    @Timeout(value = 10)
     public void testReconfigEnabledWithSuperUser() throws InterruptedException {
         try {
             zkAdmin.addAuthInfo("digest", "super:test".getBytes());
@@ -119,7 +133,8 @@ public void testReconfigEnabledWithSuperUser() throws InterruptedException {
         }
     }
 
-    @Test(timeout = 10000)
+    @Test
+    @Timeout(value = 10)
     public void testReconfigFailWithAuthWithNoACL() throws InterruptedException {
         resetZKAdmin();
 
@@ -133,14 +148,15 @@ public void testReconfigFailWithAuthWithNoACL() throws InterruptedException {
         }
     }
 
-    @Test(timeout = 10000)
+    @Test
+    @Timeout(value = 10)
     public void testReconfigEnabledWithAuthAndWrongACL() throws InterruptedException {
         resetZKAdmin();
 
         try {
             zkAdmin.addAuthInfo("digest", "super:test".getBytes());
             // There is ACL however the permission is wrong - need WRITE permission at leaste.
-            ArrayList<ACL> acls = new ArrayList<ACL>(Collections.singletonList(new ACL(ZooDefs.Perms.READ, new Id("digest", "user:tl+z3z0vO6PfPfEENfLF96E6pM0="/* password is test */))));
+            ArrayList<ACL> acls = new ArrayList<>(Collections.singletonList(new ACL(ZooDefs.Perms.READ, new Id("digest", "user:tl+z3z0vO6PfPfEENfLF96E6pM0="/* password is test */))));
             zkAdmin.setACL(ZooDefs.CONFIG_NODE, acls, -1);
             resetZKAdmin();
             zkAdmin.addAuthInfo("digest", "user:test".getBytes());
@@ -151,13 +167,14 @@ public void testReconfigEnabledWithAuthAndWrongACL() throws InterruptedException
         }
     }
 
-    @Test(timeout = 10000)
+    @Test
+    @Timeout(value = 10)
     public void testReconfigEnabledWithAuthAndACL() throws InterruptedException {
         resetZKAdmin();
 
         try {
             zkAdmin.addAuthInfo("digest", "super:test".getBytes());
-            ArrayList<ACL> acls = new ArrayList<ACL>(Collections.singletonList(new ACL(ZooDefs.Perms.WRITE, new Id("digest", "user:tl+z3z0vO6PfPfEENfLF96E6pM0="/* password is test */))));
+            ArrayList<ACL> acls = new ArrayList<>(Collections.singletonList(new ACL(ZooDefs.Perms.WRITE, new Id("digest", "user:tl+z3z0vO6PfPfEENfLF96E6pM0="/* password is test */))));
             zkAdmin.setACL(ZooDefs.CONFIG_NODE, acls, -1);
             resetZKAdmin();
             zkAdmin.addAuthInfo("digest", "user:test".getBytes());
@@ -191,7 +208,7 @@ private void resetZKAdmin() throws InterruptedException {
     }
 
     private boolean reconfigPort() throws KeeperException, InterruptedException {
-        List<String> joiningServers = new ArrayList<String>();
+        List<String> joiningServers = new ArrayList<>();
         int leaderId = 1;
         while (qu.getPeer(leaderId).peer.leader == null) {
             leaderId++;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigMisconfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigMisconfigTest.java
index 7fb675a4cfe..712497f3586 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigMisconfigTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigMisconfigTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.List;
@@ -30,9 +30,10 @@
 import org.apache.zookeeper.admin.ZooKeeperAdmin;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -44,7 +45,7 @@ public class ReconfigMisconfigTest extends ZKTestCase {
     private static String errorMsg = "Reconfig should fail without configuring the super "
                                      + "user's password on server side first.";
 
-    @Before
+    @BeforeEach
     public void setup() throws InterruptedException {
         QuorumPeerConfig.setReconfigEnabled(true);
         // Get a three server quorum.
@@ -59,7 +60,7 @@ public void setup() throws InterruptedException {
         instantiateZKAdmin();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         try {
             if (qu != null) {
@@ -73,7 +74,8 @@ public void tearDown() throws Exception {
         }
     }
 
-    @Test(timeout = 10000)
+    @Test
+    @Timeout(value = 10)
     public void testReconfigFailWithoutSuperuserPasswordConfiguredOnServer() throws InterruptedException {
         // This tests the case where ZK ensemble does not have the super user's password configured.
         // Reconfig should fail as the super user has to be explicitly configured via
@@ -113,7 +115,7 @@ private void instantiateZKAdmin() throws InterruptedException {
     }
 
     private boolean reconfigPort() throws KeeperException, InterruptedException {
-        List<String> joiningServers = new ArrayList<String>();
+        List<String> joiningServers = new ArrayList<>();
         int leaderId = 1;
         while (qu.getPeer(leaderId).peer.leader == null) {
             leaderId++;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigTest.java
index 8642b368d9c..1615be17242 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ReconfigTest.java
@@ -22,10 +22,10 @@
 import static java.lang.String.format;
 import static java.net.InetAddress.getLoopbackAddress;
 import static java.util.stream.Collectors.toList;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
@@ -58,9 +58,9 @@
 import org.apache.zookeeper.server.quorum.flexible.QuorumHierarchical;
 import org.apache.zookeeper.server.quorum.flexible.QuorumMaj;
 import org.apache.zookeeper.server.quorum.flexible.QuorumVerifier;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -72,13 +72,13 @@ public class ReconfigTest extends ZKTestCase implements DataCallback {
     private ZooKeeper[] zkArr;
     private ZooKeeperAdmin[] zkAdminArr;
 
-    @Before
+    @BeforeEach
     public void setup() {
         System.setProperty("zookeeper.DigestAuthenticationProvider.superDigest", "super:D/InIHSb7yEEbrWz8b9l71RjZJU="/* password is 'test'*/);
         QuorumPeerConfig.setReconfigEnabled(true);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         closeAllHandles(zkArr, zkAdminArr);
         if (qu != null) {
@@ -123,13 +123,13 @@ public static String reconfig(
                 ServerConfigLine joinerServerConfigLine = new ServerConfigLine(joiner);
 
                 String errorMessage = format("expected joiner config \"%s\" not found in current config:\n%s", joiner, configStr);
-                assertTrue(errorMessage, currentServerConfigs.stream().anyMatch(c -> c.equals(joinerServerConfigLine)));
+                assertTrue(currentServerConfigs.stream().anyMatch(c -> c.equals(joinerServerConfigLine)), errorMessage);
             }
         }
         if (leavingServers != null) {
             for (String leaving : leavingServers) {
                 String errorMessage = format("leaving server \"%s\" not removed from config: \n%s", leaving, configStr);
-                assertFalse(errorMessage, configStr.contains(format("server.%s=", leaving)));
+                assertFalse(configStr.contains(format("server.%s=", leaving)), errorMessage);
             }
         }
 
@@ -167,34 +167,30 @@ public static String testServerHasConfig(
         String configStr = new String(config);
         if (joiningServers != null) {
             for (String joiner : joiningServers) {
-                assertTrue("Config:<" + configStr + ">\n" + joiner, configStr.contains(joiner));
+                assertTrue(configStr.contains(joiner), "Config:<" + configStr + ">\n" + joiner);
             }
         }
         if (leavingServers != null) {
             for (String leaving : leavingServers) {
-                assertFalse("Config:<" + configStr + ">\n" + leaving, configStr.contains("server.".concat(leaving)));
+                assertFalse(configStr.contains("server.".concat(leaving)), "Config:<" + configStr + ">\n" + leaving);
             }
         }
 
         return configStr;
     }
 
-    public static void testNormalOperation(
-        ZooKeeper writer,
-        ZooKeeper reader) throws KeeperException, InterruptedException {
-        boolean testReaderNodeExists = false;
-        boolean testWriterNodeExists = false;
+    public static void testNormalOperation(ZooKeeper writer, ZooKeeper reader) throws KeeperException, InterruptedException {
+        testNormalOperation(writer, reader, true);
+    }
 
+    public static void testNormalOperation(ZooKeeper writer, ZooKeeper reader, boolean initTestNodes) throws KeeperException, InterruptedException {
+        boolean createNodes = initTestNodes;
         for (int j = 0; j < 30; j++) {
             try {
-                if (!testWriterNodeExists) {
+                if (createNodes) {
                     createZNode(writer, "/test", "test");
-                    testWriterNodeExists = true;
-                }
-
-                if (!testReaderNodeExists) {
                     createZNode(reader, "/dummy", "dummy");
-                    testReaderNodeExists = true;
+                    createNodes = false;
                 }
 
                 String data = "test" + j;
@@ -292,8 +288,8 @@ public void testRemoveAddOne() throws Exception {
         zkArr = createHandles(qu);
         zkAdminArr = createAdminHandles(qu);
 
-        List<String> leavingServers = new ArrayList<String>();
-        List<String> joiningServers = new ArrayList<String>();
+        List<String> leavingServers = new ArrayList<>();
+        List<String> joiningServers = new ArrayList<>();
 
         int leaderIndex = getLeaderId(qu);
 
@@ -370,8 +366,8 @@ public void testRemoveAddTwo() throws Exception {
         zkArr = createHandles(qu);
         zkAdminArr = createAdminHandles(qu);
 
-        List<String> leavingServers = new ArrayList<String>();
-        List<String> joiningServers = new ArrayList<String>();
+        List<String> leavingServers = new ArrayList<>();
+        List<String> joiningServers = new ArrayList<>();
 
         int leaderIndex = getLeaderId(qu);
 
@@ -477,7 +473,7 @@ public void testBulkReconfig() throws Exception {
 
         // new config will have three of the servers as followers
         // two of the servers as observers, and all ports different
-        ArrayList<String> newServers = new ArrayList<String>();
+        ArrayList<String> newServers = new ArrayList<>();
         for (int i = 1; i <= 5; i++) {
             String server = "server." + i + "=localhost:" + PortAssignment.unique()
                             + ":" + PortAssignment.unique() + ":" + ((i == 4 || i == 5) ? "observer" : "participant")
@@ -511,12 +507,12 @@ public void testRemoveOneAsynchronous() throws Exception {
         zkArr = createHandles(qu);
         zkAdminArr = createAdminHandles(qu);
 
-        List<String> leavingServers = new ArrayList<String>();
+        List<String> leavingServers = new ArrayList<>();
 
         // lets remove someone who's not the leader
         leavingServers.add(getLeaderId(qu) == 5 ? "4" : "5");
 
-        List<Integer> results = new LinkedList<Integer>();
+        List<Integer> results = new LinkedList<>();
 
         zkAdminArr[1].reconfigure(null, leavingServers, null, -1, this, results);
 
@@ -551,13 +547,13 @@ public void testRoleChange() throws Exception {
 
         // changing a server's role / port is done by "adding" it with the same
         // id but different role / port
-        List<String> joiningServers = new ArrayList<String>();
+        List<String> joiningServers = new ArrayList<>();
 
         int leaderIndex = getLeaderId(qu);
 
         // during first and second iteration, leavingIndex will correspond to a
         // follower
-        // during third and fouth iteration leavingIndex will be the index of
+        // during third and fourth iteration leavingIndex will be the index of
         // the leader
         int changingIndex = (leaderIndex == 1) ? 2 : 1;
 
@@ -626,7 +622,7 @@ public void testPortChange() throws Exception {
         zkArr = createHandles(qu);
         zkAdminArr = createAdminHandles(qu);
 
-        List<String> joiningServers = new ArrayList<String>();
+        List<String> joiningServers = new ArrayList<>();
 
         int leaderIndex = getLeaderId(qu);
         int followerIndex = leaderIndex == 1 ? 2 : 1;
@@ -765,7 +761,7 @@ private void testPortChangeToBlockedPort(boolean testLeader) throws Exception {
         zkArr = createHandles(qu);
         zkAdminArr = createAdminHandles(qu);
 
-        List<String> joiningServers = new ArrayList<String>();
+        List<String> joiningServers = new ArrayList<>();
 
         int leaderIndex = getLeaderId(qu);
         int followerIndex = leaderIndex == 1 ? 2 : 1;
@@ -808,7 +804,7 @@ private void testPortChangeToBlockedPort(boolean testLeader) throws Exception {
                 Thread.sleep(1000);
                 zkArr[serverIndex].setData("/test", "teststr".getBytes(), -1);
                 fail("New client connected to new client port!");
-            } catch (KeeperException.ConnectionLossException e) {
+            } catch (KeeperException.ConnectionLossException | KeeperException.SessionExpiredException e) {
                 // Exception is expected
             }
 
@@ -954,8 +950,8 @@ public void testJMXBeanAfterRemoveAddOne() throws Exception {
         zkArr = createHandles(qu);
         zkAdminArr = createAdminHandles(qu);
 
-        List<String> leavingServers = new ArrayList<String>();
-        List<String> joiningServers = new ArrayList<String>();
+        List<String> leavingServers = new ArrayList<>();
+        List<String> joiningServers = new ArrayList<>();
 
         // assert remotePeerBean.1 of ReplicatedServer_2
         int leavingIndex = 1;
@@ -1039,7 +1035,7 @@ public void testJMXBeanAfterRoleChange() throws Exception {
 
         // changing a server's role / port is done by "adding" it with the same
         // id but different role / port
-        List<String> joiningServers = new ArrayList<String>();
+        List<String> joiningServers = new ArrayList<>();
 
         // assert remotePeerBean.1 of ReplicatedServer_2
         int changingIndex = 1;
@@ -1106,34 +1102,80 @@ public void testJMXBeanAfterRoleChange() throws Exception {
         assertRemotePeerMXBeanAttributes(changingQS3, remotePeerBean3);
     }
 
+
+    @Test
+    public void testReconfigEnablemntWithRollingRestart() throws Exception {
+
+        // make sure dynamic reconfig is disabled
+        QuorumPeerConfig.setReconfigEnabled(false);
+
+        // start a 3 node cluster
+        qu = new QuorumUtil(1);
+        qu.disableJMXTest = true;
+        qu.startAll();
+        zkArr = createHandles(qu);
+        testNormalOperation(zkArr[1], zkArr[1], true);
+
+
+        // enable dynamic reconfig (new servers created after this time will be initialized with reconfigEnabled=true)
+        QuorumPeerConfig.setReconfigEnabled(true);
+
+        // restart the three servers, one-by-one, now with reconfig enabled
+        // test if we can write / read in the cluster after each rolling restart step
+        for (int i = 1; i < 4; i++) {
+            assertFalse(qu.getPeer(i).peer.isReconfigEnabled(), "dynamic reconfig was not disabled before stopping server " + i);
+            qu.shutdown(i);
+            qu.restart(i);
+            assertTrue(qu.getPeer(i).peer.isReconfigEnabled(), "dynamic reconfig is not enabled for the restarted server " + i);
+            testNormalOperation(zkArr[i], zkArr[(i % 3) + 1], false);
+        }
+
+        // now we will test dynamic reconfig by remove server 2, then add it back later
+        List<String> leavingServers = new ArrayList<>();
+        List<String> joiningServers = new ArrayList<>();
+        leavingServers.add("2");
+
+        // remember this server so we can add it back later
+        joiningServers.add(String.format("server.2=localhost:%d:%d:participant;localhost:%d",
+                qu.getPeer(2).peer.getQuorumAddress().getAllPorts().get(0),
+                qu.getPeer(2).peer.getElectionAddress().getAllPorts().get(0),
+                qu.getPeer(2).peer.getClientPort()));
+
+        // here we remove server 2
+        zkAdminArr = createAdminHandles(qu);
+        String configStr = reconfig(zkAdminArr[1], null, leavingServers, null, -1);
+        testServerHasConfig(zkArr[3], null, leavingServers);
+        testNormalOperation(zkArr[1], zkArr[3], false);
+
+
+        // here we add back server 2
+        QuorumVerifier qv = qu.getPeer(1).peer.configFromString(configStr);
+        long version = qv.getVersion();
+        reconfig(zkAdminArr[3], joiningServers, null, null, version);
+
+        testServerHasConfig(zkArr[1], joiningServers, null);
+        testServerHasConfig(zkArr[2], joiningServers, null);
+        testServerHasConfig(zkArr[3], joiningServers, null);
+        testNormalOperation(zkArr[3], zkArr[1], false);
+    }
+
+
     private void assertLocalPeerMXBeanAttributes(
         QuorumPeer qp,
         String beanName,
         Boolean isPartOfEnsemble) throws Exception {
-        assertEquals(
-            "Mismatches LearnerType!",
-            qp.getLearnerType().name(),
-            JMXEnv.ensureBeanAttribute(beanName, "LearnerType"));
-        assertEquals(
-            "Mismatches ClientAddress!",
-            qp.getClientAddress().getHostString() + ":" + qp.getClientAddress().getPort(),
-            JMXEnv.ensureBeanAttribute(beanName, "ClientAddress"));
-        assertEquals(
-            "Mismatches LearnerType!",
-            qp.getElectionAddress().getOne().getHostString() + ":" + qp.getElectionAddress().getOne().getPort(),
-            JMXEnv.ensureBeanAttribute(beanName, "ElectionAddress"));
-        assertEquals(
-            "Mismatches PartOfEnsemble!",
-            isPartOfEnsemble,
-            JMXEnv.ensureBeanAttribute(beanName, "PartOfEnsemble"));
-        assertEquals(
-            "Mismatches ConfigVersion!",
-            qp.getQuorumVerifier().getVersion(),
-            JMXEnv.ensureBeanAttribute(beanName, "ConfigVersion"));
-        assertEquals(
-            "Mismatches QuorumSystemInfo!",
-            qp.getQuorumVerifier().toString(),
-            JMXEnv.ensureBeanAttribute(beanName, "QuorumSystemInfo"));
+        assertEquals(qp.getLearnerType().name(), JMXEnv.ensureBeanAttribute(beanName, "LearnerType"),
+                "Mismatches LearnerType!");
+        assertEquals(qp.getClientAddress().getHostString() + ":" + qp.getClientAddress().getPort(), JMXEnv.ensureBeanAttribute(beanName, "ClientAddress"),
+                "Mismatches ClientAddress!");
+        assertEquals(qp.getElectionAddress().getOne().getHostString() + ":" + qp.getElectionAddress().getOne().getPort(), JMXEnv.ensureBeanAttribute(beanName, "ElectionAddress"),
+                "Mismatches LearnerType!");
+        assertEquals(isPartOfEnsemble, JMXEnv.ensureBeanAttribute(beanName, "PartOfEnsemble"),
+                "Mismatches PartOfEnsemble!");
+        assertEquals(qp.getQuorumVerifier().getVersion(), JMXEnv.ensureBeanAttribute(beanName, "ConfigVersion"),
+                "Mismatches ConfigVersion!");
+        assertEquals(qp.getQuorumVerifier().toString(), JMXEnv.ensureBeanAttribute(beanName, "QuorumSystemInfo"),
+                "Mismatches QuorumSystemInfo!");
     }
 
     String getAddrPortFromBean(String beanName, String attribute) throws Exception {
@@ -1154,22 +1196,17 @@ String getNumericalAddrPort(String name) throws UnknownHostException {
     }
 
     private void assertRemotePeerMXBeanAttributes(QuorumServer qs, String beanName) throws Exception {
-        assertEquals(
-            "Mismatches LearnerType!",
-            qs.type.name(),
-            JMXEnv.ensureBeanAttribute(beanName, "LearnerType"));
-        assertEquals(
-            "Mismatches ClientAddress!",
-            getNumericalAddrPort(qs.clientAddr.getHostString() + ":" + qs.clientAddr.getPort()),
-            getAddrPortFromBean(beanName, "ClientAddress"));
-        assertEquals(
-            "Mismatches ElectionAddress!",
-            getNumericalAddrPort(qs.electionAddr.getOne().getHostString() + ":" + qs.electionAddr.getOne().getPort()),
-            getAddrPortFromBean(beanName, "ElectionAddress"));
-        assertEquals(
-            "Mismatches QuorumAddress!",
-            getNumericalAddrPort(qs.addr.getOne().getHostString() + ":" + qs.addr.getOne().getPort()),
-            getAddrPortFromBean(beanName, "QuorumAddress"));
+        assertEquals(qs.type.name(), JMXEnv.ensureBeanAttribute(beanName, "LearnerType"),
+                "Mismatches LearnerType!");
+        assertEquals(getNumericalAddrPort(qs.clientAddr.getHostString() + ":" + qs.clientAddr.getPort()),
+                getAddrPortFromBean(beanName, "ClientAddress"),
+                "Mismatches ClientAddress!");
+        assertEquals(getNumericalAddrPort(qs.electionAddr.getOne().getHostString() + ":" + qs.electionAddr.getOne().getPort()),
+                getAddrPortFromBean(beanName, "ElectionAddress"),
+                "Mismatches ElectionAddress!");
+        assertEquals(getNumericalAddrPort(qs.addr.getOne().getHostString() + ":" + qs.addr.getOne().getPort()),
+                getAddrPortFromBean(beanName, "QuorumAddress"),
+                "Mismatches QuorumAddress!");
     }
 
 
@@ -1180,6 +1217,7 @@ private void assertRemotePeerMXBeanAttributes(QuorumServer qs, String beanName)
     private static class ServerConfigLine {
         private final int serverId;
         private Integer clientPort;
+        private Integer secureClientPort;
 
         // hostName -> <quorumPort1, quorumPort2>
         private final Map<String, Set<Integer>> quorumPorts = new HashMap<>();
@@ -1192,7 +1230,7 @@ private ServerConfigLine(String configLine) {
             serverId = parseInt(parts[0].split("\\.")[1]);
             String[] serverConfig = parts[1].split(";");
             String[] serverAddresses = serverConfig[0].split("\\|");
-            if (serverConfig.length > 1) {
+            if (serverConfig.length > 1 && !serverConfig[1].isEmpty()) {
                 String[] clientParts = serverConfig[1].split(":");
                 if (clientParts.length > 1) {
                     clientPort = parseInt(clientParts[1]);
@@ -1201,6 +1239,15 @@ private ServerConfigLine(String configLine) {
                 }
             }
 
+            if (serverConfig.length > 2 && !serverConfig[2].isEmpty()) {
+                String[] secureClientParts = serverConfig[2].split(":");
+                if (secureClientParts.length > 1) {
+                    secureClientPort = parseInt(secureClientParts[1]);
+                } else {
+                    secureClientPort = parseInt(secureClientParts[0]);
+                }
+            }
+
             for (String addr : serverAddresses) {
                 // addr like: 127.0.0.1:11230:11229:participant or [0:0:0:0:0:0:0:1]:11346:11347
                 String serverHost;
@@ -1231,13 +1278,14 @@ public boolean equals(Object o) {
             ServerConfigLine that = (ServerConfigLine) o;
             return serverId == that.serverId
               && Objects.equals(clientPort, that.clientPort)
+              && Objects.equals(secureClientPort, that.secureClientPort)
               && quorumPorts.equals(that.quorumPorts)
               && electionPorts.equals(that.electionPorts);
         }
 
         @Override
         public int hashCode() {
-            return Objects.hash(serverId, clientPort, quorumPorts, electionPorts);
+            return Objects.hash(serverId, clientPort, secureClientPort, quorumPorts, electionPorts);
         }
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/RecoveryTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/RecoveryTest.java
index 4f4d12d5871..fb38dd4b9ef 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/RecoveryTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/RecoveryTest.java
@@ -19,8 +19,8 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
@@ -36,7 +36,8 @@
 import org.apache.zookeeper.server.ServerCnxnFactory;
 import org.apache.zookeeper.server.SyncRequestProcessor;
 import org.apache.zookeeper.server.ZooKeeperServer;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -54,15 +55,14 @@ public class RecoveryTest extends ZKTestCase implements Watcher {
      * server to restart within the connection timeout period.
      *
      * Also note that the client latches are used to eliminate any chance
-     * of spurrious connectionloss exceptions on the read ops. Specifically
+     * of spurious connectionloss exceptions on the read ops. Specifically
      * a sync operation will throw this exception if the server goes down
      * (as recognized by the client) during the operation. If the operation
      * occurs after the server is down, but before the client recognizes
      * that the server is down (ping) then the op will throw connectionloss.
      */
     @Test
-    public void testRecovery() throws Exception {
-        File tmpDir = ClientBase.createTmpDir();
+    public void testRecovery(@TempDir File tmpDir) throws Exception {
 
         ClientBase.setupTestEnv();
         ZooKeeperServer zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
@@ -73,14 +73,14 @@ public void testRecovery() throws Exception {
             final int PORT = Integer.parseInt(HOSTPORT.split(":")[1]);
             ServerCnxnFactory f = ServerCnxnFactory.createFactory(PORT, -1);
             f.startup(zks);
-            LOG.info("starting up the the server, waiting");
+            LOG.info("starting up the server, waiting");
 
-            assertTrue("waiting for server up", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server up");
 
             startSignal = new CountDownLatch(1);
             ZooKeeper zk = new ZooKeeper(HOSTPORT, CONNECTION_TIMEOUT, this);
             startSignal.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS);
-            assertTrue("count == 0", startSignal.getCount() == 0);
+            assertTrue(startSignal.getCount() == 0, "count == 0");
             String path;
             LOG.info("starting creating nodes");
             for (int i = 0; i < 10; i++) {
@@ -99,7 +99,7 @@ public void testRecovery() throws Exception {
 
             f.shutdown();
             zks.shutdown();
-            assertTrue("waiting for server down", ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server down");
 
             zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
             f = ServerCnxnFactory.createFactory(PORT, -1);
@@ -108,10 +108,10 @@ public void testRecovery() throws Exception {
 
             f.startup(zks);
 
-            assertTrue("waiting for server up", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server up");
 
             startSignal.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS);
-            assertTrue("count == 0", startSignal.getCount() == 0);
+            assertTrue(startSignal.getCount() == 0, "count == 0");
 
             Stat stat = new Stat();
             for (int i = 0; i < 10; i++) {
@@ -130,7 +130,7 @@ public void testRecovery() throws Exception {
             f.shutdown();
             zks.shutdown();
 
-            assertTrue("waiting for server down", ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown(HOSTPORT, ClientBase.CONNECTION_TIMEOUT), "waiting for server down");
 
             zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
             f = ServerCnxnFactory.createFactory(PORT, -1);
@@ -139,10 +139,10 @@ public void testRecovery() throws Exception {
 
             f.startup(zks);
 
-            assertTrue("waiting for server up", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server up");
 
             startSignal.await(CONNECTION_TIMEOUT, TimeUnit.MILLISECONDS);
-            assertTrue("count == 0", startSignal.getCount() == 0);
+            assertTrue(startSignal.getCount() == 0, "count == 0");
 
             stat = new Stat();
             LOG.info("Check 2");
@@ -163,7 +163,7 @@ public void testRecovery() throws Exception {
             f.shutdown();
             zks.shutdown();
 
-            assertTrue("waiting for server down", ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server down");
         } finally {
             SyncRequestProcessor.setSnapCount(oldSnapCount);
         }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/RepeatStartupTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/RepeatStartupTest.java
index 27fa4a9daa7..8c79af34104 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/RepeatStartupTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/RepeatStartupTest.java
@@ -18,14 +18,14 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.server.ServerCnxnFactory;
 import org.apache.zookeeper.server.ZooKeeperServer;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class RepeatStartupTest extends ZKTestCase {
 
@@ -49,20 +49,20 @@ public void testFail() throws Exception {
         QuorumBase.shutdown(qb.s4);
         QuorumBase.shutdown(qb.s5);
         String hp = qb.hostPort.split(",")[0];
-        ZooKeeperServer zks = new ZooKeeperServer(qb.s1.getTxnFactory().getSnapDir(), qb.s1.getTxnFactory().getDataDir(), 3000);
+        ZooKeeperServer zks = new ZooKeeperServer(qb.s1.getTxnFactory().getSnapDir(), qb.s1.getTxnFactory().getDataLogDir(), 3000);
         final int PORT = Integer.parseInt(hp.split(":")[1]);
         ServerCnxnFactory factory = ServerCnxnFactory.createFactory(PORT, -1);
 
         factory.startup(zks);
         System.out.println("Comment: starting factory");
         assertTrue(
-                "waiting for server up",
-                ClientBase.waitForServerUp("127.0.0.1:" + PORT, QuorumTest.CONNECTION_TIMEOUT));
+                ClientBase.waitForServerUp("127.0.0.1:" + PORT, QuorumTest.CONNECTION_TIMEOUT),
+                "waiting for server up");
         factory.shutdown();
         zks.shutdown();
         assertTrue(
-                "waiting for server down",
-                ClientBase.waitForServerDown("127.0.0.1:" + PORT, QuorumTest.CONNECTION_TIMEOUT));
+                ClientBase.waitForServerDown("127.0.0.1:" + PORT, QuorumTest.CONNECTION_TIMEOUT),
+                "waiting for server down");
         System.out.println("Comment: shutting down standalone");
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ResponseCacheTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ResponseCacheTest.java
index 0b27ff59c10..32af00ae841 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ResponseCacheTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ResponseCacheTest.java
@@ -18,10 +18,10 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertArrayEquals;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotSame;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotSame;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.List;
 import java.util.Map;
 import org.apache.zookeeper.CreateMode;
@@ -31,9 +31,9 @@
 import org.apache.zookeeper.metrics.MetricsUtils;
 import org.apache.zookeeper.server.ServerMetrics;
 import org.apache.zookeeper.server.ZooKeeperServer;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -41,14 +41,14 @@ public class ResponseCacheTest extends ClientBase {
 
     protected static final Logger LOG = LoggerFactory.getLogger(ResponseCacheTest.class);
 
-    @Before
+    @BeforeEach
     public void setup() throws Exception {
         System.setProperty(ZooKeeperServer.GET_DATA_RESPONSE_CACHE_SIZE, "32");
         System.setProperty(ZooKeeperServer.GET_CHILDREN_RESPONSE_CACHE_SIZE, "64");
         super.setUp();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         System.clearProperty(ZooKeeperServer.GET_DATA_RESPONSE_CACHE_SIZE);
         System.clearProperty(ZooKeeperServer.GET_CHILDREN_RESPONSE_CACHE_SIZE);
@@ -79,6 +79,7 @@ public void performCacheTest(ZooKeeper zk, String path, boolean useCache) throws
         Stat writeStat = new Stat();
         Stat readStat = new Stat();
         byte[] readData = null;
+        int cacheSize = Integer.getInteger(ZooKeeperServer.GET_DATA_RESPONSE_CACHE_SIZE);
         int reads = 10;
         long expectedHits = 0;
         long expectedMisses = 0;
@@ -88,7 +89,7 @@ public void performCacheTest(ZooKeeper zk, String path, boolean useCache) throws
         LOG.info("caching: {}", useCache);
 
         if (useCache) {
-            assertEquals(zks.getReadResponseCache().getCacheSize(), 32);
+            assertEquals(zks.getReadResponseCache().getCacheSize(), cacheSize);
             assertEquals(zks.getGetChildrenResponseCache().getCacheSize(), 64);
         }
 
@@ -146,15 +147,21 @@ public void performCacheTest(ZooKeeper zk, String path, boolean useCache) throws
         createPath(path + "/a/b/e/g", zk);
         createPath(path + "/a/b/e/h", zk);
 
+        createPath(path + "/x", zk);
+        for (int i = 0; i < cacheSize * 2; ++i) {
+            createPath(path + "/x/y" + i, zk);
+        }
+
         checkPath(path + "/a", zk, 2);
         checkPath(path + "/a/b", zk, 2);
         checkPath(path + "/a/c", zk, 0);
         checkPath(path + "/a/b/d", zk, 0);
         checkPath(path + "/a/b/e", zk, 3);
         checkPath(path + "/a/b/e/h", zk, 0);
+        checkPath(path + "/x", zk, cacheSize * 2);
 
         if (useCache) {
-            expectedMisses += 6;
+            expectedMisses += 7;
         }
 
         checkCacheStatus(expectedHits, expectedMisses, "response_packet_get_children_cache_hits",
@@ -170,6 +177,19 @@ public void performCacheTest(ZooKeeper zk, String path, boolean useCache) throws
 
         checkCacheStatus(expectedHits, expectedMisses, "response_packet_get_children_cache_hits",
                 "response_packet_get_children_cache_misses");
+
+        for (int i = 0; i < cacheSize * 2; ++i) {
+            checkPath(path + "/a", zk, 2);
+            checkPath(path + "/x/y" + i, zk, 0);
+
+            if (useCache) {
+                expectedHits += 1;
+                expectedMisses += 1;
+            }
+
+            checkCacheStatus(expectedHits, expectedMisses, "response_packet_get_children_cache_hits",
+                    "response_packet_get_children_cache_misses");
+        }
     }
 
     private void createPath(String path, ZooKeeper zk) throws Exception {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/RestoreCommittedLogTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/RestoreCommittedLogTest.java
index 188396f1fc2..2e8837b0f03 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/RestoreCommittedLogTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/RestoreCommittedLogTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.util.Collection;
 import org.apache.zookeeper.CreateMode;
@@ -30,7 +30,7 @@
 import org.apache.zookeeper.server.SyncRequestProcessor;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.quorum.Leader.Proposal;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -98,7 +98,7 @@ private void testRestoreCommittedLog(int totalTransactions, byte[] data, int min
         final int PORT = Integer.parseInt(HOSTPORT.split(":")[1]);
         ServerCnxnFactory f = ServerCnxnFactory.createFactory(PORT, -1);
         f.startup(zks);
-        assertTrue("waiting for server being up ", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up ");
         ZooKeeper zk = ClientBase.createZKClient(HOSTPORT);
         try {
             for (int i = 0; i < totalTransactions; i++) {
@@ -112,10 +112,10 @@ private void testRestoreCommittedLog(int totalTransactions, byte[] data, int min
 
         f.shutdown();
         zks.shutdown();
-        assertTrue("waiting for server to shutdown", ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server to shutdown");
 
-        assertTrue("too few snapshot files", numSnaps > minExpectedSnapshots);
-        assertTrue("too many snapshot files", numSnaps <= minExpectedSnapshots * 2);
+        assertTrue(numSnaps > minExpectedSnapshots, "too few snapshot files");
+        assertTrue(numSnaps <= minExpectedSnapshots * 2, "too many snapshot files");
 
         // start server again
         zks = new ZooKeeperServer(tmpDir, tmpDir, 3000);
@@ -123,7 +123,7 @@ private void testRestoreCommittedLog(int totalTransactions, byte[] data, int min
         Collection<Proposal> committedLog = zks.getZKDatabase().getCommittedLog();
         int logsize = committedLog.size();
         LOG.info("committedLog size = {}", logsize);
-        assertTrue("log size != 0", (logsize != 0));
+        assertTrue((logsize != 0), "log size != 0");
         zks.shutdown();
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SSLAuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SSLAuthTest.java
index ddfa48dd38a..447e50ac90d 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SSLAuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SSLAuthTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertFalse;
 import java.net.InetSocketAddress;
 import java.util.concurrent.TimeUnit;
 import org.apache.zookeeper.PortAssignment;
@@ -26,9 +26,9 @@
 import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.common.ClientX509Util;
 import org.apache.zookeeper.server.ServerCnxnFactory;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class SSLAuthTest extends ClientBase {
 
@@ -64,7 +64,7 @@ public static void clearSecureSetting(ClientX509Util clientX509Util) {
         clientX509Util.close();
     }
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         clientX509Util = setUpSecure();
 
@@ -78,7 +78,7 @@ public void setUp() throws Exception {
         super.setUp();
     }
 
-    @After
+    @AfterEach
     public void teardown() throws Exception {
         clearSecureSetting(clientX509Util);
     }
@@ -96,7 +96,7 @@ public void testRejection() throws Exception {
 
         // Handshake will take place, and then X509AuthenticationProvider should reject the untrusted cert
         new TestableZooKeeper(hostPort, CONNECTION_TIMEOUT, watcher);
-        assertFalse("Untrusted certificate should not result in successful connection", watcher.clientConnected.await(1000, TimeUnit.MILLISECONDS));
+        assertFalse(watcher.clientConnected.await(1000, TimeUnit.MILLISECONDS), "Untrusted certificate should not result in successful connection");
     }
 
     @Test
@@ -109,7 +109,7 @@ public void testMisconfiguration() throws Exception {
 
         CountdownWatcher watcher = new CountdownWatcher();
         new TestableZooKeeper(hostPort, CONNECTION_TIMEOUT, watcher);
-        assertFalse("Missing SSL configuration should not result in successful connection", watcher.clientConnected.await(1000, TimeUnit.MILLISECONDS));
+        assertFalse(watcher.clientConnected.await(1000, TimeUnit.MILLISECONDS), "Missing SSL configuration should not result in successful connection");
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDesignatedClientTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDesignatedClientTest.java
index 95db1508645..57c57d0b0d6 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDesignatedClientTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDesignatedClientTest.java
@@ -18,12 +18,12 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertSame;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.FileWriter;
 import java.io.IOException;
@@ -38,9 +38,9 @@
 import org.apache.zookeeper.client.ZooKeeperSaslClient;
 import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Id;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
-public class SaslAuthDesignatedClientTest extends ClientBase {
+public class SaslAuthDesignatedClientTest extends SaslAuthDigestTestBase {
 
     static {
         System.setProperty("zookeeper.authProvider.1", "org.apache.zookeeper.server.auth.SASLAuthenticationProvider");
@@ -112,7 +112,7 @@ public void testSaslConfig() throws Exception {
     public void testReadAccessUser() throws Exception {
         System.setProperty("zookeeper.letAnySaslUserDoX", "anyone");
         ZooKeeper zk = createClient();
-        List<ACL> aclList = new ArrayList<ACL>();
+        List<ACL> aclList = new ArrayList<>();
         ACL acl = new ACL(Perms.ADMIN | Perms.CREATE | Perms.WRITE | Perms.DELETE, new Id("sasl", "fakeuser"));
         ACL acl1 = new ACL(Perms.READ, new Id("sasl", "anyone"));
         aclList.add(acl);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDesignatedServerTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDesignatedServerTest.java
index bbe12c927c7..8b85e13bb14 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDesignatedServerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDesignatedServerTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicInteger;
@@ -31,9 +31,9 @@
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.server.ZooKeeperSaslServer;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
-public class SaslAuthDesignatedServerTest extends ClientBase {
+public class SaslAuthDesignatedServerTest extends SaslAuthDigestTestBase {
 
     public static int AUTHENTICATION_TIMEOUT = 30000;
 
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogSource.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDigestTestBase.java
similarity index 51%
rename from zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogSource.java
rename to zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDigestTestBase.java
index 9845c7f0b32..2e3b4a2ba69 100644
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/java/org/apache/zookeeper/graph/LogSource.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthDigestTestBase.java
@@ -1,4 +1,4 @@
-/**
+/*
  * Licensed to the Apache Software Foundation (ASF) under one
  * or more contributor license agreements.  See the NOTICE file
  * distributed with this work for additional information
@@ -15,19 +15,30 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.apache.zookeeper.graph;
-import java.util.Iterator;
 
-public interface LogSource extends Iterable<LogEntry> {
-    public LogIterator iterator(long starttime, long endtime, FilterOp filter) throws IllegalArgumentException, FilterException;
+package org.apache.zookeeper.test;
+
+import org.apache.zookeeper.common.X509Util;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
 
-    public LogIterator iterator(long starttime, long endtime) throws IllegalArgumentException;
+/**
+ * Created as a base class for Digest Auth based SASL authentication tests.
+ * We need to disable Fips mode, otherwise DIGEST-MD5 cannot be used.
+ *
+ * @see org.apache.zookeeper.server.quorum.auth.DigestSecurityTestcase
+ */
+public class SaslAuthDigestTestBase extends ClientBase {
 
-    public LogIterator iterator() throws IllegalArgumentException;
+  @BeforeAll
+  public static void beforeClass() throws Exception {
+    // Need to disable Fips-mode, because we use DIGEST-MD5 mech for Sasl
+    System.setProperty(X509Util.FIPS_MODE_PROPERTY, "false");
+  }
 
-    public boolean overlapsRange(long starttime, long endtime);
+  @AfterAll
+  public static void afterClass() throws Exception {
+    System.clearProperty(X509Util.FIPS_MODE_PROPERTY);
+  }
 
-    public long size();
-    public long getStartTime();
-    public long getEndTime();
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthFailDesignatedClientTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthFailDesignatedClientTest.java
index f0a85c2002d..0d2c32a3ad8 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthFailDesignatedClientTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthFailDesignatedClientTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.FileWriter;
 import java.io.IOException;
@@ -28,9 +28,9 @@
 import org.apache.zookeeper.TestableZooKeeper;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.client.ZKClientConfig;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
-public class SaslAuthFailDesignatedClientTest extends ClientBase {
+public class SaslAuthFailDesignatedClientTest extends SaslAuthDigestTestBase {
 
     static {
         System.setProperty("zookeeper.authProvider.1", "org.apache.zookeeper.server.auth.SASLAuthenticationProvider");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthFailFipsModeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthFailFipsModeTest.java
new file mode 100644
index 00000000000..6bb09a14efe
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthFailFipsModeTest.java
@@ -0,0 +1,72 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.fail;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.ZooDefs.Ids;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.common.X509Util;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+
+/**
+ * Tests that DIGEST-MD5 SASL authentication is rejected when FIPS mode is enabled.
+ * Does NOT extend SaslAuthDigestTestBase because that base class disables FIPS mode.
+ */
+public class SaslAuthFailFipsModeTest extends ClientBase {
+
+    @BeforeAll
+    public static void setUpBeforeClass() {
+        System.setProperty(X509Util.FIPS_MODE_PROPERTY, "true");
+        System.setProperty(SaslTestUtil.requireSASLAuthProperty, "true");
+        System.setProperty(SaslTestUtil.authProviderProperty, SaslTestUtil.authProvider);
+        System.setProperty(SaslTestUtil.jaasConfig, SaslTestUtil.createJAASConfigFile("jaas_fips.conf", "test"));
+    }
+
+    @AfterAll
+    public static void tearDownAfterClass() {
+        System.clearProperty(X509Util.FIPS_MODE_PROPERTY);
+        System.clearProperty(SaslTestUtil.requireSASLAuthProperty);
+        System.clearProperty(SaslTestUtil.authProviderProperty);
+        System.clearProperty(SaslTestUtil.jaasConfig);
+    }
+
+    @Test
+    public void testDigestMd5RejectedInFipsMode() throws Exception {
+        ZooKeeper zk = null;
+        CountdownWatcher watcher = new CountdownWatcher();
+        try {
+            zk = createClient(watcher);
+            zk.create("/fips-test", null, Ids.CREATOR_ALL_ACL, CreateMode.PERSISTENT);
+            fail("DIGEST-MD5 SASL authentication should be rejected when FIPS mode is enabled.");
+        } catch (KeeperException e) {
+            assertEquals(KeeperException.Code.AUTHFAILED, e.code());
+            watcher.waitForDisconnected(SaslTestUtil.CLIENT_DISCONNECT_TIMEOUT);
+        } finally {
+            if (zk != null) {
+                zk.close();
+            }
+        }
+    }
+
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthFailTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthFailTest.java
index e5df31ef341..2384cd612ef 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthFailTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthFailTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.FileWriter;
 import java.io.IOException;
@@ -28,9 +28,9 @@
 import org.apache.zookeeper.Watcher.Event.KeeperState;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
-public class SaslAuthFailTest extends ClientBase {
+public class SaslAuthFailTest extends SaslAuthDigestTestBase {
 
     static {
         System.setProperty("zookeeper.authProvider.1", "org.apache.zookeeper.server.auth.SASLAuthenticationProvider");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthMissingClientConfigTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthMissingClientConfigTest.java
index 51a6d03f024..1bfd0ab34f1 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthMissingClientConfigTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthMissingClientConfigTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.FileWriter;
 import java.io.IOException;
@@ -27,9 +27,9 @@
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.client.ZKClientConfig;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
-public class SaslAuthMissingClientConfigTest extends ClientBase {
+public class SaslAuthMissingClientConfigTest extends SaslAuthDigestTestBase {
 
     static {
         System.setProperty("zookeeper.authProvider.1", "org.apache.zookeeper.server.auth.SASLAuthenticationProvider");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredFailNoSASLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredFailNoSASLTest.java
index e60fcc452a9..2d8c48c0605 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredFailNoSASLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredFailNoSASLTest.java
@@ -18,26 +18,28 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
 
-public class SaslAuthRequiredFailNoSASLTest extends ClientBase {
+public class SaslAuthRequiredFailNoSASLTest extends SaslAuthDigestTestBase {
 
-    @Before
-    public void setup() {
+    @BeforeAll
+    public static void setup() {
         System.setProperty(SaslTestUtil.requireSASLAuthProperty, "true");
+        System.setProperty(SaslTestUtil.authProviderProperty, SaslTestUtil.authProvider);
     }
 
-    @After
-    public void tearDown() throws Exception {
+    @AfterAll
+    public static void clearSetup() {
         System.clearProperty(SaslTestUtil.requireSASLAuthProperty);
+        System.clearProperty(SaslTestUtil.authProviderProperty);
     }
 
     @Test
@@ -46,7 +48,7 @@ public void testClientOpWithoutSASLConfigured() throws Exception {
         CountdownWatcher watcher = new CountdownWatcher();
         try {
             zk = createClient(watcher);
-            zk.create("/foo", null, Ids.CREATOR_ALL_ACL, CreateMode.PERSISTENT);
+            zk.create("/foo", null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
             fail("Client is not configured with SASL authentication, so zk.create operation should fail.");
         } catch (KeeperException e) {
             assertTrue(e.code() == KeeperException.Code.SESSIONCLOSEDREQUIRESASLAUTH);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredFailWrongSASLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredFailWrongSASLTest.java
index 1fed4d93c25..670706df232 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredFailWrongSASLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredFailWrongSASLTest.java
@@ -18,26 +18,26 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
-import org.junit.AfterClass;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
 
-public class SaslAuthRequiredFailWrongSASLTest extends ClientBase {
+public class SaslAuthRequiredFailWrongSASLTest extends SaslAuthDigestTestBase {
 
-    @BeforeClass
+    @BeforeAll
     public static void setUpBeforeClass() {
         System.setProperty(SaslTestUtil.requireSASLAuthProperty, "true");
         System.setProperty(SaslTestUtil.authProviderProperty, SaslTestUtil.authProvider);
         System.setProperty(SaslTestUtil.jaasConfig, SaslTestUtil.createJAASConfigFile("jaas_wrong.conf", "test1"));
     }
 
-    @AfterClass
+    @AfterAll
     public static void tearDownAfterClass() {
         System.clearProperty(SaslTestUtil.requireSASLAuthProperty);
         System.clearProperty(SaslTestUtil.authProviderProperty);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredMultiClientTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredMultiClientTest.java
new file mode 100644
index 00000000000..f21d634558b
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredMultiClientTest.java
@@ -0,0 +1,88 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.fail;
+import javax.security.auth.login.Configuration;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.ZooDefs.Ids;
+import org.apache.zookeeper.ZooKeeper;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+
+public class SaslAuthRequiredMultiClientTest extends SaslAuthDigestTestBase {
+
+    @BeforeAll
+    public static void setUpBeforeClass() {
+        System.setProperty(SaslTestUtil.requireSASLAuthProperty, "true");
+        System.setProperty(SaslTestUtil.authProviderProperty, SaslTestUtil.authProvider);
+        System.setProperty(SaslTestUtil.jaasConfig, SaslTestUtil.createJAASConfigFile("jaas.conf", "test"));
+    }
+
+    @AfterAll
+    public static void tearDownAfterClass() {
+        System.clearProperty(SaslTestUtil.requireSASLAuthProperty);
+        System.clearProperty(SaslTestUtil.authProviderProperty);
+        System.clearProperty(SaslTestUtil.jaasConfig);
+    }
+
+    @Test
+    public void testClientOpWithInvalidSASLUserAuthAfterSuccessLogin() throws Exception {
+        resetJaasConfiguration("jaas.conf", "super", "test");
+        try  (ZooKeeper zk = createClient()) {
+            zk.create("/foobar", null, Ids.CREATOR_ALL_ACL, CreateMode.PERSISTENT);
+        } catch (KeeperException e) {
+            fail("Client operation should succeed with valid SASL configuration.");
+        }
+
+        resetJaasConfiguration("jaas.conf", "super_wrong", "test");
+        try  (ZooKeeper wrongUserZk = createClient()) {
+            wrongUserZk.create("/bar", null, Ids.CREATOR_ALL_ACL, CreateMode.PERSISTENT);
+            fail("Client with wrong SASL config should not pass SASL authentication.");
+        } catch (KeeperException e) {
+            assertEquals(KeeperException.Code.AUTHFAILED, e.code());
+        }
+    }
+
+    @Test
+    public void testClientOpWithInvalidSASLPasswordAuthAfterSuccessLogin() throws Exception {
+        resetJaasConfiguration("jaas.conf", "super", "test");
+        try (ZooKeeper zk = createClient()) {
+            zk.create("/foobar", null, Ids.CREATOR_ALL_ACL, CreateMode.PERSISTENT);
+        } catch (KeeperException e) {
+            fail("Client operation should succeed with valid SASL configuration.");
+        }
+
+        resetJaasConfiguration("jaas.conf", "super", "test_wrongong");
+        try (ZooKeeper wrongPasswordZk = createClient()) {
+            wrongPasswordZk.create("/bar", null, Ids.CREATOR_ALL_ACL, CreateMode.PERSISTENT);
+            fail("Client with wrong SASL config should not pass SASL authentication.");
+        } catch (KeeperException e) {
+            assertEquals(KeeperException.Code.AUTHFAILED, e.code());
+        }
+    }
+
+    protected static void resetJaasConfiguration(String fileName, String userName, String password) {
+        Configuration.setConfiguration(null);
+        System.setProperty(SaslTestUtil.jaasConfig, SaslTestUtil.createJAASConfigFile(fileName, userName, password));
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredTest.java
index 173a3cbf385..657e7fe15ab 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslAuthRequiredTest.java
@@ -18,25 +18,25 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
-import org.junit.AfterClass;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
 
-public class SaslAuthRequiredTest extends ClientBase {
+public class SaslAuthRequiredTest extends SaslAuthDigestTestBase {
 
-    @BeforeClass
+    @BeforeAll
     public static void setUpBeforeClass() {
         System.setProperty(SaslTestUtil.requireSASLAuthProperty, "true");
         System.setProperty(SaslTestUtil.authProviderProperty, SaslTestUtil.authProvider);
         System.setProperty(SaslTestUtil.jaasConfig, SaslTestUtil.createJAASConfigFile("jaas.conf", "test"));
     }
 
-    @AfterClass
+    @AfterAll
     public static void tearDownAfterClass() {
         System.clearProperty(SaslTestUtil.requireSASLAuthProperty);
         System.clearProperty(SaslTestUtil.authProviderProperty);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslClientTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslClientTest.java
index adc69027509..4684bb3b306 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslClientTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslClientTest.java
@@ -18,25 +18,25 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.util.Arrays;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.client.ZKClientConfig;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class SaslClientTest extends ZKTestCase {
 
     private String existingPropertyValue = null;
 
-    @Before
+    @BeforeEach
     public void setUp() {
         existingPropertyValue = System.getProperty(ZKClientConfig.ENABLE_CLIENT_SASL_KEY);
     }
 
-    @After
+    @AfterEach
     public void tearDown() {
         // Restore the System property if it was set previously
         if (existingPropertyValue != null) {
@@ -47,16 +47,16 @@ public void tearDown() {
     @Test
     public void testSaslClientDisabled() {
         System.clearProperty(ZKClientConfig.ENABLE_CLIENT_SASL_KEY);
-        assertTrue("SASL client disabled", new ZKClientConfig().isSaslClientEnabled());
+        assertTrue(new ZKClientConfig().isSaslClientEnabled(), "SASL client disabled");
 
         for (String value : Arrays.asList("true", "TRUE")) {
             System.setProperty(ZKClientConfig.ENABLE_CLIENT_SASL_KEY, value);
-            assertTrue("SASL client disabled", new ZKClientConfig().isSaslClientEnabled());
+            assertTrue(new ZKClientConfig().isSaslClientEnabled(), "SASL client disabled");
         }
 
         for (String value : Arrays.asList("false", "FALSE")) {
             System.setProperty(ZKClientConfig.ENABLE_CLIENT_SASL_KEY, value);
-            assertFalse("SASL client disabled", new ZKClientConfig().isSaslClientEnabled());
+            assertFalse(new ZKClientConfig().isSaslClientEnabled(), "SASL client disabled");
         }
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslDigestAuthOverSSLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslDigestAuthOverSSLTest.java
index 09d92978ca1..9f675e60940 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslDigestAuthOverSSLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslDigestAuthOverSSLTest.java
@@ -19,7 +19,7 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.client.ZKClientConfig.LOGIN_CONTEXT_NAME_KEY;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.FileWriter;
 import java.io.IOException;
@@ -36,17 +36,17 @@
 import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.common.ClientX509Util;
 import org.apache.zookeeper.server.ServerCnxnFactory;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 
-public class SaslDigestAuthOverSSLTest extends ClientBase {
+public class SaslDigestAuthOverSSLTest extends SaslAuthDigestTestBase {
 
     private ClientX509Util clientX509Util;
     private File saslConfFile;
 
-    @Before
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         initSaslConfig();
@@ -63,7 +63,7 @@ public void setUp() throws Exception {
     }
 
 
-    @After
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         super.tearDown();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslKerberosAuthOverSSLTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslKerberosAuthOverSSLTest.java
index d466c8b8d39..0315867086b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslKerberosAuthOverSSLTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslKerberosAuthOverSSLTest.java
@@ -23,7 +23,7 @@
 import static org.apache.zookeeper.client.ZKClientConfig.ZK_SASL_CLIENT_USERNAME;
 import static org.apache.zookeeper.client.ZKClientConfig.ZOOKEEPER_SERVER_PRINCIPAL;
 import static org.apache.zookeeper.client.ZKClientConfig.ZOOKEEPER_SERVER_REALM;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.FileWriter;
 import java.io.IOException;
@@ -43,11 +43,11 @@
 import org.apache.zookeeper.server.ServerCnxnFactory;
 import org.apache.zookeeper.server.quorum.auth.KerberosTestUtils;
 import org.apache.zookeeper.server.quorum.auth.MiniKdc;
-import org.junit.After;
-import org.junit.AfterClass;
-import org.junit.Before;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class SaslKerberosAuthOverSSLTest extends ClientBase {
 
@@ -61,12 +61,12 @@ public class SaslKerberosAuthOverSSLTest extends ClientBase {
 
 
 
-    @BeforeClass
+    @BeforeAll
     public static void setupKdc() {
         startMiniKdc();
     }
 
-    @AfterClass
+    @AfterAll
     public static void tearDownKdc() {
         stopMiniKdc();
         FileUtils.deleteQuietly(kdcWorkDir);
@@ -74,7 +74,7 @@ public static void tearDownKdc() {
 
 
 
-    @Before
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         initSaslConfig();
@@ -91,7 +91,7 @@ public void setUp() throws Exception {
     }
 
 
-    @After
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         super.tearDown();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslSuperUserTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslSuperUserTest.java
index 426eeb16fb7..6bab78a77b1 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslSuperUserTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslSuperUserTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.io.File;
 import java.io.FileWriter;
 import java.io.IOException;
@@ -30,24 +30,28 @@
 import org.apache.zookeeper.Watcher.Event.KeeperState;
 import org.apache.zookeeper.ZooDefs.Perms;
 import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.data.Id;
+import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.auth.DigestAuthenticationProvider;
-import org.junit.AfterClass;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
 
-public class SaslSuperUserTest extends ClientBase {
+public class SaslSuperUserTest extends SaslAuthDigestTestBase {
 
     private static Id otherSaslUser = new Id("sasl", "joe");
     private static Id otherDigestUser;
     private static String oldAuthProvider;
+    private static String oldClientConfigSection;
     private static String oldLoginConfig;
     private static String oldSuperUser;
 
-    @BeforeClass
+    @BeforeAll
     public static void setupStatic() throws Exception {
         oldAuthProvider = System.setProperty("zookeeper.authProvider.1", "org.apache.zookeeper.server.auth.SASLAuthenticationProvider");
+        oldClientConfigSection = System.getProperty(ZKClientConfig.LOGIN_CONTEXT_NAME_KEY);
 
         File tmpDir = createTmpDir();
         File saslConfFile = new File(tmpDir, "jaas.conf");
@@ -56,42 +60,40 @@ public static void setupStatic() throws Exception {
         fwriter.write(""
                               + "Server {\n"
                               + "          org.apache.zookeeper.server.auth.DigestLoginModule required\n"
-                              + "          user_super_duper=\"test\";\n"
+                              + "          user_super_duper=\"test\"\n"
+                              + "          user_other_super=\"test\";\n"
                               + "};\n"
                               + "Client {\n"
                               + "       org.apache.zookeeper.server.auth.DigestLoginModule required\n"
                               + "       username=\"super_duper\"\n"
                               + "       password=\"test\";\n"
                               + "};"
+                              + "OtherClient {\n"
+                              + "       org.apache.zookeeper.server.auth.DigestLoginModule required\n"
+                              + "       username=\"other_super\"\n"
+                              + "       password=\"test\";\n"
+                              + "};"
                               + "\n");
         fwriter.close();
         oldLoginConfig = System.setProperty("java.security.auth.login.config", saslConfFile.getAbsolutePath());
-        oldSuperUser = System.setProperty("zookeeper.superUser", "super_duper");
+        oldSuperUser = System.setProperty(ZooKeeperServer.SASL_SUPER_USER, "super_duper");
         otherDigestUser = new Id("digest", DigestAuthenticationProvider.generateDigest("jack:jack"));
     }
 
-    @AfterClass
+    @AfterAll
     public static void cleanupStatic() {
-        if (oldAuthProvider != null) {
-            System.setProperty("zookeeper.authProvider.1", oldAuthProvider);
-        } else {
-            System.clearProperty("zookeeper.authProvider.1");
-        }
-        oldAuthProvider = null;
-
-        if (oldLoginConfig != null) {
-            System.setProperty("java.security.auth.login.config", oldLoginConfig);
-        } else {
-            System.clearProperty("java.security.auth.login.config");
-        }
-        oldLoginConfig = null;
+        restoreProperty("zookeeper.authProvider.1", oldAuthProvider);
+        restoreProperty(ZKClientConfig.LOGIN_CONTEXT_NAME_KEY, oldClientConfigSection);
+        restoreProperty("java.security.auth.login.config", oldLoginConfig);
+        restoreProperty(ZooKeeperServer.SASL_SUPER_USER, oldSuperUser);
+    }
 
-        if (oldSuperUser != null) {
-            System.setProperty("zookeeper.superUser", oldSuperUser);
+    private static void restoreProperty(String property, String oldValue) {
+        if (oldValue != null) {
+            System.setProperty(property, oldValue);
         } else {
-            System.clearProperty("zookeeper.superUser");
+            System.clearProperty(property);
         }
-        oldSuperUser = null;
     }
 
     private AtomicInteger authFailed = new AtomicInteger(0);
@@ -115,8 +117,7 @@ public synchronized void process(WatchedEvent event) {
 
     }
 
-    @Test
-    public void testSuperIsSuper() throws Exception {
+    private void connectAndPerformSuperOps() throws Exception {
         ZooKeeper zk = createClient();
         try {
             zk.create("/digest_read", null, Arrays.asList(new ACL(Perms.READ, otherDigestUser)), CreateMode.PERSISTENT);
@@ -127,11 +128,35 @@ public void testSuperIsSuper() throws Exception {
             zk.delete("/digest_read", -1);
             zk.delete("/sasl_read/sub", -1);
             zk.delete("/sasl_read", -1);
-            //If the test failes it will most likely fail with a NoAuth exception before it ever gets to this assertion
-            assertEquals(authFailed.get(), 0);
         } finally {
             zk.close();
         }
     }
 
+    @Test
+    public void testSuperIsSuper() throws Exception {
+        connectAndPerformSuperOps();
+        //If the test fails it will most likely fail with a NoAuth exception before it ever gets to this assertion
+        assertEquals(authFailed.get(), 0);
+    }
+
+    @Test
+    public void testOtherSuperIsSuper() throws Exception {
+        String prevSection = System.setProperty(ZKClientConfig.LOGIN_CONTEXT_NAME_KEY, "OtherClient");
+
+        // KLUDGE: We do this quite late, as the server has been
+        // started at this point--but the implementation currently
+        // looks at the properties each time a SASL negotiation completes.
+        String superUser1Prop = ZooKeeperServer.SASL_SUPER_USER + ".1";
+        String prevSuperUser1 = System.setProperty(superUser1Prop, "other_super");
+
+        try {
+            connectAndPerformSuperOps();
+            //If the test fails it will most likely fail with a NoAuth exception before it ever gets to this assertion
+            assertEquals(authFailed.get(), 0);
+        } finally {
+            restoreProperty(superUser1Prop, prevSuperUser1);
+            restoreProperty(ZKClientConfig.LOGIN_CONTEXT_NAME_KEY, prevSection);
+        }
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslTestUtil.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslTestUtil.java
index f787fb20c1c..d982fb695bf 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslTestUtil.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SaslTestUtil.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.FileWriter;
 import java.io.IOException;
@@ -28,6 +28,7 @@ public class SaslTestUtil extends ClientBase {
     // The maximum time (in milliseconds) a client should take to observe
     // a disconnect event of the same client from server.
     static Integer CLIENT_DISCONNECT_TIMEOUT = 3000;
+    static String SUPER_USER_NAME = "super";
     static String requireSASLAuthProperty = "zookeeper.sessionRequireClientSASLAuth";
     static String authProviderProperty = "zookeeper.authProvider.1";
     static String authProvider = "org.apache.zookeeper.server.auth.SASLAuthenticationProvider";
@@ -35,28 +36,25 @@ public class SaslTestUtil extends ClientBase {
     static String jaasConfig = "java.security.auth.login.config";
 
     static String createJAASConfigFile(String fileName, String password) {
+        return createJAASConfigFile(fileName, SUPER_USER_NAME, password);
+    }
+
+    static String createJAASConfigFile(String fileName, String userName, String password) {
         String ret = null;
         try {
             File tmpDir = createTmpDir();
             File jaasFile = new File(tmpDir, fileName);
             FileWriter fwriter = new FileWriter(jaasFile);
             fwriter.write(""
-                                  + "Server {\n"
-                                  + "          "
-                                  + digestLoginModule
-                                  + " required\n"
-                                  + "          user_super=\"test\";\n"
-                                  + "};\n"
-                                  + "Client {\n"
-                                  + "       "
-                                  + digestLoginModule
-                                  + " required\n"
-                                  + "       username=\"super\"\n"
-                                  + "       password=\""
-                                  + password
-                                  + "\";\n"
-                                  + "};"
-                                  + "\n");
+                    + "Server {\n"
+                    + "          " + digestLoginModule + " required\n"
+                    + "          user_super=\"test\";\n"
+                    + "};\n"
+                    + "Client {\n"
+                    + "       " + digestLoginModule + " required\n"
+                    + "       username=\"" + userName + "\"\n"
+                    + "       password=\"" + password + "\";\n"
+                    + "};" + "\n");
             fwriter.close();
             ret = jaasFile.getAbsolutePath();
         } catch (IOException e) {
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ServerCnxnTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ServerCnxnTest.java
index 35db43d2df9..93a35449ceb 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ServerCnxnTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ServerCnxnTest.java
@@ -18,17 +18,17 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.BufferedReader;
 import java.io.IOException;
 import java.io.InputStreamReader;
 import java.io.OutputStream;
 import java.net.Socket;
 import org.apache.zookeeper.server.NIOServerCnxnFactory;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -38,13 +38,13 @@ public class ServerCnxnTest extends ClientBase {
 
     private static int cnxnTimeout = 1000;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         System.setProperty(NIOServerCnxnFactory.ZOOKEEPER_NIO_SESSIONLESS_CNXN_TIMEOUT, Integer.toString(cnxnTimeout));
         super.setUp();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         super.tearDown();
         System.clearProperty(NIOServerCnxnFactory.ZOOKEEPER_NIO_SESSIONLESS_CNXN_TIMEOUT);
@@ -58,7 +58,7 @@ public void testServerCnxnExpiry() throws Exception {
         // Range is (now + cnxnTimeout) to (now + 2*cnxnTimeout)
         // Add 1s buffer to be safe.
         String resp = sendRequest("ruok", 2 * cnxnTimeout + 1000);
-        assertEquals("Connection should have closed", "", resp);
+        assertEquals("", resp, "Connection should have closed");
     }
 
     private void verify(String cmd, String expected) throws IOException {
@@ -114,7 +114,7 @@ private static StringBuilder readLine(BufferedReader reader) {
             // After the socket is closed, when the client tries to read a
             // line of text it will throw java.net.SocketException.
             // @see jira issue ZOOKEEPER-1862
-            LOG.info("Connnection is expired", ioe);
+            LOG.info("Connection is expired", ioe);
         }
         return sb;
     }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionInvalidationTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionInvalidationTest.java
index 0177e8660d7..f3d794f759a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionInvalidationTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionInvalidationTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.io.ByteArrayOutputStream;
 import java.io.InputStream;
 import java.io.OutputStream;
@@ -31,7 +31,7 @@
 import org.apache.zookeeper.proto.ConnectRequest;
 import org.apache.zookeeper.proto.CreateRequest;
 import org.apache.zookeeper.proto.RequestHeader;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class SessionInvalidationTest extends ClientBase {
 
@@ -41,7 +41,7 @@ public class SessionInvalidationTest extends ClientBase {
      *
      * We're using our own marshalling here in order to force an operation
      * after the session is closed (ZooKeeper.class will not allow this). Also
-     * by filling the pipe with operations it increases the likelyhood that
+     * by filling the pipe with operations it increases the likelihood that
      * the server will process the create before FinalRequestProcessor
      * removes the session from the tracker.
      */
@@ -53,7 +53,7 @@ public void testCreateAfterCloseShouldFail() throws Exception {
 
             // open a connection
             boa.writeInt(44, "len");
-            ConnectRequest conReq = new ConnectRequest(0, 0, 30000, 0, new byte[16]);
+            ConnectRequest conReq = new ConnectRequest(0, 0, 30000, 0, new byte[16], false);
             conReq.serialize(boa, "connect");
 
             // close connection
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTest.java
index d2ab579062c..3675e0eb019 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTest.java
@@ -19,12 +19,13 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.IOException;
+import java.util.Arrays;
 import java.util.LinkedList;
 import java.util.List;
 import java.util.concurrent.CountDownLatch;
@@ -43,9 +44,9 @@
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.server.ServerCnxnFactory;
 import org.apache.zookeeper.server.ZooKeeperServer;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -64,7 +65,7 @@ public class SessionTest extends ZKTestCase {
 
     private final int TICK_TIME = 3000;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         if (tmpDir == null) {
             tmpDir = ClientBase.createTmpDir();
@@ -77,23 +78,31 @@ public void setUp() throws Exception {
         serverFactory = ServerCnxnFactory.createFactory(PORT, -1);
         serverFactory.startup(zs);
 
-        assertTrue("waiting for server up", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server up");
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         serverFactory.shutdown();
         zs.shutdown();
-        assertTrue("waiting for server down", ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server down");
     }
 
     private static class CountdownWatcher implements Watcher {
 
         volatile CountDownLatch clientConnected = new CountDownLatch(1);
+        final CountDownLatch sessionTerminated = new CountDownLatch(1);
 
         public void process(WatchedEvent event) {
-            if (event.getState() == KeeperState.SyncConnected) {
-                clientConnected.countDown();
+            switch (event.getState()) {
+                case SyncConnected:
+                    clientConnected.countDown();
+                    break;
+                case AuthFailed:
+                case Expired:
+                case Closed:
+                    sessionTerminated.countDown();
+                    break;
             }
         }
 
@@ -121,8 +130,8 @@ private DisconnectableZooKeeper createClient(int timeout, CountdownWatcher watch
     // TODO this test is failing due to client close race condition fixing in separate patch for ZOOKEEPER-63
     //    /**
     //     * this test checks to see if the sessionid that was created for the
-    //     * first zookeeper client can be reused for the second one immidiately
-    //     * after the first client closes and the new client resues them.
+    //     * first zookeeper client can be reused for the second one immediately
+    //     * after the first client closes and the new client reuses them.
     //     * @throws IOException
     //     * @throws InterruptedException
     //     * @throws KeeperException
@@ -243,21 +252,8 @@ public void testSessionMove() throws Exception {
                                                                                           % hostPorts.length], CONNECTION_TIMEOUT, new MyWatcher(Integer.toString(
                     i
                             + 1)), zk.getSessionId(), zk.getSessionPasswd());
-            final int[] result = new int[1];
-            result[0] = Integer.MAX_VALUE;
-            zknew.sync("/", (rc, path, ctx) -> {
-                synchronized (result) {
-                    result[0] = rc;
-                    result.notify();
-                }
-            }, null);
-            synchronized (result) {
-                if (result[0] == Integer.MAX_VALUE) {
-                    result.wait(5000);
-                }
-            }
-            LOG.info("{} Sync returned {}", hostPorts[(i + 1) % hostPorts.length], result[0]);
-            assertTrue(result[0] == KeeperException.Code.OK.intValue());
+            zknew.sync("/");
+            LOG.info("{} Sync succeed", hostPorts[(i + 1) % hostPorts.length]);
             zknew.setData("/", new byte[1], -1);
             try {
                 zk.setData("/", new byte[1], -1);
@@ -270,6 +266,7 @@ public void testSessionMove() throws Exception {
         }
         zk.close();
     }
+
     /**
      * This test makes sure that duplicate state changes are not communicated
      * to the client watcher. For example we should not notify state as
@@ -286,17 +283,15 @@ public void testSessionStateNoDupStateReporting() throws IOException, Interrupte
         // shutdown the server
         serverFactory.shutdown();
 
-        try {
-            Thread.sleep(10000);
-        } catch (InterruptedException e) {
-            // ignore
-        }
+        watcher.sessionTerminated.await();
 
-        // verify that the size is just 2 - ie connect then disconnect
-        // if the client attempts reconnect and we are not handling current
-        // state correctly (ie eventing on duplicate disconnects) then we'll
-        // see a disconnect for each failed connection attempt
-        assertEquals(2, watcher.states.size());
+        // verify that there is no duplicated disconnected event.
+        List<KeeperState> states = Arrays.asList(
+                KeeperState.SyncConnected,
+                KeeperState.Disconnected,
+                KeeperState.Expired
+        );
+        assertEquals(states, watcher.states);
 
         zk.close();
     }
@@ -331,11 +326,11 @@ public void testSessionTimeoutAccess() throws Exception {
 
     private class DupWatcher extends CountdownWatcher {
 
-        public List<WatchedEvent> states = new LinkedList<WatchedEvent>();
+        public List<KeeperState> states = new LinkedList<>();
         public void process(WatchedEvent event) {
             super.process(event);
             if (event.getType() == EventType.None) {
-                states.add(event);
+                states.add(event.getState());
             }
         }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTimeoutTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTimeoutTest.java
index 9bf23cab84e..5688d9f5542 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTimeoutTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTimeoutTest.java
@@ -18,21 +18,35 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.greaterThan;
+import static org.hamcrest.Matchers.greaterThanOrEqualTo;
+import static org.hamcrest.Matchers.lessThan;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
+import java.time.Duration;
+import java.util.Arrays;
+import java.util.List;
+import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.TestableZooKeeper;
 import org.apache.zookeeper.WatchedEvent;
 import org.apache.zookeeper.Watcher;
 import org.apache.zookeeper.ZooDefs;
-import org.junit.Before;
-import org.junit.Test;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.client.ZooKeeperBuilder;
+import org.apache.zookeeper.common.BusyServer;
+import org.apache.zookeeper.common.Time;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -42,12 +56,27 @@ public class SessionTimeoutTest extends ClientBase {
 
     private TestableZooKeeper zk;
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         super.setUp();
         zk = createClient();
     }
 
+    private static class ExpiredWatcher implements Watcher {
+        public volatile CompletableFuture<Void> expired = new CompletableFuture<>();
+
+        synchronized void reset() {
+            expired = new CompletableFuture<>();
+        }
+
+        @Override
+        public synchronized void process(WatchedEvent event) {
+            if (event.getState() == Event.KeeperState.Expired) {
+                expired.complete(null);
+            }
+        }
+    }
+
     @Test
     public void testSessionExpiration() throws InterruptedException, KeeperException {
         final CountDownLatch expirationLatch = new CountDownLatch(1);
@@ -72,6 +101,129 @@ public void testSessionExpiration() throws InterruptedException, KeeperException
         assertTrue(gotException);
     }
 
+    @Test
+    public void testSessionRecoveredAfterMultipleFailedAttempts() throws Exception {
+        // stop client also to gain less distraction
+        zk.close();
+
+        try (BusyServer busyServer = new BusyServer()) {
+            List<String> servers = Arrays.asList(
+                    busyServer.getHostPort(),
+                    busyServer.getHostPort(),
+                    hostPort,
+                    busyServer.getHostPort(),
+                    busyServer.getHostPort(),
+                    busyServer.getHostPort()
+                    );
+            String connectString = String.join(",", servers);
+
+            zk = createClient(new CountdownWatcher(), connectString);
+            stopServer();
+
+            // Wait beyond connectTimeout but not sessionTimeout.
+            Thread.sleep(zk.getSessionTimeout() / 2);
+
+            CompletableFuture<Void> connected = new CompletableFuture<>();
+            zk.register(event -> {
+                if (event.getState() == Watcher.Event.KeeperState.SyncConnected) {
+                    connected.complete(null);
+                } else {
+                    connected.completeExceptionally(new KeeperException.SessionExpiredException());
+                }
+            });
+
+            startServer();
+            connected.join();
+        }
+    }
+
+    @Test
+    public void testSessionExpirationAfterAllServerDown() throws Exception {
+        // stop client also to gain less distraction
+        zk.close();
+
+        // given: established session
+        int sessionTimeout = 3000; // small connection timeout to gain quick ci feedback
+        ExpiredWatcher watcher = new ExpiredWatcher();
+        zk = createClient(new CountdownWatcher(), hostPort, sessionTimeout);
+        zk.register(watcher);
+
+        // when: all server down
+        long start = Time.currentElapsedTime();
+        zk.sync("/"); // touch timeout counts
+        stopServer();
+
+        // then: get Expired after session timeout
+        watcher.expired.join();
+        long elapsed = Time.currentElapsedTime() - start;
+        assertThat(elapsed, greaterThanOrEqualTo((long) zk.getSessionTimeout()));
+        assertThat(elapsed, lessThan(zk.getSessionTimeout() * 10L));
+
+        // then: future request will get SessionExpiredException
+        assertThrows(KeeperException.SessionExpiredException.class, () -> zk.exists("/", null));
+    }
+
+    @Test
+    public void testSessionExpirationWhenNoServerUp() throws Exception {
+        // stop client also to gain less distraction
+        zk.close();
+
+        // given: unavailable cluster
+        stopServer();
+
+        // when: try to establish a brand-new session
+        int sessionTimeout = 300; // small connection timeout to gain quick ci feedback
+        ExpiredWatcher watcher = new ExpiredWatcher();
+        try (ZooKeeper zk = new ZooKeeper(hostPort, sessionTimeout, watcher)) {
+            // then: never Expired
+            assertThrows(TimeoutException.class, () -> watcher.expired.get(3 * sessionTimeout, TimeUnit.MILLISECONDS));
+            assertThrows(KeeperException.ConnectionLossException.class, () -> zk.exists("/", null));
+        }
+
+        // when: try to establish a brand-new session using builder with default newSessionTimeout
+        watcher.reset();
+        try (ZooKeeper zk = new ZooKeeperBuilder(hostPort, Duration.ofMillis(sessionTimeout))
+                .withDefaultWatcher(watcher)
+                .build()) {
+            // then: never Expired
+            assertThrows(TimeoutException.class, () -> watcher.expired.get(3 * sessionTimeout, TimeUnit.MILLISECONDS));
+            assertThrows(KeeperException.ConnectionLossException.class, () -> zk.exists("/", null));
+        }
+
+        // when: try to establish a brand-new session using builder with Duration.ZERO newSessionTimeout
+        watcher.reset();
+        long start = Time.currentElapsedTime();
+        try (ZooKeeper zk = new ZooKeeperBuilder(hostPort, Duration.ofMillis(sessionTimeout))
+                .withDefaultWatcher(watcher)
+                .withNewSessionTimeout(Duration.ZERO)
+                .build()) {
+            // then: get Expired after some delay
+            watcher.expired.join();
+            long elapsed = Time.currentElapsedTime() - start;
+            assertThat(elapsed, greaterThan((long) sessionTimeout));
+            assertThat(elapsed, lessThan(sessionTimeout * 10L));
+            // then: future request will get SessionExpiredException
+            assertThrows(KeeperException.SessionExpiredException.class, () -> zk.exists("/", null));
+        }
+
+        // when: try to establish a brand-new session using builder with custom newSessionTimeout
+        watcher.reset();
+        start = Time.currentElapsedTime();
+        Duration newSessionTimeout = Duration.ofMillis(300);
+        try (ZooKeeper zk = new ZooKeeperBuilder(hostPort, Duration.ofMillis(30000))
+                .withDefaultWatcher(watcher)
+                .withNewSessionTimeout(newSessionTimeout)
+                .build()) {
+            // then: get Expired after newSessionTimeout
+            watcher.expired.join();
+            long elapsed = Time.currentElapsedTime() - start;
+            assertThat(elapsed, greaterThanOrEqualTo(newSessionTimeout.toMillis()));
+            assertThat(elapsed, lessThan(newSessionTimeout.toMillis() * 10));
+            // then: future request will get SessionExpiredException
+            assertThrows(KeeperException.SessionExpiredException.class, () -> zk.exists("/", null));
+        }
+    }
+
     @Test
     public void testQueueEvent() throws InterruptedException, KeeperException {
         final CountDownLatch eventLatch = new CountDownLatch(1);
@@ -95,12 +247,12 @@ public void testQueueEvent() throws InterruptedException, KeeperException {
     @Test
     public void testSessionDisconnect() throws KeeperException, InterruptedException, IOException {
         zk.create("/sdisconnect", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL);
-        assertNotNull("Ephemeral node has not been created", zk.exists("/sdisconnect", null));
+        assertNotNull(zk.exists("/sdisconnect", null), "Ephemeral node has not been created");
 
         zk.close();
 
         zk = createClient();
-        assertNull("Ephemeral node shouldn't exist after client disconnect", zk.exists("/sdisconnect", null));
+        assertNull(zk.exists("/sdisconnect", null), "Ephemeral node shouldn't exist after client disconnect");
     }
 
     /**
@@ -109,13 +261,13 @@ public void testSessionDisconnect() throws KeeperException, InterruptedException
     @Test
     public void testSessionRestore() throws KeeperException, InterruptedException, IOException {
         zk.create("/srestore", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL);
-        assertNotNull("Ephemeral node has not been created", zk.exists("/srestore", null));
+        assertNotNull(zk.exists("/srestore", null), "Ephemeral node has not been created");
 
         zk.disconnect();
         zk.close();
 
         zk = createClient();
-        assertNotNull("Ephemeral node should be present when session is restored", zk.exists("/srestore", null));
+        assertNotNull(zk.exists("/srestore", null), "Ephemeral node should be present when session is restored");
     }
 
     /**
@@ -124,14 +276,14 @@ public void testSessionRestore() throws KeeperException, InterruptedException, I
     @Test
     public void testSessionSurviveServerRestart() throws Exception {
         zk.create("/sdeath", new byte[0], ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.EPHEMERAL);
-        assertNotNull("Ephemeral node has not been created", zk.exists("/sdeath", null));
+        assertNotNull(zk.exists("/sdeath", null), "Ephemeral node has not been created");
 
         zk.disconnect();
         stopServer();
         startServer();
         zk = createClient();
 
-        assertNotNull("Ephemeral node should be present when server restarted", zk.exists("/sdeath", null));
+        assertNotNull(zk.exists("/sdeath", null), "Ephemeral node should be present when server restarted");
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTrackerCheckTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTrackerCheckTest.java
index a0d5c915ef3..d0ea52bd2da 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTrackerCheckTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionTrackerCheckTest.java
@@ -18,7 +18,7 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.concurrent.ConcurrentHashMap;
 import org.apache.zookeeper.KeeperException.SessionExpiredException;
 import org.apache.zookeeper.ZKTestCase;
@@ -27,9 +27,9 @@
 import org.apache.zookeeper.server.ZooKeeperServerListener;
 import org.apache.zookeeper.server.quorum.LeaderSessionTracker;
 import org.apache.zookeeper.server.quorum.LearnerSessionTracker;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -43,7 +43,7 @@ public class SessionTrackerCheckTest extends ZKTestCase {
     public static final int TICK_TIME = 1000;
     public static final int CONNECTION_TIMEOUT = TICK_TIME * 10;
 
-    private ConcurrentHashMap<Long, Integer> sessionsWithTimeouts = new ConcurrentHashMap<Long, Integer>();
+    private ConcurrentHashMap<Long, Integer> sessionsWithTimeouts = new ConcurrentHashMap<>();
 
     private class Expirer implements SessionExpirer {
 
@@ -62,12 +62,12 @@ public long getServerId() {
 
     }
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         sessionsWithTimeouts.clear();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
     }
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionUpgradeTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionUpgradeTest.java
index f10f6c8d8b4..f01e891fb5f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionUpgradeTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SessionUpgradeTest.java
@@ -18,18 +18,18 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.fail;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -48,7 +48,7 @@ public class SessionUpgradeTest extends ZKTestCase {
 
     private final QuorumBase qb = new QuorumBase();
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         LOG.info("STARTING quorum {}", getClass().getName());
         qb.localSessionsEnabled = true;
@@ -57,7 +57,7 @@ public void setUp() throws Exception {
         ClientBase.waitForServerUp(qb.hostPort, 10000);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         LOG.info("STOPPING quorum {}", getClass().getName());
         qb.tearDown();
@@ -76,7 +76,7 @@ public void testLocalSessionsWithoutEphemeralOnLeader() throws Exception {
     private void testLocalSessionsWithoutEphemeral(boolean testLeader) throws Exception {
         String nodePrefix = "/testLocalSessions-" + (testLeader ? "leaderTest-" : "followerTest-");
         int leaderIdx = qb.getLeaderIndex();
-        assertFalse("No leader in quorum?", leaderIdx == -1);
+        assertFalse(leaderIdx == -1, "No leader in quorum?");
         int followerIdx = (leaderIdx + 1) % 5;
         int otherFollowerIdx = (leaderIdx + 2) % 5;
         int testPeerIdx = testLeader ? leaderIdx : followerIdx;
@@ -94,7 +94,7 @@ private void testLocalSessionsWithoutEphemeral(boolean testLeader) throws Except
         byte[] localSessionPwd = zk.getSessionPasswd().clone();
 
         // Try connecting with the same session id on a different
-        // server.  This should fail since it is a local sesion.
+        // server.  This should fail since it is a local session.
         try {
             watcher.reset();
             DisconnectableZooKeeper zknew = new DisconnectableZooKeeper(hostPorts[otherFollowerIdx], CONNECTION_TIMEOUT, watcher, localSessionId, localSessionPwd);
@@ -156,7 +156,7 @@ public void testUpgradeWithEphemeralOnLeader() throws Exception {
     private void testUpgradeWithEphemeral(boolean testLeader) throws Exception {
         String nodePrefix = "/testUpgrade-" + (testLeader ? "leaderTest-" : "followerTest-");
         int leaderIdx = qb.getLeaderIndex();
-        assertFalse("No leader in quorum?", leaderIdx == -1);
+        assertFalse(leaderIdx == -1, "No leader in quorum?");
         int followerIdx = (leaderIdx + 1) % 5;
         int otherFollowerIdx = (leaderIdx + 2) % 5;
         int testPeerIdx = testLeader ? leaderIdx : followerIdx;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SledgeHammer.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SledgeHammer.java
index 8190797e4f1..867a092a293 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SledgeHammer.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SledgeHammer.java
@@ -58,9 +58,9 @@ public void run() {
             for (int i = 0; i < count; i++) {
                 try {
                     System.out.print(i + "\r");
-                    List<String> childs = zk.getChildren("/hammers", false);
-                    Collections.shuffle(childs);
-                    for (String s : childs) {
+                    List<String> children = zk.getChildren("/hammers", false);
+                    Collections.shuffle(children);
+                    for (String s : children) {
                         if (s.startsWith("hammer-")) {
                             s = "/hammers/" + s;
                             zk.setData(s, tag, -1);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StandaloneTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StandaloneTest.java
index 8541d7abdfc..49e648b0e72 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StandaloneTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StandaloneTest.java
@@ -19,9 +19,9 @@
 package org.apache.zookeeper.test;
 
 import static org.apache.zookeeper.test.ClientBase.CONNECTION_TIMEOUT;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.util.ArrayList;
 import java.util.List;
@@ -36,8 +36,8 @@
 import org.apache.zookeeper.server.quorum.QuorumPeerConfig;
 import org.apache.zookeeper.server.quorum.QuorumPeerTestBase;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -48,7 +48,7 @@ public class StandaloneTest extends QuorumPeerTestBase implements Watcher {
 
     protected static final Logger LOG = LoggerFactory.getLogger(StandaloneTest.class);
 
-    @Before
+    @BeforeEach
     public void setup() {
         System.setProperty("zookeeper.DigestAuthenticationProvider.superDigest", "super:D/InIHSb7yEEbrWz8b9l71RjZJU="/* password is 'test'*/);
         QuorumPeerConfig.setReconfigEnabled(true);
@@ -106,11 +106,10 @@ public void testClientPortInStaticFile() throws Exception {
     void verifyStandalone(MainThread mt, int clientPort) throws InterruptedException {
         mt.start();
         try {
-            assertTrue(
-                    "waiting for server 1 being up",
-                    ClientBase.waitForServerUp("127.0.0.1:" + clientPort, CONNECTION_TIMEOUT));
+            assertTrue(ClientBase.waitForServerUp("127.0.0.1:" + clientPort, CONNECTION_TIMEOUT),
+                    "waiting for server 1 being up");
         } finally {
-            assertFalse("Error- MainThread started in Quorum Mode!", mt.isQuorumPeerRunning());
+            assertFalse(mt.isQuorumPeerRunning(), "Error- MainThread started in Quorum Mode!");
             mt.shutdown();
         }
     }
@@ -131,14 +130,14 @@ public void testStandaloneReconfigFails() throws Exception {
 
         ServerCnxnFactory f = ServerCnxnFactory.createFactory(CLIENT_PORT, -1);
         f.startup(zks);
-        assertTrue("waiting for server being up ", ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerUp(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being up ");
 
         CountdownWatcher watcher = new CountdownWatcher();
         ZooKeeper zk = new ZooKeeper(HOSTPORT, CONNECTION_TIMEOUT, watcher);
         ZooKeeperAdmin zkAdmin = new ZooKeeperAdmin(HOSTPORT, CONNECTION_TIMEOUT, watcher);
         watcher.waitForConnected(CONNECTION_TIMEOUT);
 
-        List<String> joiners = new ArrayList<String>();
+        List<String> joiners = new ArrayList<>();
         joiners.add("server.2=localhost:1234:1235;1236");
         // generate some transactions that will get logged
         try {
@@ -152,7 +151,7 @@ public void testStandaloneReconfigFails() throws Exception {
 
         zks.shutdown();
         f.shutdown();
-        assertTrue("waiting for server being down ", ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT));
+        assertTrue(ClientBase.waitForServerDown(HOSTPORT, CONNECTION_TIMEOUT), "waiting for server being down ");
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StatTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StatTest.java
index cf575139b2f..640710b585a 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StatTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StatTest.java
@@ -18,20 +18,23 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotSame;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotSame;
 import java.io.IOException;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.data.Stat;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class StatTest extends ClientBase {
 
     private ZooKeeper zk;
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         super.setUp();
@@ -39,6 +42,7 @@ public void setUp() throws Exception {
         zk = createClient();
     }
 
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         super.tearDown();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StaticHostProviderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StaticHostProviderTest.java
index 7095c14f092..7ab20751960 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StaticHostProviderTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StaticHostProviderTest.java
@@ -22,18 +22,20 @@
 import static org.hamcrest.CoreMatchers.equalTo;
 import static org.hamcrest.CoreMatchers.hasItems;
 import static org.hamcrest.CoreMatchers.instanceOf;
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.core.Is.is;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotSame;
-import static org.junit.Assert.assertSame;
-import static org.junit.Assert.assertThat;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotSame;
+import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.spy;
 import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
-import static org.mockito.Mockito.when;
+import java.net.Inet4Address;
+import java.net.Inet6Address;
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
 import java.net.UnknownHostException;
@@ -41,16 +43,42 @@
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.Collections;
+import java.util.LinkedHashMap;
 import java.util.List;
+import java.util.Map;
 import java.util.Random;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.client.HostProvider;
 import org.apache.zookeeper.client.StaticHostProvider;
 import org.apache.zookeeper.common.Time;
-import org.junit.Test;
+import org.burningwave.tools.net.DefaultHostResolver;
+import org.burningwave.tools.net.HostResolutionRequestInterceptor;
+import org.burningwave.tools.net.MappedHostResolver;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
 
 public class StaticHostProviderTest extends ZKTestCase {
 
+    @BeforeAll
+    public static void setupDNSMocks() {
+        Map<String, String> hostAliases = new LinkedHashMap<>();
+        hostAliases.put("site1.mock", "192.168.1.1");
+        hostAliases.put("site2.mock", "192.168.1.2");
+        hostAliases.put("site3.mock", "192.168.1.3");
+        hostAliases.put("site4.mock", "192.168.1.4");
+
+        HostResolutionRequestInterceptor.INSTANCE.install(
+                new MappedHostResolver(hostAliases),
+                DefaultHostResolver.INSTANCE
+        );
+    }
+
+    @AfterAll
+    public static void clearDNSMocks() {
+        HostResolutionRequestInterceptor.INSTANCE.uninstall();
+    }
+
     private Random r = new Random(1);
 
     @Test
@@ -90,9 +118,12 @@ public void testNextDoesNotSleepForZero() {
         assertTrue(5 > stop - start);
     }
 
-    @Test(expected = IllegalArgumentException.class)
+
+    @Test
     public void testEmptyServerAddressesList() {
-        HostProvider hp = new StaticHostProvider(new ArrayList<>());
+        assertThrows(IllegalArgumentException.class, () -> {
+            HostProvider hp = new StaticHostProvider(new ArrayList<>());
+        });
     }
 
     @Test
@@ -111,8 +142,8 @@ public InetAddress[] getAllByName(String name) throws UnknownHostException {
 
         // Act & Assert
         InetSocketAddress n1 = sp.next(0);
-        assertTrue("Provider should return unresolved address is host is unresolvable", n1.isUnresolved());
-        assertSame("Provider should return original address is host is unresolvable", unresolved, n1);
+        assertTrue(n1.isUnresolved(), "Provider should return unresolved address is host is unresolvable");
+        assertSame(unresolved, n1, "Provider should return original address is host is unresolvable");
     }
 
     @Test
@@ -166,7 +197,7 @@ public void testUpdateClientMigrateOrNot() throws UnknownHostException {
         hostProvider.onConnected();
 
         // Number of machines increased, my server is not in the new cluster
-        newList = new ArrayList<InetSocketAddress>(3);
+        newList = new ArrayList<>(3);
         for (byte i = 4; i > 1; i--) { // 10.10.10.4:1238, 10.10.10.3:1237, 10.10.10.2:1236
             newList.add(new InetSocketAddress(InetAddress.getByAddress(new byte[]{10, 10, 10, i}), 1234 + i));
         }
@@ -200,20 +231,20 @@ public void testUpdateClientMigrateOrNot() throws UnknownHostException {
     public void testUpdateMigrationGoesRound() throws UnknownHostException {
         HostProvider hostProvider = getHostProvider((byte) 4);
         // old list (just the ports): 1238, 1237, 1236, 1235
-        Collection<InetSocketAddress> newList = new ArrayList<InetSocketAddress>(10);
+        Collection<InetSocketAddress> newList = new ArrayList<>(10);
         for (byte i = 12; i > 2; i--) { // 1246, 1245, 1244, 1243, 1242, 1241,
             // 1240, 1239, 1238, 1237
             newList.add(new InetSocketAddress(InetAddress.getByAddress(new byte[]{10, 10, 10, i}), 1234 + i));
         }
 
         // servers from the old list that appear in the new list
-        Collection<InetSocketAddress> oldStaying = new ArrayList<InetSocketAddress>(2);
+        Collection<InetSocketAddress> oldStaying = new ArrayList<>(2);
         for (byte i = 4; i > 2; i--) { // 1238, 1237
             oldStaying.add(new InetSocketAddress(InetAddress.getByAddress(new byte[]{10, 10, 10, i}), 1234 + i));
         }
 
         // servers in the new list that are not in the old list
-        Collection<InetSocketAddress> newComing = new ArrayList<InetSocketAddress>(10);
+        Collection<InetSocketAddress> newComing = new ArrayList<>(10);
         for (byte i = 12; i > 4; i--) {// 1246, 1245, 1244, 1243, 1242, 1241, 1240, 1139
             newComing.add(new InetSocketAddress(InetAddress.getByAddress(new byte[]{10, 10, 10, i}), 1234 + i));
         }
@@ -229,7 +260,7 @@ public void testUpdateMigrationGoesRound() throws UnknownHostException {
         // This means reconfigMode = true, and nextHostInReconfigMode will be
         // called from next
         // Since pNew = 1 we should first try the new servers
-        ArrayList<InetSocketAddress> seen = new ArrayList<InetSocketAddress>();
+        ArrayList<InetSocketAddress> seen = new ArrayList<>();
         for (int i = 0; i < newComing.size(); i++) {
             InetSocketAddress addr = hostProvider.next(0);
             assertTrue(newComing.contains(addr));
@@ -322,7 +353,7 @@ public void testUpdateLoadBalancing() throws UnknownHostException {
 
         // remove host number 0 (the first one in the current list)
         // and add back hosts 6, 7 and 8
-        newList = new ArrayList<InetSocketAddress>(8);
+        newList = new ArrayList<>(8);
         for (byte i = 9; i > 1; i--) {
             newList.add(new InetSocketAddress(InetAddress.getByAddress(new byte[]{10, 10, 10, i}), 1234 + i));
         }
@@ -483,7 +514,7 @@ private StaticHostProvider getHostProvider(byte size) {
     }
 
     private Collection<InetSocketAddress> getServerAddresses(byte size) {
-        ArrayList<InetSocketAddress> list = new ArrayList<InetSocketAddress>(size);
+        ArrayList<InetSocketAddress> list = new ArrayList<>(size);
         while (size > 0) {
             try {
                 list.add(new InetSocketAddress(InetAddress.getByAddress(new byte[]{10, 10, 10, size}), 1234 + size));
@@ -696,15 +727,12 @@ public void testLiteralIPNoReverseNS() {
     public void testReResolvingSingle() throws UnknownHostException {
         // Arrange
         byte size = 1;
-        ArrayList<InetSocketAddress> list = new ArrayList<InetSocketAddress>(size);
+        ArrayList<InetSocketAddress> list = new ArrayList<>(size);
 
         // Test a hostname that resolves to a single address
         list.add(InetSocketAddress.createUnresolved("issues.apache.org", 1234));
 
-        final InetAddress issuesApacheOrg = mock(InetAddress.class);
-        when(issuesApacheOrg.getHostAddress()).thenReturn("192.168.1.1");
-        when(issuesApacheOrg.toString()).thenReturn("issues.apache.org");
-        when(issuesApacheOrg.getHostName()).thenReturn("issues.apache.org");
+        final InetAddress issuesApacheOrg = InetAddress.getByName("site1.mock");
 
         StaticHostProvider.Resolver resolver = new StaticHostProvider.Resolver() {
             @Override
@@ -730,22 +758,16 @@ public InetAddress[] getAllByName(String name) {
     public void testReResolvingMultiple() throws UnknownHostException {
         // Arrange
         byte size = 1;
-        ArrayList<InetSocketAddress> list = new ArrayList<InetSocketAddress>(size);
+        ArrayList<InetSocketAddress> list = new ArrayList<>(size);
 
         // Test a hostname that resolves to multiple addresses
         list.add(InetSocketAddress.createUnresolved("www.apache.org", 1234));
 
-        final InetAddress apacheOrg1 = mock(InetAddress.class);
-        when(apacheOrg1.getHostAddress()).thenReturn("192.168.1.1");
-        when(apacheOrg1.toString()).thenReturn("www.apache.org");
-        when(apacheOrg1.getHostName()).thenReturn("www.apache.org");
+        final InetAddress apacheOrg1 = InetAddress.getByName("site1.mock");
 
-        final InetAddress apacheOrg2 = mock(InetAddress.class);
-        when(apacheOrg2.getHostAddress()).thenReturn("192.168.1.2");
-        when(apacheOrg2.toString()).thenReturn("www.apache.org");
-        when(apacheOrg2.getHostName()).thenReturn("www.apache.org");
+        final InetAddress apacheOrg2 = InetAddress.getByName("site2.mock");
 
-        final List<InetAddress> resolvedAddresses = new ArrayList<InetAddress>();
+        final List<InetAddress> resolvedAddresses = new ArrayList<>();
         resolvedAddresses.add(apacheOrg1);
         resolvedAddresses.add(apacheOrg2);
         StaticHostProvider.Resolver resolver = new StaticHostProvider.Resolver() {
@@ -772,16 +794,13 @@ public InetAddress[] getAllByName(String name) {
     @Test
     public void testReResolveMultipleOneFailing() throws UnknownHostException {
         // Arrange
-        final List<InetSocketAddress> list = new ArrayList<InetSocketAddress>();
+        final List<InetSocketAddress> list = new ArrayList<>();
         list.add(InetSocketAddress.createUnresolved("www.apache.org", 1234));
-        final List<String> ipList = new ArrayList<String>();
-        final List<InetAddress> resolvedAddresses = new ArrayList<InetAddress>();
+        final List<String> ipList = new ArrayList<>();
+        final List<InetAddress> resolvedAddresses = new ArrayList<>();
         for (int i = 0; i < 3; i++) {
             ipList.add(String.format("192.168.1.%d", i + 1));
-            final InetAddress apacheOrg = mock(InetAddress.class);
-            when(apacheOrg.getHostAddress()).thenReturn(String.format("192.168.1.%d", i + 1));
-            when(apacheOrg.toString()).thenReturn(String.format("192.168.1.%d", i + 1));
-            when(apacheOrg.getHostName()).thenReturn("www.apache.org");
+            final InetAddress apacheOrg = InetAddress.getByName("site" + (i + 1) + ".mock");
             resolvedAddresses.add(apacheOrg);
         }
 
@@ -796,37 +815,34 @@ public InetAddress[] getAllByName(String name) {
 
         // Act & Assert
         InetSocketAddress resolvedFirst = hostProvider.next(0);
-        assertFalse("HostProvider should return resolved addresses", resolvedFirst.isUnresolved());
+        assertFalse(resolvedFirst.isUnresolved(), "HostProvider should return resolved addresses");
         assertThat("Bad IP address returned", ipList, hasItems(resolvedFirst.getAddress().getHostAddress()));
 
         hostProvider.onConnected(); // first address worked
 
         InetSocketAddress resolvedSecond = hostProvider.next(0);
-        assertFalse("HostProvider should return resolved addresses", resolvedSecond.isUnresolved());
+        assertFalse(resolvedSecond.isUnresolved(), "HostProvider should return resolved addresses");
         assertThat("Bad IP address returned", ipList, hasItems(resolvedSecond.getAddress().getHostAddress()));
 
         // Second address doesn't work, so we don't call onConnected() this time
         // StaticHostProvider should try to re-resolve the address in this case
 
         InetSocketAddress resolvedThird = hostProvider.next(0);
-        assertFalse("HostProvider should return resolved addresses", resolvedThird.isUnresolved());
+        assertFalse(resolvedThird.isUnresolved(), "HostProvider should return resolved addresses");
         assertThat("Bad IP address returned", ipList, hasItems(resolvedThird.getAddress().getHostAddress()));
 
-        verify(spyResolver, times(3)).getAllByName("www.apache.org");  // resolution occured every time
+        verify(spyResolver, times(3)).getAllByName("www.apache.org");  // resolution occurred every time
     }
 
     @Test
     public void testEmptyResolution() throws UnknownHostException {
         // Arrange
-        final List<InetSocketAddress> list = new ArrayList<InetSocketAddress>();
+        final List<InetSocketAddress> list = new ArrayList<>();
         list.add(InetSocketAddress.createUnresolved("www.apache.org", 1234));
         list.add(InetSocketAddress.createUnresolved("www.google.com", 1234));
-        final List<InetAddress> resolvedAddresses = new ArrayList<InetAddress>();
+        final List<InetAddress> resolvedAddresses = new ArrayList<>();
 
-        final InetAddress apacheOrg1 = mock(InetAddress.class);
-        when(apacheOrg1.getHostAddress()).thenReturn("192.168.1.1");
-        when(apacheOrg1.toString()).thenReturn("www.apache.org");
-        when(apacheOrg1.getHostName()).thenReturn("www.apache.org");
+        final InetAddress apacheOrg1 = InetAddress.getByName("site1.mock");
 
         resolvedAddresses.add(apacheOrg1);
 
@@ -848,9 +864,9 @@ public InetAddress[] getAllByName(String name) {
             InetSocketAddress resolved = hostProvider.next(0);
             hostProvider.onConnected();
             if (resolved.getHostName().equals("www.google.com")) {
-                assertTrue("HostProvider should return unresolved address if host is unresolvable", resolved.isUnresolved());
+                assertTrue(resolved.isUnresolved(), "HostProvider should return unresolved address if host is unresolvable");
             } else {
-                assertFalse("HostProvider should return resolved addresses", resolved.isUnresolved());
+                assertFalse(resolved.isUnresolved(), "HostProvider should return resolved addresses");
                 assertEquals("192.168.1.1", resolved.getAddress().getHostAddress());
             }
         }
@@ -862,7 +878,7 @@ public InetAddress[] getAllByName(String name) {
     @Test
     public void testReResolvingLocalhost() {
         byte size = 2;
-        ArrayList<InetSocketAddress> list = new ArrayList<InetSocketAddress>(size);
+        ArrayList<InetSocketAddress> list = new ArrayList<>(size);
 
         // Test a hostname that resolves to multiple addresses
         list.add(InetSocketAddress.createUnresolved("localhost", 1234));
@@ -871,11 +887,45 @@ public void testReResolvingLocalhost() {
         int sizeBefore = hostProvider.size();
         InetSocketAddress next = hostProvider.next(0);
         next = hostProvider.next(0);
-        assertTrue("Different number of addresses in the list: "
-                           + hostProvider.size()
-                           + " (after), "
-                           + sizeBefore
-                           + " (before)", hostProvider.size() == sizeBefore);
+        assertTrue(hostProvider.size() == sizeBefore,
+                "Different number of addresses in the list: "
+                        + hostProvider.size() + " (after), " + sizeBefore + " (before)");
+    }
+
+    @Test
+    public void testResolverKeepsResolutionOrderPreferV6() {
+        // Arrange
+        Collection<InetSocketAddress> servers = new ArrayList<>();
+        servers.add(InetSocketAddress.createUnresolved("test-server-name", 1111));
+        InetAddress[] resolvedAddresses = new InetAddress[] {
+            mock(Inet6Address.class),
+            mock(Inet4Address.class)
+        };
+        StaticHostProvider staticHostProvider = new StaticHostProvider(servers, name -> resolvedAddresses);
+
+        // Act & Assert
+        for (int i = 0; i < 100; i++) {
+           InetSocketAddress next = staticHostProvider.next(0);
+           assertSame(next.getAddress(), resolvedAddresses[0], "Default resolver should always return the first address");
+        }
+    }
+
+    @Test
+    public void testResolverKeepsResolutionOrderPreferV4() {
+        // Arrange
+        Collection<InetSocketAddress> servers = new ArrayList<>();
+        servers.add(InetSocketAddress.createUnresolved("test-server-name", 1111));
+        InetAddress[] resolvedAddresses = new InetAddress[] {
+            mock(Inet4Address.class),
+            mock(Inet6Address.class)
+        };
+        StaticHostProvider staticHostProvider = new StaticHostProvider(servers, name -> resolvedAddresses);
+
+        // Act & Assert
+        for (int i = 0; i < 100; i++) {
+            InetSocketAddress next = staticHostProvider.next(0);
+            assertSame(next.getAddress(), resolvedAddresses[0], "Default resolver should always return the first address");
+        }
     }
 
     private StaticHostProvider getHostProviderUnresolved(byte size) {
@@ -883,7 +933,7 @@ private StaticHostProvider getHostProviderUnresolved(byte size) {
     }
 
     private Collection<InetSocketAddress> getUnresolvedServerAddresses(byte size) {
-        ArrayList<InetSocketAddress> list = new ArrayList<InetSocketAddress>(size);
+        ArrayList<InetSocketAddress> list = new ArrayList<>(size);
         while (size > 0) {
             list.add(InetSocketAddress.createUnresolved("10.10.10." + size, 1234 + size));
             --size;
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StatsTrackTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StatsTrackTest.java
new file mode 100644
index 00000000000..4bf69befa33
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StatsTrackTest.java
@@ -0,0 +1,135 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import org.apache.zookeeper.StatsTrack;
+import org.junit.Assert;
+import org.junit.Test;
+
+public class StatsTrackTest {
+
+    public static class OldStatsTrack {
+        private int count;
+        private long bytes;
+        private String countStr = "count";
+        private String byteStr = "bytes";
+
+        /**
+         * a default constructor for
+         * stats
+         */
+        public OldStatsTrack() {
+            this(null);
+        }
+        /**
+         * the stat string should be of the form count=int,bytes=long
+         * if stats is called with null the count and bytes are initialized
+         * to -1.
+         * @param stats the stat string to be initialized with
+         */
+        public OldStatsTrack(String stats) {
+            if (stats == null) {
+                stats = "count=-1,bytes=-1";
+            }
+            String[] split = stats.split(",");
+            if (split.length != 2) {
+                throw new IllegalArgumentException("invalid string " + stats);
+            }
+            count = Integer.parseInt(split[0].split("=")[1]);
+            bytes = Long.parseLong(split[1].split("=")[1]);
+        }
+
+
+        /**
+         * get the count of nodes allowed as part of quota
+         *
+         * @return the count as part of this string
+         */
+        public int getCount() {
+            return this.count;
+        }
+
+        /**
+         * set the count for this stat tracker.
+         *
+         * @param count
+         *            the count to set with
+         */
+        public void setCount(int count) {
+            this.count = count;
+        }
+
+        /**
+         * get the count of bytes allowed as part of quota
+         *
+         * @return the bytes as part of this string
+         */
+        public long getBytes() {
+            return this.bytes;
+        }
+
+        /**
+         * set the bytes for this stat tracker.
+         *
+         * @param bytes
+         *            the bytes to set with
+         */
+        public void setBytes(long bytes) {
+            this.bytes = bytes;
+        }
+
+        @Override
+        /*
+         * returns the string that maps to this stat tracking.
+         */
+        public String toString() {
+            return countStr + "=" + count + "," + byteStr + "=" + bytes;
+        }
+    }
+
+    @Test
+    public void testBackwardCompatibility() {
+        StatsTrack quota = new StatsTrack();
+        quota.setCount(4);
+        quota.setCountHardLimit(4);
+        quota.setBytes(9L);
+        quota.setByteHardLimit(15L);
+        Assert.assertEquals("count=4,bytes=9=;byteHardLimit=15;countHardLimit=4", quota.toString());
+
+        OldStatsTrack ost = new OldStatsTrack(quota.toString());
+        Assert.assertTrue("bytes are set", ost.getBytes() == 9L);
+        Assert.assertTrue("num count is set", ost.getCount() == 4);
+        Assert.assertEquals("count=4,bytes=9", ost.toString());
+    }
+
+    @Test
+    public void testUpwardCompatibility() {
+        OldStatsTrack ost = new OldStatsTrack(null);
+        ost.setCount(2);
+        ost.setBytes(5);
+        Assert.assertEquals("count=2,bytes=5", ost.toString());
+
+        StatsTrack st = new StatsTrack(ost.toString());
+        Assert.assertEquals("count=2,bytes=5", st.toString());
+        Assert.assertEquals(5, st.getBytes());
+        Assert.assertEquals(2, st.getCount());
+        Assert.assertEquals(-1, st.getByteHardLimit());
+        Assert.assertEquals(-1, st.getCountHardLimit());
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StringUtilTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StringUtilTest.java
index caa3db6318a..35c70e095ea 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/StringUtilTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/StringUtilTest.java
@@ -18,25 +18,55 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import java.util.Arrays;
+import java.util.Collections;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.common.StringUtils;
-import org.junit.Test;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
 
 public class StringUtilTest extends ZKTestCase {
 
     @Test
-    public void testStrings() {
+    public void testStringSplit() {
+        final String s1 = "   a  ,   b  , ";
+        assertEquals(Arrays.asList("a", "b"), StringUtils.split(s1, ","));
 
-        String s1 = "   a  ,   b  , ";
-        assertEquals("[a, b]", StringUtils.split(s1, ",").toString());
+        assertEquals(Collections.emptyList(), StringUtils.split("", ","));
 
-        String s2 = "";
-        assertEquals(0, StringUtils.split(s2, ",").size());
+        final String s3 = "1, , 2";
+        assertEquals(Arrays.asList("1", "2"), StringUtils.split(s3, ","));
 
-        String s3 = "1, , 2";
-        assertEquals("[1, 2]", StringUtils.split(s3, ",").toString());
+        final String s4 = "1, \t , 2";
+        assertEquals(Arrays.asList("1", "2"), StringUtils.split(s4, ","));
+    }
+
+    @Test
+    public void testStringJoinNullDelim() {
+        Assertions.assertThrows(NullPointerException.class, () -> {
+            StringUtils.joinStrings(Collections.emptyList(), null);
+        });
+    }
 
+    @Test
+    public void testStringJoinNullListNullDelim() {
+        Assertions.assertThrows(NullPointerException.class, () -> {
+            StringUtils.joinStrings(null, null);
+        });
+    }
+
+    @Test
+    public void testStringJoinNullList() {
+        assertNull(StringUtils.joinStrings(null, ","));
+    }
+
+    @Test
+    public void testStringJoin() {
+        final String expected = "a,B,null,d";
+        assertEquals(expected,
+            StringUtils.joinStrings(Arrays.asList("a", "B", null, "d"), ","));
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SyncCallTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SyncCallTest.java
index d743da077ab..684045ee723 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/SyncCallTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/SyncCallTest.java
@@ -18,8 +18,8 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.Date;
 import java.util.LinkedList;
@@ -36,7 +36,7 @@
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.data.Stat;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class SyncCallTest extends ClientBase implements ChildrenCallback, Children2Callback, StringCallback, VoidCallback, Create2Callback {
 
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/TestUtils.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/TestUtils.java
index a38d49e4866..8941c05de0e 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/TestUtils.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/TestUtils.java
@@ -18,8 +18,14 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
+import java.util.Collections;
+import java.util.List;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
+import org.apache.zookeeper.WatchedEvent;
 
 /**
  * This class contains test utility methods
@@ -57,4 +63,39 @@ public static boolean deleteFileRecursively(File file) {
         return deleteFileRecursively(file, false);
     }
 
+    /**
+     * Asserts that the given {@link WatchedEvent} are semantically equal, i.e. they have the same EventType, path and
+     * zxid.
+     */
+    public static void assertWatchedEventEquals(WatchedEvent expected, WatchedEvent actual) {
+        // TODO: .hashCode and .equals cannot be added to WatchedEvent without potentially breaking consumers. This
+        //  can be changed to `assertEquals(expected, actual)` once WatchedEvent has those methods. Until then,
+        //  compare the lists manually.
+        assertEquals(expected.getType(), actual.getType());
+        assertEquals(expected.getPath(), actual.getPath());
+        assertEquals(expected.getZxid(), actual.getZxid());
+    }
+
+    /**
+     * Return all threads
+     *
+     * Code based on commons-lang3 ThreadUtils
+     *
+     * @return all active threads
+     */
+    public static List<Thread> getAllThreads() {
+        ThreadGroup threadGroup = Thread.currentThread().getThreadGroup();
+        while (threadGroup != null && threadGroup.getParent() != null) {
+            threadGroup = threadGroup.getParent();
+        }
+
+        int count = threadGroup.activeCount();
+        Thread[] threads;
+        do {
+            threads = new Thread[count + count / 2 + 1]; //slightly grow the array size
+            count = threadGroup.enumerate(threads, true);
+            //return value of enumerate() must be strictly less than the array size according to javadoc
+        } while (count >= threads.length);
+        return Collections.unmodifiableList(Stream.of(threads).limit(count).collect(Collectors.toList()));
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpHelper.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpHelper.java
new file mode 100644
index 00000000000..87fedb35172
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpHelper.java
@@ -0,0 +1,227 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.fail;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+import mockit.Mock;
+import mockit.MockUp;
+import org.apache.zookeeper.CreateMode;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.ZooDefs;
+import org.apache.zookeeper.ZooDefs.Ids;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.data.ACL;
+import org.apache.zookeeper.data.Stat;
+import org.apache.zookeeper.server.Request;
+import org.apache.zookeeper.server.RequestThrottler;
+import org.apache.zookeeper.server.ZooKeeperServer;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class ThrottledOpHelper {
+    protected static final Logger LOG = LoggerFactory.getLogger(ThrottledOpHelper.class);
+
+    public static final class RequestThrottleMock extends MockUp<RequestThrottler> {
+        public static void throttleEveryNthOp(int n) {
+            everyNthOp = n;
+            opCounter = 0;
+        }
+        private static int everyNthOp = 0;
+        private static int opCounter = 0;
+
+        @Mock
+        private boolean shouldThrottleOp(Request request, long elapsedTime) {
+            if (everyNthOp > 0 && request.isThrottlable() && (++opCounter % everyNthOp == 0)) {
+                opCounter %= everyNthOp;
+                return true;
+            }
+            return false;
+        }
+    }
+
+    public static void applyMockUps() {
+        new RequestThrottleMock();
+    }
+
+    public void testThrottledOp(ZooKeeper zk, ZooKeeperServer zs) throws IOException, InterruptedException, KeeperException {
+        final int N = 5; // must be greater than 3
+        final int COUNT = 100;
+        RequestThrottleMock.throttleEveryNthOp(N);
+        LOG.info("Before create /ivailo nodes");
+        int opCount = 0;
+        for (int i = 0; i < COUNT; i++) {
+            String nodeName = "/ivailo" + i;
+            if (opCount % N == N - 1) {
+                try {
+                    zk.create(nodeName, "".getBytes(), Ids.OPEN_ACL_UNSAFE,
+                        (i % 2 == 0) ? CreateMode.PERSISTENT : CreateMode.EPHEMERAL);
+                    fail("Should have gotten ThrottledOp exception");
+                } catch (KeeperException.ThrottledOpException e) {
+                    // anticipated outcome
+                    Stat stat = zk.exists(nodeName, null);
+                    assertNull(stat);
+                    zk.create(nodeName, "".getBytes(), Ids.OPEN_ACL_UNSAFE,
+                        (i % 2 == 0) ? CreateMode.PERSISTENT : CreateMode.EPHEMERAL);
+                } catch (KeeperException e) {
+                    fail("Should have gotten ThrottledOp exception");
+                }
+                opCount += 3; // three ops issued
+            } else {
+                zk.create(nodeName, "".getBytes(), Ids.OPEN_ACL_UNSAFE,
+                    (i % 2 == 0) ? CreateMode.PERSISTENT : CreateMode.EPHEMERAL);
+                opCount++; // one op issued
+            }
+            if (opCount % N == N - 1) {
+                try {
+                    zk.setData(nodeName, nodeName.getBytes(), -1);
+                    fail("Should have gotten ThrottledOp exception");
+                } catch (KeeperException.ThrottledOpException e) {
+                    // anticipated outcome & retry
+                    zk.setData(nodeName, nodeName.getBytes(), -1);
+                } catch (KeeperException e) {
+                    fail("Should have gotten ThrottledOp exception");
+                }
+                opCount += 2; // two ops issued, one for retry
+            } else {
+                zk.setData(nodeName, nodeName.getBytes(), -1);
+                opCount++; // one op issued
+            }
+        }
+        LOG.info("Before delete /ivailo nodes");
+        for (int i = 0; i < COUNT; i++) {
+            String nodeName = "/ivailo" + i;
+            if (opCount % N == N - 1) {
+                try {
+                    zk.exists(nodeName, null);
+                    fail("Should have gotten ThrottledOp exception");
+                } catch (KeeperException.ThrottledOpException e) {
+                    // anticipated outcome & retry
+                    Stat stat = zk.exists(nodeName, null);
+                    assertNotNull(stat);
+                    opCount += 2; // two ops issued, one is retry
+                } catch (KeeperException e) {
+                    fail("Should have gotten ThrottledOp exception");
+                }
+            } else {
+                Stat stat = zk.exists(nodeName, null);
+                assertNotNull(stat);
+                opCount++;
+            }
+            if (opCount % N == N - 1) {
+                try {
+                    zk.getData(nodeName, null, null);
+                    fail("Should have gotten ThrottledOp exception");
+                } catch (KeeperException.ThrottledOpException e) {
+                    // anticipated outcome & retry
+                    byte[] data = zk.getData(nodeName, null, null);
+                    assertEquals(nodeName, new String(data));
+                    opCount += 2; // two ops issued, one is retry
+                } catch (KeeperException e) {
+                    fail("Should have gotten ThrottledOp exception");
+                }
+            } else {
+                byte[] data = zk.getData(nodeName, null, null);
+                assertEquals(nodeName, new String(data));
+                opCount++;
+            }
+            if (opCount % N == N - 1) {
+                try {
+                    // version 0 should not trigger BadVersion exception
+                    zk.delete(nodeName, 0);
+                    fail("Should have gotten ThrottledOp exception");
+                } catch (KeeperException.ThrottledOpException e) {
+                    // anticipated outcome & retry
+                    zk.delete(nodeName, -1);
+                } catch (KeeperException e) {
+                    fail("Should have gotten ThrottledOp exception");
+                }
+                opCount += 2; // two ops issues, one for retry
+            } else {
+                zk.delete(nodeName, -1);
+                opCount++; // one op only issued
+            }
+            if (opCount % N == N - 1) {
+                try {
+                    zk.exists(nodeName, null);
+                    fail("Should have gotten ThrottledOp exception");
+                } catch (KeeperException.ThrottledOpException e) {
+                    // anticipated outcome & retry
+                    Stat stat = zk.exists(nodeName, null);
+                    assertNull(stat);
+                    opCount += 2; // two ops issued, one is retry
+                } catch (KeeperException e) {
+                    fail("Should have gotten ThrottledOp exception");
+                }
+            } else {
+                Stat stat = zk.exists(nodeName, null);
+                assertNull(stat);
+                opCount++;
+            }
+        }
+        LOG.info("After delete /ivailo");
+        zk.close();
+    }
+
+    public void testThrottledAcl(ZooKeeper zk, ZooKeeperServer zs) throws Exception {
+        RequestThrottleMock.throttleEveryNthOp(0);
+
+        final ArrayList<ACL> ACL_PERMS =
+          new ArrayList<ACL>() { {
+            add(new ACL(ZooDefs.Perms.READ, ZooDefs.Ids.ANYONE_ID_UNSAFE));
+            add(new ACL(ZooDefs.Perms.WRITE, ZooDefs.Ids.ANYONE_ID_UNSAFE));
+            add(new ACL(ZooDefs.Perms.ALL, ZooDefs.Ids.AUTH_IDS));
+        }};
+        String path = "/path1";
+        zk.create(path, path.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk.addAuthInfo("digest", "pat:test".getBytes());
+        List<ACL> defaultAcls = zk.getACL(path, null);
+        assertEquals(1, defaultAcls.size());
+
+        RequestThrottleMock.throttleEveryNthOp(2);
+
+        path = "/path2";
+        zk.create(path, path.getBytes(), Ids.OPEN_ACL_UNSAFE,
+            CreateMode.PERSISTENT);
+        try {
+            zk.setACL(path, ACL_PERMS, -1);
+            fail("Should have gotten ThrottledOp exception");
+        } catch (KeeperException.ThrottledOpException e) {
+            // expected
+        } catch (KeeperException e) {
+            fail("Should have gotten ThrottledOp exception");
+        }
+        List<ACL> acls = zk.getACL(path, null);
+        assertEquals(1, acls.size());
+
+        RequestThrottleMock.throttleEveryNthOp(0);
+
+        path = "/path3";
+        zk.create(path, path.getBytes(), Ids.OPEN_ACL_UNSAFE,
+            CreateMode.PERSISTENT);
+        zk.setACL(path, ACL_PERMS, -1);
+        acls = zk.getACL(path, null);
+        assertEquals(3, acls.size());
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpObserverTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpObserverTest.java
new file mode 100644
index 00000000000..52d2bd80f5b
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpObserverTest.java
@@ -0,0 +1,70 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import java.io.IOException;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.server.ZooKeeperServer;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+public class ThrottledOpObserverTest extends QuorumBase {
+    @BeforeAll
+    public static void applyMockUps() {
+        ThrottledOpHelper.applyMockUps();
+    }
+
+    @BeforeEach
+    @Override
+    public void setUp() throws Exception {
+        super.setUp(true /* withObservers */, false);
+    }
+
+    @Test
+    public void testThrottledOpObserver() throws IOException, InterruptedException, KeeperException {
+        ZooKeeper zk = null;
+        try {
+            zk = createClient("localhost:" + getFirstObserverClientPort());
+            ZooKeeperServer zs = getFirstObserver().getActiveServer();
+            ThrottledOpHelper test = new ThrottledOpHelper();
+            test.testThrottledOp(zk, zs);
+        } finally {
+            if (zk != null) {
+                zk.close();
+            }
+        }
+    }
+
+    @Test
+    public void testThrottledAclObserver() throws Exception {
+        ZooKeeper zk = null;
+        try {
+            zk = createClient("localhost:" + getFirstObserverClientPort());
+            ZooKeeperServer zs = getFirstObserver().getActiveServer();
+            ThrottledOpHelper test = new ThrottledOpHelper();
+            test.testThrottledAcl(zk, zs);
+        } finally {
+            if (zk != null) {
+                zk.close();
+            }
+        }
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpQuorumTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpQuorumTest.java
new file mode 100644
index 00000000000..473b998141e
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpQuorumTest.java
@@ -0,0 +1,98 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import java.io.IOException;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.server.ZooKeeperServer;
+import org.apache.zookeeper.server.quorum.QuorumPeer;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+
+public class ThrottledOpQuorumTest extends QuorumBase {
+    @BeforeAll
+    public static void applyMockUps() {
+        ThrottledOpHelper.applyMockUps();
+    }
+
+    @Test
+    public void testThrottledOpLeader() throws IOException, InterruptedException, KeeperException {
+        ZooKeeper zk = null;
+        try {
+            zk = createClient("localhost:" + getLeaderClientPort());
+            ZooKeeperServer zs = getLeaderQuorumPeer().getActiveServer();
+            ThrottledOpHelper test = new ThrottledOpHelper();
+            test.testThrottledOp(zk, zs);
+        } finally {
+            if (zk != null) {
+                zk.close();
+            }
+        }
+    }
+
+    @Test
+    public void testThrottledAclLeader() throws Exception {
+        ZooKeeper zk = null;
+        try {
+            zk = createClient("localhost:" + getLeaderClientPort());
+            ZooKeeperServer zs = getLeaderQuorumPeer().getActiveServer();
+            ThrottledOpHelper test = new ThrottledOpHelper();
+            test.testThrottledAcl(zk, zs);
+        } finally {
+            if (zk != null) {
+                zk.close();
+            }
+        }
+    }
+
+    @Test
+    public void testThrottledOpFollower() throws IOException, InterruptedException, KeeperException {
+        ZooKeeper zk = null;
+        try {
+            int clientPort = (getLeaderClientPort() == portClient1) ? portClient2 : portClient1;
+            zk = createClient("localhost:" + clientPort);
+            QuorumPeer qp = (getLeaderClientPort() == portClient1) ? s2 : s1;
+            ZooKeeperServer zs = qp.getActiveServer();
+            ThrottledOpHelper test = new ThrottledOpHelper();
+            test.testThrottledOp(zk, zs);
+        } finally {
+            if (zk != null) {
+                zk.close();
+            }
+        }
+    }
+
+    @Test
+    public void testThrottledAclFollower() throws Exception {
+        ZooKeeper zk = null;
+        try {
+            int clientPort = (getLeaderClientPort() == portClient1) ? portClient2 : portClient1;
+            zk = createClient("localhost:" + clientPort);
+            QuorumPeer qp = (getLeaderClientPort() == portClient1) ? s2 : s1;
+            ZooKeeperServer zs = qp.getActiveServer();
+            ThrottledOpHelper test = new ThrottledOpHelper();
+            test.testThrottledAcl(zk, zs);
+        } finally {
+            if (zk != null) {
+                zk.close();
+            }
+        }
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpStandaloneTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpStandaloneTest.java
new file mode 100644
index 00000000000..88f6cf681d3
--- /dev/null
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ThrottledOpStandaloneTest.java
@@ -0,0 +1,64 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.test;
+
+import java.io.IOException;
+import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.server.ZooKeeperServer;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+
+public class ThrottledOpStandaloneTest extends ClientBase {
+
+    @BeforeAll
+    public static void applyMockUps() {
+        ThrottledOpHelper.applyMockUps();
+    }
+
+    @Test
+    public void testThrottledOp() throws IOException, InterruptedException, KeeperException {
+        ZooKeeper zk = null;
+        try {
+            zk = createClient(hostPort);
+            ZooKeeperServer zs = serverFactory.getZooKeeperServer();
+            ThrottledOpHelper test = new ThrottledOpHelper();
+            test.testThrottledOp(zk, zs);
+        } finally {
+            if (zk != null) {
+                zk.close();
+            }
+        }
+    }
+
+    @Test
+    public void testThrottledAcl() throws Exception {
+        ZooKeeper zk = null;
+        try {
+            zk = createClient(hostPort);
+            ZooKeeperServer zs = serverFactory.getZooKeeperServer();
+            ThrottledOpHelper test = new ThrottledOpHelper();
+            test.testThrottledAcl(zk, zs);
+        } finally {
+            if (zk != null) {
+                zk.close();
+            }
+        }
+    }
+}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/TruncateTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/TruncateTest.java
index 089a7644aab..c7654003f30 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/TruncateTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/TruncateTest.java
@@ -19,10 +19,10 @@
 package org.apache.zookeeper.test;
 
 import static org.hamcrest.CoreMatchers.is;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertThat;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.File;
 import java.io.IOException;
 import java.net.InetSocketAddress;
@@ -47,9 +47,9 @@
 import org.apache.zookeeper.server.quorum.QuorumPeer.QuorumServer;
 import org.apache.zookeeper.txn.SetDataTxn;
 import org.apache.zookeeper.txn.TxnHeader;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -58,14 +58,14 @@ public class TruncateTest extends ZKTestCase {
     private static final Logger LOG = LoggerFactory.getLogger(TruncateTest.class);
     File dataDir1, dataDir2, dataDir3;
 
-    @Before
+    @BeforeEach
     public void setUp() throws IOException {
         dataDir1 = ClientBase.createTmpDir();
         dataDir2 = ClientBase.createTmpDir();
         dataDir3 = ClientBase.createTmpDir();
     }
 
-    @After
+    @AfterEach
     public void tearDown() {
         ClientBase.recursiveDelete(dataDir1);
         ClientBase.recursiveDelete(dataDir2);
@@ -121,10 +121,10 @@ public void testTruncationNullLog() throws Exception {
             append(zkdb, i);
         }
         zkdb.close();
-        File[] logs = snaplog.getDataDir().listFiles();
+        File[] logs = snaplog.getDataLogDir().listFiles();
         for (int i = 0; i < logs.length; i++) {
             LOG.debug("Deleting: {}", logs[i].getName());
-            assertTrue("Failed to delete log file: " + logs[i].getName(), logs[i].delete());
+            assertTrue(logs[i].delete(), "Failed to delete log file: " + logs[i].getName());
         }
         try {
             assertThat("truncateLog() should return false if truncation fails instead of throwing exception", zkdb.truncateLog(1), is(false));
@@ -189,7 +189,7 @@ public void testTruncate() throws Exception {
         int port3 = PortAssignment.unique();
 
         // Start up two of the quorum and add 10 txns
-        Map<Long, QuorumServer> peers = new HashMap<Long, QuorumServer>();
+        Map<Long, QuorumServer> peers = new HashMap<>();
         peers.put(Long.valueOf(1), new QuorumServer(1, new InetSocketAddress("127.0.0.1", PortAssignment.unique()), new InetSocketAddress("127.0.0.1", PortAssignment.unique()), new InetSocketAddress("127.0.0.1", port1)));
         peers.put(Long.valueOf(2), new QuorumServer(2, new InetSocketAddress("127.0.0.1", PortAssignment.unique()), new InetSocketAddress("127.0.0.1", PortAssignment.unique()), new InetSocketAddress("127.0.0.1", port2)));
         peers.put(Long.valueOf(3), new QuorumServer(3, new InetSocketAddress("127.0.0.1", PortAssignment.unique()), new InetSocketAddress("127.0.0.1", PortAssignment.unique()), new InetSocketAddress("127.0.0.1", port3)));
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/UnsupportedAddWatcherTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/UnsupportedAddWatcherTest.java
index 95b5569bb08..a49640184d9 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/UnsupportedAddWatcherTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/UnsupportedAddWatcherTest.java
@@ -17,22 +17,27 @@
 
 package org.apache.zookeeper.test;
 
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import java.io.IOException;
 import java.io.PrintWriter;
 import java.util.Collections;
+import java.util.List;
 import org.apache.zookeeper.AddWatchMode;
+import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.Watcher;
+import org.apache.zookeeper.ZooDefs;
 import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.data.ACL;
 import org.apache.zookeeper.server.watch.IWatchManager;
 import org.apache.zookeeper.server.watch.WatchManagerFactory;
 import org.apache.zookeeper.server.watch.WatcherOrBitSet;
 import org.apache.zookeeper.server.watch.WatchesPathReport;
 import org.apache.zookeeper.server.watch.WatchesReport;
 import org.apache.zookeeper.server.watch.WatchesSummary;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class UnsupportedAddWatcherTest extends ClientBase {
 
@@ -58,12 +63,12 @@ public void removeWatcher(Watcher watcher) {
         }
 
         @Override
-        public WatcherOrBitSet triggerWatch(String path, Watcher.Event.EventType type) {
+        public WatcherOrBitSet triggerWatch(String path, Watcher.Event.EventType type, long zxid, List<ACL> acl) {
             return new WatcherOrBitSet(Collections.emptySet());
         }
 
         @Override
-        public WatcherOrBitSet triggerWatch(String path, Watcher.Event.EventType type, WatcherOrBitSet suppress) {
+        public WatcherOrBitSet triggerWatch(String path, Watcher.Event.EventType type, long zxid, List<ACL> acl, WatcherOrBitSet suppress) {
             return new WatcherOrBitSet(Collections.emptySet());
         }
 
@@ -98,13 +103,13 @@ public void dumpWatches(PrintWriter pwriter, boolean byPath) {
         }
     }
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         System.setProperty(WatchManagerFactory.ZOOKEEPER_WATCH_MANAGER_NAME, StubbedWatchManager.class.getName());
         super.setUp();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         try {
             super.tearDown();
@@ -113,12 +118,16 @@ public void tearDown() throws Exception {
         }
     }
 
-    @Test(expected = KeeperException.MarshallingErrorException.class)
+    @Test
     public void testBehavior() throws IOException, InterruptedException, KeeperException {
-        try (ZooKeeper zk = createClient(hostPort)) {
-            // the server will generate an exception as our custom watch manager doesn't implement
-            // the new version of addWatch()
-            zk.addWatch("/foo", event -> {}, AddWatchMode.PERSISTENT_RECURSIVE);
-        }
+        assertThrows(KeeperException.MarshallingErrorException.class, () -> {
+            try (ZooKeeper zk = createClient(hostPort)) {
+                // the server will generate an exception as our custom watch manager doesn't implement
+                // the new version of addWatch()
+                zk.create("/foo", null, ZooDefs.Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+                zk.addWatch("/foo", event -> {
+                }, AddWatchMode.PERSISTENT_RECURSIVE);
+            }
+        });
     }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatchEventWhenAutoResetTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatchEventWhenAutoResetTest.java
index 005b525f554..5fd4b96b177 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatchEventWhenAutoResetTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatchEventWhenAutoResetTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.concurrent.LinkedBlockingQueue;
 import java.util.concurrent.TimeUnit;
@@ -33,9 +33,9 @@
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.data.Stat;
 import org.apache.zookeeper.test.ClientBase.CountdownWatcher;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -51,7 +51,7 @@ public class WatchEventWhenAutoResetTest extends ZKTestCase {
 
     public static class EventsWatcher extends CountdownWatcher {
 
-        private LinkedBlockingQueue<WatchedEvent> dataEvents = new LinkedBlockingQueue<WatchedEvent>();
+        private LinkedBlockingQueue<WatchedEvent> dataEvents = new LinkedBlockingQueue<>();
 
         @Override
         public void process(WatchedEvent event) {
@@ -68,7 +68,7 @@ public void process(WatchedEvent event) {
         public void assertEvent(long timeout, EventType eventType) {
             try {
                 WatchedEvent event = dataEvents.poll(timeout, TimeUnit.MILLISECONDS);
-                assertNotNull("do not receive a " + eventType, event);
+                assertNotNull(event, "do not receive a " + eventType);
                 assertEquals(eventType, event.getType());
             } catch (InterruptedException e) {
                 LOG.warn("ignoring interrupt during EventsWatcher assertEvent");
@@ -94,7 +94,7 @@ private ZooKeeper createClient(QuorumUtil qu, int id) throws IOException {
         return createClient(qu, id, new EventsWatcher());
     }
 
-    @Before
+    @BeforeEach
     public void setUp() throws IOException {
         System.setProperty("zookeeper.admin.enableServer", "false");
 
@@ -106,7 +106,7 @@ public void setUp() throws IOException {
         zk2 = createClient(qu, 2);
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws InterruptedException {
         if (zk1 != null) {
             zk1.close();
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatchedEventTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatchedEventTest.java
index 17d3510329e..a9bc11da2a6 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatchedEventTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatchedEventTest.java
@@ -18,15 +18,15 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.util.EnumSet;
 import org.apache.zookeeper.WatchedEvent;
 import org.apache.zookeeper.Watcher.Event.EventType;
 import org.apache.zookeeper.Watcher.Event.KeeperState;
 import org.apache.zookeeper.ZKTestCase;
 import org.apache.zookeeper.proto.WatcherEvent;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
 
 public class WatchedEventTest extends ZKTestCase {
 
@@ -61,7 +61,7 @@ public void testCreatingWatchedEventFromWrapper() {
         for (EventType et : allTypes) {
             for (KeeperState ks : allStates) {
                 wep = new WatcherEvent(et.getIntValue(), ks.getIntValue(), "blah");
-                we = new WatchedEvent(wep);
+                we = new WatchedEvent(wep, WatchedEvent.NO_ZXID);
                 assertEquals(et, we.getType());
                 assertEquals(ks, we.getState());
                 assertEquals("blah", we.getPath());
@@ -75,7 +75,7 @@ public void testCreatingWatchedEventFromInvalidWrapper() {
 
         try {
             WatcherEvent wep = new WatcherEvent(-2342, -252352, "foo");
-            new WatchedEvent(wep);
+            new WatchedEvent(wep, WatchedEvent.NO_ZXID);
             fail("Was able to create WatchedEvent from bad wrapper");
         } catch (RuntimeException re) {
             // we're good
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatcherFuncTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatcherFuncTest.java
index 5a274b53b0e..44440a7c3bb 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatcherFuncTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatcherFuncTest.java
@@ -18,11 +18,11 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.List;
@@ -37,13 +37,16 @@
 import org.apache.zookeeper.Watcher.Event.KeeperState;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
-import org.junit.Test;
+import org.apache.zookeeper.data.Stat;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class WatcherFuncTest extends ClientBase {
 
     private static class SimpleWatcher implements Watcher {
 
-        private LinkedBlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<WatchedEvent>();
+        private LinkedBlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<>();
         private CountDownLatch latch;
 
         public SimpleWatcher(CountDownLatch latch) {
@@ -63,17 +66,20 @@ public void process(WatchedEvent event) {
             try {
                 events.put(event);
             } catch (InterruptedException e) {
-                assertTrue("interruption unexpected", false);
+                assertTrue(false, "interruption unexpected");
             }
         }
-        public void verify(List<EventType> expected) throws InterruptedException {
+
+        public void verify(List<WatchedEvent> expected) throws InterruptedException {
+            List<WatchedEvent> actual = new ArrayList<>();
             WatchedEvent event;
-            int count = 0;
-            while (count < expected.size() && (event = events.poll(30, TimeUnit.SECONDS)) != null) {
-                assertEquals(expected.get(count), event.getType());
-                count++;
+            while (actual.size() < expected.size() && (event = events.poll(30, TimeUnit.SECONDS)) != null) {
+                actual.add(event);
+            }
+            assertEquals(expected.size(), actual.size());
+            for (int i = 0; i < expected.size(); i++) {
+                TestUtils.assertWatchedEventEquals(expected.get(i), actual.get(i));
             }
-            assertEquals(expected.size(), count);
             events.clear();
         }
 
@@ -86,8 +92,9 @@ public void verify(List<EventType> expected) throws InterruptedException {
     private volatile CountDownLatch lsnr_latch;
     private ZooKeeper lsnr;
 
-    private List<EventType> expected;
+    private List<WatchedEvent> expected;
 
+    @BeforeEach
     @Override
     public void setUp() throws Exception {
         super.setUp();
@@ -100,9 +107,10 @@ public void setUp() throws Exception {
         lsnr_dwatch = new SimpleWatcher(lsnr_latch);
         lsnr = createClient(lsnr_dwatch, lsnr_latch);
 
-        expected = new ArrayList<EventType>();
+        expected = new ArrayList<>();
     }
 
+    @AfterEach
     @Override
     public void tearDown() throws Exception {
         client.close();
@@ -123,15 +131,34 @@ private void verify() throws InterruptedException {
         expected.clear();
     }
 
+    private void addEvent(List<WatchedEvent> events, EventType eventType, String path, Stat stat) {
+        addEvent(events, eventType, path, stat.getMzxid());
+    }
+
+    private void addEvent(List<WatchedEvent> events, EventType eventType, String path, long zxid) {
+        events.add(new WatchedEvent(eventType, KeeperState.SyncConnected, path, zxid));
+    }
+
+    private long delete(String path) throws InterruptedException, KeeperException {
+        client.delete(path, -1);
+        int lastSlash = path.lastIndexOf('/');
+        String parent = (lastSlash == 0)
+            ? "/"
+            : path.substring(0, lastSlash);
+        // the deletion's zxid will be reflected in the parent's Pzxid
+        return client.exists(parent, false).getPzxid();
+    }
+
     @Test
     public void testExistsSync() throws IOException, InterruptedException, KeeperException {
         assertNull(lsnr.exists("/foo", true));
         assertNull(lsnr.exists("/foo/bar", true));
 
-        client.create("/foo", "parent".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        expected.add(EventType.NodeCreated);
-        client.create("/foo/bar", "child".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        expected.add(EventType.NodeCreated);
+        Stat stat = new Stat();
+        client.create("/foo", "parent".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+        addEvent(expected, EventType.NodeCreated, "/foo", stat);
+        client.create("/foo/bar", "child".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+        addEvent(expected, EventType.NodeCreated, "/foo/bar", stat);
 
         verify();
 
@@ -156,20 +183,20 @@ public void testExistsSync() throws IOException, InterruptedException, KeeperExc
             assertEquals("/foo/car", e.getPath());
         }
 
-        client.setData("/foo", "parent".getBytes(), -1);
-        expected.add(EventType.NodeDataChanged);
-        client.setData("/foo/bar", "child".getBytes(), -1);
-        expected.add(EventType.NodeDataChanged);
+        stat = client.setData("/foo", "parent".getBytes(), -1);
+        addEvent(expected, EventType.NodeDataChanged, "/foo", stat);
+        stat = client.setData("/foo/bar", "child".getBytes(), -1);
+        addEvent(expected, EventType.NodeDataChanged, "/foo/bar", stat);
 
         verify();
 
         assertNotNull(lsnr.exists("/foo", true));
         assertNotNull(lsnr.exists("/foo/bar", true));
 
-        client.delete("/foo/bar", -1);
-        expected.add(EventType.NodeDeleted);
-        client.delete("/foo", -1);
-        expected.add(EventType.NodeDeleted);
+        long deleteZxid = delete("/foo/bar");
+        addEvent(expected, EventType.NodeDeleted, "/foo/bar", deleteZxid);
+        deleteZxid = delete("/foo");
+        addEvent(expected, EventType.NodeDeleted, "/foo", deleteZxid);
 
         verify();
     }
@@ -196,20 +223,20 @@ public void testGetDataSync() throws IOException, InterruptedException, KeeperEx
         client.create("/foo/bar", "child".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         assertNotNull(lsnr.getData("/foo/bar", true, null));
 
-        client.setData("/foo", "parent".getBytes(), -1);
-        expected.add(EventType.NodeDataChanged);
-        client.setData("/foo/bar", "child".getBytes(), -1);
-        expected.add(EventType.NodeDataChanged);
+        Stat stat = client.setData("/foo", "parent".getBytes(), -1);
+        addEvent(expected, EventType.NodeDataChanged, "/foo", stat);
+        stat = client.setData("/foo/bar", "child".getBytes(), -1);
+        addEvent(expected, EventType.NodeDataChanged, "/foo/bar", stat);
 
         verify();
 
         assertNotNull(lsnr.getData("/foo", true, null));
         assertNotNull(lsnr.getData("/foo/bar", true, null));
 
-        client.delete("/foo/bar", -1);
-        expected.add(EventType.NodeDeleted);
-        client.delete("/foo", -1);
-        expected.add(EventType.NodeDeleted);
+        long deleteZxid = delete("/foo/bar");
+        addEvent(expected, EventType.NodeDeleted, "/foo/bar", deleteZxid);
+        deleteZxid = delete("/foo");
+        addEvent(expected, EventType.NodeDeleted, "/foo", deleteZxid);
 
         verify();
     }
@@ -234,8 +261,9 @@ public void testGetChildrenSync() throws IOException, InterruptedException, Keep
         client.create("/foo", "parent".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         assertNotNull(lsnr.getChildren("/foo", true));
 
-        client.create("/foo/bar", "child".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        expected.add(EventType.NodeChildrenChanged); // /foo
+        Stat stat = new Stat();
+        client.create("/foo/bar", "child".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+        addEvent(expected, EventType.NodeChildrenChanged, "/foo", stat); // /foo
         assertNotNull(lsnr.getChildren("/foo/bar", true));
 
         client.setData("/foo", "parent".getBytes(), -1);
@@ -246,11 +274,11 @@ public void testGetChildrenSync() throws IOException, InterruptedException, Keep
         assertNotNull(lsnr.getChildren("/foo", true));
         assertNotNull(lsnr.getChildren("/foo/bar", true));
 
-        client.delete("/foo/bar", -1);
-        expected.add(EventType.NodeDeleted); // /foo/bar childwatch
-        expected.add(EventType.NodeChildrenChanged); // /foo
-        client.delete("/foo", -1);
-        expected.add(EventType.NodeDeleted);
+        long deleteZxid = delete("/foo/bar");
+        addEvent(expected, EventType.NodeDeleted, "/foo/bar", deleteZxid); // /foo/bar childwatch
+        addEvent(expected, EventType.NodeChildrenChanged, "/foo", deleteZxid); // /foo
+        deleteZxid = delete("/foo");
+        addEvent(expected, EventType.NodeDeleted, "/foo", deleteZxid);
 
         verify();
     }
@@ -262,7 +290,7 @@ public void testExistsSyncWObj() throws IOException, InterruptedException, Keepe
         SimpleWatcher w3 = new SimpleWatcher(null);
         SimpleWatcher w4 = new SimpleWatcher(null);
 
-        List<EventType> e2 = new ArrayList<EventType>();
+        List<WatchedEvent> e2 = new ArrayList<>();
 
         assertNull(lsnr.exists("/foo", true));
         assertNull(lsnr.exists("/foo", w1));
@@ -272,10 +300,11 @@ public void testExistsSyncWObj() throws IOException, InterruptedException, Keepe
         assertNull(lsnr.exists("/foo/bar", w3));
         assertNull(lsnr.exists("/foo/bar", w4));
 
-        client.create("/foo", "parent".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        expected.add(EventType.NodeCreated);
-        client.create("/foo/bar", "child".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        e2.add(EventType.NodeCreated);
+        Stat stat = new Stat();
+        client.create("/foo", "parent".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+        addEvent(expected, EventType.NodeCreated, "/foo", stat);
+        client.create("/foo/bar", "child".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+        addEvent(e2, EventType.NodeCreated, "/foo/bar", stat);
 
         lsnr_dwatch.verify(expected);
         w1.verify(expected);
@@ -293,12 +322,12 @@ public void testExistsSyncWObj() throws IOException, InterruptedException, Keepe
         assertNotNull(lsnr.exists("/foo/bar", w4));
         assertNotNull(lsnr.exists("/foo/bar", w4));
 
-        client.setData("/foo", "parent".getBytes(), -1);
-        expected.add(EventType.NodeDataChanged);
-        client.setData("/foo/bar", "child".getBytes(), -1);
-        e2.add(EventType.NodeDataChanged);
+        stat = client.setData("/foo", "parent".getBytes(), -1);
+        addEvent(expected, EventType.NodeDataChanged, "/foo", stat);
+        stat = client.setData("/foo/bar", "child".getBytes(), -1);
+        addEvent(e2, EventType.NodeDataChanged, "/foo/bar", stat);
 
-        lsnr_dwatch.verify(new ArrayList<EventType>()); // not reg so should = 0
+        lsnr_dwatch.verify(new ArrayList<>()); // not reg so should = 0
         w1.verify(expected);
         w2.verify(e2);
         w3.verify(e2);
@@ -315,10 +344,10 @@ public void testExistsSyncWObj() throws IOException, InterruptedException, Keepe
         assertNotNull(lsnr.exists("/foo/bar", w3));
         assertNotNull(lsnr.exists("/foo/bar", w4));
 
-        client.delete("/foo/bar", -1);
-        expected.add(EventType.NodeDeleted);
-        client.delete("/foo", -1);
-        e2.add(EventType.NodeDeleted);
+        long deleteZxid = delete("/foo/bar");
+        addEvent(e2, EventType.NodeDeleted, "/foo/bar", deleteZxid);
+        deleteZxid = delete("/foo");
+        addEvent(expected, EventType.NodeDeleted, "/foo", deleteZxid);
 
         lsnr_dwatch.verify(expected);
         w1.verify(expected);
@@ -327,7 +356,6 @@ public void testExistsSyncWObj() throws IOException, InterruptedException, Keepe
         w4.verify(e2);
         expected.clear();
         e2.clear();
-
     }
 
     @Test
@@ -337,7 +365,7 @@ public void testGetDataSyncWObj() throws IOException, InterruptedException, Keep
         SimpleWatcher w3 = new SimpleWatcher(null);
         SimpleWatcher w4 = new SimpleWatcher(null);
 
-        List<EventType> e2 = new ArrayList<EventType>();
+        List<WatchedEvent> e2 = new ArrayList<>();
 
         try {
             lsnr.getData("/foo", w1, null);
@@ -363,10 +391,10 @@ public void testGetDataSyncWObj() throws IOException, InterruptedException, Keep
         assertNotNull(lsnr.getData("/foo/bar", w4, null));
         assertNotNull(lsnr.getData("/foo/bar", w4, null));
 
-        client.setData("/foo", "parent".getBytes(), -1);
-        expected.add(EventType.NodeDataChanged);
-        client.setData("/foo/bar", "child".getBytes(), -1);
-        e2.add(EventType.NodeDataChanged);
+        Stat stat = client.setData("/foo", "parent".getBytes(), -1);
+        addEvent(expected, EventType.NodeDataChanged, "/foo", stat);
+        stat = client.setData("/foo/bar", "child".getBytes(), -1);
+        addEvent(e2, EventType.NodeDataChanged, "/foo/bar", stat);
 
         lsnr_dwatch.verify(expected);
         w1.verify(expected);
@@ -383,10 +411,10 @@ public void testGetDataSyncWObj() throws IOException, InterruptedException, Keep
         assertNotNull(lsnr.getData("/foo/bar", w3, null));
         assertNotNull(lsnr.getData("/foo/bar", w4, null));
 
-        client.delete("/foo/bar", -1);
-        expected.add(EventType.NodeDeleted);
-        client.delete("/foo", -1);
-        e2.add(EventType.NodeDeleted);
+        long deleteZxid = delete("/foo/bar");
+        addEvent(e2, EventType.NodeDeleted, "/foo/bar", deleteZxid);
+        deleteZxid = delete("/foo");
+        addEvent(expected, EventType.NodeDeleted, "/foo", deleteZxid);
 
         lsnr_dwatch.verify(expected);
         w1.verify(expected);
@@ -404,7 +432,7 @@ public void testGetChildrenSyncWObj() throws IOException, InterruptedException,
         SimpleWatcher w3 = new SimpleWatcher(null);
         SimpleWatcher w4 = new SimpleWatcher(null);
 
-        List<EventType> e2 = new ArrayList<EventType>();
+        List<WatchedEvent> e2 = new ArrayList<>();
 
         try {
             lsnr.getChildren("/foo", true);
@@ -425,8 +453,9 @@ public void testGetChildrenSyncWObj() throws IOException, InterruptedException,
         assertNotNull(lsnr.getChildren("/foo", true));
         assertNotNull(lsnr.getChildren("/foo", w1));
 
-        client.create("/foo/bar", "child".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        expected.add(EventType.NodeChildrenChanged); // /foo
+        Stat stat = new Stat();
+        client.create("/foo/bar", "child".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT, stat);
+        addEvent(expected, EventType.NodeChildrenChanged, "/foo", stat); // /foo
         assertNotNull(lsnr.getChildren("/foo/bar", w2));
         assertNotNull(lsnr.getChildren("/foo/bar", w2));
         assertNotNull(lsnr.getChildren("/foo/bar", w3));
@@ -447,11 +476,11 @@ public void testGetChildrenSyncWObj() throws IOException, InterruptedException,
         assertNotNull(lsnr.getChildren("/foo/bar", w4));
         assertNotNull(lsnr.getChildren("/foo/bar", w4));
 
-        client.delete("/foo/bar", -1);
-        e2.add(EventType.NodeDeleted); // /foo/bar childwatch
-        expected.add(EventType.NodeChildrenChanged); // /foo
-        client.delete("/foo", -1);
-        expected.add(EventType.NodeDeleted);
+        long deleteZxid = delete("/foo/bar");
+        addEvent(e2, EventType.NodeDeleted, "/foo/bar", deleteZxid);
+        addEvent(expected, EventType.NodeChildrenChanged, "/foo", deleteZxid); // /foo
+        deleteZxid = delete("/foo");
+        addEvent(expected, EventType.NodeDeleted, "/foo", deleteZxid);
 
         lsnr_dwatch.verify(expected);
         w1.verify(expected);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatcherTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatcherTest.java
index 6f419ed0e5b..22da89a2e67 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatcherTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/WatcherTest.java
@@ -18,10 +18,10 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.concurrent.BlockingQueue;
 import java.util.concurrent.LinkedBlockingQueue;
@@ -40,8 +40,8 @@
 import org.apache.zookeeper.ZooKeeper;
 import org.apache.zookeeper.client.ZKClientConfig;
 import org.apache.zookeeper.data.Stat;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -63,7 +63,7 @@ public void processResult(int rc, String path, Object ctx, Stat stat) {
 
     private class MyWatcher extends CountdownWatcher {
 
-        LinkedBlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<WatchedEvent>();
+        LinkedBlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<>();
 
         public void process(WatchedEvent event) {
             super.process(event);
@@ -79,7 +79,7 @@ public void process(WatchedEvent event) {
 
     }
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         super.setUp();
         // Reset to default value since some test cases set this to true.
@@ -177,9 +177,9 @@ public void processResult(int rc, String path, Object ctx, Stat stat) {
 
             WatchedEvent event = queue.poll(10, TimeUnit.SECONDS);
 
-            assertNotNull("No watch event was received after closing the Zookeeper client. A 'Closed' event should have occurred", event);
-            assertEquals("Closed events are not generated by the server, and so should have a type of 'None'", Event.EventType.None, event.getType());
-            assertEquals("A 'Closed' event was expected as the Zookeeper client was closed without altering the node it was watching", Event.KeeperState.Closed, event.getState());
+            assertNotNull(event, "No watch event was received after closing the Zookeeper client. A 'Closed' event should have occurred");
+            assertEquals(Event.EventType.None, event.getType(), "Closed events are not generated by the server, and so should have a type of 'None'");
+            assertEquals(Event.KeeperState.Closed, event.getState(), "A 'Closed' event was expected as the Zookeeper client was closed without altering the node it was watching");
         } finally {
             if (zk != null) {
                 zk.close();
@@ -241,7 +241,7 @@ public void testWatchAutoResetWithPending() throws Exception {
             zk.exists("/test", watches[i], cbs[i], count);
         }
         zk.exists("/test", false);
-        assertTrue("Failed to pause the connection!", zk.pauseCnxn(3000));
+        assertTrue(zk.pauseCnxn(3000), "Failed to pause the connection!");
         zk2.close();
         stopServer();
         watches[0].waitForDisconnected(60000);
@@ -255,13 +255,13 @@ public void testWatchAutoResetWithPending() throws Exception {
         assertEquals(null, zk.exists("/test", false));
         waitForAllWatchers();
         for (int i = 0; i < COUNT / 2; i++) {
-            assertEquals("For " + i, 1, watches[i].events.size());
+            assertEquals(1, watches[i].events.size(), "For " + i);
         }
         for (int i = COUNT / 2; i < COUNT; i++) {
-            if (cbs[i].rc == 0) {
-                assertEquals("For " + i, 1, watches[i].events.size());
+            if (cbs[i].rc == KeeperException.Code.OK.intValue()) {
+                assertEquals(1, watches[i].events.size(), "For " + i);
             } else {
-                assertEquals("For " + i, 0, watches[i].events.size());
+                assertEquals(0, watches[i].events.size(), "For " + i);
             }
         }
         assertEquals(COUNT, count[0]);
@@ -349,7 +349,7 @@ private void testWatcherAutoReset(ZooKeeper zk, MyWatcher globalWatcher, MyWatch
         WatchedEvent e;
         if (!disableAutoWatchReset) {
             e = localWatcher.events.poll(TIMEOUT, TimeUnit.MILLISECONDS);
-            assertEquals(e.getPath(), EventType.NodeDataChanged, e.getType());
+            assertEquals(EventType.NodeDataChanged, e.getType(), e.getPath());
             assertEquals("/watchtest/child", e.getPath());
         } else {
             // we'll catch this later if it does happen after timeout, so
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/X509AuthTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/X509AuthTest.java
index 62dabccf037..31477b5433b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/X509AuthTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/X509AuthTest.java
@@ -18,7 +18,9 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.Mockito.mock;
 import java.math.BigInteger;
 import java.net.Socket;
 import java.security.InvalidKeyException;
@@ -35,16 +37,20 @@
 import java.security.cert.X509Certificate;
 import java.util.Arrays;
 import java.util.Date;
+import java.util.List;
 import java.util.Set;
 import javax.net.ssl.X509KeyManager;
 import javax.net.ssl.X509TrustManager;
 import javax.security.auth.x500.X500Principal;
+import javax.servlet.http.HttpServletRequest;
 import org.apache.zookeeper.KeeperException;
 import org.apache.zookeeper.ZKTestCase;
+import org.apache.zookeeper.data.Id;
 import org.apache.zookeeper.server.MockServerCnxn;
 import org.apache.zookeeper.server.auth.X509AuthenticationProvider;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.Mockito;
 
 public class X509AuthTest extends ZKTestCase {
 
@@ -52,7 +58,7 @@ public class X509AuthTest extends ZKTestCase {
     private static TestCertificate superCert;
     private static TestCertificate unknownCert;
 
-    @Before
+    @BeforeEach
     public void setUp() {
         System.setProperty("zookeeper.X509AuthenticationProvider.superUser", "CN=SUPER");
         System.setProperty("zookeeper.ssl.keyManager", "org.apache.zookeeper.test.X509AuthTest.TestKeyManager");
@@ -69,6 +75,8 @@ public void testTrustedAuth() {
         MockServerCnxn cnxn = new MockServerCnxn();
         cnxn.clientChain = new X509Certificate[]{clientCert};
         assertEquals(KeeperException.Code.OK, provider.handleAuthentication(cnxn, null));
+        final List<Id> ids = Arrays.asList(new Id("x509", "CN=CLIENT"));
+        assertEquals(ids, cnxn.getAuthInfo());
     }
 
     @Test
@@ -77,7 +85,8 @@ public void testSuperAuth() {
         MockServerCnxn cnxn = new MockServerCnxn();
         cnxn.clientChain = new X509Certificate[]{superCert};
         assertEquals(KeeperException.Code.OK, provider.handleAuthentication(cnxn, null));
-        assertEquals("super", cnxn.getAuthInfo().get(0).getScheme());
+        final List<Id> ids = Arrays.asList(new Id("super", "CN=SUPER"), new Id("x509", "CN=SUPER"));
+        assertEquals(ids, cnxn.getAuthInfo());
     }
 
     @Test
@@ -88,6 +97,32 @@ public void testUntrustedAuth() {
         assertEquals(KeeperException.Code.AUTHFAILED, provider.handleAuthentication(cnxn, null));
     }
 
+    @Test
+    public void testTrustedAuth_HttpServletRequest() {
+        final X509AuthenticationProvider provider = createProvider(clientCert);
+        final HttpServletRequest mockRequest =  mock(HttpServletRequest.class);
+        Mockito.doReturn(new X509Certificate[]{clientCert}).when(mockRequest).getAttribute(X509AuthenticationProvider.X509_CERTIFICATE_ATTRIBUTE_NAME);
+        final List<Id> ids = Arrays.asList(new Id("x509", "CN=CLIENT"));
+        assertEquals(ids, provider.handleAuthentication(mockRequest, null));
+    }
+
+    @Test
+    public void testSuperAuth_HttpServletRequest() {
+        final X509AuthenticationProvider provider = createProvider(superCert);
+        final HttpServletRequest mockRequest =  mock(HttpServletRequest.class);
+        Mockito.doReturn(new X509Certificate[]{superCert}).when(mockRequest).getAttribute(X509AuthenticationProvider.X509_CERTIFICATE_ATTRIBUTE_NAME);
+        final List<Id> ids = Arrays.asList(new Id("super", "CN=SUPER"), new Id("x509", "CN=SUPER"));
+        assertEquals(ids, provider.handleAuthentication(mockRequest, null));
+    }
+
+    @Test
+    public void testUntrustedAuth_HttpServletRequest() {
+        final X509AuthenticationProvider provider = createProvider(clientCert);
+        final HttpServletRequest mockRequest =  mock(HttpServletRequest.class);
+        Mockito.doReturn(new X509Certificate[]{unknownCert}).when(mockRequest).getAttribute(X509AuthenticationProvider.X509_CERTIFICATE_ATTRIBUTE_NAME);
+        assertTrue(provider.handleAuthentication(mockRequest, null).isEmpty());
+    }
+
     private static class TestPublicKey implements PublicKey {
 
         private static final long serialVersionUID = 1L;
@@ -147,10 +182,12 @@ public BigInteger getSerialNumber() {
             return null;
         }
         @Override
+        @Deprecated
         public Principal getIssuerDN() {
             return null;
         }
         @Override
+        @Deprecated
         public Principal getSubjectDN() {
             return null;
         }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZkDatabaseCorruptionTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZkDatabaseCorruptionTest.java
index 133ed39927e..d1da7faab80 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZkDatabaseCorruptionTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZkDatabaseCorruptionTest.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import java.io.File;
 import java.io.IOException;
 import java.io.RandomAccessFile;
@@ -35,9 +35,9 @@
 import org.apache.zookeeper.server.persistence.FileTxnSnapLog;
 import org.apache.zookeeper.server.quorum.QuorumPeer;
 import org.apache.zookeeper.server.quorum.QuorumPeer.ServerState;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -48,13 +48,13 @@ public class ZkDatabaseCorruptionTest extends ZKTestCase {
 
     private final QuorumBase qb = new QuorumBase();
 
-    @Before
+    @BeforeEach
     public void setUp() throws Exception {
         LOG.info("STARTING quorum {}", getClass().getName());
         qb.setUp();
     }
 
-    @After
+    @AfterEach
     public void tearDown() throws Exception {
         LOG.info("STOPPING quorum {}", getClass().getName());
     }
@@ -105,7 +105,7 @@ public void testCorruption() throws Exception {
             ++leaderSid;
         }
 
-        assertNotNull("Cannot find the leader.", leader);
+        assertNotNull(leader, "Cannot find the leader.");
         leader.shutdown();
 
         // now corrupt the leader's database
@@ -153,7 +153,7 @@ public void testCorruption() throws Exception {
         for (int i = 0; i < 5; i++) {
             if (leaderSid != (i + 1)) {
                 String hp = list[i];
-                assertTrue("waiting for server up", ClientBase.waitForServerUp(hp, CONNECTION_TIMEOUT));
+                assertTrue(ClientBase.waitForServerUp(hp, CONNECTION_TIMEOUT), "waiting for server up");
                 LOG.info("{} is accepting client connections", hp);
             } else {
                 LOG.info("Skipping the leader");
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperQuotaTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperQuotaTest.java
index 2eb2c6caabe..211f91a476f 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperQuotaTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperQuotaTest.java
@@ -18,27 +18,60 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Map;
+import java.util.UUID;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
+import org.apache.zookeeper.KeeperException.QuotaExceededException;
+import org.apache.zookeeper.Op;
 import org.apache.zookeeper.Quotas;
 import org.apache.zookeeper.StatsTrack;
 import org.apache.zookeeper.ZooDefs.Ids;
 import org.apache.zookeeper.ZooKeeper;
+import org.apache.zookeeper.cli.DelQuotaCommand;
+import org.apache.zookeeper.cli.ListQuotaCommand;
 import org.apache.zookeeper.cli.MalformedPathException;
 import org.apache.zookeeper.cli.SetQuotaCommand;
 import org.apache.zookeeper.data.Stat;
+import org.apache.zookeeper.metrics.MetricsUtils;
 import org.apache.zookeeper.server.ZooKeeperServer;
-import org.junit.Test;
+import org.apache.zookeeper.server.util.QuotaMetricsUtils;
+import org.apache.zookeeper.test.StatsTrackTest.OldStatsTrack;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 
 public class ZooKeeperQuotaTest extends ClientBase {
+    private ZooKeeper zk = null;
+
+    @BeforeEach
+    @Override
+    public void setUp() throws Exception {
+        System.setProperty(ZooKeeperServer.ENFORCE_QUOTA, "true");
+        super.setUp();
+        zk = createClient();
+    }
+
+    @AfterEach
+    @Override
+    public void tearDown() throws Exception {
+        System.clearProperty(ZooKeeperServer.ENFORCE_QUOTA);
+        super.tearDown();
+        zk.close();
+    }
 
     @Test
     public void testQuota() throws Exception {
-        final ZooKeeper zk = createClient();
+
         final String path = "/a/b/v";
         // making sure setdata works on /
         zk.setData("/", "some".getBytes(), -1);
@@ -49,20 +82,33 @@ public void testQuota() throws Exception {
         zk.create("/a/b/v", "some".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
         zk.create("/a/b/v/d", "some".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
-        SetQuotaCommand.createQuota(zk, path, 5L, 10);
+
+        StatsTrack quota = new StatsTrack();
+        quota.setCount(4);
+        quota.setCountHardLimit(4);
+        quota.setBytes(9L);
+        quota.setByteHardLimit(15L);
+        SetQuotaCommand.createQuota(zk, path, quota);
 
         // see if its set
-        String absolutePath = Quotas.quotaZookeeper + path + "/" + Quotas.limitNode;
+        String absolutePath = Quotas.limitPath(path);
         byte[] data = zk.getData(absolutePath, false, new Stat());
-        StatsTrack st = new StatsTrack(new String(data));
-        assertTrue("bytes are set", st.getBytes() == 5L);
-        assertTrue("num count is set", st.getCount() == 10);
+        StatsTrack st = new StatsTrack(data);
+        assertTrue(st.getBytes() == 9L, "bytes are set");
+        assertTrue(st.getByteHardLimit() == 15L, "byte hard limit is set");
+        assertTrue(st.getCount() == 4, "num count is set");
+        assertTrue(st.getCountHardLimit() == 4, "count hard limit is set");
+
+        // check quota node readable by old servers
+        OldStatsTrack ost = new OldStatsTrack(new String(data));
+        assertTrue(ost.getBytes() == 9L, "bytes are set");
+        assertTrue(ost.getCount() == 4, "num count is set");
 
-        String statPath = Quotas.quotaZookeeper + path + "/" + Quotas.statNode;
+        String statPath = Quotas.statPath(path);
         byte[] qdata = zk.getData(statPath, false, new Stat());
-        StatsTrack qst = new StatsTrack(new String(qdata));
-        assertTrue("bytes are set", qst.getBytes() == 8L);
-        assertTrue("count is set", qst.getCount() == 2);
+        StatsTrack qst = new StatsTrack(qdata);
+        assertTrue(qst.getBytes() == 8L, "bytes are set");
+        assertTrue(qst.getCount() == 2, "count is set");
 
         //force server to restart and load from snapshot, not txn log
         stopServer();
@@ -70,13 +116,11 @@ public void testQuota() throws Exception {
         stopServer();
         startServer();
         ZooKeeperServer server = serverFactory.getZooKeeperServer();
-        assertNotNull("Quota is still set", server.getZKDatabase().getDataTree().getMaxPrefixWithQuota(path)
-                                                           != null);
+        assertNotNull(server.getZKDatabase().getDataTree().getMaxPrefixWithQuota(path), "Quota is still set");
     }
 
     @Test
     public void testSetQuota() throws IOException, InterruptedException, KeeperException, MalformedPathException {
-        final ZooKeeper zk = createClient();
 
         String path = "/c1";
         String nodeData = "foo";
@@ -84,18 +128,21 @@ public void testSetQuota() throws IOException, InterruptedException, KeeperExcep
 
         int count = 10;
         long bytes = 5L;
-        SetQuotaCommand.createQuota(zk, path, bytes, count);
+        StatsTrack quota = new StatsTrack();
+        quota.setCount(count);
+        quota.setBytes(bytes);
+        SetQuotaCommand.createQuota(zk, path, quota);
 
         //check the limit
-        String absoluteLimitPath = Quotas.quotaZookeeper + path + "/" + Quotas.limitNode;
+        String absoluteLimitPath = Quotas.limitPath(path);
         byte[] data = zk.getData(absoluteLimitPath, false, null);
-        StatsTrack st = new StatsTrack(new String(data));
+        StatsTrack st = new StatsTrack(data);
         assertEquals(bytes, st.getBytes());
         assertEquals(count, st.getCount());
         //check the stats
-        String absoluteStatPath = Quotas.quotaZookeeper + path + "/" + Quotas.statNode;
+        String absoluteStatPath = Quotas.statPath(path);
         data = zk.getData(absoluteStatPath, false, null);
-        st = new StatsTrack(new String(data));
+        st = new StatsTrack(data);
         assertEquals(nodeData.length(), st.getBytes());
         assertEquals(1, st.getCount());
 
@@ -104,9 +151,9 @@ public void testSetQuota() throws IOException, InterruptedException, KeeperExcep
         String nodeData2 = "bar";
         zk.create(path2, nodeData2.getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
-        absoluteStatPath = Quotas.quotaZookeeper + path + "/" + Quotas.statNode;
+        absoluteStatPath = Quotas.statPath(path);
         data = zk.getData(absoluteStatPath, false, null);
-        st = new StatsTrack(new String(data));
+        st = new StatsTrack(data);
         //check the stats
         assertEquals(nodeData.length() + nodeData2.length(), st.getBytes());
         assertEquals(2, st.getCount());
@@ -114,7 +161,6 @@ public void testSetQuota() throws IOException, InterruptedException, KeeperExcep
 
     @Test
     public void testSetQuotaWhenSetQuotaOnParentOrChildPath() throws IOException, InterruptedException, KeeperException, MalformedPathException {
-        final ZooKeeper zk = createClient();
 
         zk.create("/c1", "some".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
         zk.create("/c1/c2", "some".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
@@ -123,19 +169,435 @@ public void testSetQuotaWhenSetQuotaOnParentOrChildPath() throws IOException, In
         zk.create("/c1/c2/c3/c4/c5", "some".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
 
         //set the quota on the path:/c1/c2/c3
-        SetQuotaCommand.createQuota(zk, "/c1/c2/c3", 5L, 10);
+        StatsTrack quota = new StatsTrack();
+        quota.setCount(5);
+        quota.setBytes(10);
+        SetQuotaCommand.createQuota(zk, "/c1/c2/c3", quota);
 
         try {
-            SetQuotaCommand.createQuota(zk, "/c1", 5L, 10);
+            SetQuotaCommand.createQuota(zk, "/c1", quota);
+            fail("should not set quota when child has a quota");
         } catch (IllegalArgumentException e) {
             assertEquals("/c1 has a child /c1/c2/c3 which has a quota", e.getMessage());
         }
 
         try {
-            SetQuotaCommand.createQuota(zk, "/c1/c2/c3/c4/c5", 5L, 10);
+            SetQuotaCommand.createQuota(zk, "/c1/c2/c3/c4/c5", quota);
+            fail("should not set quota when parent has a quota");
         } catch (IllegalArgumentException e) {
             assertEquals("/c1/c2/c3/c4/c5 has a parent /c1/c2/c3 which has a quota", e.getMessage());
         }
     }
 
+    @Test
+    public void testSetQuotaWhenExceedBytesSoftQuota() throws Exception {
+
+        final String namespace = UUID.randomUUID().toString();
+        final String path = "/" + namespace;
+        zk.create(path, "data".getBytes(), Ids.OPEN_ACL_UNSAFE,
+                CreateMode.PERSISTENT);
+        StatsTrack st = new StatsTrack();
+        st.setBytes(5L);
+        SetQuotaCommand.createQuota(zk, path, st);
+
+        zk.setData(path, "12345".getBytes(), -1);
+
+        try {
+            zk.setData(path, "123456".getBytes(), -1);
+            validateNoQuotaExceededMetrics(namespace);
+        } catch (Exception e) {
+            fail("should set data which exceeds the soft byte quota");
+        }
+    }
+
+    @Test
+    public void testSetQuotaWhenExceedBytesHardQuota() throws Exception {
+
+        final String namespace = UUID.randomUUID().toString();
+        final String path = "/" + namespace;
+        zk.create(path, "12345".getBytes(), Ids.OPEN_ACL_UNSAFE,
+                CreateMode.PERSISTENT);
+        StatsTrack st = new StatsTrack();
+        st.setByteHardLimit(5L);
+        SetQuotaCommand.createQuota(zk, path, st);
+
+        try {
+            zk.setData(path, "123456".getBytes(), -1);
+            fail("should not set data which exceeds the hard byte quota");
+        } catch (QuotaExceededException e) {
+           //expected
+            validateQuotaExceededMetrics(namespace);
+        }
+    }
+
+    @Test
+    public void testSetQuotaWhenExceedBytesHardQuotaExtend() throws Exception {
+
+        final String namespace = UUID.randomUUID().toString();
+        final String path = "/" + namespace;
+        zk.create(path, "1".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        int bytes = 100;
+        StatsTrack st = new StatsTrack();
+        st.setByteHardLimit(bytes);
+        SetQuotaCommand.createQuota(zk, path, st);
+        StringBuilder sb = new StringBuilder(path);
+        for (int i = 1; i <= bytes; i++) {
+            sb.append("/c" + i);
+            if (i == bytes) {
+                try {
+                    zk.create(sb.toString(), "1".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+                    fail("should not set quota when exceeds hard bytes quota");
+                } catch (QuotaExceededException e) {
+                    //expected
+                    validateQuotaExceededMetrics(namespace);
+                }
+            } else {
+                zk.create(sb.toString(), "1".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            }
+        }
+    }
+
+    @Test
+    public void testSetQuotaWhenSetQuotaLessThanExistBytes() throws Exception {
+
+        final String namespace = UUID.randomUUID().toString();
+        final String path = "/" + namespace;
+        zk.create(path, "123456789".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        int bytes = 5;
+        StatsTrack st = new StatsTrack();
+        st.setByteHardLimit(bytes);
+        SetQuotaCommand.createQuota(zk, path, st);
+        try {
+            zk.setData(path, "123456".getBytes(), -1);
+            fail("should not set quota when exceeds hard bytes quota");
+        } catch (QuotaExceededException e) {
+            //expected
+            validateQuotaExceededMetrics(namespace);
+        }
+    }
+
+    @Test
+    public void testSetQuotaWhenSetChildDataExceedBytesQuota() throws Exception {
+
+        final String namespace = UUID.randomUUID().toString();
+        final String path = "/" + namespace + "/quota";
+        zk.create("/" + namespace, null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk.create(path, "01234".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk.create(path + "/data", "56789".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+        StatsTrack quota = new StatsTrack();
+        quota.setByteHardLimit(10);
+        SetQuotaCommand.createQuota(zk, path, quota);
+        try {
+            zk.setData(path + "/data", "567891".getBytes(), -1);
+            fail("should not set data when exceed hard byte quota");
+        } catch (QuotaExceededException e) {
+            //expected
+            validateQuotaExceededMetrics(namespace);
+        }
+    }
+
+    @Test
+    public void testSetQuotaWhenCreateNodeExceedBytesQuota() throws Exception {
+
+        final String namespace = UUID.randomUUID().toString();
+        final String path = "/" + namespace + "/quota";
+        zk.create("/" + namespace, null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk.create(path, "01234".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+        StatsTrack quota = new StatsTrack();
+        quota.setByteHardLimit(10);
+        SetQuotaCommand.createQuota(zk, path, quota);
+        try {
+            zk.create(path + "/data", "567891".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            fail("should not set data when exceed hard byte quota");
+        } catch (QuotaExceededException e) {
+            //expected
+            validateQuotaExceededMetrics(namespace);
+        }
+    }
+
+    @Test
+    public void testSetQuotaWhenExceedCountSoftQuota() throws Exception {
+
+        final String namespace = UUID.randomUUID().toString();
+        final String path = "/" + namespace;
+        zk.create(path, "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        int count = 2;
+        StatsTrack st = new StatsTrack();
+        st.setCount(count);
+        SetQuotaCommand.createQuota(zk, path, st);
+        zk.create(path + "/c2", "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+        try {
+            zk.create(path + "/c2" + "/c3", "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            validateNoQuotaExceededMetrics(namespace);
+        } catch (QuotaExceededException e) {
+            fail("should set quota when exceeds soft count quota");
+        }
+    }
+
+    @Test
+    public void testSetQuotaWhenExceedCountHardQuota() throws Exception {
+
+        final String namespace = UUID.randomUUID().toString();
+        final String path = "/" + namespace;
+        zk.create(path, "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        int count = 2;
+        StatsTrack st = new StatsTrack();
+        st.setCountHardLimit(count);
+        SetQuotaCommand.createQuota(zk, path, st);
+        zk.create(path + "/c2", "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+        try {
+            zk.create(path + "/c2" + "/c3", "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            fail("should not set quota when exceeds hard count quota");
+        } catch (QuotaExceededException e) {
+            //expected
+            validateQuotaExceededMetrics(namespace);
+        }
+    }
+
+    @Test
+    public void testSetQuotaWhenExceedCountHardQuotaExtend() throws Exception {
+
+        final String namespace = UUID.randomUUID().toString();
+        final String path = "/" + namespace;
+        zk.create(path, "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        int count = 100;
+        StatsTrack st = new StatsTrack();
+        st.setCountHardLimit(count);
+        SetQuotaCommand.createQuota(zk, path, st);
+        StringBuilder sb = new StringBuilder(path);
+        for (int i = 1; i <= count; i++) {
+            sb.append("/c" + i);
+            if (i == count) {
+                try {
+                    zk.create(sb.toString() , "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+                    fail("should not set quota when exceeds hard count quota");
+                } catch (QuotaExceededException e) {
+                    //expected
+                    validateQuotaExceededMetrics(namespace);
+                }
+            } else {
+                zk.create(sb.toString(), "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            }
+        }
+    }
+
+    @Test
+    public void testSetQuotaWhenSetQuotaLessThanExistCount() throws Exception {
+
+        final String namespace = UUID.randomUUID().toString();
+        final String path = "/" + namespace;
+        zk.create(path, "1".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk.create(path + "/c1", "1".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        zk.create(path + "/c2", "1".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        int count = 2;
+        StatsTrack st = new StatsTrack();
+        st.setCountHardLimit(count);
+        SetQuotaCommand.createQuota(zk, path, st);
+        try {
+            zk.create(path + "/c3", "1".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            fail("should not set quota when exceeds hard count quota");
+        } catch (QuotaExceededException e) {
+            //expected
+            validateQuotaExceededMetrics(namespace);
+        }
+    }
+
+    @Test
+    public void testSetQuotaWhenExceedBothBytesAndCountHardQuota() throws Exception {
+
+        final String namespace = UUID.randomUUID().toString();
+        final String path = "/" + namespace;
+        zk.create(path, "12345".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        StatsTrack st = new StatsTrack();
+        st.setByteHardLimit(5L);
+        st.setCountHardLimit(1);
+        SetQuotaCommand.createQuota(zk, path, st);
+
+        try {
+            zk.create(path + "/c2", "1".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            fail("should give priority to CountQuotaExceededException when both meets the count and bytes quota");
+        } catch (QuotaExceededException e) {
+            //expected
+            validateQuotaExceededMetrics(namespace);
+        }
+    }
+
+    @Test
+    public void testMultiCreateThenSetDataShouldWork() throws Exception {
+        final String path = "/a";
+        final String subPath = "/a/b";
+
+        zk.create(path, null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+        final byte[] data13b = "Hello, World!".getBytes(StandardCharsets.UTF_8);
+
+        final StatsTrack st = new StatsTrack();
+        st.setByteHardLimit(data13b.length);
+        SetQuotaCommand.createQuota(zk, path, st);
+
+        final List<Op> ops = Arrays.asList(
+            Op.create(subPath, null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
+            Op.setData(subPath, data13b, -1));
+
+        zk.multi(ops);
+    }
+
+    @Test
+    public void testMultiCreateThenSetDataShouldFail() throws Exception {
+        final String path = "/a";
+        final String subPath = "/a/b";
+
+        zk.create(path, null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+        final byte[] data13b = "Hello, World!".getBytes(StandardCharsets.UTF_8);
+
+        final StatsTrack st = new StatsTrack();
+        st.setByteHardLimit(data13b.length - 1);
+        SetQuotaCommand.createQuota(zk, path, st);
+
+        final List<Op> ops = Arrays.asList(
+            Op.create(subPath, null, Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT),
+            Op.setData(subPath, data13b, -1));
+
+        try {
+            zk.multi(ops);
+            fail("should fail transaction when hard quota is exceeded");
+        } catch (QuotaExceededException e) {
+            //expected
+        }
+
+        assertNull(zk.exists(subPath, null));
+    }
+
+    @Test
+    public void testDeleteBytesQuota() throws Exception {
+
+        final String namespace = UUID.randomUUID().toString();
+        final String path = "/" + namespace;
+        zk.create(path, "12345".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        StatsTrack st = new StatsTrack();
+        st.setByteHardLimit(5L);
+        SetQuotaCommand.createQuota(zk, path, st);
+
+        try {
+            zk.setData(path, "123456".getBytes(), -1);
+            fail("should not set data which exceeds the hard byte quota");
+        } catch (QuotaExceededException e) {
+            //expected
+            validateQuotaExceededMetrics(namespace);
+        }
+
+        //delete the Byte Hard Quota
+        st = new StatsTrack();
+        st.setByteHardLimit(1);
+        DelQuotaCommand.delQuota(zk, path, st);
+
+        zk.setData(path, "123456".getBytes(), -1);
+        validateQuotaExceededMetrics(namespace);
+    }
+
+    @Test
+    public void testDeleteCountQuota() throws Exception {
+
+        final String namespace = UUID.randomUUID().toString();
+        final String path = "/" + namespace;
+        zk.create(path, "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        int count = 2;
+        StatsTrack st = new StatsTrack();
+        st.setCountHardLimit(count);
+        SetQuotaCommand.createQuota(zk, path, st);
+        zk.create(path + "/c2", "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+
+        try {
+            zk.create(path + "/c2" + "/c3", "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+            fail("should not set quota when exceeds hard count quota");
+        } catch (QuotaExceededException e) {
+            //expected
+            validateQuotaExceededMetrics(namespace);
+        }
+
+        //delete the Count Hard Quota
+        st = new StatsTrack();
+        st.setCountHardLimit(1);
+        DelQuotaCommand.delQuota(zk, path, st);
+
+        zk.create(path + "/c2" + "/c3", "data".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        validateQuotaExceededMetrics(namespace);
+    }
+
+    @Test
+    public void testListQuota() throws Exception {
+
+        final String path = "/c1";
+        zk.create(path, "12345".getBytes(), Ids.OPEN_ACL_UNSAFE, CreateMode.PERSISTENT);
+        StatsTrack st = new StatsTrack();
+        long bytes = 5L;
+        int count = 10;
+        long byteHardLimit = 6L;
+        int countHardLimit = 12;
+        st.setBytes(bytes);
+        st.setCount(count);
+        st.setByteHardLimit(byteHardLimit);
+        st.setCountHardLimit(countHardLimit);
+        SetQuotaCommand.createQuota(zk, path, st);
+
+        List<StatsTrack> statsTracks = ListQuotaCommand.listQuota(zk, path);
+        for (int i = 0; i < statsTracks.size(); i++) {
+            st = statsTracks.get(i);
+            if (i == 0) {
+                assertEquals(count, st.getCount());
+                assertEquals(countHardLimit, st.getCountHardLimit());
+                assertEquals(bytes, st.getBytes());
+                assertEquals(byteHardLimit, st.getByteHardLimit());
+            } else {
+                assertEquals(1, st.getCount());
+                assertEquals(-1, st.getCountHardLimit());
+                assertEquals(5, st.getBytes());
+                assertEquals(-1, st.getByteHardLimit());
+            }
+        }
+        //delete the Byte Hard Quota
+        st = new StatsTrack();
+        st.setByteHardLimit(1);
+        st.setBytes(1);
+        st.setCountHardLimit(1);
+        st.setCount(1);
+        DelQuotaCommand.delQuota(zk, path, st);
+
+        statsTracks = ListQuotaCommand.listQuota(zk, path);
+        for (int i = 0; i < statsTracks.size(); i++) {
+            st = statsTracks.get(i);
+            if (i == 0) {
+                assertEquals(-1, st.getCount());
+                assertEquals(-1, st.getCountHardLimit());
+                assertEquals(-1, st.getBytes());
+                assertEquals(-1, st.getByteHardLimit());
+            } else {
+                assertEquals(1, st.getCount());
+                assertEquals(-1, st.getCountHardLimit());
+                assertEquals(5, st.getBytes());
+                assertEquals(-1, st.getByteHardLimit());
+            }
+        }
+    }
+
+    private void validateQuotaExceededMetrics(final String namespace) {
+        final String name = QuotaMetricsUtils.QUOTA_EXCEEDED_ERROR_PER_NAMESPACE;
+        final Map<String, Object> metrics = MetricsUtils.currentServerMetrics();
+
+        assertEquals(1, metrics.keySet().stream().filter(
+                key -> key.contains(String.format("%s_%s", namespace, name))).count());
+
+        assertEquals(1L, metrics.get(String.format("%s_%s", namespace, name)));
+    }
+
+    static void validateNoQuotaExceededMetrics(final String namespace) {
+        final Map<String, Object> metrics = MetricsUtils.currentServerMetrics();
+        assertEquals(0, metrics.keySet().stream().filter(
+                key -> key.contains(String.format("%s_%s", namespace, QuotaMetricsUtils.QUOTA_EXCEEDED_ERROR_PER_NAMESPACE))).count());
+    }
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperTestClient.java b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperTestClient.java
index 42f0ebee751..3bd0ff569d8 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperTestClient.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/test/ZooKeeperTestClient.java
@@ -18,9 +18,9 @@
 
 package org.apache.zookeeper.test;
 
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
 import java.io.IOException;
 import java.util.List;
 import java.util.concurrent.LinkedBlockingQueue;
@@ -45,7 +45,7 @@ public class ZooKeeperTestClient extends ZKTestCase implements Watcher {
 
     protected String testDirOnZK = dirOnZK + "/" + Time.currentElapsedTime();
 
-    LinkedBlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<WatchedEvent>();
+    LinkedBlockingQueue<WatchedEvent> events = new LinkedBlockingQueue<>();
 
     private WatchedEvent getEvent(int numTries) throws InterruptedException {
         WatchedEvent event = null;
@@ -131,7 +131,7 @@ private void enode_test_1() throws IOException, InterruptedException, KeeperExce
             Code code = ke.code();
             boolean valid = code == KeeperException.Code.NODEEXISTS;
             if (!valid) {
-                fail("Unexpected exception code for createin: " + ke.getMessage());
+                fail("Unexpected exception code for create: " + ke.getMessage());
             }
         }
 
@@ -207,7 +207,7 @@ private void enode_test_2() throws IOException, InterruptedException, KeeperExce
             Code code = ke.code();
             boolean valid = code == KeeperException.Code.NODEEXISTS;
             if (!valid) {
-                fail("Unexpected exception code for createin: " + ke.getMessage());
+                fail("Unexpected exception code for create: " + ke.getMessage());
             }
         }
 
@@ -243,7 +243,7 @@ private void enode_test_2() throws IOException, InterruptedException, KeeperExce
             Code code = ke.code();
             boolean valid = code == KeeperException.Code.NOCHILDRENFOREPHEMERALS;
             if (!valid) {
-                fail("Unexpected exception code for createin: " + code);
+                fail("Unexpected exception code for create: " + code);
             }
         }
 
@@ -262,7 +262,7 @@ private void enode_test_2() throws IOException, InterruptedException, KeeperExce
             Code code = ke.code();
             boolean valid = code == KeeperException.Code.NONODE;
             if (!valid) {
-                fail("Unexpected exception code for createin: " + code);
+                fail("Unexpected exception code for create: " + code);
             }
         }
         firstGen1 = zk_1.getChildren(parentName, true);
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/util/PemReaderTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/util/PemReaderTest.java
index 423b38bb435..30d9241e7ac 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/util/PemReaderTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/util/PemReaderTest.java
@@ -18,50 +18,29 @@
 
 package org.apache.zookeeper.util;
 
-import static org.junit.Assert.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import java.io.IOException;
 import java.security.GeneralSecurityException;
 import java.security.KeyStoreException;
 import java.security.PrivateKey;
 import java.security.cert.X509Certificate;
-import java.util.Collection;
 import java.util.List;
 import java.util.Optional;
 import org.apache.zookeeper.common.BaseX509ParameterizedTestCase;
 import org.apache.zookeeper.common.KeyStoreFileType;
 import org.apache.zookeeper.common.X509KeyType;
-import org.apache.zookeeper.common.X509TestContext;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.MethodSource;
 
-@RunWith(Parameterized.class)
 public class PemReaderTest extends BaseX509ParameterizedTestCase {
 
-    @Parameterized.Parameters
-    public static Collection<Object[]> params() {
-        return BaseX509ParameterizedTestCase.defaultParams();
-    }
-
-    public PemReaderTest(
-            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex) {
-        super(paramIndex, () -> {
-            try {
-                return X509TestContext.newBuilder()
-                        .setTempDir(tempDir)
-                        .setKeyStorePassword(keyPassword)
-                        .setKeyStoreKeyType(certKeyType)
-                        .setTrustStorePassword(keyPassword)
-                        .setTrustStoreKeyType(caKeyType)
-                        .build();
-            } catch (Exception e) {
-                throw new RuntimeException(e);
-            }
-        });
-    }
-
-    @Test
-    public void testLoadPrivateKeyFromKeyStore() throws IOException, GeneralSecurityException {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPrivateKeyFromKeyStore(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         Optional<String> optPassword = x509TestContext.getKeyStorePassword().length() > 0
                                                ? Optional.of(x509TestContext.getKeyStorePassword())
                                                : Optional.empty();
@@ -70,56 +49,93 @@ public void testLoadPrivateKeyFromKeyStore() throws IOException, GeneralSecurity
     }
 
     // Try to load a password-protected private key without providing a password
-    @Test(expected = GeneralSecurityException.class)
-    public void testLoadEncryptedPrivateKeyFromKeyStoreWithoutPassword() throws GeneralSecurityException, IOException {
-        if (!x509TestContext.isKeyStoreEncrypted()) {
-            throw new GeneralSecurityException(); // this case is not tested so throw the expected exception
-        }
-        PemReader.loadPrivateKey(x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM), Optional.empty());
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadEncryptedPrivateKeyFromKeyStoreWithoutPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(GeneralSecurityException.class, () -> {
+            if (!x509TestContext.isKeyStoreEncrypted()) {
+                throw new GeneralSecurityException(); // this case is not tested so throw the expected exception
+            }
+            PemReader.loadPrivateKey(x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM), Optional.empty());
+        });
     }
 
     // Try to load a password-protected private key with the wrong password
-    @Test(expected = GeneralSecurityException.class)
-    public void testLoadEncryptedPrivateKeyFromKeyStoreWithWrongPassword() throws GeneralSecurityException, IOException {
-        if (!x509TestContext.isKeyStoreEncrypted()) {
-            throw new GeneralSecurityException(); // this case is not tested so throw the expected exception
-        }
-        PemReader.loadPrivateKey(x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM), Optional.of("wrong password"));
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadEncryptedPrivateKeyFromKeyStoreWithWrongPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(GeneralSecurityException.class, () -> {
+            if (!x509TestContext.isKeyStoreEncrypted()) {
+                throw new GeneralSecurityException(); // this case is not tested so throw the expected exception
+            }
+            PemReader.loadPrivateKey(x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM), Optional.of("wrong password"));
+        });
     }
 
     // Try to load a non-protected private key while providing a password
-    @Test(expected = IOException.class)
-    public void testLoadUnencryptedPrivateKeyFromKeyStoreWithWrongPassword() throws GeneralSecurityException, IOException {
-        if (x509TestContext.isKeyStoreEncrypted()) {
-            throw new IOException();
-        }
-        PemReader.loadPrivateKey(x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM), Optional.of("wrong password"));
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadUnencryptedPrivateKeyFromKeyStoreWithWrongPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(IOException.class, () -> {
+            if (x509TestContext.isKeyStoreEncrypted()) {
+                throw new IOException();
+            }
+            PemReader.loadPrivateKey(x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM), Optional.of("wrong password"));
+        });
     }
 
     // Expect this to fail, the trust store does not contain a private key
-    @Test(expected = KeyStoreException.class)
-    public void testLoadPrivateKeyFromTrustStore() throws IOException, GeneralSecurityException {
-        PemReader.loadPrivateKey(x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM), Optional.empty());
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPrivateKeyFromTrustStore(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(KeyStoreException.class, () -> {
+            PemReader.loadPrivateKey(x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM), Optional.empty());
+        });
     }
 
     // Expect this to fail, the trust store does not contain a private key
-    @Test(expected = KeyStoreException.class)
-    public void testLoadPrivateKeyFromTrustStoreWithPassword() throws IOException, GeneralSecurityException {
-        PemReader.loadPrivateKey(x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM), Optional.of("foobar"));
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadPrivateKeyFromTrustStoreWithPassword(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
+        assertThrows(KeyStoreException.class, () -> {
+            PemReader.loadPrivateKey(x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM), Optional.of("foobar"));
+        });
     }
 
-    @Test
-    public void testLoadCertificateFromKeyStore() throws IOException, GeneralSecurityException {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadCertificateFromKeyStore(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         List<X509Certificate> certs = PemReader.readCertificateChain(x509TestContext.getKeyStoreFile(KeyStoreFileType.PEM));
         assertEquals(1, certs.size());
         assertEquals(x509TestContext.getKeyStoreCertificate(), certs.get(0));
     }
 
-    @Test
-    public void testLoadCertificateFromTrustStore() throws IOException, GeneralSecurityException {
+    @ParameterizedTest
+    @MethodSource("data")
+    public void testLoadCertificateFromTrustStore(
+            X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
+            throws Exception {
+        init(caKeyType, certKeyType, keyPassword, paramIndex);
         List<X509Certificate> certs = PemReader.readCertificateChain(x509TestContext.getTrustStoreFile(KeyStoreFileType.PEM));
-        assertEquals(1, certs.size());
-        assertEquals(x509TestContext.getTrustStoreCertificate(), certs.get(0));
+        assertEquals(x509TestContext.getTrustStoreCertificates(), certs);
     }
 
 }
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/util/TestCircularBlockingQueue.java b/zookeeper-server/src/test/java/org/apache/zookeeper/util/TestCircularBlockingQueue.java
index ac24d2e5b4d..c68397f0db2 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/util/TestCircularBlockingQueue.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/util/TestCircularBlockingQueue.java
@@ -18,12 +18,13 @@
 
 package org.apache.zookeeper.util;
 
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import java.util.concurrent.ExecutionException;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
 import java.util.concurrent.Future;
-import org.junit.Assert;
-import org.junit.Test;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 public class TestCircularBlockingQueue {
 
@@ -36,17 +37,18 @@ public void testCircularBlockingQueue() throws InterruptedException {
     testQueue.offer(2);
     testQueue.offer(3);
 
-    Assert.assertEquals(2, testQueue.size());
+    assertEquals(2, testQueue.size());
 
-    Assert.assertEquals(2, testQueue.take().intValue());
-    Assert.assertEquals(3, testQueue.take().intValue());
+    assertEquals(2, testQueue.take().intValue());
+    assertEquals(3, testQueue.take().intValue());
 
-    Assert.assertEquals(1L, testQueue.getDroppedCount());
-    Assert.assertEquals(0, testQueue.size());
-    Assert.assertEquals(true, testQueue.isEmpty());
+    assertEquals(1L, testQueue.getDroppedCount());
+    assertEquals(0, testQueue.size());
+    assertEquals(true, testQueue.isEmpty());
   }
 
-  @Test(timeout = 10000L)
+  @Test
+  @Timeout(value = 10)
   public void testCircularBlockingQueueTakeBlock()
       throws InterruptedException, ExecutionException {
 
@@ -67,7 +69,7 @@ public void testCircularBlockingQueueTakeBlock()
       testQueue.offer(10);
 
       Integer result = testTake.get();
-      Assert.assertEquals(10, result.intValue());
+      assertEquals(10, result.intValue());
     } finally {
       executor.shutdown();
     }
diff --git a/zookeeper-server/src/test/resources/data/ssl/README.md b/zookeeper-server/src/test/resources/data/ssl/README.md
index b8823d8a3de..26d4d0b6fff 100644
--- a/zookeeper-server/src/test/resources/data/ssl/README.md
+++ b/zookeeper-server/src/test/resources/data/ssl/README.md
@@ -1,6 +1,21 @@
 SSL test data
 ===================
 
+Create keystore with certificate
+```
+keytool -genkeypair -alias test -keyalg RSA -keysize 2048 -dname "CN=localhost,OU=ZooKeeper,O=Apache,L=Unknown,ST=Unknown,C=Unknown" -keypass testpass -keystore keystore.jks -storepass testpass -ext SAN=DNS:localhost,IP:127.0.0.1
+```
+
+Export certificate to file
+```
+keytool -exportcert -alias test -keystore keystore.jks -file test.cer -rfc
+```
+
+Create truststore
+```
+keytool -importcert -alias test -file test.cer -keystore truststore.jks -storepass testpass
+```
+
 testKeyStore.jks
 ---
 Testing keystore, password is "testpass".
diff --git a/zookeeper-server/src/test/resources/data/ssl/testKeyStore.jks b/zookeeper-server/src/test/resources/data/ssl/testKeyStore.jks
index 40a7d0b7eae..60e5d52b656 100644
Binary files a/zookeeper-server/src/test/resources/data/ssl/testKeyStore.jks and b/zookeeper-server/src/test/resources/data/ssl/testKeyStore.jks differ
diff --git a/zookeeper-server/src/test/resources/data/ssl/testTrustStore.jks b/zookeeper-server/src/test/resources/data/ssl/testTrustStore.jks
index 33f09c11dfa..bced986e430 100644
Binary files a/zookeeper-server/src/test/resources/data/ssl/testTrustStore.jks and b/zookeeper-server/src/test/resources/data/ssl/testTrustStore.jks differ
diff --git a/zookeeper-server/src/test/resources/embedded/testKeyStore.jks b/zookeeper-server/src/test/resources/embedded/testKeyStore.jks
new file mode 100644
index 00000000000..40a7d0b7eae
Binary files /dev/null and b/zookeeper-server/src/test/resources/embedded/testKeyStore.jks differ
diff --git a/zookeeper-server/src/test/resources/embedded/testTrustStore.jks b/zookeeper-server/src/test/resources/embedded/testTrustStore.jks
new file mode 100644
index 00000000000..33f09c11dfa
Binary files /dev/null and b/zookeeper-server/src/test/resources/embedded/testTrustStore.jks differ
diff --git a/zookeeper-server/src/test/resources/embedded/test_jaas_server_auth.conf b/zookeeper-server/src/test/resources/embedded/test_jaas_server_auth.conf
new file mode 100644
index 00000000000..5f8323e00e7
--- /dev/null
+++ b/zookeeper-server/src/test/resources/embedded/test_jaas_server_auth.conf
@@ -0,0 +1,18 @@
+Server {
+       org.apache.zookeeper.server.auth.DigestLoginModule required
+       user_foo="bar";
+};
+Client {
+       org.apache.zookeeper.server.auth.DigestLoginModule required
+       username="foo"
+       password="bar";
+};
+QuorumServer {
+       org.apache.zookeeper.server.auth.DigestLoginModule required
+       user_test="test";
+};
+QuorumLearner {
+       org.apache.zookeeper.server.auth.DigestLoginModule required
+       username="test"
+       password="test";
+};
\ No newline at end of file
diff --git a/zookeeper-server/src/test/resources/log4j.properties b/zookeeper-server/src/test/resources/log4j.properties
deleted file mode 100644
index 4a2ede95503..00000000000
--- a/zookeeper-server/src/test/resources/log4j.properties
+++ /dev/null
@@ -1,65 +0,0 @@
-# Copyright 2012 The Apache Software Foundation
-# 
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Define some default values that can be overridden by system properties
-zookeeper.root.logger=INFO, CONSOLE
-
-zookeeper.console.threshold=INFO
-
-zookeeper.log.dir=.
-zookeeper.log.file=zookeeper.log
-zookeeper.log.threshold=INFO
-zookeeper.log.maxfilesize=256MB
-zookeeper.log.maxbackupindex=20
-
-zookeeper.tracelog.dir=${zookeeper.log.dir}
-zookeeper.tracelog.file=zookeeper_trace.log
-
-log4j.rootLogger=${zookeeper.root.logger}
-
-#
-# console
-# Add "console" to rootlogger above if you want to use this 
-#
-log4j.appender.CONSOLE=org.apache.log4j.ConsoleAppender
-log4j.appender.CONSOLE.Threshold=${zookeeper.console.threshold}
-log4j.appender.CONSOLE.layout=org.apache.log4j.PatternLayout
-log4j.appender.CONSOLE.layout.ConversionPattern=%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L] - %m%n
-
-#
-# Add ROLLINGFILE to rootLogger to get log file output
-#
-log4j.appender.ROLLINGFILE=org.apache.log4j.RollingFileAppender
-log4j.appender.ROLLINGFILE.Threshold=${zookeeper.log.threshold}
-log4j.appender.ROLLINGFILE.File=${zookeeper.log.dir}/${zookeeper.log.file}
-log4j.appender.ROLLINGFILE.MaxFileSize=${zookeeper.log.maxfilesize}
-log4j.appender.ROLLINGFILE.MaxBackupIndex=${zookeeper.log.maxbackupindex}
-log4j.appender.ROLLINGFILE.layout=org.apache.log4j.PatternLayout
-log4j.appender.ROLLINGFILE.layout.ConversionPattern=%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L] - %m%n
-
-#
-# Add TRACEFILE to rootLogger to get log file output
-#    Log TRACE level and above messages to a log file
-#
-log4j.appender.TRACEFILE=org.apache.log4j.FileAppender
-log4j.appender.TRACEFILE.Threshold=TRACE
-log4j.appender.TRACEFILE.File=${zookeeper.tracelog.dir}/${zookeeper.tracelog.file}
-
-log4j.appender.TRACEFILE.layout=org.apache.log4j.PatternLayout
-### Notice we are including log4j's NDC here (%x)
-log4j.appender.TRACEFILE.layout.ConversionPattern=%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L][%x] - %m%n
diff --git a/zookeeper-server/src/test/resources/logback.xml b/zookeeper-server/src/test/resources/logback.xml
new file mode 100644
index 00000000000..a1e627724a5
--- /dev/null
+++ b/zookeeper-server/src/test/resources/logback.xml
@@ -0,0 +1,36 @@
+<!--
+ Copyright 2022 The Apache Software Foundation
+
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements.  See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership.  The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+ Define some default values that can be overridden by system properties
+-->
+<configuration>
+
+  <appender name="CONSOLE" class="ch.qos.logback.core.ConsoleAppender">
+    <encoder>
+      <pattern>%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L] - %m%n</pattern>
+    </encoder>
+    <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
+      <level>INFO</level>
+    </filter>
+  </appender>
+
+  <root level="INFO">
+    <appender-ref ref="CONSOLE" />
+  </root>
+</configuration>
diff --git a/zookeeper-server/src/test/resources/test-github-pr.sh b/zookeeper-server/src/test/resources/test-github-pr.sh
deleted file mode 100755
index 3acccc38bd6..00000000000
--- a/zookeeper-server/src/test/resources/test-github-pr.sh
+++ /dev/null
@@ -1,614 +0,0 @@
-#!/usr/bin/env bash
-#   Licensed under the Apache License, Version 2.0 (the "License");
-#   you may not use this file except in compliance with the License.
-#   You may obtain a copy of the License at
-#
-#       http://www.apache.org/licenses/LICENSE-2.0
-#
-#   Unless required by applicable law or agreed to in writing, software
-#   distributed under the License is distributed on an "AS IS" BASIS,
-#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-#   See the License for the specific language governing permissions and
-#   limitations under the License.
-
-
-#set -x
-
-### Setup some variables.
-### GIT_COMMIT and BUILD_URL are set by Hudson if it is run by patch process
-### Read variables from properties file
-. `dirname $0`/test-patch.properties
-
-###############################################################################
-parseArgs() {
-  case "$1" in
-    QABUILD)
-      ### Set QABUILD to true to indicate that this script is being run by Hudson
-      QABUILD=true
-      if [[ $# != 13 ]] ; then
-        echo "ERROR: usage $0 QABUILD <PATCH_DIR> <PS_CMD> <WGET_CMD> <JIRACLI> <GIT_CMD> <GREP_CMD> <PATCH_CMD> <FINDBUGS_HOME> <WORKSPACE_BASEDIR> <JIRA_PASSWD> <JAVA5_HOME> <CURL_CMD>"
-        cleanupAndExit 0
-      fi
-      PATCH_DIR=$2
-      PS=$3
-      WGET=$4
-      JIRACLI=$5
-      GIT=$6
-      GREP=$7
-      PATCH=$8
-      FINDBUGS_HOME=$9
-      BASEDIR=${10}
-      JIRA_PASSWD=${11}
-      JAVA5_HOME=${12}
-      CURL=${13}
-      if [ ! -e "$PATCH_DIR" ] ; then
-        mkdir -p $PATCH_DIR
-      fi
-
-      ## Obtain PR number and title
-      PULLREQUEST_ID=${GIT_PR_NUMBER}
-      PULLREQUEST_TITLE="${GIT_PR_TITLE}"
-
-      ## Extract jira number from PR title
-      local prefix=${PULLREQUEST_TITLE%ZOOKEEPER\-[0-9]*}
-      local noprefix=${PULLREQUEST_TITLE#$prefix}
-      local regex='\(ZOOKEEPER-.[0-9]*\)'
-      defect=$(expr "$noprefix" : ${regex})
-
-      echo "Pull request id: ${PULLREQUEST_ID}"
-      echo "Pull request title: ${PULLREQUEST_TITLE}"
-      echo "Defect number: ${defect}"
-
-      JIRA_COMMENT="GitHub Pull Request ${PULLREQUEST_NUMBER} Build
-      "
-      ;;
-    DEVELOPER)
-      ### Set QABUILD to false to indicate that this script is being run by a developer
-      QABUILD=false
-      if [[ $# != 9 ]] ; then
-        echo "ERROR: usage $0 DEVELOPER <GIT_PR_URL> <SCRATCH_DIR> <GIT_CMD> <GREP_CMD> <PATCH_CMD> <FINDBUGS_HOME> <WORKSPACE_BASEDIR> <JAVA5_HOME>"
-        cleanupAndExit 0
-      fi
-      PATCH_DIR=$3
-      PATCH_FILE=${PATCH_DIR}/patch
-      curl -L $2.diff > ${PATCH_FILE}
-      ### PATCH_FILE contains the location of the patchfile
-      if [[ ! -e "$PATCH_FILE" ]] ; then
-        echo "Unable to locate the patch file $PATCH_FILE"
-        cleanupAndExit 0
-      fi
-      ### Check if $PATCH_DIR exists. If it does not exist, create a new directory
-      if [[ ! -e "$PATCH_DIR" ]] ; then
-	mkdir "$PATCH_DIR"
-	if [[ $? == 0 ]] ; then
-	  echo "$PATCH_DIR has been created"
-	else
-	  echo "Unable to create $PATCH_DIR"
-	  cleanupAndExit 0
-	fi
-      fi
-      GIT=$4
-      GREP=$5
-      PATCH=$6
-      FINDBUGS_HOME=$7
-      BASEDIR=$8
-      JAVA5_HOME=${9}
-      ### Obtain the patch filename to append it to the version number
-      local subject=`grep "Subject:" ${PATCH_FILE}`
-      local length=`expr match ${subject} ZOOKEEPER-[0-9]*`
-      local position=`expr index ${subject} ZOOKEEPER-`
-      defect=${${subject:$position:$length}#ZOOKEEPER-}
-      ;;
-    *)
-      echo "ERROR: usage $0 QABUILD [args] | DEVELOPER [args]"
-      cleanupAndExit 0
-      ;;
-  esac
-}
-
-###############################################################################
-checkout () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Testing patch for pull request ${PULLREQUEST_ID}."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  ### When run by a developer, if the workspace contains modifications, do not continue
-  # Ref http://stackoverflow.com/a/2659808 for details on checking dirty status
-  ${GIT} diff-index --quiet HEAD
-  if [[ $? -ne 0 ]] ; then
-    uncommitted=`${GIT} diff --name-only HEAD`
-    uncommitted="You have the following files with uncommitted changes:${NEWLINE}${uncommitted}"
-  fi
-  untracked="$(${GIT} ls-files --exclude-standard --others)" && test -z "${untracked}"
-  if [[ $? -ne 0 ]] ; then
-    untracked="You have untracked and unignored files:${NEWLINE}${untracked}"
-  fi
-
-  if [[ $QABUILD == "false" ]] ; then
-    if [[ $uncommitted || $untracked ]] ; then
-      echo "ERROR: can't run in a workspace that contains the following modifications"
-      echo ""
-      echo "${uncommitted}"
-      echo ""
-      echo "${untracked}"
-      cleanupAndExit 1
-    fi
-  else
-    # I don't believe we need to do anything here - the jenkins job will
-    # cleanup the environment for us ("cleanup before checkout" action)
-    # on the precommit jenkins job
-    echo
-  fi
-  return $?
-}
-
-###############################################################################
-setup () {
-  ### exit if warnings are NOT defined in the properties file
-  if [ -z "$OK_FINDBUGS_WARNINGS" ] || [[ -z "$OK_JAVADOC_WARNINGS" ]] || [[ -z $OK_RELEASEAUDIT_WARNINGS ]]; then
-    echo "Please define the following properties in test-patch.properties file"
-	 echo  "OK_FINDBUGS_WARNINGS"
-	 echo  "OK_RELEASEAUDIT_WARNINGS"
-	 echo  "OK_JAVADOC_WARNINGS"
-    cleanupAndExit 1
-  fi
-  ### get pull request diff
-  ${CURL} -L ${GIT_PR_URL}.diff > $PATCH_DIR/patch
-
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo " Pre-build trunk to verify trunk stability and javac warnings"
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  echo "$ANT_HOME/bin/ant  -Djavac.args="-Xlint -Xmaxwarns 1000" -Djava5.home=${JAVA5_HOME} -DZookeeperPatchProcess= clean tar > $PATCH_DIR/trunkJavacWarnings.txt 2>&1"
- $ANT_HOME/bin/ant -Djavac.args="-Xlint -Xmaxwarns 1000" -Djava5.home=${JAVA5_HOME} -DZookeeperPatchProcess= clean tar > $PATCH_DIR/trunkJavacWarnings.txt 2>&1
-  if [[ $? != 0 ]] ; then
-    echo "Trunk compilation is broken?"
-    cleanupAndExit 1
-  fi
-}
-
-###############################################################################
-### Check for @author tags in the patch
-checkAuthor () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Checking there are no @author tags in the patch."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  authorTags=`$GREP -c -i '@author' $PATCH_DIR/patch`
-  echo "There appear to be $authorTags @author tags in the patch."
-  if [[ $authorTags != 0 ]] ; then
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 @author.  The patch appears to contain $authorTags @author tags which the Zookeeper community has agreed to not allow in code contributions."
-    return 1
-  fi
-  JIRA_COMMENT="$JIRA_COMMENT
-
-    +1 @author.  The patch does not contain any @author tags."
-  return 0
-}
-
-###############################################################################
-### Check for tests in the patch
-checkTests () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Checking there are new or changed tests in the patch."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  testReferences=`$GREP -c -i '/test' $PATCH_DIR/patch`
-  echo "There appear to be $testReferences test files referenced in the patch."
-  if [[ $testReferences == 0 ]] ; then
-    if [[ $QABUILD == "true" ]] ; then
-      patchIsDoc=`$GREP -c -i 'title="documentation' $PATCH_DIR/jira`
-      if [[ $patchIsDoc != 0 ]] ; then
-        echo "The patch appears to be a documentation patch that doesn't require tests."
-        JIRA_COMMENT="$JIRA_COMMENT
-
-    +0 tests included.  The patch appears to be a documentation patch that doesn't require tests."
-        return 0
-      fi
-    fi
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 tests included.  The patch doesn't appear to include any new or modified tests.
-                        Please justify why no new tests are needed for this patch.
-                        Also please list what manual steps were performed to verify this patch."
-    return 1
-  fi
-  JIRA_COMMENT="$JIRA_COMMENT
-
-    +1 tests included.  The patch appears to include $testReferences new or modified tests."
-  return 0
-}
-
-###############################################################################
-### Check there are no javadoc warnings
-checkJavadocWarnings () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Determining number of patched javadoc warnings."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  echo "$ANT_HOME/bin/ant -DZookeeperPatchProcess= clean javadoc | tee $PATCH_DIR/patchJavadocWarnings.txt"
-  $ANT_HOME/bin/ant -DZookeeperPatchProcess= clean javadoc | tee $PATCH_DIR/patchJavadocWarnings.txt
-  javadocWarnings=`$GREP -o '\[javadoc\] [0-9]* warning' $PATCH_DIR/patchJavadocWarnings.txt | awk '{total += $2} END {print total}'`
-  echo ""
-  echo ""
-  echo "There appear to be $javadocWarnings javadoc warnings generated by the patched build."
-
-  ### if current warnings greater than OK_JAVADOC_WARNINGS
-  if [[ $javadocWarnings > $OK_JAVADOC_WARNINGS ]] ; then
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 javadoc.  The javadoc tool appears to have generated `expr $(($javadocWarnings-$OK_JAVADOC_WARNINGS))` warning messages."
-    return 1
-  fi
-  JIRA_COMMENT="$JIRA_COMMENT
-
-    +1 javadoc.  The javadoc tool did not generate any warning messages."
-  return 0
-}
-
-###############################################################################
-### Check there are no changes in the number of Javac warnings
-checkJavacWarnings () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Determining number of patched javac warnings."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  echo "$ANT_HOME/bin/ant -Djavac.args="-Xlint -Xmaxwarns 1000" -Djava5.home=${JAVA5_HOME} -DZookeeperPatchProcess= clean tar > $PATCH_DIR/patchJavacWarnings.txt 2>&1"
-  $ANT_HOME/bin/ant -Djavac.args="-Xlint -Xmaxwarns 1000" -Djava5.home=${JAVA5_HOME} -DZookeeperPatchProcess= clean tar > $PATCH_DIR/patchJavacWarnings.txt 2>&1
-  if [[ $? != 0 ]] ; then
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 javac.  The patch appears to cause tar ant target to fail."
-    return 1
-  fi
-  ### Compare trunk and patch javac warning numbers
-  if [[ -f $PATCH_DIR/patchJavacWarnings.txt ]] ; then
-    trunkJavacWarnings=`$GREP -o '\[javac\] [0-9]* warning' $PATCH_DIR/trunkJavacWarnings.txt | awk '{total += $2} END {print total}'`
-    patchJavacWarnings=`$GREP -o '\[javac\] [0-9]* warning' $PATCH_DIR/patchJavacWarnings.txt | awk '{total += $2} END {print total}'`
-    echo "There appear to be $trunkJavacWarnings javac compiler warnings before the patch and $patchJavacWarnings javac compiler warnings after applying the patch."
-    if [[ $patchJavacWarnings != "" && $trunkJavacWarnings != "" ]] ; then
-      if [[ $patchJavacWarnings -gt $trunkJavacWarnings ]] ; then
-        JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 javac.  The applied patch generated $patchJavacWarnings javac compiler warnings (more than the trunk's current $trunkJavacWarnings warnings)."
-        return 1
-      fi
-    fi
-  fi
-  JIRA_COMMENT="$JIRA_COMMENT
-
-    +1 javac.  The applied patch does not increase the total number of javac compiler warnings."
-  return 0
-}
-
-###############################################################################
-### Check there are no changes in the number of release audit (RAT) warnings
-checkReleaseAuditWarnings () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Determining number of patched release audit warnings."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  echo "$ANT_HOME/bin/ant -Djava5.home=${JAVA5_HOME} -DZookeeperPatchProcess= releaseaudit > $PATCH_DIR/patchReleaseAuditWarnings.txt 2>&1"
-  $ANT_HOME/bin/ant -Djava5.home=${JAVA5_HOME} -DZookeeperPatchProcess= releaseaudit > $PATCH_DIR/patchReleaseAuditWarnings.txt 2>&1
-
-  ### Compare trunk and patch release audit warning numbers
-  if [[ -f $PATCH_DIR/patchReleaseAuditWarnings.txt ]] ; then
-    patchReleaseAuditWarnings=`$GREP -c '\!?????' $PATCH_DIR/patchReleaseAuditWarnings.txt`
-    echo ""
-    echo ""
-    echo "There appear to be $OK_RELEASEAUDIT_WARNINGS release audit warnings before the patch and $patchReleaseAuditWarnings release audit warnings after applying the patch."
-    if [[ $patchReleaseAuditWarnings != "" && $OK_RELEASEAUDIT_WARNINGS != "" ]] ; then
-      if [[ $patchReleaseAuditWarnings -gt $OK_RELEASEAUDIT_WARNINGS ]] ; then
-        JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 release audit.  The applied patch generated $patchReleaseAuditWarnings release audit warnings (more than the trunk's current $OK_RELEASEAUDIT_WARNINGS warnings)."
-        $GREP '\!?????' $PATCH_DIR/patchReleaseAuditWarnings.txt > $PATCH_DIR/patchReleaseAuditProblems.txt
-        echo "Lines that start with ????? in the release audit report indicate files that do not have an Apache license header." >> $PATCH_DIR/patchReleaseAuditProblems.txt
-        JIRA_COMMENT_FOOTER="Release audit warnings: $BUILD_URL/artifact/trunk/patchprocess/patchReleaseAuditProblems.txt
-$JIRA_COMMENT_FOOTER"
-        return 1
-      fi
-    fi
-  fi
-  JIRA_COMMENT="$JIRA_COMMENT
-
-    +1 release audit.  The applied patch does not increase the total number of release audit warnings."
-  return 0
-}
-
-###############################################################################
-### Check there are no changes in the number of Checkstyle warnings
-checkStyle () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Determining number of patched checkstyle warnings."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  echo "THIS IS NOT IMPLEMENTED YET"
-  echo ""
-  echo ""
-  echo "$ANT_HOME/bin/ant -DZookeeperPatchProcess= checkstyle"
-  $ANT_HOME/bin/ant -DZookeeperPatchProcess= checkstyle
-  JIRA_COMMENT_FOOTER="Checkstyle results: $BUILD_URL/artifact/trunk/build/test/checkstyle-errors.html
-$JIRA_COMMENT_FOOTER"
-  ### TODO: calculate actual patchStyleErrors
-#  patchStyleErrors=0
-#  if [[ $patchStyleErrors != 0 ]] ; then
-#    JIRA_COMMENT="$JIRA_COMMENT
-#
-#    -1 checkstyle.  The patch generated $patchStyleErrors code style errors."
-#    return 1
-#  fi
-#  JIRA_COMMENT="$JIRA_COMMENT
-#
-#    +1 checkstyle.  The patch generated 0 code style errors."
-  return 0
-}
-
-###############################################################################
-### Check there are no changes in the number of Findbugs warnings
-checkFindbugsWarnings () {
-  findbugs_version=`${FINDBUGS_HOME}/bin/findbugs -version`
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Determining number of patched Findbugs warnings."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  echo "$ANT_HOME/bin/ant -Dfindbugs.home=$FINDBUGS_HOME -Djava5.home=${JAVA5_HOME} -DZookeeperPatchProcess= findbugs"
-  $ANT_HOME/bin/ant -Dfindbugs.home=$FINDBUGS_HOME -Djava5.home=${JAVA5_HOME} -DZookeeperPatchProcess= findbugs
-  if [ $? != 0 ] ; then
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 findbugs.  The patch appears to cause Findbugs (version ${findbugs_version}) to fail."
-    return 1
-  fi
-JIRA_COMMENT_FOOTER="Findbugs warnings: $BUILD_URL/artifact/trunk/build/test/findbugs/newPatchFindbugsWarnings.html
-$JIRA_COMMENT_FOOTER"
-  cp $BASEDIR/build/test/findbugs/*.xml $PATCH_DIR/patchFindbugsWarnings.xml
-  $FINDBUGS_HOME/bin/setBugDatabaseInfo -timestamp "01/01/2000" \
-    $PATCH_DIR/patchFindbugsWarnings.xml \
-    $PATCH_DIR/patchFindbugsWarnings.xml
-  findbugsWarnings=`$FINDBUGS_HOME/bin/filterBugs -first "01/01/2000" $PATCH_DIR/patchFindbugsWarnings.xml \
-    $BASEDIR/build/test/findbugs/newPatchFindbugsWarnings.xml | /usr/bin/awk '{print $1}'`
-  $FINDBUGS_HOME/bin/convertXmlToText -html \
-    $BASEDIR/build/test/findbugs/newPatchFindbugsWarnings.xml \
-    $BASEDIR/build/test/findbugs/newPatchFindbugsWarnings.html
-  cp $BASEDIR/build/test/findbugs/newPatchFindbugsWarnings.html $PATCH_DIR/newPatchFindbugsWarnings.html
-  cp $BASEDIR/build/test/findbugs/newPatchFindbugsWarnings.xml $PATCH_DIR/newPatchFindbugsWarnings.xml
-
-  ### if current warnings greater than OK_FINDBUGS_WARNINGS
-  if [[ $findbugsWarnings > $OK_FINDBUGS_WARNINGS ]] ; then
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 findbugs.  The patch appears to introduce `expr $(($findbugsWarnings-$OK_FINDBUGS_WARNINGS))` new Findbugs (version ${findbugs_version}) warnings."
-    return 1
-  fi
-  JIRA_COMMENT="$JIRA_COMMENT
-
-    +1 findbugs.  The patch does not introduce any new Findbugs (version ${findbugs_version}) warnings."
-  return 0
-}
-
-###############################################################################
-### Run the test-core target
-runCoreTests () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Running core tests."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-
-  ### Kill any rogue build processes from the last attempt
-  $PS auxwww | $GREP ZookeeperPatchProcess | /usr/bin/nawk '{print $2}' | /usr/bin/xargs -t -I {} /bin/kill -9 {} > /dev/null
-
-  echo "$ANT_HOME/bin/ant -DZookeeperPatchProcess= -Dtest.junit.output.format=xml -Dtest.output=no -Dtest.junit.threads=4 -Dcompile.c++=yes -Djava5.home=$JAVA5_HOME test-core"
-  $ANT_HOME/bin/ant -DZookeeperPatchProcess= -Dtest.junit.output.format=xml -Dtest.output=no -Dtest.junit.threads=4 -Dcompile.c++=yes -Djava5.home=$JAVA5_HOME test-core
-  if [[ $? != 0 ]] ; then
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 core tests.  The patch failed core unit tests."
-    return 1
-  fi
-  JIRA_COMMENT="$JIRA_COMMENT
-
-    +1 core tests.  The patch passed core unit tests."
-  return 0
-}
-
-###############################################################################
-### Run the test-contrib target
-runContribTests () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Running contrib tests."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-
-  ### Kill any rogue build processes from the last attempt
-  $PS auxwww | $GREP ZookeeperPatchProcess | /usr/bin/nawk '{print $2}' | /usr/bin/xargs -t -I {} /bin/kill -9 {} > /dev/null
-
-  echo "$ANT_HOME/bin/ant -DZookeeperPatchProcess= -Dtest.junit.output.format=xml -Dtest.output=no test-contrib"
-  $ANT_HOME/bin/ant -DZookeeperPatchProcess= -Dtest.junit.output.format=xml -Dtest.output=no test-contrib
-  if [[ $? != 0 ]] ; then
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 contrib tests.  The patch failed contrib unit tests."
-    return 1
-  fi
-  JIRA_COMMENT="$JIRA_COMMENT
-
-    +1 contrib tests.  The patch passed contrib unit tests."
-  return 0
-}
-
-###############################################################################
-### Submit a comment to the defect's Jira
-submitJiraComment () {
-  local result=$1
-  ### Do not output the value of JIRA_COMMENT_FOOTER when run by a developer
-  if [[  $QABUILD == "false" ]] ; then
-    JIRA_COMMENT_FOOTER=""
-  fi
-  if [[ $result == 0 ]] ; then
-    comment="+1 overall.  $JIRA_COMMENT
-
-$JIRA_COMMENT_FOOTER"
-  else
-    comment="-1 overall.  $JIRA_COMMENT
-
-$JIRA_COMMENT_FOOTER"
-  fi
-  ### Output the test result to the console
-  echo "
-
-
-
-$comment"
-
-  if [[ $QABUILD == "true" ]] ; then
-    echo ""
-    echo ""
-    echo "======================================================================"
-    echo "======================================================================"
-    echo "    Adding comment to Jira."
-    echo "======================================================================"
-    echo "======================================================================"
-    echo ""
-    echo ""
-    ### Update Jira with a comment
-    export USER=jenkins
-    $JIRACLI -s https://issues.apache.org/jira -a addcomment -u hadoopqa -p $JIRA_PASSWD --comment "$comment" --issue $defect
-    $JIRACLI -s https://issues.apache.org/jira -a logout -u hadoopqa -p $JIRA_PASSWD
-  fi
-}
-
-###############################################################################
-### Cleanup files
-cleanupAndExit () {
-  local result=$1
-  if [[ $QABUILD == "true" ]] ; then
-    if [ -e "$PATCH_DIR" ] ; then
-      mv $PATCH_DIR $BASEDIR
-    fi
-  fi
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Finished build."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  exit $result
-}
-
-###############################################################################
-###############################################################################
-###############################################################################
-
-JIRA_COMMENT=""
-JIRA_COMMENT_FOOTER="Console output: $BUILD_URL/console
-
-This message is automatically generated."
-
-### Check if arguments to the script have been specified properly or not
-echo "----- Going to parser args -----"
-parseArgs $@
-cd $BASEDIR
-
-echo "----- Parsed args, going to checkout -----"
-checkout
-RESULT=$?
-if [[ $QABUILD == "true" ]] ; then
-  if [[ $RESULT != 0 ]] ; then
-    exit 100
-  fi
-fi
-setup
-checkAuthor
-(( RESULT = RESULT + $? ))
-
-checkTests
-checkTestsResult=$?
-(( RESULT = RESULT + $checkTestsResult ))
-if [[ $checkTestsResult != 0 ]] ; then
-  submitJiraComment 1
-  cleanupAndExit 1
-fi
-checkJavadocWarnings
-(( RESULT = RESULT + $? ))
-checkJavacWarnings
-(( RESULT = RESULT + $? ))
-### Checkstyle not implemented yet
-#checkStyle
-#(( RESULT = RESULT + $? ))
-checkFindbugsWarnings
-(( RESULT = RESULT + $? ))
-checkReleaseAuditWarnings
-(( RESULT = RESULT + $? ))
-### Do not call these when run by a developer
-if [[ $QABUILD == "true" ]] ; then
-  runCoreTests
-  (( RESULT = RESULT + $? ))
-  runContribTests
-  (( RESULT = RESULT + $? ))
-fi
-JIRA_COMMENT_FOOTER="Test results: $BUILD_URL/testReport/
-$JIRA_COMMENT_FOOTER"
-
-submitJiraComment $RESULT
-cleanupAndExit $RESULT
diff --git a/zookeeper-server/src/test/resources/test-patch.sh b/zookeeper-server/src/test/resources/test-patch.sh
deleted file mode 100755
index 90b0a0bb23a..00000000000
--- a/zookeeper-server/src/test/resources/test-patch.sh
+++ /dev/null
@@ -1,647 +0,0 @@
-#!/usr/bin/env bash
-#   Licensed under the Apache License, Version 2.0 (the "License");
-#   you may not use this file except in compliance with the License.
-#   You may obtain a copy of the License at
-#
-#       http://www.apache.org/licenses/LICENSE-2.0
-#
-#   Unless required by applicable law or agreed to in writing, software
-#   distributed under the License is distributed on an "AS IS" BASIS,
-#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-#   See the License for the specific language governing permissions and
-#   limitations under the License.
-
-
-#set -x
-
-### Setup some variables.  
-### GIT_COMMIT and BUILD_URL are set by Hudson if it is run by patch process
-### Read variables from properties file
-. `dirname $0`/test-patch.properties
-
-###############################################################################
-parseArgs() {
-  case "$1" in
-    HUDSON)
-      ### Set HUDSON to true to indicate that this script is being run by Hudson
-      HUDSON=true
-      if [[ $# != 14 ]] ; then
-        echo "ERROR: usage $0 HUDSON <PATCH_DIR> <PS_CMD> <WGET_CMD> <JIRACLI> <GIT_CMD> <GREP_CMD> <PATCH_CMD> <FINDBUGS_HOME> <WORKSPACE_BASEDIR> <JIRA_PASSWD> <JAVA5_HOME> <CURL_CMD> <DEFECT> "
-        cleanupAndExit 0
-      fi
-      PATCH_DIR=$2
-      PS=$3
-      WGET=$4
-      JIRACLI=$5
-      GIT=$6
-      GREP=$7
-      PATCH=$8
-      FINDBUGS_HOME=$9
-      BASEDIR=${10}
-      JIRA_PASSWD=${11}
-      JAVA5_HOME=${12}
-      CURL=${13}
-      defect=${14}
-		
-      ### Retrieve the defect number
-      if [ -z "$defect" ] ; then
-        echo "Could not determine the patch to test.  Exiting."
-        cleanupAndExit 0
-      fi
-
-      if [ ! -e "$PATCH_DIR" ] ; then
-        mkdir -p $PATCH_DIR 
-      fi
-
-      ;;
-    DEVELOPER)
-      ### Set HUDSON to false to indicate that this script is being run by a developer
-      HUDSON=false
-      if [[ $# != 9 ]] ; then
-        echo "ERROR: usage $0 DEVELOPER <PATCH_FILE> <SCRATCH_DIR> <GIT_CMD> <GREP_CMD> <PATCH_CMD> <FINDBUGS_HOME> <WORKSPACE_BASEDIR> <JAVA5_HOME>"
-        cleanupAndExit 0
-      fi
-      ### PATCH_FILE contains the location of the patchfile
-      PATCH_FILE=$2 
-      if [[ ! -e "$PATCH_FILE" ]] ; then
-        echo "Unable to locate the patch file $PATCH_FILE"
-        cleanupAndExit 0
-      fi
-      PATCH_DIR=$3
-      ### Check if $PATCH_DIR exists. If it does not exist, create a new directory
-      if [[ ! -e "$PATCH_DIR" ]] ; then
-	mkdir "$PATCH_DIR"
-	if [[ $? == 0 ]] ; then 
-	  echo "$PATCH_DIR has been created"
-	else
-	  echo "Unable to create $PATCH_DIR"
-	  cleanupAndExit 0
-	fi
-      fi
-      GIT=$4
-      GREP=$5
-      PATCH=$6
-      FINDBUGS_HOME=$7
-      BASEDIR=$8
-      JAVA5_HOME=${9}
-      ### Obtain the patch filename to append it to the version number
-      defect=`basename $PATCH_FILE` 
-      ;;
-    *)
-      echo "ERROR: usage $0 HUDSON [args] | DEVELOPER [args]"
-      cleanupAndExit 0
-      ;;
-  esac
-}
-
-###############################################################################
-checkout () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Testing patch for ${defect}."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  ### When run by a developer, if the workspace contains modifications, do not continue
-  # Ref http://stackoverflow.com/a/2659808 for details on checking dirty status
-  ${GIT} diff-index --quiet HEAD
-  if [[ $? -ne 0 ]] ; then
-    uncommitted=`${GIT} diff --name-only HEAD`
-    uncommitted="You have the following files with uncommitted changes:${NEWLINE}${uncommitted}"
-  fi
-  untracked="$(${GIT} ls-files --exclude-standard --others)" && test -z "${untracked}"
-  if [[ $? -ne 0 ]] ; then
-    untracked="You have untracked and unignored files:${NEWLINE}${untracked}"
-  fi
-
-  if [[ $HUDSON == "false" ]] ; then
-    if [[ $uncommitted || $untracked ]] ; then
-      echo "ERROR: can't run in a workspace that contains the following modifications"
-      echo ""
-      echo "${uncommitted}"
-      echo ""
-      echo "${untracked}"
-      cleanupAndExit 1
-    fi
-  else   
-    # I don't believe we need to do anything here - the jenkins job will
-    # cleanup the environment for us ("cleanup before checkout" action)
-    # on the precommit jenkins job
-    echo
-  fi
-  return $?
-}
-
-###############################################################################
-setup () {
-  ### Download latest patch file (ignoring .htm and .html) when run from patch process
-  if [[ $HUDSON == "true" ]] ; then
-    $WGET -q -O $PATCH_DIR/jira http://issues.apache.org/jira/browse/$defect
-    if [[ `$GREP -c 'Patch Available' $PATCH_DIR/jira` == 0 ]] ; then
-      echo "$defect is not \"Patch Available\".  Exiting."
-      cleanupAndExit 0
-    fi
-    relativePatchURL=`$GREP -o '"/jira/secure/attachment/[0-9]*/[^"]*' $PATCH_DIR/jira | $GREP -v -e 'htm[l]*$' | sort | tail -1 | $GREP -o '/jira/secure/attachment/[0-9]*/[^"]*'`
-    patchURL="http://issues.apache.org${relativePatchURL}"
-    patchNum=`echo $patchURL | $GREP -o '[0-9]*/' | $GREP -o '[0-9]*'`
-    echo "$defect patch is being downloaded at `date` from"
-    echo "$patchURL"
-    $WGET -q -O $PATCH_DIR/patch $patchURL
-    JIRA_COMMENT="Here are the results of testing the latest attachment 
-  $patchURL
-  against trunk revision ${GIT_COMMIT}."
-
-  ### Copy the patch file to $PATCH_DIR
-  else
-    cp $PATCH_FILE $PATCH_DIR/patch
-    if [[ $? == 0 ]] ; then
-      echo "Patch file $PATCH_FILE copied to $PATCH_DIR"
-    else
-      echo "Could not copy $PATCH_FILE to $PATCH_DIR"
-      cleanupAndExit 0
-    fi
-  fi
-  ### exit if warnings are NOT defined in the properties file
-  if [ -z "$OK_FINDBUGS_WARNINGS" ] || [[ -z "$OK_JAVADOC_WARNINGS" ]] || [[ -z $OK_RELEASEAUDIT_WARNINGS ]]; then
-    echo "Please define the following properties in test-patch.properties file"
-	 echo  "OK_FINDBUGS_WARNINGS"
-	 echo  "OK_RELEASEAUDIT_WARNINGS"
-	 echo  "OK_JAVADOC_WARNINGS"
-    cleanupAndExit 1
-  fi
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo " Pre-build trunk to verify trunk stability and javac warnings" 
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  echo "$ANT_HOME/bin/ant  -Djavac.args="-Xlint -Xmaxwarns 1000" -Djava5.home=${JAVA5_HOME} -DZookeeperPatchProcess= clean tar > $PATCH_DIR/trunkJavacWarnings.txt 2>&1"
- $ANT_HOME/bin/ant -Djavac.args="-Xlint -Xmaxwarns 1000" -Djava5.home=${JAVA5_HOME} -DZookeeperPatchProcess= clean tar > $PATCH_DIR/trunkJavacWarnings.txt 2>&1
-  if [[ $? != 0 ]] ; then
-    echo "Trunk compilation is broken?"
-    cleanupAndExit 1
-  fi
-}
-
-###############################################################################
-### Check for @author tags in the patch
-checkAuthor () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Checking there are no @author tags in the patch."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  authorTags=`$GREP -c -i '@author' $PATCH_DIR/patch`
-  echo "There appear to be $authorTags @author tags in the patch."
-  if [[ $authorTags != 0 ]] ; then
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 @author.  The patch appears to contain $authorTags @author tags which the Zookeeper community has agreed to not allow in code contributions."
-    return 1
-  fi
-  JIRA_COMMENT="$JIRA_COMMENT
-
-    +1 @author.  The patch does not contain any @author tags."
-  return 0
-}
-
-###############################################################################
-### Check for tests in the patch
-checkTests () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Checking there are new or changed tests in the patch."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  testReferences=`$GREP -c -i '/test' $PATCH_DIR/patch`
-  echo "There appear to be $testReferences test files referenced in the patch."
-  if [[ $testReferences == 0 ]] ; then
-    if [[ $HUDSON == "true" ]] ; then
-      patchIsDoc=`$GREP -c -i 'title="documentation' $PATCH_DIR/jira`
-      if [[ $patchIsDoc != 0 ]] ; then
-        echo "The patch appears to be a documentation patch that doesn't require tests."
-        JIRA_COMMENT="$JIRA_COMMENT
-
-    +0 tests included.  The patch appears to be a documentation patch that doesn't require tests."
-        return 0
-      fi
-    fi
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 tests included.  The patch doesn't appear to include any new or modified tests.
-                        Please justify why no new tests are needed for this patch.
-                        Also please list what manual steps were performed to verify this patch."
-    return 1
-  fi
-  JIRA_COMMENT="$JIRA_COMMENT
-
-    +1 tests included.  The patch appears to include $testReferences new or modified tests."
-  return 0
-}
-
-###############################################################################
-### Attempt to apply the patch
-applyPatch () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Applying patch."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  $PATCH -E -p0 < $PATCH_DIR/patch
-  if [[ $? != 0 ]] ; then
-    echo "PATCH APPLICATION FAILED"
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 patch.  The patch command could not apply the patch."
-    return 1
-  fi
-  return 0
-}
-
-###############################################################################
-### Check there are no javadoc warnings
-checkJavadocWarnings () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Determining number of patched javadoc warnings."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  echo "$ANT_HOME/bin/ant -DZookeeperPatchProcess= clean javadoc | tee $PATCH_DIR/patchJavadocWarnings.txt"
-  $ANT_HOME/bin/ant -DZookeeperPatchProcess= clean javadoc | tee $PATCH_DIR/patchJavadocWarnings.txt
-  javadocWarnings=`$GREP -o '\[javadoc\] [0-9]* warning' $PATCH_DIR/patchJavadocWarnings.txt | awk '{total += $2} END {print total}'`
-  echo ""
-  echo ""
-  echo "There appear to be $javadocWarnings javadoc warnings generated by the patched build."
-
-  ### if current warnings greater than OK_JAVADOC_WARNINGS
-  if [[ $javadocWarnings > $OK_JAVADOC_WARNINGS ]] ; then
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 javadoc.  The javadoc tool appears to have generated `expr $(($javadocWarnings-$OK_JAVADOC_WARNINGS))` warning messages."
-    return 1
-  fi
-  JIRA_COMMENT="$JIRA_COMMENT
-
-    +1 javadoc.  The javadoc tool did not generate any warning messages."
-  return 0
-}
-
-###############################################################################
-### Check there are no changes in the number of Javac warnings
-checkJavacWarnings () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Determining number of patched javac warnings."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  echo "$ANT_HOME/bin/ant -Djavac.args="-Xlint -Xmaxwarns 1000" -Djava5.home=${JAVA5_HOME} -DZookeeperPatchProcess= clean tar > $PATCH_DIR/patchJavacWarnings.txt 2>&1"
-  $ANT_HOME/bin/ant -Djavac.args="-Xlint -Xmaxwarns 1000" -Djava5.home=${JAVA5_HOME} -DZookeeperPatchProcess= clean tar > $PATCH_DIR/patchJavacWarnings.txt 2>&1
-  if [[ $? != 0 ]] ; then
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 javac.  The patch appears to cause tar ant target to fail."
-    return 1
-  fi
-  ### Compare trunk and patch javac warning numbers
-  if [[ -f $PATCH_DIR/patchJavacWarnings.txt ]] ; then
-    trunkJavacWarnings=`$GREP -o '\[javac\] [0-9]* warning' $PATCH_DIR/trunkJavacWarnings.txt | awk '{total += $2} END {print total}'`
-    patchJavacWarnings=`$GREP -o '\[javac\] [0-9]* warning' $PATCH_DIR/patchJavacWarnings.txt | awk '{total += $2} END {print total}'`
-    echo "There appear to be $trunkJavacWarnings javac compiler warnings before the patch and $patchJavacWarnings javac compiler warnings after applying the patch."
-    if [[ $patchJavacWarnings != "" && $trunkJavacWarnings != "" ]] ; then
-      if [[ $patchJavacWarnings -gt $trunkJavacWarnings ]] ; then
-        JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 javac.  The applied patch generated $patchJavacWarnings javac compiler warnings (more than the trunk's current $trunkJavacWarnings warnings)."
-        return 1
-      fi
-    fi
-  fi
-  JIRA_COMMENT="$JIRA_COMMENT
-
-    +1 javac.  The applied patch does not increase the total number of javac compiler warnings."
-  return 0
-}
-
-###############################################################################
-### Check there are no changes in the number of release audit (RAT) warnings
-checkReleaseAuditWarnings () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Determining number of patched release audit warnings."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  echo "$ANT_HOME/bin/ant -Djava5.home=${JAVA5_HOME} -DZookeeperPatchProcess= releaseaudit > $PATCH_DIR/patchReleaseAuditWarnings.txt 2>&1"
-  $ANT_HOME/bin/ant -Djava5.home=${JAVA5_HOME} -DZookeeperPatchProcess= releaseaudit > $PATCH_DIR/patchReleaseAuditWarnings.txt 2>&1
-
-  ### Compare trunk and patch release audit warning numbers
-  if [[ -f $PATCH_DIR/patchReleaseAuditWarnings.txt ]] ; then
-    patchReleaseAuditWarnings=`$GREP -c '\!?????' $PATCH_DIR/patchReleaseAuditWarnings.txt`
-    echo ""
-    echo ""
-    echo "There appear to be $OK_RELEASEAUDIT_WARNINGS release audit warnings before the patch and $patchReleaseAuditWarnings release audit warnings after applying the patch."
-    if [[ $patchReleaseAuditWarnings != "" && $OK_RELEASEAUDIT_WARNINGS != "" ]] ; then
-      if [[ $patchReleaseAuditWarnings -gt $OK_RELEASEAUDIT_WARNINGS ]] ; then
-        JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 release audit.  The applied patch generated $patchReleaseAuditWarnings release audit warnings (more than the trunk's current $OK_RELEASEAUDIT_WARNINGS warnings)."
-        $GREP '\!?????' $PATCH_DIR/patchReleaseAuditWarnings.txt > $PATCH_DIR/patchReleaseAuditProblems.txt
-        echo "Lines that start with ????? in the release audit report indicate files that do not have an Apache license header." >> $PATCH_DIR/patchReleaseAuditProblems.txt
-        JIRA_COMMENT_FOOTER="Release audit warnings: $BUILD_URL/artifact/trunk/patchprocess/patchReleaseAuditProblems.txt
-$JIRA_COMMENT_FOOTER"
-        return 1
-      fi
-    fi
-  fi
-  JIRA_COMMENT="$JIRA_COMMENT
-
-    +1 release audit.  The applied patch does not increase the total number of release audit warnings."
-  return 0
-}
-
-###############################################################################
-### Check there are no changes in the number of Checkstyle warnings
-checkStyle () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Determining number of patched checkstyle warnings."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  echo "THIS IS NOT IMPLEMENTED YET"
-  echo ""
-  echo ""
-  echo "$ANT_HOME/bin/ant -DZookeeperPatchProcess= checkstyle"
-  $ANT_HOME/bin/ant -DZookeeperPatchProcess= checkstyle
-  JIRA_COMMENT_FOOTER="Checkstyle results: $BUILD_URL/artifact/trunk/build/test/checkstyle-errors.html
-$JIRA_COMMENT_FOOTER"
-  ### TODO: calculate actual patchStyleErrors
-#  patchStyleErrors=0
-#  if [[ $patchStyleErrors != 0 ]] ; then
-#    JIRA_COMMENT="$JIRA_COMMENT
-#
-#    -1 checkstyle.  The patch generated $patchStyleErrors code style errors."
-#    return 1
-#  fi
-#  JIRA_COMMENT="$JIRA_COMMENT
-#
-#    +1 checkstyle.  The patch generated 0 code style errors."
-  return 0
-}
-
-###############################################################################
-### Check there are no changes in the number of Findbugs warnings
-checkFindbugsWarnings () {
-  findbugs_version=`${FINDBUGS_HOME}/bin/findbugs -version`
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Determining number of patched Findbugs warnings."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  echo "$ANT_HOME/bin/ant -Dfindbugs.home=$FINDBUGS_HOME -Djava5.home=${JAVA5_HOME} -DZookeeperPatchProcess= findbugs"
-  $ANT_HOME/bin/ant -Dfindbugs.home=$FINDBUGS_HOME -Djava5.home=${JAVA5_HOME} -DZookeeperPatchProcess= findbugs
-  if [ $? != 0 ] ; then
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 findbugs.  The patch appears to cause Findbugs (version ${findbugs_version}) to fail."
-    return 1
-  fi
-JIRA_COMMENT_FOOTER="Findbugs warnings: $BUILD_URL/artifact/trunk/build/test/findbugs/newPatchFindbugsWarnings.html
-$JIRA_COMMENT_FOOTER"
-  cp $BASEDIR/build/test/findbugs/*.xml $PATCH_DIR/patchFindbugsWarnings.xml
-  $FINDBUGS_HOME/bin/setBugDatabaseInfo -timestamp "01/01/2000" \
-    $PATCH_DIR/patchFindbugsWarnings.xml \
-    $PATCH_DIR/patchFindbugsWarnings.xml
-  findbugsWarnings=`$FINDBUGS_HOME/bin/filterBugs -first "01/01/2000" $PATCH_DIR/patchFindbugsWarnings.xml \
-    $BASEDIR/build/test/findbugs/newPatchFindbugsWarnings.xml | /usr/bin/awk '{print $1}'`
-  $FINDBUGS_HOME/bin/convertXmlToText -html \
-    $BASEDIR/build/test/findbugs/newPatchFindbugsWarnings.xml \
-    $BASEDIR/build/test/findbugs/newPatchFindbugsWarnings.html
-  cp $BASEDIR/build/test/findbugs/newPatchFindbugsWarnings.html $PATCH_DIR/newPatchFindbugsWarnings.html
-  cp $BASEDIR/build/test/findbugs/newPatchFindbugsWarnings.xml $PATCH_DIR/newPatchFindbugsWarnings.xml
-
-  ### if current warnings greater than OK_FINDBUGS_WARNINGS
-  if [[ $findbugsWarnings > $OK_FINDBUGS_WARNINGS ]] ; then
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 findbugs.  The patch appears to introduce `expr $(($findbugsWarnings-$OK_FINDBUGS_WARNINGS))` new Findbugs (version ${findbugs_version}) warnings."
-    return 1
-  fi
-  JIRA_COMMENT="$JIRA_COMMENT
-
-    +1 findbugs.  The patch does not introduce any new Findbugs (version ${findbugs_version}) warnings."
-  return 0
-}
-
-###############################################################################
-### Run the test-core target
-runCoreTests () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Running core tests."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  
-  ### Kill any rogue build processes from the last attempt
-  $PS auxwww | $GREP ZookeeperPatchProcess | /usr/bin/nawk '{print $2}' | /usr/bin/xargs -t -I {} /bin/kill -9 {} > /dev/null
-
-  echo "$ANT_HOME/bin/ant -DZookeeperPatchProcess= -Dtest.junit.output.format=xml -Dtest.output=yes -Dtest.junit.threads=8 -Dcompile.c++=yes -Djava5.home=$JAVA5_HOME test-core"
-  $ANT_HOME/bin/ant -DZookeeperPatchProcess= -Dtest.junit.output.format=xml -Dtest.output=yes -Dtest.junit.threads=8 -Dcompile.c++=yes -Djava5.home=$JAVA5_HOME test-core
-  if [[ $? != 0 ]] ; then
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 core tests.  The patch failed core unit tests."
-    return 1
-  fi
-  JIRA_COMMENT="$JIRA_COMMENT
-
-    +1 core tests.  The patch passed core unit tests."
-  return 0
-}
-
-###############################################################################
-### Run the test-contrib target
-runContribTests () {
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Running contrib tests."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-
-  ### Kill any rogue build processes from the last attempt
-  $PS auxwww | $GREP ZookeeperPatchProcess | /usr/bin/nawk '{print $2}' | /usr/bin/xargs -t -I {} /bin/kill -9 {} > /dev/null
-
-  echo "$ANT_HOME/bin/ant -DZookeeperPatchProcess= -Dtest.junit.output.format=xml -Dtest.output=yes test-contrib"
-  $ANT_HOME/bin/ant -DZookeeperPatchProcess= -Dtest.junit.output.format=xml -Dtest.output=yes test-contrib
-  if [[ $? != 0 ]] ; then
-    JIRA_COMMENT="$JIRA_COMMENT
-
-    -1 contrib tests.  The patch failed contrib unit tests."
-    return 1
-  fi
-  JIRA_COMMENT="$JIRA_COMMENT
-
-    +1 contrib tests.  The patch passed contrib unit tests."
-  return 0
-}
-
-###############################################################################
-### Submit a comment to the defect's Jira
-submitJiraComment () {
-  local result=$1
-  ### Do not output the value of JIRA_COMMENT_FOOTER when run by a developer
-  if [[  $HUDSON == "false" ]] ; then
-    JIRA_COMMENT_FOOTER=""
-  fi
-  if [[ $result == 0 ]] ; then
-    comment="+1 overall.  $JIRA_COMMENT
-
-$JIRA_COMMENT_FOOTER"
-  else
-    comment="-1 overall.  $JIRA_COMMENT
-
-$JIRA_COMMENT_FOOTER"
-  fi
-  ### Output the test result to the console
-  echo "
-
-
-
-$comment"  
-
-  if [[ $HUDSON == "true" ]] ; then
-    echo ""
-    echo ""
-    echo "======================================================================"
-    echo "======================================================================"
-    echo "    Adding comment to Jira."
-    echo "======================================================================"
-    echo "======================================================================"
-    echo ""
-    echo ""
-    ### Update Jira with a comment
-    export USER=jenkins
-    $JIRACLI -s https://issues.apache.org/jira -a addcomment -u hadoopqa -p $JIRA_PASSWD --comment "$comment" --issue $defect
-    $JIRACLI -s https://issues.apache.org/jira -a logout -u hadoopqa -p $JIRA_PASSWD
-  fi
-}
-
-###############################################################################
-### Cleanup files
-cleanupAndExit () {
-  local result=$1
-  if [[ $HUDSON == "true" ]] ; then
-    if [ -e "$PATCH_DIR" ] ; then
-      mv $PATCH_DIR $BASEDIR
-    fi
-  fi
-  echo ""
-  echo ""
-  echo "======================================================================"
-  echo "======================================================================"
-  echo "    Finished build."
-  echo "======================================================================"
-  echo "======================================================================"
-  echo ""
-  echo ""
-  exit $result
-}
-
-###############################################################################
-###############################################################################
-###############################################################################
-
-JIRA_COMMENT=""
-JIRA_COMMENT_FOOTER="Console output: $BUILD_URL/console
-
-This message is automatically generated."
-
-### Check if arguments to the script have been specified properly or not
-parseArgs $@
-cd $BASEDIR
-
-checkout
-RESULT=$?
-if [[ $HUDSON == "true" ]] ; then
-  if [[ $RESULT != 0 ]] ; then
-    exit 100
-  fi
-fi
-setup
-checkAuthor
-RESULT=$?
-
-checkTests
-(( RESULT = RESULT + $? ))
-applyPatch
-if [[ $? != 0 ]] ; then
-  submitJiraComment 1
-  cleanupAndExit 1
-fi
-checkJavadocWarnings
-(( RESULT = RESULT + $? ))
-checkJavacWarnings
-(( RESULT = RESULT + $? ))
-### Checkstyle not implemented yet
-#checkStyle
-#(( RESULT = RESULT + $? ))
-checkFindbugsWarnings
-(( RESULT = RESULT + $? ))
-checkReleaseAuditWarnings
-(( RESULT = RESULT + $? ))
-### Do not call these when run by a developer 
-if [[ $HUDSON == "true" ]] ; then
-  runCoreTests
-  (( RESULT = RESULT + $? ))
-  runContribTests
-  (( RESULT = RESULT + $? ))
-fi
-JIRA_COMMENT_FOOTER="Test results: $BUILD_URL/testReport/
-$JIRA_COMMENT_FOOTER"
-
-submitJiraComment $RESULT
-cleanupAndExit $RESULT
diff --git a/zookeeper-server/src/test/resources/test-scripts.sh b/zookeeper-server/src/test/resources/test-scripts.sh
deleted file mode 100755
index 25854b815ae..00000000000
--- a/zookeeper-server/src/test/resources/test-scripts.sh
+++ /dev/null
@@ -1,221 +0,0 @@
-#!/usr/bin/env bash
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-ZKS=bin/zkServer.sh
-ZKSI=bin/zkServer-initialize.sh
-
-if [ ! -d "conf" ]; then
-    echo "run this from the toplevel directory"
-    exit 1
-fi
-
-DATADIR=test-scripts_datadir
-DATALOGDIR=test-scripts_datalogdir
-
-case "`uname`" in
-    CYGWIN*) cygwin=true ;;
-    *) cygwin=false ;;
-esac
-
-if $cygwin
-then
-    ZOOCFG=`cygpath -wp "$ZOOCFG"`
-    # cygwin has a "kill" in the shell itself, gets confused
-    KILL=/bin/kill
-else
-    KILL=kill
-fi
-
-fail() {
-    # don't run clear_tmp to allow debugging
-    echo "FAIL $1"
-    $KILL -9 $(cat "$ZOOPIDFILE")
-    $KILL -9 $$
-}
-
-#generate a minimal config
-genconfig1() {
-    cat > test-scripts.cfg <<EOF
-tickTime=2000
-initLimit=10
-syncLimit=5
-dataDir=$DATADIR
-clientPort=19181
-EOF
-}
-
-genconfig2() {
-    genconfig1
-    cat >> test-scripts.cfg <<EOF
-dataLogDir=$DATALOGDIR
-EOF
-}
-
-export ZOOCFGDIR=`pwd`
-export ZOOCFG="test-scripts.cfg"
-export CLASSPATH=$ZOOCFGDIR/conf
-
-#clear out the clutter generated by scripts
-clear_tmp() {
-    rm -f test-scripts.cfg
-    rm -fr $DATADIR
-    rm -fr $DATALOGDIR
-    rm -f zookeeper.out
-}
-
-start() {
-    $CONFIG
-    #ensure not already running
-    $ZKS status && (echo "already running"; fail $LINENO)
-    export ZOOPIDFILE="$DATADIR/zookeeper_server.pid"
-
-    $ZKS start
-}
-
-stop() {
-    $ZKS stop
-}
-
-CONFIG=genconfig1
-
-clear_tmp
-start
-ls $DATADIR || fail $LINENO
-ls $DATALOGDIR && fail $LINENO
-stop
-
-CONFIG=genconfig2
-
-clear_tmp
-start
-ls $DATADIR || fail $LINENO
-
-# zk actually checks for this to exist, but doesn't create
-ls $DATALOGDIR && fail $LINENO
-
-clear_tmp
-mkdir -p "$DATALOGDIR"
-start
-ls $DATADIR || fail $LINENO
-ls $DATALOGDIR || fail $LINENO
-stop
-
-#
-# verify autocreate diabled
-#
-export ZOO_DATADIR_AUTOCREATE_DISABLE=1
-
-CONFIG=genconfig1
-
-clear_tmp
-start
-[ $? -eq 1 ] || fail $LINENO
-ls $DATADIR && fail $LINENO
-ls $DATALOGDIR && fail $LINENO
-
-CONFIG=genconfig2
-
-clear_tmp
-mkdir -p "$DATADIR/version-2"
-start
-[ $? -eq 1 ] || fail $LINENO
-ls $DATALOGDIR && fail $LINENO
-
-CONFIG=genconfig1
-
-clear_tmp
-mkdir -p "$DATADIR/version-2"
-start
-[ $? -eq 0 ] || fail $LINENO
-stop
-
-CONFIG=genconfig2
-
-clear_tmp
-mkdir -p "$DATADIR/version-2"
-mkdir -p "$DATALOGDIR/version-2"
-start
-[ $? -eq 0 ] || fail $LINENO
-stop
-
-#
-# validate the initialize script
-#
-
-CONFIG=genconfig1
-
-clear_tmp
-$CONFIG
-
-$ZKSI --configfile "$ZOOCFGDIR/$ZOOCFG"
-ls $DATADIR || fail $LINENO
-
-#ensure not already running
-$ZKS status && (echo "already running"; fail $LINENO)
-export ZOOPIDFILE="$DATADIR/zookeeper_server.pid"
-
-$ZKS start
-[ $? -eq 0 ] || fail $LINENO
-stop
-
-
-CONFIG=genconfig2
-
-clear_tmp
-$CONFIG
-
-$ZKSI --configfile "$ZOOCFGDIR/$ZOOCFG"
-ls $DATADIR || fail $LINENO
-ls $DATALOGDIR || fail $LINENO
-
-#ensure not already running
-$ZKS status && (echo "already running"; fail $LINENO)
-export ZOOPIDFILE="$DATADIR/zookeeper_server.pid"
-
-$ZKS start
-[ $? -eq 0 ] || fail $LINENO
-stop
-
-
-## validate force
-CONFIG=genconfig1
-
-clear_tmp
-$CONFIG
-
-$ZKSI --configfile "$ZOOCFGDIR/$ZOOCFG" || fail $LINENO
-ls $DATADIR || fail $LINENO
-$ZKSI --configfile "$ZOOCFGDIR/$ZOOCFG" && fail $LINENO
-$ZKSI --force --configfile "$ZOOCFGDIR/$ZOOCFG" || fail $LINENO
-
-#ensure not already running
-$ZKS status && (echo "already running"; fail $LINENO)
-export ZOOPIDFILE="$DATADIR/zookeeper_server.pid"
-
-$ZKS start
-[ $? -eq 0 ] || fail $LINENO
-stop
-
-$ZKSI --force --myid=1 --configfile "$ZOOCFGDIR/$ZOOCFG" || fail $LINENO
-
-#test version script
-TEST_PRINT_VERSION=`$ZKS version 2>/dev/null`
-[ "$TEST_PRINT_VERSION" != "" ] || fail $LINENO
-
-#done, cleanup and exit
-clear_tmp
-echo "SUCCESS"
diff --git a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph.sh b/zookeeper-server/src/test/resources/zookeeper-client.config
old mode 100755
new mode 100644
similarity index 55%
rename from zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph.sh
rename to zookeeper-server/src/test/resources/zookeeper-client.config
index 0259dc690d6..4718f6d9c2c
--- a/zookeeper-contrib/zookeeper-contrib-loggraph/src/main/resources/loggraph.sh
+++ b/zookeeper-server/src/test/resources/zookeeper-client.config
@@ -1,5 +1,3 @@
-#!/bin/sh
-
 # Licensed to the Apache Software Foundation (ASF) under one or more
 # contributor license agreements.  See the NOTICE file distributed with
 # this work for additional information regarding copyright ownership.
@@ -15,34 +13,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-make_canonical () {
-    cd $1; pwd;
-}
-
-SCRIPTDIR=`dirname $0`
-BUILDDIR=`make_canonical $SCRIPTDIR/../../../../../build/contrib/loggraph`
-LIBDIR=`make_canonical $BUILDDIR/lib`
-ZKDIR=`make_canonical $SCRIPTDIR/../../../../../build/`
-
-if [ ! -x $BUILDDIR ]; then
-    echo "\n\n*** You need to build loggraph before running it ***\n\n";
-    exit;
-fi
-
-for i in `ls $LIBDIR`; do 
-    CLASSPATH=$LIBDIR/$i:$CLASSPATH
-done
-
-for i in `ls $BUILDDIR/*.jar`; do 
-    CLASSPATH=$i:$CLASSPATH
-done
-
-for i in $ZKDIR/zookeeper-*.jar; do
-    CLASSPATH="$i:$CLASSPATH"
-done
-
-java -cp $CLASSPATH org.apache.zookeeper.graph.LogServer $*
-
-
-
-
+# Sample secrets
+zookeeper.ssl.keyStore.password=FileSecret456!
+zookeeper.ssl.keyStore.passwordPath=/home/zookeeper/top_secret.txt
+ssl.quorum.keyStore.password=AnotherFileSecret789!
diff --git a/zookeeper-specifications/protocol-spec/Zab.tla b/zookeeper-specifications/protocol-spec/Zab.tla
new file mode 100644
index 00000000000..4913f0012eb
--- /dev/null
+++ b/zookeeper-specifications/protocol-spec/Zab.tla
@@ -0,0 +1,1251 @@
+(*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *)
+
+-------------------------------- MODULE Zab ---------------------------------
+(* This is the formal specification for the Zab consensus algorithm,
+   in DSN'2011, which represents protocol specification in our work.*)
+EXTENDS Integers, FiniteSets, Sequences, Naturals, TLC
+-----------------------------------------------------------------------------
+\* The set of servers
+CONSTANT Server
+\* States of server
+CONSTANTS LOOKING, FOLLOWING, LEADING
+\* Zab states of server
+CONSTANTS ELECTION, DISCOVERY, SYNCHRONIZATION, BROADCAST
+\* Message types
+CONSTANTS CEPOCH, NEWEPOCH, ACKEPOCH, NEWLEADER, ACKLD, COMMITLD, PROPOSE, ACK, COMMIT
+\* [MaxTimeoutFailures, MaxTransactionNum, MaxEpoch, MaxRestarts]
+CONSTANT Parameters
+
+MAXEPOCH == 10
+NullPoint == CHOOSE p: p \notin Server
+Quorums == {Q \in SUBSET Server: Cardinality(Q)*2 > Cardinality(Server)}
+-----------------------------------------------------------------------------
+\* Variables that all servers use.
+VARIABLES state,          \* State of server, in {LOOKING, FOLLOWING, LEADING}.
+          zabState,       \* Current phase of server, in
+                          \* {ELECTION, DISCOVERY, SYNCHRONIZATION, BROADCAST}.
+          acceptedEpoch,  \* Epoch of the last LEADERINFO packet accepted,
+                          \* namely f.p in paper.
+          currentEpoch,   \* Epoch of the last NEWLEADER packet accepted,
+                          \* namely f.a in paper.
+          history,        \* History of servers: sequence of transactions,
+                          \* containing: [zxid, value, ackSid, epoch].
+          lastCommitted   \* Maximum index and zxid known to be committed,
+                          \* namely 'lastCommitted' in Leader. Starts from 0,
+                          \* and increases monotonically before restarting.
+
+\* Variables only used for leader.
+VARIABLES learners,       \* Set of servers leader connects.
+          cepochRecv,     \* Set of learners leader has received CEPOCH from.
+                          \* Set of record [sid, connected, epoch],
+                          \* where epoch means f.p from followers.
+          ackeRecv,       \* Set of learners leader has received ACKEPOCH from.
+                          \* Set of record 
+                          \* [sid, connected, peerLastEpoch, peerHistory],
+                          \* to record f.a and h(f) from followers.
+          ackldRecv,      \* Set of learners leader has received ACKLD from.
+                          \* Set of record [sid, connected].
+          sendCounter     \* Count of txns leader has broadcast.
+
+\* Variables only used for follower.
+VARIABLES connectInfo \* If follower has connected with leader.
+                      \* If follower lost connection, then null.
+
+\* Variable representing oracle of leader.
+VARIABLE  leaderOracle  \* Current oracle.
+
+\* Variables about network channel.
+VARIABLE  msgs       \* Simulates network channel.
+                     \* msgs[i][j] means the input buffer of server j 
+                     \* from server i.
+
+\* Variables only used in verifying properties.
+VARIABLES epochLeader,       \* Set of leaders in every epoch.
+          proposalMsgsLog,   \* Set of all broadcast messages.
+          violatedInvariants \* Check whether there are conditions 
+                             \* contrary to the facts.
+
+\* Variable used for recording critical data,
+\* to constrain state space or update values.
+VARIABLE  recorder \* Consists: members of Parameters and pc, values.
+                   \* Form is record: 
+                   \* [pc, nTransaction, maxEpoch, nTimeout, nRestart, nClientRequest]
+
+serverVars == <<state, zabState, acceptedEpoch, currentEpoch, 
+                history, lastCommitted>>
+
+leaderVars == <<learners, cepochRecv, ackeRecv, ackldRecv, 
+                sendCounter>>
+
+followerVars == connectInfo
+
+electionVars == leaderOracle
+
+msgVars == msgs
+
+verifyVars == <<proposalMsgsLog, epochLeader, violatedInvariants>>
+
+vars == <<serverVars, leaderVars, followerVars, electionVars, 
+          msgVars, verifyVars, recorder>>
+-----------------------------------------------------------------------------
+\* Return the maximum value from the set S
+Maximum(S) == IF S = {} THEN -1
+                        ELSE CHOOSE n \in S: \A m \in S: n >= m
+\* Return the minimum value from the set S
+Minimum(S) == IF S = {} THEN -1
+                        ELSE CHOOSE n \in S: \A m \in S: n <= m
+
+\* Check server state                       
+IsLeader(s)   == state[s] = LEADING
+IsFollower(s) == state[s] = FOLLOWING
+IsLooking(s)  == state[s] = LOOKING
+
+\* Check if s is a quorum
+IsQuorum(s) == s \in Quorums
+
+IsMyLearner(i, j) == j \in learners[i]
+IsMyLeader(i, j)  == connectInfo[i] = j
+HasNoLeader(i)    == connectInfo[i] = NullPoint
+HasLeader(i)      == connectInfo[i] /= NullPoint
+-----------------------------------------------------------------------------
+\* FALSE: zxid1 <= zxid2; TRUE: zxid1 > zxid2
+ZxidCompare(zxid1, zxid2) == \/ zxid1[1] > zxid2[1]
+                             \/ /\ zxid1[1] = zxid2[1]
+                                /\ zxid1[2] > zxid2[2]
+
+ZxidEqual(zxid1, zxid2) == zxid1[1] = zxid2[1] /\ zxid1[2] = zxid2[2]
+
+TxnZxidEqual(txn, z) == txn.zxid[1] = z[1] /\ txn.zxid[2] = z[2]
+
+TxnEqual(txn1, txn2) == /\ ZxidEqual(txn1.zxid, txn2.zxid)
+                        /\ txn1.value = txn2.value
+
+EpochPrecedeInTxn(txn1, txn2) == txn1.zxid[1] < txn2.zxid[1]
+-----------------------------------------------------------------------------
+\* Actions about recorder
+GetParameter(p) == IF p \in DOMAIN Parameters THEN Parameters[p] ELSE 0
+GetRecorder(p)  == IF p \in DOMAIN recorder   THEN recorder[p]   ELSE 0
+
+RecorderGetHelper(m) == (m :> recorder[m])
+RecorderIncHelper(m) == (m :> recorder[m] + 1)
+
+RecorderIncTimeout == RecorderIncHelper("nTimeout")
+RecorderGetTimeout == RecorderGetHelper("nTimeout")
+RecorderIncRestart == RecorderIncHelper("nRestart")
+RecorderGetRestart == RecorderGetHelper("nRestart")
+RecorderSetTransactionNum(pc) == ("nTransaction" :> 
+                                IF pc[1] = "LeaderProcessRequest" THEN
+                                    LET s == CHOOSE i \in Server: 
+                                        \A j \in Server: Len(history'[i]) >= Len(history'[j])                       
+                                    IN Len(history'[s])
+                                ELSE recorder["nTransaction"])
+RecorderSetMaxEpoch(pc)       == ("maxEpoch" :> 
+                                IF pc[1] = "LeaderProcessCEPOCH" THEN
+                                    LET s == CHOOSE i \in Server:
+                                        \A j \in Server: acceptedEpoch'[i] >= acceptedEpoch'[j]
+                                    IN acceptedEpoch'[s]
+                                ELSE recorder["maxEpoch"])
+RecorderSetRequests(pc)       == ("nClientRequest" :>
+                                IF pc[1] = "LeaderProcessRequest" THEN
+                                    recorder["nClientRequest"] + 1
+                                ELSE recorder["nClientRequest"] )
+RecorderSetPc(pc)      == ("pc" :> pc)
+RecorderSetFailure(pc) == CASE pc[1] = "Timeout"         -> RecorderIncTimeout @@ RecorderGetRestart
+                          []   pc[1] = "LeaderTimeout"   -> RecorderIncTimeout @@ RecorderGetRestart
+                          []   pc[1] = "FollowerTimeout" -> RecorderIncTimeout @@ RecorderGetRestart
+                          []   pc[1] = "Restart"         -> RecorderIncTimeout @@ RecorderIncRestart
+                          []   OTHER                     -> RecorderGetTimeout @@ RecorderGetRestart
+
+UpdateRecorder(pc) == recorder' = RecorderSetFailure(pc)      @@ RecorderSetTransactionNum(pc)
+                                  @@ RecorderSetMaxEpoch(pc)  @@ RecorderSetPc(pc) 
+                                  @@ RecorderSetRequests(pc)  @@ recorder
+UnchangeRecorder   == UNCHANGED recorder
+
+CheckParameterHelper(n, p, Comp(_,_)) == IF p \in DOMAIN Parameters 
+                                         THEN Comp(n, Parameters[p])
+                                         ELSE TRUE
+CheckParameterLimit(n, p) == CheckParameterHelper(n, p, LAMBDA i, j: i < j)
+
+CheckTimeout        == CheckParameterLimit(recorder.nTimeout,     "MaxTimeoutFailures")
+CheckTransactionNum == CheckParameterLimit(recorder.nTransaction, "MaxTransactionNum")
+CheckEpoch          == CheckParameterLimit(recorder.maxEpoch,     "MaxEpoch")
+CheckRestart        == /\ CheckTimeout 
+                       /\ CheckParameterLimit(recorder.nRestart,  "MaxRestarts")
+
+CheckStateConstraints == CheckTimeout /\ CheckTransactionNum /\ CheckEpoch /\ CheckRestart
+-----------------------------------------------------------------------------
+\* Actions about network
+PendingCEPOCH(i, j)    == /\ msgs[j][i] /= << >>
+                          /\ msgs[j][i][1].mtype = CEPOCH
+PendingNEWEPOCH(i, j)  == /\ msgs[j][i] /= << >>
+                          /\ msgs[j][i][1].mtype = NEWEPOCH
+PendingACKEPOCH(i, j)  == /\ msgs[j][i] /= << >>
+                          /\ msgs[j][i][1].mtype = ACKEPOCH
+PendingNEWLEADER(i, j) == /\ msgs[j][i] /= << >>
+                          /\ msgs[j][i][1].mtype = NEWLEADER
+PendingACKLD(i, j)     == /\ msgs[j][i] /= << >>
+                          /\ msgs[j][i][1].mtype = ACKLD
+PendingCOMMITLD(i, j)  == /\ msgs[j][i] /= << >>
+                          /\ msgs[j][i][1].mtype = COMMITLD
+PendingPROPOSE(i, j)   == /\ msgs[j][i] /= << >>
+                          /\ msgs[j][i][1].mtype = PROPOSE
+PendingACK(i, j)       == /\ msgs[j][i] /= << >>
+                          /\ msgs[j][i][1].mtype = ACK
+PendingCOMMIT(i, j)    == /\ msgs[j][i] /= << >>
+                          /\ msgs[j][i][1].mtype = COMMIT
+\* Add a message to msgs - add a message m to msgs.
+Send(i, j, m) == msgs' = [msgs EXCEPT ![i][j] = Append(msgs[i][j], m)]
+\* Remove a message from msgs - discard head of msgs.
+Discard(i, j) == msgs' = IF msgs[i][j] /= << >> THEN [msgs EXCEPT ![i][j] = Tail(msgs[i][j])]
+                                                ELSE msgs
+\* Combination of Send and Discard - discard head of msgs[j][i] and add m into msgs.
+Reply(i, j, m) == msgs' = [msgs EXCEPT ![j][i] = Tail(msgs[j][i]),
+                                       ![i][j] = Append(msgs[i][j], m)]
+\* Shuffle input buffer.
+Clean(i, j) == msgs' = [msgs EXCEPT ![j][i] = << >>, ![i][j] = << >>]   
+CleanInputBuffer(S) == msgs' = [s \in Server |-> 
+                                    [v \in Server |-> IF v \in S THEN << >>
+                                                      ELSE msgs[s][v] ] ]
+\* Leader broadcasts a message PROPOSE to all other servers in Q.
+\* Note: In paper, Q is fuzzy. We think servers who leader broadcasts NEWLEADER to
+\*       should receive every PROPOSE. So we consider ackeRecv as Q.
+\* Since we let ackeRecv = Q, there may exist some follower receiving COMMIT before
+\* COMMITLD, and zxid in COMMIT later than zxid in COMMITLD. To avoid this situation,
+\* if f \in ackeRecv but \notin ackldRecv, f should not receive COMMIT until 
+\* f \in ackldRecv and receives COMMITLD.
+Broadcast(i, m) ==
+        LET ackeRecv_quorum == {a \in ackeRecv[i]: a.connected = TRUE }
+            sid_ackeRecv == { a.sid: a \in ackeRecv_quorum }
+        IN msgs' = [msgs EXCEPT ![i] = [v \in Server |-> IF /\ v \in sid_ackeRecv
+                                                            /\ v \in learners[i] 
+                                                            /\ v /= i
+                                                         THEN Append(msgs[i][v], m)
+                                                         ELSE msgs[i][v] ] ]  
+\* Since leader decides to broadcasts message COMMIT when processing ACK, so
+\* we need to discard ACK and broadcast COMMIT.
+\* Here Q is ackldRecv, because we assume that f should not receive COMMIT until
+\* f receives COMMITLD.
+DiscardAndBroadcast(i, j, m) ==
+        LET ackldRecv_quorum == {a \in ackldRecv[i]: a.connected = TRUE }
+            sid_ackldRecv == { a.sid: a \in ackldRecv_quorum }
+        IN msgs' = [msgs EXCEPT ![j][i] = Tail(msgs[j][i]),
+                                ![i] = [v \in Server |-> IF /\ v \in sid_ackldRecv
+                                                            /\ v \in learners[i] 
+                                                            /\ v /= i
+                                                         THEN Append(msgs[i][v], m)
+                                                         ELSE msgs[i][v] ] ]  
+\* Leader broadcasts LEADERINFO to all other servers in cepochRecv.
+DiscardAndBroadcastNEWEPOCH(i, j, m) ==
+        LET new_cepochRecv_quorum == {c \in cepochRecv'[i]: c.connected = TRUE }
+            new_sid_cepochRecv == { c.sid: c \in new_cepochRecv_quorum }
+        IN msgs' = [msgs EXCEPT ![j][i] = Tail(msgs[j][i]),
+                                ![i] = [v \in Server |-> IF /\ v \in new_sid_cepochRecv
+                                                            /\ v \in learners[i] 
+                                                            /\ v /= i
+                                                         THEN Append(msgs[i][v], m)
+                                                         ELSE msgs[i][v] ] ]
+\* Leader broadcasts NEWLEADER to all other servers in ackeRecv.
+DiscardAndBroadcastNEWLEADER(i, j, m) ==
+        LET new_ackeRecv_quorum == {a \in ackeRecv'[i]: a.connected = TRUE }
+            new_sid_ackeRecv == { a.sid: a \in new_ackeRecv_quorum }
+        IN msgs' = [msgs EXCEPT ![j][i] = Tail(msgs[j][i]),
+                                ![i] = [v \in Server |-> IF /\ v \in new_sid_ackeRecv
+                                                            /\ v \in learners[i] 
+                                                            /\ v /= i
+                                                         THEN Append(msgs[i][v], m)
+                                                         ELSE msgs[i][v] ] ]
+\* Leader broadcasts COMMITLD to all other servers in ackldRecv.
+DiscardAndBroadcastCOMMITLD(i, j, m) ==
+        LET new_ackldRecv_quorum == {a \in ackldRecv'[i]: a.connected = TRUE }
+            new_sid_ackldRecv == { a.sid: a \in new_ackldRecv_quorum }
+        IN msgs' = [msgs EXCEPT ![j][i] = Tail(msgs[j][i]),
+                                ![i] = [v \in Server |-> IF /\ v \in new_sid_ackldRecv
+                                                            /\ v \in learners[i] 
+                                                            /\ v /= i
+                                                         THEN Append(msgs[i][v], m)
+                                                         ELSE msgs[i][v] ] ]
+-----------------------------------------------------------------------------
+\* Define initial values for all variables 
+InitServerVars == /\ state         = [s \in Server |-> LOOKING]
+                  /\ zabState      = [s \in Server |-> ELECTION]
+                  /\ acceptedEpoch = [s \in Server |-> 0]
+                  /\ currentEpoch  = [s \in Server |-> 0]
+                  /\ history       = [s \in Server |-> << >>]
+                  /\ lastCommitted = [s \in Server |-> [ index |-> 0,
+                                                         zxid  |-> <<0, 0>> ] ]
+
+InitLeaderVars == /\ learners       = [s \in Server |-> {}]
+                  /\ cepochRecv     = [s \in Server |-> {}]
+                  /\ ackeRecv       = [s \in Server |-> {}]
+                  /\ ackldRecv      = [s \in Server |-> {}]
+                  /\ sendCounter    = [s \in Server |-> 0]
+
+InitFollowerVars == connectInfo = [s \in Server |-> NullPoint]
+
+InitElectionVars == leaderOracle = NullPoint
+
+InitMsgVars == msgs = [s \in Server |-> [v \in Server |-> << >>] ]
+
+InitVerifyVars == /\ proposalMsgsLog    = {}
+                  /\ epochLeader        = [i \in 1..MAXEPOCH |-> {} ]
+                  /\ violatedInvariants = [stateInconsistent    |-> FALSE,
+                                           proposalInconsistent |-> FALSE,
+                                           commitInconsistent   |-> FALSE,
+                                           ackInconsistent      |-> FALSE,
+                                           messageIllegal       |-> FALSE ]
+
+InitRecorder == recorder = [nTimeout       |-> 0,
+                            nTransaction   |-> 0,
+                            maxEpoch       |-> 0,
+                            nRestart       |-> 0,
+                            pc             |-> <<"Init">>,
+                            nClientRequest |-> 0]
+
+Init == /\ InitServerVars
+        /\ InitLeaderVars
+        /\ InitFollowerVars
+        /\ InitElectionVars
+        /\ InitVerifyVars
+        /\ InitMsgVars
+        /\ InitRecorder
+-----------------------------------------------------------------------------
+\* Utils in state switching
+FollowerShutdown(i) == 
+        /\ state'    = [state      EXCEPT ![i] = LOOKING]
+        /\ zabState' = [zabState   EXCEPT ![i] = ELECTION]
+        /\ connectInfo' = [connectInfo EXCEPT ![i] = NullPoint]
+
+LeaderShutdown(i) ==
+        /\ LET S == learners[i]
+           IN /\ state' = [s \in Server |-> IF s \in S THEN LOOKING ELSE state[s] ]
+              /\ zabState' = [s \in Server |-> IF s \in S THEN ELECTION ELSE zabState[s] ]
+              /\ connectInfo' = [s \in Server |-> IF s \in S THEN NullPoint ELSE connectInfo[s] ]
+              /\ CleanInputBuffer(S)
+        /\ learners'   = [learners   EXCEPT ![i] = {}]
+
+SwitchToFollower(i) ==
+        /\ state' = [state EXCEPT ![i] = FOLLOWING]
+        /\ zabState' = [zabState EXCEPT ![i] = DISCOVERY]
+
+SwitchToLeader(i) ==
+        /\ state' = [state EXCEPT ![i] = LEADING]
+        /\ zabState' = [zabState EXCEPT ![i] = DISCOVERY]
+        /\ learners' = [learners EXCEPT ![i] = {i}]
+        /\ cepochRecv' = [cepochRecv EXCEPT ![i] = { [ sid       |-> i,
+                                                       connected |-> TRUE,
+                                                       epoch     |-> acceptedEpoch[i] ] }]
+        /\ ackeRecv' = [ackeRecv EXCEPT ![i] = { [ sid           |-> i,
+                                                   connected     |-> TRUE,
+                                                   peerLastEpoch |-> currentEpoch[i],
+                                                   peerHistory   |-> history[i] ] }]
+        /\ ackldRecv' = [ackldRecv EXCEPT ![i] = { [ sid       |-> i,
+                                                     connected |-> TRUE ] }]
+        /\ sendCounter' = [sendCounter EXCEPT ![i] = 0]
+
+RemoveCepochRecv(set, sid) ==
+        LET sid_cepochRecv == {s.sid: s \in set}
+        IN IF sid \notin sid_cepochRecv THEN set
+           ELSE LET info == CHOOSE s \in set: s.sid = sid
+                    new_info == [ sid       |-> sid,
+                                  connected |-> FALSE,
+                                  epoch     |-> info.epoch ]
+                IN (set \ {info}) \union {new_info}
+
+RemoveAckeRecv(set, sid) ==
+        LET sid_ackeRecv == {s.sid: s \in set}
+        IN IF sid \notin sid_ackeRecv THEN set
+           ELSE LET info == CHOOSE s \in set: s.sid = sid
+                    new_info == [ sid |-> sid,
+                                  connected |-> FALSE,
+                                  peerLastEpoch |-> info.peerLastEpoch,
+                                  peerHistory   |-> info.peerHistory ]
+                IN (set \ {info}) \union {new_info}
+
+RemoveAckldRecv(set, sid) ==
+        LET sid_ackldRecv == {s.sid: s \in set}
+        IN IF sid \notin sid_ackldRecv THEN set
+           ELSE LET info == CHOOSE s \in set: s.sid = sid
+                    new_info == [ sid |-> sid,
+                                  connected |-> FALSE ]
+                IN (set \ {info}) \union {new_info}
+
+RemoveLearner(i, j) ==
+        /\ learners'   = [learners   EXCEPT ![i] = @ \ {j}] 
+        /\ cepochRecv' = [cepochRecv EXCEPT ![i] = RemoveCepochRecv(@, j) ]
+        /\ ackeRecv'   = [ackeRecv   EXCEPT ![i] = RemoveAckeRecv(@, j) ]
+        /\ ackldRecv'  = [ackldRecv  EXCEPT ![i] = RemoveAckldRecv(@, j) ]
+-----------------------------------------------------------------------------
+\* Actions of election
+UpdateLeader(i) ==
+        /\ IsLooking(i)
+        /\ leaderOracle /= i
+        /\ leaderOracle' = i
+        /\ SwitchToLeader(i)
+        /\ UNCHANGED <<acceptedEpoch, currentEpoch, history, lastCommitted, 
+                followerVars, verifyVars, msgVars>>
+        /\ UpdateRecorder(<<"UpdateLeader", i>>)
+
+FollowLeader(i) ==
+        /\ IsLooking(i)
+        /\ leaderOracle /= NullPoint
+        /\ \/ /\ leaderOracle = i
+              /\ SwitchToLeader(i)
+           \/ /\ leaderOracle /= i
+              /\ SwitchToFollower(i)
+              /\ UNCHANGED leaderVars
+        /\ UNCHANGED <<acceptedEpoch, currentEpoch, history, lastCommitted, 
+                electionVars, followerVars, verifyVars, msgVars>>
+        /\ UpdateRecorder(<<"FollowLeader", i>>)
+
+-----------------------------------------------------------------------------
+(* Actions of situation error. Situation error in protocol spec is different
+   from latter specs. This is for compressing state space, we focus on results
+   from external events (e.g. network partition, node failure, etc.), so we do
+   not need to add variables and actions about network conditions and node 
+   conditions. It is reasonable that we have action 'Restart' but no 'Crash',
+   because when a node does not execute any internal events after restarting, 
+   this is equivalent to executing a crash.
+*)
+
+\* Timeout between leader and follower.   
+Timeout(i, j) ==
+        /\ CheckTimeout \* test restrictions of timeout
+        /\ IsLeader(i)   /\ IsMyLearner(i, j)
+        /\ IsFollower(j) /\ IsMyLeader(j, i)
+        /\ LET newLearners == learners[i] \ {j}
+           IN \/ /\ IsQuorum(newLearners)  \* just remove this learner
+                 /\ RemoveLearner(i, j)
+                 /\ FollowerShutdown(j)
+                 /\ Clean(i, j)
+              \/ /\ ~IsQuorum(newLearners) \* leader switches to looking
+                 /\ LeaderShutdown(i)
+                 /\ UNCHANGED <<cepochRecv, ackeRecv, ackldRecv>>
+        /\ UNCHANGED <<acceptedEpoch, currentEpoch, history, lastCommitted,
+                       sendCounter, electionVars, verifyVars>>
+        /\ UpdateRecorder(<<"Timeout", i, j>>)
+
+Restart(i) ==
+        /\ CheckRestart \* test restrictions of restart
+        /\ \/ /\ IsLooking(i)
+              /\ UNCHANGED <<state, zabState, learners, followerVars, msgVars,
+                    cepochRecv, ackeRecv, ackldRecv>>
+           \/ /\ IsFollower(i)
+              /\ LET connectedWithLeader == HasLeader(i)
+                 IN \/ /\ connectedWithLeader
+                       /\ LET leader == connectInfo[i]
+                              newLearners == learners[leader] \ {i}
+                          IN 
+                          \/ /\ IsQuorum(newLearners)  \* leader remove learner i
+                             /\ RemoveLearner(leader, i)
+                             /\ FollowerShutdown(i)
+                             /\ Clean(leader, i)
+                          \/ /\ ~IsQuorum(newLearners) \* leader switches to looking
+                             /\ LeaderShutdown(leader)
+                             /\ UNCHANGED <<cepochRecv, ackeRecv, ackldRecv>>
+                    \/ /\ ~connectedWithLeader
+                       /\ FollowerShutdown(i)
+                       /\ CleanInputBuffer({i})
+                       /\ UNCHANGED <<learners, cepochRecv, ackeRecv, ackldRecv>>
+           \/ /\ IsLeader(i)
+              /\ LeaderShutdown(i)
+              /\ UNCHANGED <<cepochRecv, ackeRecv, ackldRecv>>
+        /\ lastCommitted' = [lastCommitted EXCEPT ![i] = [ index |-> 0,
+                                                           zxid  |-> <<0, 0>> ] ]
+        /\ UNCHANGED <<acceptedEpoch, currentEpoch, history,
+                       sendCounter, leaderOracle, verifyVars>>
+        /\ UpdateRecorder(<<"Restart", i>>)
+-----------------------------------------------------------------------------
+(* Establish connection between leader and follower. *)
+ConnectAndFollowerSendCEPOCH(i, j) ==
+        /\ IsLeader(i) /\ \lnot IsMyLearner(i, j)
+        /\ IsFollower(j) /\ HasNoLeader(j) /\ leaderOracle = i
+        /\ learners'   = [learners   EXCEPT ![i] = @ \union {j}]
+        /\ connectInfo' = [connectInfo EXCEPT ![j] = i]
+        /\ Send(j, i, [ mtype  |-> CEPOCH,
+                        mepoch |-> acceptedEpoch[j] ]) \* contains f.p
+        /\ UNCHANGED <<serverVars, electionVars, verifyVars, cepochRecv,
+                       ackeRecv, ackldRecv, sendCounter>>
+        /\ UpdateRecorder(<<"ConnectAndFollowerSendCEPOCH", i, j>>)
+
+CepochRecvQuorumFormed(i) == LET sid_cepochRecv == {c.sid: c \in cepochRecv[i]}
+                             IN IsQuorum(sid_cepochRecv)
+CepochRecvBecomeQuorum(i) == LET sid_cepochRecv == {c.sid: c \in cepochRecv'[i]}
+                             IN IsQuorum(sid_cepochRecv)
+
+UpdateCepochRecv(oldSet, sid, peerEpoch) ==
+        LET sid_set == {s.sid: s \in oldSet}
+        IN IF sid \in sid_set
+           THEN LET old_info == CHOOSE info \in oldSet: info.sid = sid
+                    new_info == [ sid       |-> sid,
+                                  connected |-> TRUE,
+                                  epoch     |-> peerEpoch ]
+                IN ( oldSet \ {old_info} ) \union {new_info}
+           ELSE LET follower_info == [ sid       |-> sid,
+                                       connected |-> TRUE,
+                                       epoch     |-> peerEpoch ]
+                IN oldSet \union {follower_info}
+
+\* Determine new e' in this round from a quorum of CEPOCH.
+DetermineNewEpoch(i) ==
+        LET epoch_cepochRecv == {c.epoch: c \in cepochRecv'[i]}
+        IN Maximum(epoch_cepochRecv) + 1
+
+(* Leader waits for receiving FOLLOWERINFO from a quorum including itself,
+   and chooses a new epoch e' as its own epoch and broadcasts NEWEPOCH. *)
+LeaderProcessCEPOCH(i, j) ==
+        /\ CheckEpoch  \* test restrictions of max epoch
+        /\ IsLeader(i)
+        /\ PendingCEPOCH(i, j)
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLearner(i, j)
+           IN /\ infoOk
+              /\ \/ \* 1. has not broadcast NEWEPOCH
+                    /\ ~CepochRecvQuorumFormed(i)
+                    /\ \/ /\ zabState[i] = DISCOVERY
+                          /\ UNCHANGED violatedInvariants
+                       \/ /\ zabState[i] /= DISCOVERY
+                          /\ PrintT("Exception: CepochRecvQuorumFormed false," \o
+                               " while zabState not DISCOVERY.")
+                          /\ violatedInvariants' = [violatedInvariants 
+                                    EXCEPT !.stateInconsistent = TRUE]
+                    /\ cepochRecv' = [cepochRecv EXCEPT ![i] = UpdateCepochRecv(@, j, msg.mepoch) ]
+                    /\ \/ \* 1.1. cepochRecv becomes quorum, 
+                          \* then determine e' and broadcasts NEWEPOCH in Q. 
+                          /\ CepochRecvBecomeQuorum(i)
+                          /\ acceptedEpoch' = [acceptedEpoch EXCEPT ![i] = DetermineNewEpoch(i)]
+                          /\ LET m == [ mtype  |-> NEWEPOCH,
+                                        mepoch |-> acceptedEpoch'[i] ]
+                             IN DiscardAndBroadcastNEWEPOCH(i, j, m)
+                       \/ \* 1.2. cepochRecv still not quorum.
+                          /\ ~CepochRecvBecomeQuorum(i)
+                          /\ Discard(j, i)
+                          /\ UNCHANGED acceptedEpoch
+                 \/ \* 2. has broadcast NEWEPOCH
+                    /\ CepochRecvQuorumFormed(i)
+                    /\ cepochRecv' = [cepochRecv EXCEPT ![i] = UpdateCepochRecv(@, j, msg.mepoch) ]
+                    /\ Reply(i, j, [ mtype  |-> NEWEPOCH,
+                                     mepoch |-> acceptedEpoch[i] ])
+                    /\ UNCHANGED <<violatedInvariants, acceptedEpoch>>
+        /\ UNCHANGED <<state, zabState, currentEpoch, history, lastCommitted, learners, 
+                       ackeRecv, ackldRecv, sendCounter, followerVars,
+                       electionVars, proposalMsgsLog, epochLeader>>
+        /\ UpdateRecorder(<<"LeaderProcessCEPOCH", i, j>>)
+
+(* Follower receives LEADERINFO. If newEpoch >= acceptedEpoch, then follower 
+   updates acceptedEpoch and sends ACKEPOCH back, containing currentEpoch and
+   history. After this, zabState turns to SYNC. *)
+FollowerProcessNEWEPOCH(i, j) ==
+        /\ IsFollower(i)
+        /\ PendingNEWEPOCH(i, j)
+        /\ LET msg     == msgs[j][i][1]
+               infoOk  == IsMyLeader(i, j)
+               stateOk == zabState[i] = DISCOVERY
+               epochOk == msg.mepoch >= acceptedEpoch[i]
+           IN /\ infoOk
+              /\ \/ \* 1. Normal case
+                    /\ epochOk
+                    /\ \/ /\ stateOk
+                          /\ acceptedEpoch' = [acceptedEpoch EXCEPT ![i] = msg.mepoch]
+                          /\ LET m == [ mtype    |-> ACKEPOCH,
+                                        mepoch   |-> currentEpoch[i],
+                                        mhistory |-> history[i] ]
+                             IN Reply(i, j, m)
+                          /\ zabState' = [zabState EXCEPT ![i] = SYNCHRONIZATION]
+                          /\ UNCHANGED violatedInvariants
+                       \/ /\ ~stateOk
+                          /\ PrintT("Exception: Follower receives NEWEPOCH," \o
+                             " whileZabState not DISCOVERY.")
+                          /\ violatedInvariants' = [violatedInvariants 
+                                        EXCEPT !.stateInconsistent = TRUE]
+                          /\ Discard(j, i)
+                          /\ UNCHANGED <<acceptedEpoch, zabState>>
+                    /\ UNCHANGED <<followerVars, learners, cepochRecv, ackeRecv,
+                            ackldRecv, state>>
+                 \/ \* 2. Abnormal case - go back to election
+                    /\ ~epochOk
+                    /\ FollowerShutdown(i)
+                    /\ LET leader == connectInfo[i]
+                       IN /\ Clean(i, leader)
+                          /\ RemoveLearner(leader, i)
+                    /\ UNCHANGED <<acceptedEpoch, violatedInvariants>>
+        /\ UNCHANGED <<currentEpoch, history, lastCommitted, sendCounter,
+                    electionVars, proposalMsgsLog, epochLeader>>
+        /\ UpdateRecorder(<<"FollowerProcessNEWEPOCH", i, j>>)
+
+AckeRecvQuorumFormed(i) == LET sid_ackeRecv == {a.sid: a \in ackeRecv[i]}
+                           IN IsQuorum(sid_ackeRecv)
+AckeRecvBecomeQuorum(i) == LET sid_ackeRecv == {a.sid: a \in ackeRecv'[i]}
+                           IN IsQuorum(sid_ackeRecv)
+
+UpdateAckeRecv(oldSet, sid, peerEpoch, peerHistory) ==
+        LET sid_set == {s.sid: s \in oldSet}
+            follower_info == [ sid           |-> sid,
+                               connected     |-> TRUE,
+                               peerLastEpoch |-> peerEpoch,
+                               peerHistory   |-> peerHistory ]
+        IN IF sid \in sid_set 
+           THEN LET old_info == CHOOSE info \in oldSet: info.sid = sid
+                IN (oldSet \ {old_info}) \union {follower_info}
+           ELSE oldSet \union {follower_info}
+
+\* for checking invariants
+RECURSIVE SetPacketsForChecking(_,_,_,_,_,_)
+SetPacketsForChecking(set, src, ep, his, cur, end) ==
+        IF cur > end THEN set
+        ELSE LET m_proposal == [ source |-> src,
+                                 epoch  |-> ep,
+                                 zxid   |-> his[cur].zxid,
+                                 data   |-> his[cur].value ]
+             IN SetPacketsForChecking((set \union {m_proposal}), src, ep, his, cur + 1, end)
+    
+
+LastZxidOfHistory(his) == IF Len(his) = 0 THEN <<0, 0>>
+                          ELSE his[Len(his)].zxid
+
+\* TRUE: f1.a > f2.a or (f1.a = fa.a and f1.zxid >= f2.zxid)
+MoreResentOrEqual(ss1, ss2) == \/ ss1.currentEpoch > ss2.currentEpoch
+                               \/ /\ ss1.currentEpoch = ss2.currentEpoch
+                                  /\ ~ZxidCompare(ss2.lastZxid, ss1.lastZxid)
+
+\* Determine initial history Ie' in this round from a quorum of ACKEPOCH.
+DetermineInitialHistory(i) ==
+        LET set == ackeRecv'[i]
+            ss_set == { [ sid          |-> a.sid,
+                          currentEpoch |-> a.peerLastEpoch,
+                          lastZxid     |-> LastZxidOfHistory(a.peerHistory) ]
+                        : a \in set }
+            selected == CHOOSE ss \in ss_set: 
+                            \A ss1 \in (ss_set \ {ss}): MoreResentOrEqual(ss, ss1)
+            info == CHOOSE f \in set: f.sid = selected.sid
+        IN info.peerHistory
+
+RECURSIVE InitAcksidHelper(_,_)
+InitAcksidHelper(txns, src) == IF Len(txns) = 0 THEN << >>
+                               ELSE LET oldTxn == txns[1]
+                                        newTxn == [ zxid   |-> oldTxn.zxid,
+                                                    value  |-> oldTxn.value,
+                                                    ackSid |-> {src},
+                                                    epoch  |-> oldTxn.epoch ]
+                                    IN <<newTxn>> \o InitAcksidHelper( Tail(txns), src)
+
+\* Atomically let all txns in initial history contain self's acks.
+InitAcksid(i, his) == InitAcksidHelper(his, i)
+
+(* Leader waits for receiving ACKEPOPCH from a quorum, and determines initialHistory
+   according to history of whom has most recent state summary from them. After this,
+   leader's zabState turns to SYNCHRONIZATION. *)
+LeaderProcessACKEPOCH(i, j) ==
+        /\ IsLeader(i)
+        /\ PendingACKEPOCH(i, j)
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLearner(i, j)
+           IN /\ infoOk
+              /\ \/ \* 1. has broadcast NEWLEADER 
+                    /\ AckeRecvQuorumFormed(i)
+                    /\ ackeRecv' = [ackeRecv EXCEPT ![i] = UpdateAckeRecv(@, j, 
+                                            msg.mepoch, msg.mhistory) ]
+                    /\ LET toSend == history[i] \* contains (Ie', Be')
+                           m == [ mtype    |-> NEWLEADER,
+                                  mepoch   |-> acceptedEpoch[i],
+                                  mhistory |-> toSend ]
+                           set_forChecking == SetPacketsForChecking({ }, i, 
+                                        acceptedEpoch[i], toSend, 1, Len(toSend))
+                       IN 
+                       /\ Reply(i, j, m) 
+                       /\ proposalMsgsLog' = proposalMsgsLog \union set_forChecking
+                    /\ UNCHANGED <<violatedInvariants, currentEpoch, history, 
+                                   zabState, epochLeader>>
+                 \/ \* 2. has not broadcast NEWLEADER
+                    /\ ~AckeRecvQuorumFormed(i)
+                    /\ \/ /\ zabState[i] = DISCOVERY
+                          /\ UNCHANGED violatedInvariants
+                       \/ /\ zabState[i] /= DISCOVERY
+                          /\ PrintT("Exception: AckeRecvQuorumFormed false," \o
+                             " while zabState not DISCOVERY.")
+                          /\ violatedInvariants' = [violatedInvariants EXCEPT 
+                                                    !.stateInconsistent = TRUE]
+                    /\ ackeRecv' = [ackeRecv EXCEPT ![i] = UpdateAckeRecv(@, j, 
+                                            msg.mepoch, msg.mhistory) ]
+                    /\ \/ \* 2.1. ackeRecv becomes quorum, determine Ie'
+                          \* and broadcasts NEWLEADER in Q. (l.1.2 + l.2.1)
+                          /\ AckeRecvBecomeQuorum(i)
+                          /\ \* Update f.a
+                             LET newLeaderEpoch == acceptedEpoch[i] IN 
+                             /\ currentEpoch' = [currentEpoch EXCEPT ![i] = newLeaderEpoch]
+                             /\ epochLeader' = [epochLeader EXCEPT ![newLeaderEpoch] 
+                                                = @ \union {i} ] \* for checking invariants
+                          /\ \* Determine initial history Ie'
+                             LET initialHistory == DetermineInitialHistory(i) IN 
+                             history' = [history EXCEPT ![i] = InitAcksid(i, initialHistory) ]
+                          /\ \* Update zabState
+                             zabState' = [zabState EXCEPT ![i] = SYNCHRONIZATION]
+                          /\ \* Broadcast NEWLEADER with (e', Ie')
+                             LET toSend == history'[i] 
+                                 m == [ mtype    |-> NEWLEADER,
+                                        mepoch   |-> acceptedEpoch[i],
+                                        mhistory |-> toSend ]
+                                 set_forChecking == SetPacketsForChecking({ }, i, 
+                                            acceptedEpoch[i], toSend, 1, Len(toSend))
+                             IN 
+                             /\ DiscardAndBroadcastNEWLEADER(i, j, m)
+                             /\ proposalMsgsLog' = proposalMsgsLog \union set_forChecking
+                       \/ \* 2.2. ackeRecv still not quorum.
+                          /\ ~AckeRecvBecomeQuorum(i)
+                          /\ Discard(j, i)
+                          /\ UNCHANGED <<currentEpoch, history, zabState, 
+                                     proposalMsgsLog, epochLeader>>
+        /\ UNCHANGED <<state, acceptedEpoch, lastCommitted, learners, cepochRecv, ackldRecv, 
+                sendCounter, followerVars, electionVars>>
+        /\ UpdateRecorder(<<"LeaderProcessACKEPOCH", i, j>>)
+-----------------------------------------------------------------------------    
+(* Follower receives NEWLEADER. Update f.a and history. *)
+FollowerProcessNEWLEADER(i, j) ==
+        /\ IsFollower(i)
+        /\ PendingNEWLEADER(i, j)
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLeader(i, j)
+               epochOk == acceptedEpoch[i] = msg.mepoch
+               stateOk == zabState[i] = SYNCHRONIZATION
+           IN /\ infoOk
+              /\ \/ \* 1. f.p not equals e', starts a new iteration.
+                    /\ ~epochOk
+                    /\ FollowerShutdown(i)
+                    /\ LET leader == connectInfo[i]
+                       IN /\ Clean(i, leader)
+                          /\ RemoveLearner(leader, i)
+                    /\ UNCHANGED <<violatedInvariants, currentEpoch, history>>
+                 \/ \* 2. f.p equals e'.
+                    /\ epochOk
+                    /\ \/ /\ stateOk
+                          /\ UNCHANGED violatedInvariants
+                       \/ /\ ~stateOk
+                          /\ PrintT("Exception: Follower receives NEWLEADER," \o
+                             " whileZabState not SYNCHRONIZATION.")
+                          /\ violatedInvariants' = [violatedInvariants 
+                                    EXCEPT !.stateInconsistent = TRUE]
+                    /\ currentEpoch' = [currentEpoch EXCEPT ![i] = acceptedEpoch[i]]
+                    /\ history' = [history EXCEPT ![i] = msg.mhistory] \* no need to care ackSid
+                    /\ LET m == [ mtype |-> ACKLD,
+                                  mzxid |-> LastZxidOfHistory(history'[i]) ]
+                       IN Reply(i, j, m)
+                    /\ UNCHANGED <<followerVars, state, zabState, learners, cepochRecv,
+                                    ackeRecv, ackldRecv>>
+        /\ UNCHANGED <<acceptedEpoch, lastCommitted, sendCounter, electionVars, 
+                proposalMsgsLog, epochLeader>>
+        /\ UpdateRecorder(<<"FollowerProcessNEWLEADER", i, j>>)
+
+AckldRecvQuorumFormed(i) == LET sid_ackldRecv == {a.sid: a \in ackldRecv[i]}
+                            IN IsQuorum(sid_ackldRecv)
+AckldRecvBecomeQuorum(i) == LET sid_ackldRecv == {a.sid: a \in ackldRecv'[i]}
+                            IN IsQuorum(sid_ackldRecv)
+
+UpdateAckldRecv(oldSet, sid) ==
+        LET sid_set == {s.sid: s \in oldSet}
+            follower_info == [ sid       |-> sid,
+                               connected |-> TRUE ]
+        IN IF sid \in sid_set
+           THEN LET old_info == CHOOSE info \in oldSet: info.sid = sid
+                IN (oldSet \ {old_info}) \union {follower_info}
+           ELSE oldSet \union {follower_info}
+
+LastZxid(i) == LastZxidOfHistory(history[i])
+
+RECURSIVE UpdateAcksidHelper(_,_,_)
+UpdateAcksidHelper(txns, target, endZxid) ==
+        IF Len(txns) = 0 THEN << >>
+        ELSE LET oldTxn == txns[1]
+             IN IF ZxidCompare(oldTxn.zxid, endZxid) THEN txns
+                ELSE LET newTxn == [ zxid   |-> oldTxn.zxid,
+                                     value  |-> oldTxn.value,
+                                     ackSid |-> IF target \in oldTxn.ackSid
+                                                THEN oldTxn.ackSid
+                                                ELSE oldTxn.ackSid \union {target},
+                                     epoch  |-> oldTxn.epoch ]
+                     IN <<newTxn>> \o UpdateAcksidHelper( Tail(txns), target, endZxid)
+    
+\* Atomically add ackSid of one learner according to zxid in ACKLD.
+UpdateAcksid(his, target, endZxid) == UpdateAcksidHelper(his, target, endZxid)
+
+(* Leader waits for receiving ACKLD from a quorum including itself,
+   and broadcasts COMMITLD and turns to BROADCAST. *)
+LeaderProcessACKLD(i, j) ==
+        /\ IsLeader(i)
+        /\ PendingACKLD(i, j)
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLearner(i, j)
+           IN /\ infoOk
+              /\ \/ \* 1. has not broadcast COMMITLD
+                    /\ ~AckldRecvQuorumFormed(i)
+                    /\ \/ /\ zabState[i] = SYNCHRONIZATION
+                          /\ UNCHANGED violatedInvariants
+                       \/ /\ zabState[i] /= SYNCHRONIZATION
+                          /\ PrintT("Exception: AckldRecvQuorumFormed false," \o
+                                " while zabState not SYNCHRONIZATION.")
+                          /\ violatedInvariants' = [violatedInvariants 
+                                    EXCEPT !.stateInconsistent = TRUE]
+                    /\ ackldRecv' = [ackldRecv EXCEPT ![i] = UpdateAckldRecv(@, j) ]
+                    /\ history' = [history EXCEPT ![i] = UpdateAcksid(@, j, msg.mzxid)]
+                    /\ \/ \* 1.1. ackldRecv becomes quorum,
+                          \* then broadcasts COMMITLD and turns to BROADCAST.
+                          /\ AckldRecvBecomeQuorum(i)
+                          /\ lastCommitted' = [lastCommitted EXCEPT 
+                                                    ![i] = [ index |-> Len(history[i]),
+                                                             zxid  |-> LastZxid(i) ] ]
+                          /\ zabState' = [zabState EXCEPT ![i] = BROADCAST]
+                          /\ LET m == [ mtype |-> COMMITLD,
+                                        mzxid |-> LastZxid(i) ]
+                             IN DiscardAndBroadcastCOMMITLD(i, j, m)
+                       \/ \* 1.2. ackldRecv still not quorum.
+                          /\ ~AckldRecvBecomeQuorum(i)
+                          /\ Discard(j, i)
+                          /\ UNCHANGED <<zabState, lastCommitted>>
+                 \/ \* 2. has broadcast COMMITLD
+                    /\ AckldRecvQuorumFormed(i)
+                    /\ \/ /\ zabState[i] = BROADCAST
+                          /\ UNCHANGED violatedInvariants
+                       \/ /\ zabState[i] /= BROADCAST
+                          /\ PrintT("Exception: AckldRecvQuorumFormed true," \o
+                                " while zabState not BROADCAST.")
+                          /\ violatedInvariants' = [violatedInvariants 
+                                    EXCEPT !.stateInconsistent = TRUE]
+                    /\ ackldRecv' = [ackldRecv EXCEPT ![i] = UpdateAckldRecv(@, j) ]
+                    /\ history' = [history EXCEPT ![i] = UpdateAcksid(@, j, msg.mzxid)]
+                    /\ Reply(i, j, [ mtype |-> COMMITLD,
+                                     mzxid |-> lastCommitted[i].zxid ])
+                    /\ UNCHANGED <<zabState, lastCommitted>>
+        /\ UNCHANGED <<state, acceptedEpoch, currentEpoch, learners, cepochRecv, ackeRecv, 
+                    sendCounter, followerVars, electionVars, proposalMsgsLog, epochLeader>>
+        /\ UpdateRecorder(<<"LeaderProcessACKLD", i, j>>)
+
+RECURSIVE ZxidToIndexHelper(_,_,_,_)
+ZxidToIndexHelper(his, zxid, cur, appeared) ==
+        IF cur > Len(his) THEN cur  
+        ELSE IF TxnZxidEqual(his[cur], zxid) 
+             THEN CASE appeared = TRUE -> -1
+                  []   OTHER           -> Minimum( { cur, 
+                            ZxidToIndexHelper(his, zxid, cur + 1, TRUE) } )
+             ELSE ZxidToIndexHelper(his, zxid, cur + 1, appeared)
+
+\* return -1: this zxid appears at least twice. Len(his) + 1: does not exist.
+\* 1 - Len(his): exists and appears just once.
+ZxidToIndex(his, zxid) == IF ZxidEqual( zxid, <<0, 0>> ) THEN 0
+                          ELSE IF Len(his) = 0 THEN 1
+                               ELSE LET len == Len(his) IN
+                                    IF \E idx \in 1..len: TxnZxidEqual(his[idx], zxid)
+                                    THEN ZxidToIndexHelper(his, zxid, 1, FALSE)
+                                    ELSE len + 1
+
+(* Follower receives COMMITLD. Commit all txns. *)
+FollowerProcessCOMMITLD(i, j) ==
+        /\ IsFollower(i)
+        /\ PendingCOMMITLD(i, j)
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLeader(i, j)
+               index == IF ZxidEqual(msg.mzxid, <<0, 0>>) THEN 0
+                        ELSE ZxidToIndex(history[i], msg.mzxid)
+               logOk == index >= 0 /\ index <= Len(history[i])
+           IN /\ infoOk
+              /\ \/ /\ logOk
+                    /\ UNCHANGED violatedInvariants
+                 \/ /\ ~logOk
+                    /\ PrintT("Exception: zxid in COMMITLD not exists in history.")
+                    /\ violatedInvariants' = [violatedInvariants
+                                 EXCEPT !.proposalInconsistent = TRUE]
+              /\ lastCommitted' = [lastCommitted EXCEPT ![i] = [ index |-> index,
+                                                                 zxid  |-> msg.mzxid ] ]
+              /\ zabState' = [zabState EXCEPT ![i] = BROADCAST]
+              /\ Discard(j, i)
+        /\ UNCHANGED <<state, acceptedEpoch, currentEpoch, history, leaderVars, 
+                    followerVars, electionVars, proposalMsgsLog, epochLeader>>
+        /\ UpdateRecorder(<<"FollowerProcessCOMMITLD", i, j>>)
+----------------------------------------------------------------------------
+IncZxid(s, zxid) == IF currentEpoch[s] = zxid[1] THEN <<zxid[1], zxid[2] + 1>>
+                    ELSE <<currentEpoch[s], 1>>
+
+(* Leader receives client request.
+   Note: In production, any server in traffic can receive requests and 
+         forward it to leader if necessary. We choose to let leader be
+         the sole one who can receive write requests, to simplify spec 
+         and keep correctness at the same time. *)
+LeaderProcessRequest(i) ==
+        /\ CheckTransactionNum \* test restrictions of transaction num
+        /\ IsLeader(i)
+        /\ zabState[i] = BROADCAST
+        /\ LET request_value == GetRecorder("nClientRequest") \* unique value
+               newTxn == [ zxid   |-> IncZxid(i, LastZxid(i)),
+                           value  |-> request_value,
+                           ackSid |-> {i},
+                           epoch  |-> currentEpoch[i] ]
+           IN history' = [history EXCEPT ![i] = Append(@, newTxn) ]
+        /\ UNCHANGED <<state, zabState, acceptedEpoch, currentEpoch, lastCommitted,
+                    leaderVars, followerVars, electionVars, msgVars, verifyVars>>
+        /\ UpdateRecorder(<<"LeaderProcessRequest", i>>)
+
+\* Latest counter existing in history.
+CurrentCounter(i) == IF LastZxid(i)[1] = currentEpoch[i] THEN LastZxid(i)[2]
+                     ELSE 0
+
+(* Leader broadcasts PROPOSE when sendCounter < currentCounter. *)
+LeaderBroadcastPROPOSE(i) == 
+        /\ IsLeader(i)
+        /\ zabState[i] = BROADCAST
+        /\ sendCounter[i] < CurrentCounter(i) \* there exists proposal to be sent
+        /\ LET toSendCounter == sendCounter[i] + 1
+               toSendZxid == <<currentEpoch[i], toSendCounter>>
+               toSendIndex == ZxidToIndex(history[i], toSendZxid)
+               toSendTxn == history[i][toSendIndex]
+               m_proposal == [ mtype |-> PROPOSE,
+                               mzxid |-> toSendTxn.zxid,
+                               mdata |-> toSendTxn.value ]
+               m_proposal_forChecking == [ source |-> i,
+                                           epoch  |-> currentEpoch[i],
+                                           zxid   |-> toSendTxn.zxid,
+                                           data   |-> toSendTxn.value ]
+           IN /\ sendCounter' = [sendCounter EXCEPT ![i] = toSendCounter]
+              /\ Broadcast(i, m_proposal)
+              /\ proposalMsgsLog' = proposalMsgsLog \union {m_proposal_forChecking}
+        /\ UNCHANGED <<serverVars, learners, cepochRecv, ackeRecv, ackldRecv, 
+                followerVars, electionVars, epochLeader, violatedInvariants>>
+        /\ UpdateRecorder(<<"LeaderBroadcastPROPOSE", i>>)
+
+IsNextZxid(curZxid, nextZxid) ==
+            \/ \* first PROPOSAL in this epoch
+               /\ nextZxid[2] = 1
+               /\ curZxid[1] < nextZxid[1]
+            \/ \* not first PROPOSAL in this epoch
+               /\ nextZxid[2] > 1
+               /\ curZxid[1] = nextZxid[1]
+               /\ curZxid[2] + 1 = nextZxid[2]
+
+(* Follower processes PROPOSE, saves it in history and replies ACK. *)
+FollowerProcessPROPOSE(i, j) ==
+        /\ IsFollower(i)
+        /\ PendingPROPOSE(i, j)
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLeader(i, j)
+               isNext == IsNextZxid(LastZxid(i), msg.mzxid)
+               newTxn == [ zxid   |-> msg.mzxid,
+                           value  |-> msg.mdata,
+                           ackSid |-> {},
+                           epoch  |-> currentEpoch[i] ]
+               m_ack == [ mtype |-> ACK,
+                          mzxid |-> msg.mzxid ]
+           IN /\ infoOk
+              /\ \/ /\ isNext
+                    /\ history' = [history EXCEPT ![i] = Append(@, newTxn)]
+                    /\ Reply(i, j, m_ack)
+                    /\ UNCHANGED violatedInvariants
+                 \/ /\ ~isNext
+                    /\ LET index == ZxidToIndex(history[i], msg.mzxid)
+                           exist == index > 0 /\ index <= Len(history[i])
+                       IN \/ /\ exist
+                             /\ UNCHANGED violatedInvariants
+                          \/ /\ ~exist
+                             /\ PrintT("Exception: Follower receives PROPOSE, while" \o 
+                                    " txn is neither the next nor exists in history.")
+                             /\ violatedInvariants' = [violatedInvariants EXCEPT 
+                                         !.proposalInconsistent = TRUE]
+                    /\ Discard(j, i)
+                    /\ UNCHANGED history
+        /\ UNCHANGED <<state, zabState, acceptedEpoch, currentEpoch, lastCommitted,
+                    leaderVars, followerVars, electionVars, proposalMsgsLog, epochLeader>>
+        /\ UpdateRecorder(<<"FollowerProcessPROPOSE", i, j>>)
+
+LeaderTryToCommit(s, index, zxid, newTxn, follower) ==
+        LET allTxnsBeforeCommitted == lastCommitted[s].index >= index - 1
+                    \* Only when all proposals before zxid has been committed,
+                    \* this proposal can be permitted to be committed.
+            hasAllQuorums == IsQuorum(newTxn.ackSid)
+                    \* In order to be committed, a proposal must be accepted
+                    \* by a quorum.
+            ordered == lastCommitted[s].index + 1 = index
+                    \* Commit proposals in order.
+        IN \/ /\ \* Current conditions do not satisfy committing the proposal.
+                 \/ ~allTxnsBeforeCommitted
+                 \/ ~hasAllQuorums
+              /\ Discard(follower, s)
+              /\ UNCHANGED <<violatedInvariants, lastCommitted>>
+           \/ /\ allTxnsBeforeCommitted
+              /\ hasAllQuorums
+              /\ \/ /\ ~ordered
+                    /\ PrintT("Warn: Committing zxid " \o ToString(zxid) \o " not first.")
+                    /\ violatedInvariants' = [violatedInvariants EXCEPT 
+                            !.commitInconsistent = TRUE]
+                 \/ /\ ordered
+                    /\ UNCHANGED violatedInvariants
+              /\ lastCommitted' = [lastCommitted EXCEPT ![s] = [ index |-> index,
+                                                                 zxid  |-> zxid ] ]
+              /\ LET m_commit == [ mtype |-> COMMIT,
+                                   mzxid |-> zxid ]
+                 IN DiscardAndBroadcast(s, follower, m_commit)
+
+
+LastAckIndexFromFollower(i, j) == 
+        LET set_index == {idx \in 1..Len(history[i]): j \in history[i][idx].ackSid }
+        IN Maximum(set_index)
+
+(* Leader Keeps a count of acks for a particular proposal, and try to
+   commit the proposal. If committed, COMMIT of proposal will be broadcast. *)
+LeaderProcessACK(i, j) ==
+        /\ IsLeader(i)
+        /\ PendingACK(i, j)
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLearner(i, j)
+               index == ZxidToIndex(history[i], msg.mzxid)
+               exist == index >= 1 /\ index <= Len(history[i]) \* proposal exists in history
+               outstanding == lastCommitted[i].index < Len(history[i]) \* outstanding not null
+               hasCommitted == ~ZxidCompare(msg.mzxid, lastCommitted[i].zxid)
+               ackIndex == LastAckIndexFromFollower(i, j)
+               monotonicallyInc == \/ ackIndex = -1
+                                   \/ ackIndex + 1 = index
+           IN /\ infoOk
+              /\ \/ /\ exist
+                    /\ monotonicallyInc
+                    /\ LET txn == history[i][index]
+                           txnAfterAddAck == [ zxid   |-> txn.zxid,
+                                               value  |-> txn.value,
+                                               ackSid |-> txn.ackSid \union {j} ,
+                                               epoch  |-> txn.epoch ]   
+                       IN
+                       /\ history' = [history EXCEPT ![i][index] = txnAfterAddAck ]
+                       /\ \/ /\ \* Note: outstanding is 0. 
+                                \* / proposal has already been committed.
+                                \/ ~outstanding
+                                \/ hasCommitted
+                             /\ Discard(j, i)
+                             /\ UNCHANGED <<violatedInvariants, lastCommitted>>
+                          \/ /\ outstanding
+                             /\ ~hasCommitted
+                             /\ LeaderTryToCommit(i, index, msg.mzxid, txnAfterAddAck, j)
+                 \/ /\ \/ ~exist
+                       \/ ~monotonicallyInc
+                    /\ PrintT("Exception: No such zxid. " \o 
+                           " / ackIndex doesn't inc monotonically.")
+                    /\ violatedInvariants' = [violatedInvariants 
+                            EXCEPT !.ackInconsistent = TRUE]
+                    /\ Discard(j, i)
+                    /\ UNCHANGED <<history, lastCommitted>>
+        /\ UNCHANGED <<state, zabState, acceptedEpoch, currentEpoch, leaderVars,
+                    followerVars, electionVars, proposalMsgsLog, epochLeader>>
+        /\ UpdateRecorder(<<"LeaderProcessACK", i, j>>)
+
+(* Follower processes COMMIT. *)
+FollowerProcessCOMMIT(i, j) ==
+        /\ IsFollower(i)
+        /\ PendingCOMMIT(i, j)
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLeader(i, j)
+               pending == lastCommitted[i].index < Len(history[i])
+           IN /\ infoOk
+              /\ \/ /\ ~pending
+                    /\ PrintT("Warn: Committing zxid without seeing txn.")
+                    /\ UNCHANGED <<lastCommitted, violatedInvariants>>
+                 \/ /\ pending
+                    /\ LET firstElement == history[i][lastCommitted[i].index + 1]
+                           match == ZxidEqual(firstElement.zxid, msg.mzxid)
+                       IN
+                       \/ /\ ~match
+                          /\ PrintT("Exception: Committing zxid not equals" \o
+                                     " next pending txn zxid.")
+                          /\ violatedInvariants' = [violatedInvariants EXCEPT 
+                                    !.commitInconsistent = TRUE]
+                          /\ UNCHANGED lastCommitted
+                       \/ /\ match
+                          /\ lastCommitted' = [lastCommitted EXCEPT ![i] = 
+                                            [ index |-> lastCommitted[i].index + 1,
+                                              zxid  |-> firstElement.zxid ] ]
+                          /\ UNCHANGED violatedInvariants
+        /\ Discard(j, i)
+        /\ UNCHANGED <<state, zabState, acceptedEpoch, currentEpoch, history,
+                    leaderVars, followerVars, electionVars, proposalMsgsLog, epochLeader>>
+        /\ UpdateRecorder(<<"FollowerProcessCOMMIT", i, j>>)
+----------------------------------------------------------------------------     
+(* Used to discard some messages which should not exist in network channel.
+   This action should not be triggered. *)
+FilterNonexistentMessage(i) ==
+        /\ \E j \in Server \ {i}: /\ msgs[j][i] /= << >>
+                                  /\ LET msg == msgs[j][i][1]
+                                     IN 
+                                        \/ /\ IsLeader(i)
+                                           /\ LET infoOk == IsMyLearner(i, j)
+                                              IN
+                                              \/ msg.mtype = NEWEPOCH
+                                              \/ msg.mtype = NEWLEADER
+                                              \/ msg.mtype = COMMITLD
+                                              \/ msg.mtype = PROPOSE
+                                              \/ msg.mtype = COMMIT
+                                              \/ /\ ~infoOk
+                                                 /\ \/ msg.mtype = CEPOCH
+                                                    \/ msg.mtype = ACKEPOCH
+                                                    \/ msg.mtype = ACKLD
+                                                    \/ msg.mtype = ACK
+                                        \/ /\ IsFollower(i)
+                                           /\ LET infoOk == IsMyLeader(i, j) 
+                                              IN
+                                              \/ msg.mtype = CEPOCH
+                                              \/ msg.mtype = ACKEPOCH
+                                              \/ msg.mtype = ACKLD
+                                              \/ msg.mtype = ACK
+                                              \/ /\ ~infoOk
+                                                 /\ \/ msg.mtype = NEWEPOCH
+                                                    \/ msg.mtype = NEWLEADER
+                                                    \/ msg.mtype = COMMITLD
+                                                    \/ msg.mtype = PROPOSE
+                                                    \/ msg.mtype = COMMIT   
+                                        \/ IsLooking(i)
+                                  /\ Discard(j, i)
+        /\ violatedInvariants' = [violatedInvariants EXCEPT !.messageIllegal = TRUE]
+        /\ UNCHANGED <<serverVars, leaderVars, followerVars, electionVars,
+                    proposalMsgsLog, epochLeader>>
+        /\ UnchangeRecorder
+----------------------------------------------------------------------------
+\* Defines how the variables may transition.
+Next ==
+        (* Election *)
+        \/ \E i \in Server:    UpdateLeader(i)
+        \/ \E i \in Server:    FollowLeader(i)
+        (* Abnormal situations like failure, network disconnection *)
+        \/ \E i, j \in Server: Timeout(i, j)
+        \/ \E i \in Server:    Restart(i)
+        (* Zab module - Discovery and Synchronization part *)
+        \/ \E i, j \in Server: ConnectAndFollowerSendCEPOCH(i, j)
+        \/ \E i, j \in Server: LeaderProcessCEPOCH(i, j)
+        \/ \E i, j \in Server: FollowerProcessNEWEPOCH(i, j)
+        \/ \E i, j \in Server: LeaderProcessACKEPOCH(i, j)
+        \/ \E i, j \in Server: FollowerProcessNEWLEADER(i, j)
+        \/ \E i, j \in Server: LeaderProcessACKLD(i, j)
+        \/ \E i, j \in Server: FollowerProcessCOMMITLD(i, j)
+        (* Zab module - Broadcast part *)
+        \/ \E i \in Server:    LeaderProcessRequest(i)
+        \/ \E i \in Server:    LeaderBroadcastPROPOSE(i)
+        \/ \E i, j \in Server: FollowerProcessPROPOSE(i, j)
+        \/ \E i, j \in Server: LeaderProcessACK(i, j)
+        \/ \E i, j \in Server: FollowerProcessCOMMIT(i, j)
+        (* An action used to judge whether there are redundant messages in network *)
+        \/ \E i \in Server:    FilterNonexistentMessage(i)
+
+Spec == Init /\ [][Next]_vars
+----------------------------------------------------------------------------
+\* Define safety properties of Zab.
+
+ShouldNotBeTriggered == \A p \in DOMAIN violatedInvariants: violatedInvariants[p] = FALSE
+
+\* There is most one established leader for a certain epoch.
+Leadership1 == \A i, j \in Server:
+                   /\ IsLeader(i) /\ zabState[i] \in {SYNCHRONIZATION, BROADCAST}
+                   /\ IsLeader(j) /\ zabState[j] \in {SYNCHRONIZATION, BROADCAST}
+                   /\ currentEpoch[i] = currentEpoch[j]
+                  => i = j
+
+Leadership2 == \A epoch \in 1..MAXEPOCH: Cardinality(epochLeader[epoch]) <= 1
+
+\* PrefixConsistency: The prefix that have been committed 
+\* in history in any process is the same.
+PrefixConsistency == \A i, j \in Server:
+                        LET smaller == Minimum({lastCommitted[i].index, lastCommitted[j].index})
+                        IN \/ smaller = 0
+                           \/ /\ smaller > 0
+                              /\ \A index \in 1..smaller:
+                                   TxnEqual(history[i][index], history[j][index])
+
+\* Integrity: If some follower delivers one transaction, then some primary has broadcast it.
+Integrity == \A i \in Server:
+                /\ IsFollower(i)
+                /\ lastCommitted[i].index > 0
+                => \A idx \in 1..lastCommitted[i].index: \E proposal \in proposalMsgsLog:
+                    LET txn_proposal == [ zxid  |-> proposal.zxid,
+                                          value |-> proposal.data ]
+                    IN  TxnEqual(history[i][idx], txn_proposal)
+
+\* Agreement: If some follower f delivers transaction a and some follower f' delivers transaction b,
+\*            then f' delivers a or f delivers b.
+Agreement == \A i, j \in Server:
+                /\ IsFollower(i) /\ lastCommitted[i].index > 0
+                /\ IsFollower(j) /\ lastCommitted[j].index > 0
+                =>
+                \A idx1 \in 1..lastCommitted[i].index, idx2 \in 1..lastCommitted[j].index :
+                    \/ \E idx_j \in 1..lastCommitted[j].index:
+                        TxnEqual(history[j][idx_j], history[i][idx1])
+                    \/ \E idx_i \in 1..lastCommitted[i].index:
+                        TxnEqual(history[i][idx_i], history[j][idx2])
+
+\* Total order: If some follower delivers a before b, then any process that delivers b
+\*              must also deliver a and deliver a before b.
+TotalOrder == \A i, j \in Server: 
+                LET committed1 == lastCommitted[i].index 
+                    committed2 == lastCommitted[j].index  
+                IN committed1 >= 2 /\ committed2 >= 2
+                    => \A idx_i1 \in 1..(committed1 - 1) : \A idx_i2 \in (idx_i1 + 1)..committed1 :
+                    LET logOk == \E idx \in 1..committed2 :
+                                     TxnEqual(history[i][idx_i2], history[j][idx])
+                    IN \/ ~logOk 
+                       \/ /\ logOk 
+                          /\ \E idx_j2 \in 1..committed2 : 
+                                /\ TxnEqual(history[i][idx_i2], history[j][idx_j2])
+                                /\ \E idx_j1 \in 1..(idx_j2 - 1):
+                                       TxnEqual(history[i][idx_i1], history[j][idx_j1])
+
+\* Local primary order: If a primary broadcasts a before it broadcasts b, then a follower that
+\*                      delivers b must also deliver a before b.
+LocalPrimaryOrder == LET p_set(i, e) == {p \in proposalMsgsLog: /\ p.source = i 
+                                                                /\ p.epoch  = e }
+                         txn_set(i, e) == { [ zxid  |-> p.zxid, 
+                                              value |-> p.data ] : p \in p_set(i, e) }
+                     IN \A i \in Server: \A e \in 1..currentEpoch[i]:
+                         \/ Cardinality(txn_set(i, e)) < 2
+                         \/ /\ Cardinality(txn_set(i, e)) >= 2
+                            /\ \E txn1, txn2 \in txn_set(i, e):
+                             \/ TxnEqual(txn1, txn2)
+                             \/ /\ ~TxnEqual(txn1, txn2)
+                                /\ LET TxnPre  == IF ZxidCompare(txn1.zxid, txn2.zxid) THEN txn2 ELSE txn1
+                                       TxnNext == IF ZxidCompare(txn1.zxid, txn2.zxid) THEN txn1 ELSE txn2
+                                   IN \A j \in Server: /\ lastCommitted[j].index >= 2
+                                                       /\ \E idx \in 1..lastCommitted[j].index: 
+                                                            TxnEqual(history[j][idx], TxnNext)
+                                        => \E idx2 \in 1..lastCommitted[j].index: 
+                                            /\ TxnEqual(history[j][idx2], TxnNext)
+                                            /\ idx2 > 1
+                                            /\ \E idx1 \in 1..(idx2 - 1): 
+                                                TxnEqual(history[j][idx1], TxnPre)
+
+\* Global primary order: A follower f delivers both a with epoch e and b with epoch e', and e < e',
+\*                       then f must deliver a before b.
+GlobalPrimaryOrder == \A i \in Server: lastCommitted[i].index >= 2
+                         => \A idx1, idx2 \in 1..lastCommitted[i].index:
+                                \/ ~EpochPrecedeInTxn(history[i][idx1], history[i][idx2])
+                                \/ /\ EpochPrecedeInTxn(history[i][idx1], history[i][idx2])
+                                   /\ idx1 < idx2
+
+\* Primary integrity: If primary p broadcasts a and some follower f delivers b such that b has epoch
+\*                    smaller than epoch of p, then p must deliver b before it broadcasts a.
+PrimaryIntegrity == \A i, j \in Server: /\ IsLeader(i)   /\ IsMyLearner(i, j)
+                                        /\ IsFollower(j) /\ IsMyLeader(j, i)
+                                        /\ zabState[i] = BROADCAST
+                                        /\ zabState[j] = BROADCAST
+                                        /\ lastCommitted[j].index >= 1
+                        => \A idx_j \in 1..lastCommitted[j].index:
+                                \/ history[j][idx_j].zxid[1] >= currentEpoch[i]
+                                \/ /\ history[j][idx_j].zxid[1] < currentEpoch[i]
+                                   /\ \E idx_i \in 1..lastCommitted[i].index: 
+                                        TxnEqual(history[i][idx_i], history[j][idx_j])
+=============================================================================
+\* Modification History
+\* Last modified Tue Jan 31 20:40:11 CST 2023 by huangbinyu
+\* Last modified Sat Dec 11 22:31:08 CST 2021 by Dell
+\* Created Thu Dec 02 20:49:23 CST 2021 by Dell
diff --git a/zookeeper-specifications/protocol-spec/doc.md b/zookeeper-specifications/protocol-spec/doc.md
new file mode 100644
index 00000000000..f4bb09b3494
--- /dev/null
+++ b/zookeeper-specifications/protocol-spec/doc.md
@@ -0,0 +1,120 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+//-->
+
+# ZooKeeper's Protocol Specification of TLA+
+
+## Overview
+ZooKeeper's Protocol Specification focuses on the Zookeeper Atomic Broadcast (Zab) consensus protocol proposed in *Junqueira F P, Reed B C, Serafini M. Zab: High-performance broadcast for primary-backup systems[C]//2011 IEEE/IFIP 41st International Conference on Dependable Systems & Networks (DSN). IEEE, 2011: 245-256*.  
+
+We have completed the the [protocol specification](Zab.tla) for Zab using TLA+ toolbox, and we have done a certain scale of model checking to verify the correctness of Zab. From the experience, we have found some subtle [issues](issues.md) related to the protocol specification and the Zab informal description. 
+
+To handle the ambiguities and omissions of the informal description in the paper, we supplement the specification with some further details. If you have any question, please let us know.
+
+
+
+## Specification Development
+
+
+### Requirements
+TLA+ toolbox version 1.7.0
+
+### Run
+Create specification [Zab.tla](Zab.tla) and run models in the following way.  
+We can clearly divide spec into five modules, which are:  
+
+- Phase0. Leader Election  
+- Phase1. Discovery  
+- Phase2. Synchronization  
+- Phase3. Broadcast  
+- Abnormal situations like failure, network disconnection
+
+#### Assign constants
+After creating this new model and choosing *Temporal formula* with value *Spec*, we first assign most of constants.  
+We should set CONSTANTS about server states as model value, including *FOLLOWING*, *LEADING*, and *LOOKING*.  
+We should set CONSTANTS about server zabStates as model value, including *ELECTION*, *DISCOVERY*, *SYNCHRONIZATION*, and *BROADCAST*.  
+We should set CONSTANTS about message types as model value, including *CEPOCH*, *NEWEPOCH*, *ACKE*, *NEWLEADER*, *ACKLD*, *COMMITLD*, *PROPOSE*, *ACK*, and *COMMIT*.  
+
+#### Assign left constants affecting state space
+Then we should assign CONSTANTS *Server* as a symmetrical model value(such as <symmetrical\>{s1, s2, s3}).  
+To compress state space, we need to assign CONSTANT *Parameters* as a record, whose domain contains *MaxTimeoutFailures*, *MaxTransactionNum*, *MaxEpoch*, and *MaxRestarts*. For example, we can assign it to format like [MaxTimeoutFailures |-> 3, MaxTransactionNum |-> 5, MaxEpoch |-> 3, MaxRestarts |-> 2].
+
+#### Assign invariants
+We remove *'Deadlock'* option.  
+We add invariants defined in spec into *'Invariants'* to check whether the model will reach an illogical state, including *ShouldNotBeTriggered*, *Leadership1*, *Leadership2*, *PrefixConsistency*, *Integrity*, *Agreement*, *TotalOrder*, *LocalPrimaryOrder*, *GlobalPriamryOrder*, and *PrimaryIntegrity*.  
+Here the meanings of these invariants are described in the following. Except for the first four, all invariants are defined in paper.   
+	-	**ShouldNotBeTriggered**: Some conditions should not be triggered when we are running the model. For example, follower should not receive NEWLEADER when its zabState is not SYNCHRONIZATION.  
+	-	**Lerdership**: There is most one established leader in a certain epoch.(Established means leader has updated its f.a and switched its zabState to SYNCHRONIZATION.)  
+	-	**PrefixConsistency**: Transactions that have been committed in history are the same in any server.  
+	-	**Integrity**: If some follower delivers one transaction, some primary must have broadcast it.  
+	-	**Agreement**: If some follower *f<sub>1</sub>* delivers transaction *a* and some follower *f<sub>2</sub>* delivers transaction *b*, then *f<sub>2</sub>* delivers *a* or *f<sub>1</sub>* delivers *b*.  
+	-	**TotalOrder**: If some server delivers *a* before *b*, then any server that delivers *b* must also deliver *a* and deliver *a* before *b*.  
+	-	**LocalPrimaryOrder**: If a primary broadcasts *a* before it broadcasts *b*, then a follower that delivers *b* must also deliver *a* before *b*.  
+	-	**GlobalPrimaryOrder**: A server *f* delivers both *a* with epoch *e* and *b* with epoch *e'*, and *e* < *e'*, then *f* must deliver *a* before *b*.  
+	-	**PrimaryIntegrity**: If primary *p* broadcasts *a* and some follower *f* delivers *b* such that *b* has epoch smaller than epoch of *p*, then *p* must deliver *b* before it broadcasts *a*.  
+
+#### Assign additional TLC options
+We set number of worker threads as 10(if unavailable on your system, just decrease it).  
+We can choose checking mode from *Model-checking mode* and *simulation mode*.  
+
+-	Model-checking mode: It is a traverse method like BFS. Diameter in results represent the maximum depth when traversing. All intermediate results will be saved as binary files locally and occupy a large space if running time is long.  
+-	Simulation mode: Everytime TLC randomly chooses a path and run through it until reaching termination or reaching maximum length of the trace, and randomly chooses another path. Currently we set *Maximum length of the trace* as 100.  
+Here we mainly use simulation mode to discover if there exists deep bugs, which is hard to be found in model-checking mode.
+
+
+
+### Results
+
+You can find our [result](verification-statistics.md) of verification using TLC model checking.
+
+## Adjustments in protocol spec from paper
+>Because the pursuit of the paper is to describe the Zab protocol to others in a concise manner, which will lead to insufficient description of the protocol, there are missing or vague places in the paper. As a mathematical language, no ambiguity is allowed in the TLA+ specification, and this is why we need adjustment.
+
+Overall, we categorize the flaws of the original paper into two classes: abstraction and vagueness.
+
+### Abstraction
+
+There is a missing part in the paper, in which the pseudocode uses the **Discovery** stage as the initial stage of each round, and omits the **Election** stage.  
+
+On the one hand, in spec, **Election** helps advance the state of the system, and is also related to the liveness and strong consistency of the system, so we cannot omit it. On the other hand, our focus is on Zab, so the **Election** module should be expressed with a small number of variables and actions to reduce the state space of the model.
+
+We use one variable *leaderOracle* and two actions *UpdateLeader* and *FollowerLeader* to express the **election** module streamlined.
+
+### Vagueness
+
+We categorize vagueness in the paper into two classes: vagueness in variables and vagueness in actions.
+
+#### Vagueness in variables
+First, the character **Q** is used everywhere in the pseudocode to represent the set of Followers perceived by the Leader in the current term. We divide the set **Q** specifically into variables *learners*, *cepochRecv*, *ackeRecv* and *ackldRecv*. We use *cepochRecv* to let Leader broadcast *NEWEPOCH*, *ackeRecv* to let Leader broadcast *NEWLEADER* and *PROPOSE*, *ackldRecv* to let Leader broadcast *COMMIT-LD* and *COMMIT*. We will explain the reason why we use these sets when Leader broadcasts *PROPOSE* and *COMMIT* in the [issues](issues.md).
+
+Second, *zxid* in *COMMIT-LD* is omitted in hte paper. We will explain the value of the *zxid* in the [issues](issues.md).
+
+#### Vagueness in actions
+Totally, adjustment on vagueness in actions can be divided into two classes: Completing the missing description and Adjusting the protocol structure.
+
+*	For completing the missing description, we categorize four classes:
+
+	1.	Complete the branch of action where after the Leader node processes the message *m* of type *t*, the receiving set of messages of type *t* still does not satisfy the quorum.
+	2.	Complete the branch of action where before the Leader node processes the message *m* of type *t*, the receiving set of messages of type *t* has already satisfied the quorum.
+	3.	Supplement the logical action that the Leader receives the request from the client, encapsulates the request as a log entry, and persists the log entry.
+	4.	Supplement the logical action that the Leader tries to commit log entries based on confirmation information from followers.
+
+*	For adjusting the protocol structure, in order to improve the readability of the spec, we impose standardized and unified restrictions on the spec. That is, the division unit is to one node receiving and processing one message. Each action, except actions in election module and environment error module, makes a node receiving a certain message a trigger condition, and then produces a subsequent state change.
+
+See example when Leader processes message *CEPOCH* from one follower:
+
+![case_leader_process_cepoch](pic/case_leader_process_cepoch.png)
diff --git a/zookeeper-specifications/protocol-spec/issues.md b/zookeeper-specifications/protocol-spec/issues.md
new file mode 100644
index 00000000000..c6d2bcd857f
--- /dev/null
+++ b/zookeeper-specifications/protocol-spec/issues.md
@@ -0,0 +1,58 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+//-->
+
+# Issues
+
+>This document describes issues related to the ambiguous description of the Zab protocol. 
+
+## （Issue 1）Issue introduced by vague explanation of broadcast object set Q
+Because the Leader will only accept the client request when it reaches the *Broadcast* stage, thus when Leader broadcasting messages from *Broadcast* stage, we naturally use the set *ackldRecv* as the object set when Leader broadcasting *Propose* and *Commit* messages in the initial protocol. 
+
+On this basis, the model checking found that there was an error in the protocol. After analyzing the execution path and the violated invariant, we located the error in the action *FollowerProcessCommit*. The Follower received an illegal *COMMIT* message, as shown in the figure below. In the *COMMIT* message, the log entry corresponding to the *zxid* does not exist in the local log.  
+
+![protocol-spec-mck-bug1](pic/protocol-spec-mck-bug1.png)
+
+A quorum of nodes including node *A* and node *B* completed the log recovery, and entered the *Broadcast* stage. Leader node *B* sent *NEWLEADER*(1, <[1, 1, v1]>) to node *C*, which joined the cluster. Then Leader *B* received client request and broadcast *PROPOSE*([1, 2, v2]). But node *C* did not receive the message because *C* is not in *B*'s *ackldRecv*. Later, the Leader firstly processes *ACK-LD* from *C* and then *ACK* from *A*. So, the object of Leader *B*'s broadcast *COMMIT*([1, 2]) contains *C*, and there is no log entry with *zxid* [1, 2] locally in *C*.
+
+We found that because the set of objects when the Leader broadcast *PROPOSE* is *ackldRecv*, the Follower will not receive messages with type *PROPOSE* until receiving the *COMMIT-LD*. If a log entry is committed between the Leader sending *NEWLEADER* and *COMMIT-LD*, the corresponding receiver will permanently lose the log entry.
+
+Therefore, we have made amendments in the spec. When the Leader broadcasts *PROPOSE*, the set of sending objects has been changed from *ackldRecv* to *ackeRecv*. We successfully discovered errors introduced by the vague description of **Q** in the protocol through model checking, and fixed them in the specification.
+
+## (Issue 2) Issue introduced by lack of client request logic
+Since there is no descriptions about client request, we need to add a process that describes the Leader receives a client request and encapsulates the request as a new log entry and appends it to the local log. This process are represented as action *LeaderProcessRequest* in the spec.
+
+In our original specification, when Follower receives the message *PROPOSE*, the *zxid* of the proposed log entry should be the successor *zxid* of the latest local log entry‘s *zxid*, otherwise it will be regarded as an illegal *PROPOSE*.
+
+On this basis, model checking told us that there was an error in the model, as shown in the figure below, where Follower receives redundant *PROPOSE* from the same log entry. 
+
+![protocol-spec-mck-bug2](pic/protocol-spec-mck-bug2.png)
+
+A quorum of nodes including node *A* and *B* completed log recovery first and entered the *Broadcast* stage. When receiving a client request, Leader B encapsulated the request as a log entry [1, 1, v1]. Before B broadcast the proposal of the log entry, node *C* that joined the cluster later sent *ACKEPOCH* to *B*, and *B* replied with *NEWLEADER*(1, <[1, 1, v1]>), and added *C* to the set *ackeRecv*. So the *PROPOSE*([1, 1, v1]) broadcast by *B* was also sent to *C*, so *C* received the redundant proposal for the log entry [1, 1, v1].
+
+We have analyzed two repair schemes. The first scheme is to atomize the actions *LeaderProcessRequest* and *LeaderBroadcastPROPOSE* and merge them into one action. The second scheme is to relax the constraints, where if the Follower receives redundant *PROPOSE*, it will be release this message directly. We chose the second scheme, because we think the situation is not serious and will not affect the correctness of Zab.
+
+## (Issue 3) Issue introduced by ambiguity of zxid in the message COMMIT-LD
+When the Leader sends *COMMIT-LD*, the paper does not express the specific value of the *zxid* carried in the message. Therefore, we naturally set the *zxid* carried in *COMMIT-LD* to the *zxid* in *ACK-LD*.
+
+Therefore, the model checking found an invariant violation, as shown in the figure below, the Follower received an illegal message *COMMIT*.
+
+![protocol-spec-mck-bug3](pic/protocol-spec-mck-bug3.png)
+
+A quorum of nodes including node *A* and *B* completed log recovery first and entered the *Broadcast* stage. When the node *C* that joined the cluster later sent *ACKEPOCH* to Leader *B*, *B* sent *NEWLEADER*(1, <[1, 1, v1]>) to *C*, and then received the client request to broadcast *PROPOSE*([1, 2, v2]). Then, *B* received the message *ACK*([1, 2]) from *A* before receiving *ACK-LD* from *C*, so Leader *B* committed the log entry [1, 2, v2] and broadcasts *COMMIT*([1, 2]). Because the object set when broadcasting *COMMIT* is *ackldRecv*, *C* did not receive the commit message. Afterwards, *B* processed the *ACK-LD*([1, 1]) from *C*, and replied with *COMMIT-LD*([1, 1]). Therefore, when Leader *B* reached a consensus on the new log entry [1, 3, v3], it sendt *COMMIT*([1, 3]) to *C*, and *C* found that entry [1, 2, v2] in the local log has not been committed yet, which was treated as an illegal *COMMIT*.
+
+The repair solution we analyzed is that in the action *LeaderProcessACKLD*, the *zxid* carried by *COMMIT-LD* is changed from the *zxid* in *ACK-LD* to the latest *zxid* committed locally by Leader, thus making up for the missing commit information.
diff --git a/zookeeper-specifications/protocol-spec/pic/case_leader_process_cepoch.png b/zookeeper-specifications/protocol-spec/pic/case_leader_process_cepoch.png
new file mode 100644
index 00000000000..74a0c7e59d1
Binary files /dev/null and b/zookeeper-specifications/protocol-spec/pic/case_leader_process_cepoch.png differ
diff --git a/zookeeper-specifications/protocol-spec/pic/protocol-spec-mck-bug1.png b/zookeeper-specifications/protocol-spec/pic/protocol-spec-mck-bug1.png
new file mode 100644
index 00000000000..d9e763aba97
Binary files /dev/null and b/zookeeper-specifications/protocol-spec/pic/protocol-spec-mck-bug1.png differ
diff --git a/zookeeper-specifications/protocol-spec/pic/protocol-spec-mck-bug2.png b/zookeeper-specifications/protocol-spec/pic/protocol-spec-mck-bug2.png
new file mode 100644
index 00000000000..9154af6be21
Binary files /dev/null and b/zookeeper-specifications/protocol-spec/pic/protocol-spec-mck-bug2.png differ
diff --git a/zookeeper-specifications/protocol-spec/pic/protocol-spec-mck-bug3.png b/zookeeper-specifications/protocol-spec/pic/protocol-spec-mck-bug3.png
new file mode 100644
index 00000000000..002700df0f0
Binary files /dev/null and b/zookeeper-specifications/protocol-spec/pic/protocol-spec-mck-bug3.png differ
diff --git a/zookeeper-specifications/protocol-spec/verification-statistics.md b/zookeeper-specifications/protocol-spec/verification-statistics.md
new file mode 100644
index 00000000000..df7d0f1b9bd
--- /dev/null
+++ b/zookeeper-specifications/protocol-spec/verification-statistics.md
@@ -0,0 +1,62 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+//-->
+
+# Verification Statistics 
+##### Experiment configuration
+
+Our statistical results include: diameter of the system states that have been traversed, the number of states that have been traversed, the number of different states that have been discovered, and the time spent in the experiment.
+
+The machine configuration used in the experiment is 2.40 GHz, 10-core CPU, 64GB memory. The TLC version number is 1.7.0.
+
+
+
+##### State space constraints in model checking
+
+Due to the state space explosion in model checking and the complex actions of Zab protocol, as well as unlimited number of rounds and unlimited length of history, it is impossible to traverse all states.  
+We try to let models can tap into larger state space. See CONSTANT *Parameters* for details.
+
+
+
+##### Verification statistics of model checking  
+|  Mode  |     TLC model         |    Diameter   |     num of states  | time of checking(hh:mm:ss) |
+| ----- | ---------------------- | ------------- | ------------------ | ------------------ |
+| BFS   | (2 servers,3 rounds,2 transactions)    |     59   |  7758091583 |  17:28:17|
+| Simulation | (2 servers,3 rounds,2 transactions)   |   -|  6412825222| 17:07:20  |
+| BFS   | (3 servers,2 rounds,2 transactions)    |     19   |  4275801206 |  09:40:08|
+| Simulation | (3 servers,2 rounds,2 transactions)   |   -|  10899460942| 20:15:11  |
+| BFS   | (3 servers,2 rounds,3 transactions)   |    22    |  8740566213  | 17:49:09 |
+| Simulation | (3 servers,2 rounds,3 transactions)  |  -    | 9639135842  |   20:10:00 |
+| BFS    |  (3 servers,3 rounds,2 transactions)    |    21    | 7079744342    |14:17:45 |
+| Simulation | (3 servers,3 rounds,2 transactions)    |  -  |  6254964039   | 15:08:42 |
+| BFS    |  (4 servers,3 rounds,2 transactions)    |    16    | 5634112480  |15:42:09 |
+| Simulation | (4 servers,3 rounds,2 transactions)    |  -  |  3883461291   | 15:52:03 |
+
+
+
+##### Verification statistics with parameters (count of servers, MaxTotalRestartNum, MaxElectionNum, MaxTransactionNum)
+
+|  Mode  |     TLC model         |    Diameter   |     num of states  | time of checking(hh:mm:ss) |
+| ----- | ---------------------- | ------------- | ------------------ | ------------------ |
+| BFS   | (2,2,3,2,termination) |     55   |  10772649   |  00:02:21|
+| BFS   | (3,1,1,2)             |     45   |  9602018536 |  31:01:57|
+
+
+
+##### Issues
+
+Besides, we have found several issues related to the ambiguous description of the Zab protocol. Details can be found at [issues.md](issues.md).
diff --git a/zookeeper-specifications/system-spec/doc.md b/zookeeper-specifications/system-spec/doc.md
new file mode 100644
index 00000000000..1a7d33b72a1
--- /dev/null
+++ b/zookeeper-specifications/system-spec/doc.md
@@ -0,0 +1,35 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+//-->
+
+# ZooKeeper's System Specification of TLA+
+
+## Overview
+
+ZooKeeper's system specification of TLA+ focuses on the implementation of the Zookeeper Atomic Broadcast(ZAB) consensus protocol (or, [ZAB1.0](https://cwiki.apache.org/confluence/display/ZOOKEEPER/Zab1.0)). 
+
+As is shown by the informal description of [ZAB1.0](https://cwiki.apache.org/confluence/display/ZOOKEEPER/Zab1.0), the implementation of ZAB that used in ZooKeeper production differs a lot from its original design.
+
+We make this system specification to grasp the core logic of the ZAB's implementation especially. 
+
+The [sysetm specification](zk-3.7/ZkV3_7_0.tla) written in TLA+ is precise without ambiguity, and testable with existed tools like the TLC model checker. (We have done a certain scale of model checking to verify its correctness!) 
+
+The system specification can serve as the super-doc supplementing detailed system documentation for the ZooKeeper developers. It can evolve incrementally without high cost as the system develops over time, continually ensuring correctness for both the design and the implementation.
+
+We have also made a formal [specification](zk-3.7/FastLeaderElection.tla) for Fast Leader Election in Zab since ZAB 1.0 depends on FLE to complete the election phase.
+
+If you have any question or find any problem of the specification, please contact us.
diff --git a/zookeeper-specifications/system-spec/zk-3.7/FastLeaderElection.tla b/zookeeper-specifications/system-spec/zk-3.7/FastLeaderElection.tla
new file mode 100644
index 00000000000..cdff66ad225
--- /dev/null
+++ b/zookeeper-specifications/system-spec/zk-3.7/FastLeaderElection.tla
@@ -0,0 +1,553 @@
+(*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *)
+
+------------------------- MODULE FastLeaderElection -------------------------
+\* This is the formal specification for Fast Leader Election in Zab protocol.
+(* Reference:
+   FastLeaderElection.java, Vote.java, QuorumPeer.java in https://github.com/apache/zookeeper.
+   Medeiros A. ZooKeeper's atomic broadcast protocol: Theory and practice[J]. Aalto University School of Science, 2012.
+*)
+EXTENDS Integers, FiniteSets, Sequences, Naturals, TLC
+
+-----------------------------------------------------------------------------
+\* The set of server identifiers
+CONSTANT Server
+
+\* Server states
+CONSTANTS LOOKING, FOLLOWING, LEADING
+(* NOTE: In spec, we do not discuss servers whose ServerState is OBSERVING.
+*)
+
+\* Message types
+CONSTANTS NOTIFICATION
+
+\* Timeout signal
+CONSTANT NONE
+-----------------------------------------------------------------------------
+Quorums == {Q \in SUBSET Server: Cardinality(Q)*2 > Cardinality(Server)}
+
+NullPoint == CHOOSE p: p \notin Server
+
+-----------------------------------------------------------------------------
+\* Server's state(LOOKING, FOLLOWING, LEADING).
+VARIABLE state
+
+VARIABLE history
+
+\* The epoch number of the last NEWLEADER packet accepted, used for comparing.
+VARIABLE currentEpoch
+
+\* The index and zxid of the last processed transaction in history.
+VARIABLE lastProcessed
+
+\* currentVote[i]: The server who i thinks is the current leader(id,zxid,peerEpoch,...).
+VARIABLE currentVote
+
+\* Election instance.(logicalClock in code)
+VARIABLE logicalClock
+
+\* The votes from the current leader election are stored in ReceiveVotes.
+VARIABLE receiveVotes
+
+(* The votes from previous leader elections, as well as the votes from the current leader election are
+   stored in outofelection. Note that notifications in a LOOKING state are not stored in outofelection.
+   Only FOLLOWING or LEADING notifications are stored in outofelection.  *)
+VARIABLE outOfElection
+
+\* recvQueue[i]: The queue of received notifications or timeout signals in server i.
+VARIABLE recvQueue
+
+\* A variable to wait for new notifications, corresponding to line 1050 in FastLeaderElection.java.
+VARIABLE waitNotmsg
+
+\* leadingVoteSet[i]: The set of voters that follow i.
+VARIABLE leadingVoteSet
+
+(* The messages about election sent from one server to another.
+   electionMsgs[i][j] means the input buffer of server j from server i. *)
+VARIABLE electionMsgs
+
+\* Set used for mapping Server to Integers, to compare ids from different servers.
+\* VARIABLE idTable
+
+serverVarsL == <<state, currentEpoch, lastProcessed, history>>
+
+electionVarsL == <<currentVote, logicalClock, receiveVotes, outOfElection, recvQueue, waitNotmsg>>
+
+leaderVarsL == <<leadingVoteSet>>
+
+varsL == <<serverVarsL, electionVarsL, leaderVarsL, electionMsgs>>
+-----------------------------------------------------------------------------
+\* Processing of electionMsgs
+BroadcastNotmsg(i, m) == electionMsgs' = [electionMsgs EXCEPT ![i] = [v \in Server |-> IF v /= i
+                                                                                       THEN Append(electionMsgs[i][v], m)
+                                                                                       ELSE electionMsgs[i][v]]]
+
+DiscardNotmsg(i, j) == electionMsgs' = [electionMsgs EXCEPT ![i][j] = IF electionMsgs[i][j] /= << >>
+                                                                      THEN Tail(electionMsgs[i][j])
+                                                                      ELSE << >>]
+
+ReplyNotmsg(i, j, m) == electionMsgs' = [electionMsgs EXCEPT ![i][j] = Append(electionMsgs[i][j], m),
+                                                             ![j][i] = Tail(electionMsgs[j][i])]
+                                               
+-----------------------------------------------------------------------------
+\* Processing of recvQueue
+RECURSIVE RemoveNone(_)
+RemoveNone(seq) == CASE seq =  << >> -> << >>
+                   []   seq /= << >> -> IF Head(seq).mtype = NONE THEN RemoveNone(Tail(seq))
+                                                                  ELSE <<Head(seq)>> \o RemoveNone(Tail(seq)) 
+
+\* Processing of idTable and order comparing
+RECURSIVE InitializeIdTable(_)
+InitializeIdTable(Remaining) == IF Remaining = {} THEN {}
+                                ELSE LET chosen == CHOOSE i \in Remaining: TRUE
+                                         re     == Remaining \ {chosen}
+                                     IN {<<chosen, Cardinality(Remaining)>>} \union InitializeIdTable(re)
+
+IdTable == InitializeIdTable(Server) 
+
+\* FALSE: id1 < id2; TRUE: id1 > id2
+IdCompare(id1,id2) == LET item1 == CHOOSE item \in IdTable: item[1] = id1
+                          item2 == CHOOSE item \in IdTable: item[1] = id2
+                      IN item1[2] > item2[2]
+
+\* FALSE: zxid1 <= zxid2; TRUE: zxid1 > zxid2
+ZxidCompare(zxid1, zxid2) == \/ zxid1[1] > zxid2[1]
+                             \/ /\ zxid1[1] = zxid2[1]
+                                /\ zxid1[2] > zxid2[2]
+
+ZxidEqual(zxid1, zxid2) == zxid1[1] = zxid2[1] /\ zxid1[2] = zxid2[2]
+
+\* FALSE: vote1 <= vote2; TRUE: vote1 > vote2
+TotalOrderPredicate(vote1, vote2) == \/ vote1.proposedEpoch > vote2.proposedEpoch
+                                     \/ /\ vote1.proposedEpoch = vote2.proposedEpoch
+                                        /\ \/ ZxidCompare(vote1.proposedZxid, vote2.proposedZxid)
+                                           \/ /\ ZxidEqual(vote1.proposedZxid, vote2.proposedZxid)
+                                              /\ IdCompare(vote1.proposedLeader, vote2.proposedLeader)
+
+VoteEqual(vote1, round1, vote2, round2) == /\ vote1.proposedLeader = vote2.proposedLeader
+                                           /\ ZxidEqual(vote1.proposedZxid, vote2.proposedZxid)
+                                           /\ vote1.proposedEpoch  = vote2.proposedEpoch
+                                           /\ round1 = round2
+
+InitLastProcessed(i) == IF Len(history[i]) = 0 THEN [ index |-> 0, 
+                                                 zxid |-> <<0, 0>> ]
+                        ELSE
+                        LET lastIndex == Len(history[i])
+                            entry     == history[i][lastIndex]
+                        IN [ index |-> lastIndex,
+                             zxid  |-> entry.zxid ]
+
+RECURSIVE InitAcksidInTxns(_,_)
+InitAcksidInTxns(txns, src) == IF Len(txns) = 0 THEN << >>
+                               ELSE LET newTxn == [ zxid   |-> txns[1].zxid,
+                                                    value  |-> txns[1].value,
+                                                    ackSid |-> {src},
+                                                    epoch  |-> txns[1].epoch ]
+                                    IN <<newTxn>> \o InitAcksidInTxns( Tail(txns), src)
+
+InitHistory(i) == LET newState == state'[i] IN 
+                    IF newState = LEADING THEN InitAcksidInTxns(history[i], i)
+                    ELSE history[i]
+-----------------------------------------------------------------------------
+\* Processing of currentVote
+InitialVote == [proposedLeader |-> NullPoint,
+                proposedZxid   |-> <<0, 0>>,
+                proposedEpoch  |-> 0]
+
+SelfVote(i) == [proposedLeader |-> i,
+                proposedZxid   |-> lastProcessed[i].zxid,
+                proposedEpoch  |-> currentEpoch[i]]
+
+UpdateProposal(i, nid, nzxid, nepoch) == currentVote' = [currentVote EXCEPT ![i].proposedLeader = nid, \* no need to record state in LOOKING
+                                                                            ![i].proposedZxid   = nzxid,
+                                                                            ![i].proposedEpoch  = nepoch]  
+                                                                            
+-----------------------------------------------------------------------------
+\* Processing of receiveVotes and outOfElection
+RvClear(i) == receiveVotes'  = [receiveVotes  EXCEPT ![i] = [v \in Server |-> [vote    |-> InitialVote,
+                                                                               round   |-> 0,
+                                                                               state   |-> LOOKING,
+                                                                               version |-> 0]]]
+
+RvPut(i, id, mvote, mround, mstate) == receiveVotes' = CASE receiveVotes[i][id].round < mround -> [receiveVotes EXCEPT ![i][id].vote    = mvote,
+                                                                                                                       ![i][id].round   = mround,
+                                                                                                                       ![i][id].state   = mstate,
+                                                                                                                       ![i][id].version = 1]
+                                                       []   receiveVotes[i][id].round = mround -> [receiveVotes EXCEPT ![i][id].vote    = mvote,
+                                                                                                                       ![i][id].state   = mstate,
+                                                                                                                       ![i][id].version = @ + 1]
+                                                       []   receiveVotes[i][id].round > mround -> receiveVotes
+
+Put(i, id, rcvset, mvote, mround, mstate) == CASE rcvset[id].round < mround -> [rcvset EXCEPT ![id].vote    = mvote,
+                                                                                              ![id].round   = mround,
+                                                                                              ![id].state   = mstate,
+                                                                                              ![id].version = 1]
+                                             []   rcvset[id].round = mround -> [rcvset EXCEPT ![id].vote    = mvote,
+                                                                                              ![id].state   = mstate,
+                                                                                              ![id].version = @ + 1]
+                                             []   rcvset[id].round > mround -> rcvset
+
+RvClearAndPut(i, id, vote, round) == receiveVotes' = LET oneVote == [vote    |-> vote, 
+                                                                     round   |-> round, 
+                                                                     state   |-> LOOKING,
+                                                                     version |-> 1]
+                                                     IN [receiveVotes EXCEPT ![i] = [v \in Server |-> IF v = id THEN oneVote
+                                                                                                                ELSE [vote    |-> InitialVote,
+                                                                                                                      round   |-> 0,
+                                                                                                                      state   |-> LOOKING,
+                                                                                                                      version |-> 0]]]                     
+
+VoteSet(i, msource, rcvset, thisvote, thisround) == {msource} \union {s \in (Server \ {msource}): VoteEqual(rcvset[s].vote, 
+                                                                                                            rcvset[s].round,
+                                                                                                            thisvote,
+                                                                                                            thisround)}
+
+HasQuorums(i, msource, rcvset, thisvote, thisround) == LET Q == VoteSet(i, msource, rcvset, thisvote, thisround)
+                                                       IN IF Q \in Quorums THEN TRUE ELSE FALSE
+
+CheckLeader(i, votes, thisleader, thisround) == IF thisleader = i THEN (IF thisround = logicalClock[i] THEN TRUE ELSE FALSE)
+                                                ELSE (IF votes[thisleader].vote.proposedLeader = NullPoint THEN FALSE
+                                                      ELSE (IF votes[thisleader].state = LEADING THEN TRUE 
+                                                                                                 ELSE FALSE))
+
+OoeClear(i) == outOfElection' = [outOfElection EXCEPT ![i] = [v \in Server |-> [vote    |-> InitialVote,
+                                                                                round   |-> 0,
+                                                                                state   |-> LOOKING,
+                                                                                version |-> 0]]]  
+
+OoePut(i, id, mvote, mround, mstate) == outOfElection' = CASE outOfElection[i][id].round < mround -> [outOfElection EXCEPT ![i][id].vote    = mvote,
+                                                                                                                           ![i][id].round   = mround,
+                                                                                                                           ![i][id].state   = mstate,
+                                                                                                                           ![i][id].version = 1]
+                                                         []   outOfElection[i][id].round = mround -> [outOfElection EXCEPT ![i][id].vote    = mvote,
+                                                                                                                           ![i][id].state   = mstate,
+                                                                                                                           ![i][id].version = @ + 1]
+                                                         []   outOfElection[i][id].round > mround -> outOfElection
+                                                                                                                             
+-----------------------------------------------------------------------------    
+InitServerVarsL == /\ state         = [s \in Server |-> LOOKING]
+                   /\ currentEpoch  = [s \in Server |-> 0]
+                   /\ lastProcessed = [s \in Server |-> [index |-> 0,
+                                                         zxid  |-> <<0, 0>>] ]
+                   /\ history       = [s \in Server |-> << >>]
+
+InitElectionVarsL == /\ currentVote   = [s \in Server |-> SelfVote(s)]
+                     /\ logicalClock  = [s \in Server |-> 0]
+                     /\ receiveVotes  = [s \in Server |-> [v \in Server |-> [vote    |-> InitialVote,
+                                                                             round   |-> 0,
+                                                                             state   |-> LOOKING,
+                                                                             version |-> 0]]]
+                     /\ outOfElection = [s \in Server |-> [v \in Server |-> [vote    |-> InitialVote,
+                                                                             round   |-> 0,
+                                                                             state   |-> LOOKING,
+                                                                             version |-> 0]]]
+                     /\ recvQueue     = [s \in Server |-> << >>]
+                     /\ waitNotmsg    = [s \in Server |-> FALSE]
+
+InitLeaderVarsL == leadingVoteSet = [s \in Server |-> {}]
+
+InitL == /\ InitServerVarsL
+        /\ InitElectionVarsL
+        /\ InitLeaderVarsL
+        /\ electionMsgs = [s \in Server |-> [v \in Server |-> << >>]]
+        \* /\ idTable = InitializeIdTable(Server)
+        
+-----------------------------------------------------------------------------
+(* The beginning part of FLE's main function lookForLeader() *)
+ZabTimeout(i) ==
+        /\ state[i] \in {LEADING, FOLLOWING}
+        /\ state'          = [state          EXCEPT ![i] = LOOKING]
+        /\ lastProcessed'  = [lastProcessed  EXCEPT ![i] = InitLastProcessed(i)]
+        /\ logicalClock'   = [logicalClock   EXCEPT ![i] = logicalClock[i] + 1]
+        /\ currentVote'    = [currentVote    EXCEPT ![i] = [proposedLeader |-> i,
+                                                            proposedZxid   |-> lastProcessed'[i].zxid,
+                                                            proposedEpoch  |-> currentEpoch[i]]]
+        /\ receiveVotes'   = [receiveVotes   EXCEPT ![i] = [v \in Server |-> [vote    |-> InitialVote,
+                                                                              round   |-> 0,
+                                                                              state   |-> LOOKING,
+                                                                              version |-> 0]]]
+        /\ outOfElection'  = [outOfElection  EXCEPT ![i] = [v \in Server |-> [vote    |-> InitialVote,
+                                                                              round   |-> 0,
+                                                                              state   |-> LOOKING,
+                                                                              version |-> 0]]]
+        /\ recvQueue'      = [recvQueue      EXCEPT ![i] = << >>]  
+        /\ waitNotmsg'     = [waitNotmsg     EXCEPT ![i] = FALSE]
+        /\ leadingVoteSet' = [leadingVoteSet EXCEPT ![i] = {}]
+        /\ BroadcastNotmsg(i, [mtype   |-> NOTIFICATION,
+                               msource |-> i,
+                               mstate  |-> LOOKING,
+                               mround  |-> logicalClock'[i],
+                               mvote   |-> currentVote'[i]])
+        /\ UNCHANGED <<currentEpoch, history>>
+        
+(* Abstraction of WorkerReceiver.run() *)
+ReceiveNotmsg(i, j) ==
+        /\ electionMsgs[j][i] /= << >>
+        /\ LET notmsg == electionMsgs[j][i][1]
+               toSend == [mtype   |-> NOTIFICATION,
+                          msource |-> i,
+                          mstate  |-> state[i],
+                          mround  |-> logicalClock[i],
+                          mvote   |-> currentVote[i]]
+           IN \/ /\ state[i] = LOOKING
+                 /\ recvQueue' = [recvQueue EXCEPT ![i] = Append(RemoveNone(recvQueue[i]), notmsg)]
+                 /\ LET replyOk == /\ notmsg.mstate = LOOKING
+                                   /\ notmsg.mround < logicalClock[i]
+                    IN 
+                    \/ /\ replyOk
+                       /\ ReplyNotmsg(i, j, toSend)
+                    \/ /\ ~replyOk
+                       /\ DiscardNotmsg(j, i)
+              \/ /\ state[i] \in {LEADING, FOLLOWING}
+                 /\ \/ \* Only reply when sender's state is LOOKING
+                       /\ notmsg.mstate = LOOKING
+                       /\ ReplyNotmsg(i, j, toSend)
+                    \/ \* sender's state and mine are both not LOOKING, just discard
+                       /\ notmsg.mstate /= LOOKING
+                       /\ DiscardNotmsg(j, i)
+                 /\ UNCHANGED recvQueue
+        /\ UNCHANGED <<serverVarsL, currentVote, logicalClock, receiveVotes, outOfElection, waitNotmsg, leaderVarsL>>
+        
+NotmsgTimeout(i) == 
+        /\ state[i] = LOOKING
+        /\ \A j \in Server: electionMsgs[j][i] = << >>
+        /\ recvQueue[i] = << >>
+        /\ recvQueue' = [recvQueue EXCEPT ![i] = Append(recvQueue[i], [mtype |-> NONE])]
+        /\ UNCHANGED <<serverVarsL, currentVote, logicalClock, receiveVotes, outOfElection, waitNotmsg, leaderVarsL, electionMsgs>>
+
+-----------------------------------------------------------------------------
+\* Sub-action in HandleNotmsg
+ReceivedFollowingAndLeadingNotification(i, n) ==
+        LET newVotes    == Put(i, n.msource, receiveVotes[i], n.mvote, n.mround, n.mstate)
+            voteSet1    == VoteSet(i, n.msource, newVotes, n.mvote, n.mround)
+            hasQuorums1 == voteSet1 \in Quorums
+            check1      == CheckLeader(i, newVotes, n.mvote.proposedLeader, n.mround)
+            leaveOk1    == /\ n.mround = logicalClock[i]
+                           /\ hasQuorums1
+                           /\ check1    \* state and leadingVoteSet cannot be changed twice in the first '/\' and second '/\'.
+        IN
+        /\ \/ /\ n.mround = logicalClock[i]
+              /\ receiveVotes' = [receiveVotes EXCEPT ![i] = newVotes]
+           \/ /\ n.mround /= logicalClock[i]
+              /\ UNCHANGED receiveVotes
+        /\ \/ /\ leaveOk1
+              \* /\ PrintT("leave with condition 1")
+              /\ state' = [state EXCEPT ![i] = IF n.mvote.proposedLeader = i THEN LEADING ELSE FOLLOWING]
+              /\ leadingVoteSet' = [leadingVoteSet EXCEPT ![i] = IF n.mvote.proposedLeader = i THEN voteSet1 ELSE @]
+              /\ UpdateProposal(i, n.mvote.proposedLeader, n.mvote.proposedZxid, n.mvote.proposedEpoch)
+              /\ UNCHANGED <<logicalClock, outOfElection>>
+           \/ /\ ~leaveOk1
+              /\ outOfElection' = [outOfElection EXCEPT ![i] = Put(i, n.msource, outOfElection[i], n.mvote,n.mround, n.mstate)]
+              /\ LET voteSet2    == VoteSet(i, n.msource, outOfElection'[i], n.mvote, n.mround)
+                     hasQuorums2 == voteSet2 \in Quorums
+                     check2      == CheckLeader(i, outOfElection'[i], n.mvote.proposedLeader, n.mround)
+                     leaveOk2    == /\ hasQuorums2
+                                    /\ check2
+                 IN
+                 \/ /\ leaveOk2
+                    \* /\ PrintT("leave with condition 2")
+                    /\ logicalClock' = [logicalClock EXCEPT ![i] = n.mround]
+                    /\ state' = [state EXCEPT ![i] = IF n.mvote.proposedLeader = i THEN LEADING ELSE FOLLOWING]
+                    /\ leadingVoteSet' = [leadingVoteSet EXCEPT ![i] = IF n.mvote.proposedLeader = i THEN voteSet2 ELSE @]
+                    /\ UpdateProposal(i, n.mvote.proposedLeader, n.mvote.proposedZxid, n.mvote.proposedEpoch)
+                 \/ /\ ~leaveOk2
+                    /\ LET leaveOk3 == /\ n.mstate = LEADING
+                                       /\ n.mround = logicalClock[i]
+                       IN
+                       \/ /\ leaveOk3
+                          \* /\ PrintT("leave with condition 3")
+                          /\ state' = [state EXCEPT ![i] = IF n.mvote.proposedLeader = i THEN LEADING ELSE FOLLOWING]
+                          /\ UpdateProposal(i, n.mvote.proposedLeader, n.mvote.proposedZxid, n.mvote.proposedEpoch)
+                       \/ /\ ~leaveOk3
+                          /\ UNCHANGED <<state, currentVote>>
+                    /\ UNCHANGED <<logicalClock, leadingVoteSet>>
+
+(* Main part of lookForLeader() *)
+HandleNotmsg(i) ==
+        /\ state[i] = LOOKING
+        /\ \lnot waitNotmsg[i]
+        /\ recvQueue[i] /= << >>
+        /\ LET n         == recvQueue[i][1]
+               rawToSend == [mtype   |-> NOTIFICATION,
+                             msource |-> i,
+                             mstate  |-> LOOKING,
+                             mround  |-> logicalClock[i],
+                             mvote   |-> currentVote[i]]
+           IN \/ /\ n.mtype = NONE
+                 /\ BroadcastNotmsg(i, rawToSend)
+                 /\ UNCHANGED <<history, logicalClock, currentVote, receiveVotes, waitNotmsg, outOfElection, state, leadingVoteSet>>
+              \/ /\ n.mtype = NOTIFICATION
+                 /\ \/ /\ n.mstate = LOOKING
+                       /\ \/ \* n.round >= my round, then update data and receiveVotes.
+                             /\ n.mround >= logicalClock[i]
+                             /\ \/ \* n.round > my round, update round and decide new proposed leader.
+                                   /\ n.mround > logicalClock[i]
+                                   /\ logicalClock' = [logicalClock EXCEPT ![i] = n.mround] \* There should be RvClear, we will handle it in the following.
+                                   /\ LET selfinfo == [proposedLeader |-> i,
+                                                       proposedZxid   |-> lastProcessed[i].zxid,
+                                                       proposedEpoch  |-> currentEpoch[i]]
+                                          peerOk   == TotalOrderPredicate(n.mvote, selfinfo)
+                                      IN \/ /\ peerOk
+                                            /\ UpdateProposal(i, n.mvote.proposedLeader, n.mvote.proposedZxid, n.mvote.proposedEpoch)
+                                         \/ /\ ~peerOk
+                                            /\ UpdateProposal(i, i, lastProcessed[i].zxid, currentEpoch[i])
+                                   /\ BroadcastNotmsg(i, [mtype   |-> NOTIFICATION,
+                                                          msource |-> i,
+                                                          mstate  |-> LOOKING,
+                                                          mround  |-> n.mround,
+                                                          mvote   |-> currentVote'[i]])
+                                \/ \* n.round = my round & n.vote > my vote
+                                   /\ n.mround = logicalClock[i]
+                                   /\ LET peerOk == TotalOrderPredicate(n.mvote, currentVote[i])
+                                      IN \/ /\ peerOk
+                                            /\ UpdateProposal(i, n.mvote.proposedLeader, n.mvote.proposedZxid, n.mvote.proposedEpoch)
+                                            /\ BroadcastNotmsg(i, [mtype   |-> NOTIFICATION,
+                                                                   msource |-> i,
+                                                                   mstate  |-> LOOKING,
+                                                                   mround  |-> logicalClock[i],
+                                                                   mvote   |-> n.mvote])
+                                         \/ /\ ~peerOk
+                                            /\ UNCHANGED <<currentVote, electionMsgs>>
+                                   /\ UNCHANGED logicalClock
+                             /\ LET rcvsetModifiedTwice == n.mround > logicalClock[i]
+                                IN \/ /\ rcvsetModifiedTwice   \* Since a variable cannot be changed more than once in one action, we handle receiveVotes here.
+                                      /\ RvClearAndPut(i, n.msource, n.mvote, n.mround)  \* clear + put
+                                   \/ /\ ~rcvsetModifiedTwice
+                                      /\ RvPut(i, n.msource, n.mvote, n.mround, n.mstate)          \* put
+                             /\ LET hasQuorums == HasQuorums(i, i, receiveVotes'[i], currentVote'[i], n.mround)
+                                IN \/ /\ hasQuorums \* If hasQuorums, see action WaitNewNotmsg and WaitNewNotmsgEnd.
+                                      /\ waitNotmsg' = [waitNotmsg EXCEPT ![i] = TRUE] 
+                                   \/ /\ ~hasQuorums                            
+                                      /\ UNCHANGED waitNotmsg
+                          \/ \* n.round < my round, just discard it.
+                             /\ n.mround < logicalClock[i]
+                             /\ UNCHANGED <<logicalClock, currentVote, electionMsgs, receiveVotes, waitNotmsg>>
+                       /\ UNCHANGED <<state, history, outOfElection, leadingVoteSet>>
+                    \/ \* mainly contains receivedFollowingNotification(line 1146), receivedLeadingNotification(line 1185).
+                       /\ n.mstate \in {LEADING, FOLLOWING}
+                       /\ ReceivedFollowingAndLeadingNotification(i, n)
+                       /\ history' = [history EXCEPT ![i] = InitHistory(i) ]
+                       /\ UNCHANGED <<electionMsgs, waitNotmsg>>
+        /\ recvQueue' = [recvQueue EXCEPT ![i] = Tail(recvQueue[i])]
+        /\ UNCHANGED <<currentEpoch, lastProcessed>>
+
+\* On the premise that ReceiveVotes.HasQuorums = TRUE, corresponding to logic in LFE.java.
+WaitNewNotmsg(i) ==
+        /\ state[i] = LOOKING
+        /\ waitNotmsg[i] = TRUE
+        /\ \/ /\ recvQueue[i] /= << >>
+              /\ recvQueue[i][1].mtype = NOTIFICATION
+              /\ LET n == recvQueue[i][1]
+                     peerOk == TotalOrderPredicate(n.mvote, currentVote[i])
+                 IN \/ /\ peerOk
+                       /\ waitNotmsg' = [waitNotmsg EXCEPT ![i] = FALSE]
+                       /\ recvQueue'  = [recvQueue  EXCEPT ![i] = Append(Tail(@), n)]
+                    \/ /\ ~peerOk
+                       /\ recvQueue' = [recvQueue EXCEPT ![i] = Tail(@)]
+                       /\ UNCHANGED waitNotmsg
+              /\ UNCHANGED <<serverVarsL, currentVote, logicalClock, receiveVotes, outOfElection, 
+                             leaderVarsL, electionMsgs>>
+           \/ /\ \/ recvQueue[i] = << >>
+                 \/ /\ recvQueue[i] /= << >>
+                    /\ recvQueue[i][1].mtype = NONE
+              /\ state' = [state EXCEPT ![i] = IF currentVote[i].proposedLeader = i THEN LEADING
+                                               ELSE FOLLOWING ]
+              /\ leadingVoteSet' = [leadingVoteSet EXCEPT ![i] = 
+                                                           IF currentVote[i].proposedLeader = i 
+                                                           THEN VoteSet(i, i, receiveVotes[i], currentVote[i],
+                                                                        logicalClock[i])
+                                                           ELSE @]
+              /\ history' = [history EXCEPT ![i] = InitHistory(i)]
+              /\ UNCHANGED <<currentEpoch, lastProcessed, electionVarsL, electionMsgs>>
+-----------------------------------------------------------------------------
+(*Test - simulate modifying currentEpoch and lastProcessed.
+  We want to reach violations to achieve some traces and see whether the whole state of system is advancing.
+  The actions below are completely not equal to implementation in real, 
+  just simulate a process of leader updates state and followers get it. *)
+
+LeaderAdvanceEpoch(i) ==
+        /\ state[i] = LEADING
+        /\ currentEpoch' = [currentEpoch EXCEPT ![i] = @ + 1]
+        /\ UNCHANGED <<state, lastProcessed, history, electionVarsL, leaderVarsL, electionMsgs>>
+
+FollowerUpdateEpoch(i, j) ==
+        /\ state[i] = FOLLOWING
+        /\ currentVote[i].proposedLeader = j
+        /\ state[j] = LEADING
+        /\ currentEpoch[i] < currentEpoch[j]
+        /\ currentEpoch' = [currentEpoch EXCEPT ![i] = currentEpoch[j]]
+        /\ UNCHANGED <<state, lastProcessed, history, electionVarsL, leaderVarsL, electionMsgs>>
+
+LeaderAdvanceZxid(i) ==
+        /\ state[i] = LEADING
+        /\ lastProcessed' = [lastProcessed EXCEPT ![i] = IF lastProcessed[i].zxid[1] = currentEpoch[i] 
+                                               THEN [  index |-> lastProcessed[i].index + 1,
+                                                       zxid  |-> <<currentEpoch[i], lastProcessed[i].zxid[2] + 1>> ]
+                                               ELSE [  index |-> lastProcessed[i].index + 1,
+                                                       zxid  |-> <<currentEpoch[i], 1>> ] ]
+        /\ history' = [history EXCEPT ![i] = Append(@, [zxid   |-> lastProcessed'[i].zxid,
+                                                        value  |-> NONE,
+                                                        ackSid |-> {},
+                                                        epoch  |-> 0])]
+        /\ UNCHANGED <<state, currentEpoch, electionVarsL, leaderVarsL, electionMsgs>>
+
+FollowerUpdateZxid(i, j) ==
+        /\ state[i] = FOLLOWING
+        /\ currentVote[i].proposedLeader = j
+        /\ state[j] = LEADING
+        /\ LET precede == \/ lastProcessed[i].zxid[1] < lastProcessed[j].zxid[1]
+                          \/ /\ lastProcessed[i].zxid[1] = lastProcessed[j].zxid[1]
+                             /\ lastProcessed[i].zxid[2] < lastProcessed[j].zxid[2]
+           IN /\ precede
+              /\ lastProcessed' = [lastProcessed EXCEPT ![i] = lastProcessed[j]]
+              /\ history' = [history EXCEPT ![i] = history[j]]
+        /\ UNCHANGED <<state, currentEpoch, electionVarsL, leaderVarsL, electionMsgs>>
+
+NextL == 
+        \/ \E i \in Server:     ZabTimeout(i)
+        \/ \E i, j \in Server:  ReceiveNotmsg(i, j)
+        \/ \E i \in Server:     NotmsgTimeout(i)
+        \/ \E i \in Server:     HandleNotmsg(i)
+        \/ \E i \in Server:     WaitNewNotmsg(i)
+       
+        \/ \E i \in Server:     LeaderAdvanceEpoch(i)
+        \/ \E i, j \in Server:  FollowerUpdateEpoch(i, j)
+        \/ \E i \in Server:     LeaderAdvanceZxid(i)
+        \/ \E i, j \in Server:  FollowerUpdateZxid(i, j)
+
+SpecL == InitL /\ [][NextL]_varsL
+       
+\* These invariants should be violated after running for minutes.
+
+ShouldBeTriggered1 == ~\E Q \in Quorums: /\ \A i \in Q: /\ state[i] \in {FOLLOWING, LEADING}
+                                                        /\ currentEpoch[i] > 3
+                                                        /\ logicalClock[i] > 2
+                                                        /\ currentVote[i].proposedLeader \in Q
+                                         /\ \A i, j \in Q: currentVote[i].proposedLeader = currentVote[j].proposedLeader
+
+(*
+ShouldBeTriggered2 == ~\E Q \in Quorums: /\ \A i \in Q: /\ state[i] \in {FOLLOWING, LEADING}
+                                                        /\ currentEpoch[i] > 3
+                                                        /\ currentVote[i].proposedLeader \in Q
+                                         /\ \A i, j \in Q: currentVote[i].proposedLeader = currentVote[j].proposedLeader*)
+=============================================================================
+\* Modification History
+\* Last modified Sat Jan 14 15:19:45 CST 2023 by huangbinyu
+\* Last modified Sun Nov 14 15:18:32 CST 2021 by Dell
+\* Created Fri Jun 18 20:23:47 CST 2021 by Dell
diff --git a/zookeeper-specifications/system-spec/zk-3.7/ZkV3_7_0.tla b/zookeeper-specifications/system-spec/zk-3.7/ZkV3_7_0.tla
new file mode 100644
index 00000000000..2f3efd6ec6e
--- /dev/null
+++ b/zookeeper-specifications/system-spec/zk-3.7/ZkV3_7_0.tla
@@ -0,0 +1,2050 @@
+(*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *)
+
+------------------------------ MODULE ZkV3_7_0 ------------------------------
+(* This is the system specification for Zab in apache/zookeeper with version 3.7.0 *)
+
+(* Reference:
+   FLE: FastLeaderElection.java, Vote.java, QuorumPeer.java, e.g. in 
+        https://github.com/apache/zookeeper.
+   ZAB: QuorumPeer.java, Learner.java, Follower.java, LearnerHandler.java,
+        Leader.java, e.g. in https://github.com/apache/zookeeper.
+        https://cwiki.apache.org/confluence/display/ZOOKEEPER/Zab1.0.
+ *)
+EXTENDS FastLeaderElection
+-----------------------------------------------------------------------------
+\* The set of requests that can go into history
+\* CONSTANT Value \* Replaced by recorder.nClientRequest
+Value == Nat
+ 
+\* Zab states
+CONSTANTS ELECTION, DISCOVERY, SYNCHRONIZATION, BROADCAST
+
+\* Sync modes & message types
+CONSTANTS DIFF, TRUNC, SNAP
+
+\* Message types
+CONSTANTS FOLLOWERINFO, LEADERINFO, ACKEPOCH, NEWLEADER, ACKLD, 
+          UPTODATE, PROPOSAL, ACK, COMMIT
+(* NOTE: In production, there is no message type ACKLD. Server judges if counter 
+         of ACK is 0 to distinguish one ACK represents ACKLD or not. Here we
+         divide ACK into ACKLD and ACK, to enhance readability of spec.*)
+
+\* Node status
+CONSTANTS ONLINE, OFFLINE
+
+\* [MaxTimeoutFailures, MaxTransactionNum, MaxEpoch, MaxCrashes, MaxPartitions]
+CONSTANT Parameters
+
+MAXEPOCH == 10
+-----------------------------------------------------------------------------
+\* Variables in annotations mean variables defined in FastLeaderElection.
+\* Variables that all servers use.
+VARIABLES zabState,      \* Current phase of server, in
+                         \* {ELECTION, DISCOVERY, SYNCHRONIZATION, BROADCAST}.
+          acceptedEpoch, \* Epoch of the last LEADERINFO packet accepted,
+                         \* namely f.p in paper.
+          lastCommitted, \* Maximum index and zxid known to be committed,
+                         \* namely 'lastCommitted' in Leader. Starts from 0,
+                         \* and increases monotonically before restarting.
+          lastSnapshot,  \* Index and zxid corresponding to latest snapshot
+                         \* from data tree.
+          initialHistory \* history that server initially has before election.
+          \* state,        \* State of server, in {LOOKING, FOLLOWING, LEADING}.
+          \* currentEpoch, \* Epoch of the last NEWLEADER packet accepted,
+                           \* namely f.a in paper.
+          \* lastProcessed,\* Index and zxid of the last processed txn.
+          \* history       \* History of servers: sequence of transactions,
+                           \* containing: zxid, value, ackSid, epoch.
+           \* leader  : [committedRequests + toBeApplied] [outstandingProposals]
+           \* follower: [committedRequests] [pendingTxns] 
+
+\* Variables only used for leader.
+VARIABLES learners,       \* Set of servers leader connects, 
+                          \* namely 'learners' in Leader.
+          connecting,     \* Set of learners leader has received 
+                          \* FOLLOWERINFO from, namely  
+                          \* 'connectingFollowers' in Leader.
+                          \* Set of record [sid, connected].
+          electing,       \* Set of learners leader has received
+                          \* ACKEPOCH from, namely 'electingFollowers'
+                          \* in Leader. Set of record 
+                          \* [sid, peerLastZxid, inQuorum].
+                          \* And peerLastZxid = <<-1,-1>> means has done
+                          \* syncFollower with this sid.
+                          \* inQuorum = TRUE means in code it is one
+                          \* element in 'electingFollowers'.
+          ackldRecv,      \* Set of learners leader has received
+                          \* ACK of NEWLEADER from, namely
+                          \* 'newLeaderProposal' in Leader.
+                          \* Set of record [sid, connected].         
+          forwarding,     \* Set of learners that are synced with
+                          \* leader, namely 'forwardingFollowers'
+                          \* in Leader.
+          tempMaxEpoch    \* ({Maximum epoch in FOLLOWEINFO} + 1) that 
+                          \* leader has received from learners,
+                          \* namely 'epoch' in Leader.
+          \* leadingVoteSet \* Set of voters that follow leader.
+
+\* Variables only used for follower.
+VARIABLES connectInfo, \* Record [sid, syncMode, nlRcv].
+                       \* sid: Leader id that follower has connected with.
+                       \* syncMode: Sync mode according to reveiced Sync Message.
+                       \* nlRcv: If follower has received NEWLEADER.
+          packetsSync  \* packets of PROPOSAL and COMMIT from leader,
+                       \* namely 'packetsNotCommitted' and
+                       \* 'packetsCommitted' in SyncWithLeader
+                       \* in Learner.
+
+\* Variables about network channel.
+VARIABLE msgs       \* Simulates network channel.
+                    \* msgs[i][j] means the input buffer of server j 
+                    \* from server i.
+         \* electionMsgs \* Network channel in FLE module.
+
+\* Variables about status of cluster network and node presence.
+VARIABLES status,    \* Whether the server is online or offline.
+          partition  \* network partition.
+
+\* Variables only used in verifying properties.
+VARIABLES epochLeader,       \* Set of leaders in every epoch.
+          proposalMsgsLog,   \* Set of all broadcast messages.
+          violatedInvariants \* Check whether there are conditions 
+                             \* contrary to the facts.
+\* Variables only used for looking.                             
+\*VARIABLE currentVote,   \* Info of current vote, namely 'currentVote'
+\*                        \* in QuorumPeer.
+\*         logicalClock,  \* Election instance, namely 'logicalClock'
+\*                        \* in FastLeaderElection.
+\*         receiveVotes,  \* Votes from current FLE round, namely
+\*                        \* 'recvset' in FastLeaderElection.
+\*         outOfElection, \* Votes from previous and current FLE round,
+\*                        \* namely 'outofelection' in FastLeaderElection.
+\*         recvQueue,     \* Queue of received notifications or timeout
+\*                        \* signals.
+\*         waitNotmsg     \* Whether waiting for new not.See line 1050
+\*                        \* in FastLeaderElection for details.
+\*VARIABLE idTable \* For mapping Server to Integers,
+                   \* to compare ids between servers.
+    \* Update: we have transformed idTable from variable to function.
+
+\*VARIABLE clientRequest \* Start from 0, and increases monotonically
+                         \* when LeaderProcessRequest performed. To
+                         \* avoid existing two requests with same value. 
+    \* Update: Remove it to recorder.nClientRequest.
+
+\* Variable used for recording critical data,
+\* to constrain state space or update values.
+VARIABLE recorder \* Consists: members of Parameters and pc, values.
+                  \* Form is record: 
+                  \* [pc, nTransaction, maxEpoch, nTimeout, nClientRequest,
+                  \*  nPartition, nCrash]
+
+serverVars == <<state, currentEpoch, lastProcessed, zabState, acceptedEpoch,
+                history, lastCommitted, lastSnapshot, initialHistory>>       
+electionVars == electionVarsL  
+leaderVars == <<leadingVoteSet, learners, connecting, electing, 
+                 ackldRecv, forwarding, tempMaxEpoch>>                                           
+followerVars == <<connectInfo, packetsSync>>                
+verifyVars == <<proposalMsgsLog, epochLeader, violatedInvariants>>   
+msgVars == <<msgs, electionMsgs>>
+envVars == <<status, partition>>                        
+
+vars == <<serverVars, electionVars, leaderVars, followerVars,
+          verifyVars, msgVars, envVars, recorder>> 
+-----------------------------------------------------------------------------
+ServersIncNullPoint == Server \union {NullPoint} 
+
+Zxid ==
+    Seq(Nat \union {-1}) 
+    
+HistoryItem ==
+     [ zxid: Zxid,
+       value: Value,
+       ackSid: SUBSET Server,
+       epoch: Nat ]    
+    
+Proposal ==
+    [ source: Server, 
+      epoch: Nat,
+      zxid: Zxid,
+      data: Value ]   
+
+LastItem ==
+    [ index: Nat, zxid: Zxid ]
+
+SyncPackets == 
+    [ notCommitted: Seq(HistoryItem),
+      committed: Seq(Zxid) ]
+
+Message ==
+    [ mtype: {FOLLOWERINFO}, mzxid: Zxid ] \union
+    [ mtype: {LEADERINFO}, mzxid: Zxid ] \union
+    [ mtype: {ACKEPOCH}, mzxid: Zxid, mepoch: Nat \union {-1} ] \union
+    [ mtype: {DIFF}, mzxid: Zxid ] \union 
+    [ mtype: {TRUNC}, mtruncZxid: Zxid ] \union 
+    [ mtype: {SNAP}, msnapZxid: Zxid, msnapshot: Seq(HistoryItem)] \union
+    [ mtype: {PROPOSAL}, mzxid: Zxid, mdata: Value ] \union 
+    [ mtype: {COMMIT}, mzxid: Zxid ] \union 
+    [ mtype: {NEWLEADER}, mzxid: Zxid ] \union 
+    [ mtype: {ACKLD}, mzxid: Zxid ] \union 
+    [ mtype: {ACK}, mzxid: Zxid ] \union 
+    [ mtype: {UPTODATE}, mzxid: Zxid ]
+ 
+ElectionState == {LOOKING, FOLLOWING, LEADING}
+
+ZabState == {ELECTION, DISCOVERY, SYNCHRONIZATION, BROADCAST}
+
+ViolationSet == {"stateInconsistent", "proposalInconsistent", 
+                 "commitInconsistent", "ackInconsistent", 
+                 "messageIllegal" }
+
+SyncMode == {DIFF, TRUNC, SNAP, NONE}
+
+Connecting == [ sid : Server,
+                connected: BOOLEAN ]
+
+AckldRecv  == Connecting
+
+Electing == [ sid: Server,
+              peerLastZxid: Zxid,
+              inQuorum: BOOLEAN  ]
+
+ConnectInfo == [ sid : ServersIncNullPoint,
+                 syncMode: SyncMode,
+                 nlRcv: BOOLEAN ]
+
+Vote ==
+    [proposedLeader: ServersIncNullPoint,
+     proposedZxid: Zxid,
+     proposedEpoch: Nat ]
+     
+ElectionVote ==
+    [vote: Vote, round: Nat, state: ElectionState, version: Nat]
+
+ElectionMsg ==
+    [ mtype: {NOTIFICATION}, 
+      msource: Server, 
+      mstate: ElectionState, 
+      mround: Nat, 
+      mvote: Vote ] \union
+    [ mtype: {NONE} ]
+            
+TypeOK ==
+    /\ zabState \in [Server -> ZabState]
+    /\ acceptedEpoch \in [Server -> Nat]
+    /\ lastCommitted \in [Server -> LastItem]
+    /\ lastSnapshot \in [Server -> LastItem]
+    /\ learners \in [Server -> SUBSET Server]
+    /\ connecting \in [Server -> SUBSET Connecting]
+    /\ electing \in [Server -> SUBSET Electing]
+    /\ ackldRecv \in [Server -> SUBSET AckldRecv]
+    /\ forwarding \in [Server -> SUBSET Server]
+    /\ initialHistory \in [Server -> Seq(HistoryItem)] 
+    /\ tempMaxEpoch \in [Server -> Nat]
+    /\ connectInfo \in [Server -> ConnectInfo]
+    /\ packetsSync \in [Server -> SyncPackets]
+    /\ status \in [Server -> {ONLINE, OFFLINE}]
+    /\ partition \in [Server -> [Server -> BOOLEAN ]]
+    /\ proposalMsgsLog \in SUBSET Proposal
+    /\ epochLeader \in [1..MAXEPOCH -> SUBSET Server]
+    /\ violatedInvariants \in [ViolationSet -> BOOLEAN]
+    /\ msgs \in [Server -> [Server -> Seq(Message)]]
+    \* Fast Leader Election
+    /\ electionMsgs \in [Server -> [Server -> Seq(ElectionMsg)]]
+    /\ recvQueue \in [Server -> Seq(ElectionMsg)]
+    /\ leadingVoteSet \in [Server -> SUBSET Server]
+    /\ receiveVotes \in [Server -> [Server -> ElectionVote]]
+    /\ currentVote \in [Server -> Vote]
+    /\ outOfElection \in [Server -> [Server -> ElectionVote]]
+    /\ lastProcessed \in [Server -> LastItem]
+    /\ history \in [Server -> Seq(HistoryItem)]
+    /\ state \in [Server -> ElectionState]
+    /\ waitNotmsg \in [Server -> BOOLEAN]
+    /\ currentEpoch \in [Server -> Nat]
+    /\ logicalClock \in [Server -> Nat]
+-----------------------------------------------------------------------------
+\* Return the maximum value from the set S
+Maximum(S) == IF S = {} THEN -1
+                        ELSE CHOOSE n \in S: \A m \in S: n >= m
+
+\* Return the minimum value from the set S
+Minimum(S) == IF S = {} THEN -1
+                        ELSE CHOOSE n \in S: \A m \in S: n <= m
+
+\* Check server state
+IsON(s)  == status[s] = ONLINE 
+IsOFF(s) == status[s] = OFFLINE
+
+IsLeader(s)   == state[s] = LEADING
+IsFollower(s) == state[s] = FOLLOWING
+IsLooking(s)  == state[s] = LOOKING
+
+IsMyLearner(i, j) == j \in learners[i]
+IsMyLeader(i, j)  == connectInfo[i].sid = j
+HasNoLeader(i)    == connectInfo[i].sid = NullPoint
+HasLeader(i)      == connectInfo[i].sid /= NullPoint
+MyVote(i)         == currentVote[i].proposedLeader 
+
+\* Check if s is a quorum
+IsQuorum(s) == s \in Quorums
+
+HasPartitioned(i, j) == /\ partition[i][j] = TRUE 
+                        /\ partition[j][i] = TRUE
+-----------------------------------------------------------------------------
+\* Check zxid state
+ToZxid(z) == [epoch |-> z[1], counter |-> z[2]]
+
+TxnZxidEqual(txn, z) == txn.zxid[1] = z[1] /\ txn.zxid[2] = z[2]
+
+TxnEqual(txn1, txn2) == /\ ZxidEqual(txn1.zxid, txn2.zxid)
+                        /\ txn1.value = txn2.value
+
+EpochPrecedeInTxn(txn1, txn2) == txn1.zxid[1] < txn2.zxid[1]
+-----------------------------------------------------------------------------
+\* Actions about recorder
+GetParameter(p) == IF p \in DOMAIN Parameters THEN Parameters[p] ELSE 0
+GetRecorder(p)  == IF p \in DOMAIN recorder   THEN recorder[p]   ELSE 0
+
+RecorderGetHelper(m) == (m :> recorder[m])
+RecorderIncHelper(m) == (m :> recorder[m] + 1)
+
+RecorderIncTimeout == RecorderIncHelper("nTimeout")
+RecorderGetTimeout == RecorderGetHelper("nTimeout")
+RecorderIncCrash   == RecorderIncHelper("nCrash")
+RecorderGetCrash   == RecorderGetHelper("nCrash")
+
+RecorderSetTransactionNum(pc) == ("nTransaction" :> 
+                                IF pc[1] = "LeaderProcessRequest" THEN
+                                    LET s == CHOOSE i \in Server: 
+                                        \A j \in Server: Len(history'[i]) >= Len(history'[j])                       
+                                    IN Len(history'[s])
+                                ELSE recorder["nTransaction"])
+RecorderSetMaxEpoch(pc)       == ("maxEpoch" :> 
+                                IF pc[1] = "LeaderProcessFOLLOWERINFO" THEN
+                                    LET s == CHOOSE i \in Server:
+                                        \A j \in Server: acceptedEpoch'[i] >= acceptedEpoch'[j]
+                                    IN acceptedEpoch'[s]
+                                ELSE recorder["maxEpoch"])
+RecorderSetRequests(pc)       == ("nClientRequest" :>
+                                IF pc[1] = "LeaderProcessRequest" THEN
+                                    recorder["nClientRequest"] + 1
+                                ELSE recorder["nClientRequest"] )
+RecorderSetPartition(pc)      == ("nPartition" :> 
+                                IF pc[1] = "PartitionStart" THEN recorder["nPartition"] + 1
+                                                            ELSE recorder["nPartition"] )  
+RecorderSetPc(pc)      == ("pc" :> pc)
+RecorderSetFailure(pc) == CASE pc[1] = "Timeout"         -> RecorderIncTimeout @@ RecorderGetCrash
+                          []   pc[1] = "LeaderTimeout"   -> RecorderIncTimeout @@ RecorderGetCrash 
+                          []   pc[1] = "FollowerTimeout" -> RecorderIncTimeout @@ RecorderGetCrash 
+                          []   pc[1] = "PartitionStart"  -> IF IsLooking(pc[2]) 
+                                                            THEN RecorderGetTimeout @@ RecorderGetCrash
+                                                            ELSE RecorderIncTimeout @@ RecorderGetCrash
+                          []   pc[1] = "NodeCrash"       -> IF IsLooking(pc[2]) 
+                                                            THEN RecorderGetTimeout @@ RecorderIncCrash 
+                                                            ELSE RecorderIncTimeout @@ RecorderIncCrash 
+                          []   OTHER                     -> RecorderGetTimeout @@ RecorderGetCrash
+
+UpdateRecorder(pc) == recorder' = RecorderSetPartition(pc)
+                                  @@  RecorderSetFailure(pc)  @@ RecorderSetTransactionNum(pc)
+                                  @@ RecorderSetMaxEpoch(pc)  @@ RecorderSetPc(pc) 
+                                  @@ RecorderSetRequests(pc)  @@ recorder
+UnchangeRecorder   == UNCHANGED recorder
+
+CheckParameterHelper(n, p, Comp(_,_)) == IF p \in DOMAIN Parameters 
+                                         THEN Comp(n, Parameters[p])
+                                         ELSE TRUE
+CheckParameterLimit(n, p) == CheckParameterHelper(n, p, LAMBDA i, j: i < j)
+
+CheckTimeout        == CheckParameterLimit(recorder.nTimeout,     "MaxTimeoutFailures")
+CheckTransactionNum == CheckParameterLimit(recorder.nTransaction, "MaxTransactionNum")
+CheckEpoch          == CheckParameterLimit(recorder.maxEpoch,     "MaxEpoch")
+CheckPartition      == /\ CheckTimeout
+                       /\ CheckParameterLimit(recorder.nPartition,   "MaxPartitions")
+CheckCrash(i)       == /\ \/ IsLooking(i)
+                          \/ /\ ~IsLooking(i)
+                             /\ CheckTimeout
+                       /\ CheckParameterLimit(recorder.nCrash,    "MaxCrashes")
+
+CheckStateConstraints == CheckTimeout /\ CheckTransactionNum /\ CheckEpoch
+-----------------------------------------------------------------------------
+\* Actions about network
+PendingFOLLOWERINFO(i, j) == /\ msgs[j][i] /= << >>
+                             /\ msgs[j][i][1].mtype = FOLLOWERINFO
+PendingLEADERINFO(i, j)   == /\ msgs[j][i] /= << >>
+                             /\ msgs[j][i][1].mtype = LEADERINFO
+PendingACKEPOCH(i, j)     == /\ msgs[j][i] /= << >>
+                             /\ msgs[j][i][1].mtype = ACKEPOCH
+PendingNEWLEADER(i, j)    == /\ msgs[j][i] /= << >>
+                             /\ msgs[j][i][1].mtype = NEWLEADER
+PendingACKLD(i, j)        == /\ msgs[j][i] /= << >>
+                             /\ msgs[j][i][1].mtype = ACKLD
+PendingUPTODATE(i, j)     == /\ msgs[j][i] /= << >>
+                             /\ msgs[j][i][1].mtype = UPTODATE
+PendingPROPOSAL(i, j)     == /\ msgs[j][i] /= << >>
+                             /\ msgs[j][i][1].mtype = PROPOSAL
+PendingACK(i, j)          == /\ msgs[j][i] /= << >>
+                             /\ msgs[j][i][1].mtype = ACK
+PendingCOMMIT(i, j)       == /\ msgs[j][i] /= << >>
+                             /\ msgs[j][i][1].mtype = COMMIT
+\* Add a message to msgs - add a message m to msgs.
+Send(i, j, m) == msgs' = [msgs EXCEPT ![i][j] = Append(msgs[i][j], m)]
+SendPackets(i, j, ms) == msgs' = [msgs EXCEPT ![i][j] = msgs[i][j] \o ms ]
+DiscardAndSendPackets(i, j, ms) == msgs' = [msgs EXCEPT ![j][i] = Tail(msgs[j][i]), 
+                                                ![i][j] = msgs[i][j] \o ms ]
+\* Remove a message from msgs - discard head of msgs.
+Discard(i, j) == msgs' = IF msgs[i][j] /= << >> THEN [msgs EXCEPT ![i][j] = Tail(msgs[i][j])]
+                                                ELSE msgs
+\* Leader broadcasts a message(PROPOSAL/COMMIT) to all other servers in forwardingFollowers.
+Broadcast(i, m) == msgs' = [msgs EXCEPT ![i] = [v \in Server |-> IF /\ v \in forwarding[i]
+                                                                    /\ v /= i
+                                                                 THEN Append(msgs[i][v], m)
+                                                                 ELSE msgs[i][v]]]                                                           
+DiscardAndBroadcast(i, j, m) ==
+        msgs' = [msgs EXCEPT ![j][i] = Tail(msgs[j][i]),
+                             ![i] = [v \in Server |-> IF /\ v \in forwarding[i]
+                                                         /\ v /= i
+                                                      THEN Append(msgs[i][v], m)
+                                                      ELSE msgs[i][v]]]            
+\* Leader broadcasts LEADERINFO to all other servers in connectingFollowers.
+DiscardAndBroadcastLEADERINFO(i, j, m) ==
+        LET new_connecting_quorum == {c \in connecting'[i]: c.connected = TRUE }
+            new_sid_connecting == {c.sid: c \in new_connecting_quorum }
+        IN 
+        msgs' = [msgs EXCEPT ![j][i] = Tail(msgs[j][i]),
+                             ![i] = [v \in Server |-> IF /\ v \in new_sid_connecting
+                                                         /\ v \in learners[i] 
+                                                         /\ v /= i
+                                                      THEN Append(msgs[i][v], m)
+                                                      ELSE msgs[i][v] ] ]
+\* Leader broadcasts UPTODATE to all other servers in newLeaderProposal.
+DiscardAndBroadcastUPTODATE(i, j, m) ==
+        LET new_ackldRecv_quorum == {a \in ackldRecv'[i]: a.connected = TRUE }
+            new_sid_ackldRecv == {a.sid: a \in new_ackldRecv_quorum}
+        IN
+        msgs' = [msgs EXCEPT ![j][i] = Tail(msgs[j][i]),
+                             ![i] = [v \in Server |-> IF /\ v \in new_sid_ackldRecv
+                                                         /\ v \in learners[i] 
+                                                         /\ v /= i
+                                                      THEN Append(msgs[i][v], m)
+                                                      ELSE msgs[i][v] ] ]
+\* Combination of Send and Discard - discard head of msgs[j][i] and add m into msgs.
+Reply(i, j, m) == msgs' = [msgs EXCEPT ![j][i] = Tail(msgs[j][i]),
+                                       ![i][j] = Append(msgs[i][j], m)]
+
+\* Shuffle input buffer.
+Clean(i, j) == msgs' = [msgs EXCEPT ![j][i] = << >>, ![i][j] = << >>]     
+CleanInputBuffer(i) == msgs' = [s \in Server |-> [v \in Server |-> IF v = i THEN << >>
+                                                                   ELSE msgs[s][v]]]  
+CleanInputBufferInCluster(S) == msgs' = [s \in Server |-> 
+                                            [v \in Server |-> IF v \in S THEN << >>
+                                                              ELSE msgs[s][v] ] ]                      
+-----------------------------------------------------------------------------
+\* Define initial values for all variables 
+InitServerVars == /\ InitServerVarsL
+                  /\ zabState      = [s \in Server |-> ELECTION]
+                  /\ acceptedEpoch = [s \in Server |-> 0]
+                  /\ lastCommitted = [s \in Server |-> [ index |-> 0,
+                                                         zxid  |-> <<0, 0>> ] ]
+                  /\ lastSnapshot  = [s \in Server |-> [ index |-> 0,
+                                                         zxid  |-> <<0, 0>> ] ]
+                  /\ initialHistory = [s \in Server |-> << >>]
+
+InitLeaderVars == /\ InitLeaderVarsL
+                  /\ learners         = [s \in Server |-> {}]
+                  /\ connecting       = [s \in Server |-> {}]
+                  /\ electing         = [s \in Server |-> {}]
+                  /\ ackldRecv        = [s \in Server |-> {}]
+                  /\ forwarding       = [s \in Server |-> {}]
+                  /\ tempMaxEpoch     = [s \in Server |-> 0]
+
+InitElectionVars == InitElectionVarsL
+
+InitFollowerVars == /\ connectInfo = [s \in Server |-> [sid |-> NullPoint,
+                                                        syncMode |-> NONE,
+                                                        nlRcv |-> FALSE ] ]
+                    /\ packetsSync = [s \in Server |->
+                                        [ notCommitted |-> << >>,
+                                          committed    |-> << >> ] ]
+
+InitVerifyVars == /\ proposalMsgsLog    = {}
+                  /\ epochLeader        = [e \in 1..MAXEPOCH |-> {} ]
+                  /\ violatedInvariants = [stateInconsistent    |-> FALSE,
+                                           proposalInconsistent |-> FALSE,
+                                           commitInconsistent   |-> FALSE,
+                                           ackInconsistent      |-> FALSE,
+                                           messageIllegal       |-> FALSE ]
+                   
+InitMsgVars == /\ msgs         = [s \in Server |-> [v \in Server |-> << >>] ]
+               /\ electionMsgs = [s \in Server |-> [v \in Server |-> << >>] ]
+
+InitEnvVars == /\ status    = [s \in Server |-> ONLINE ]
+               /\ partition = [s \in Server |-> [v \in Server |-> FALSE] ]
+                
+InitRecorder == recorder = [nTimeout       |-> 0,
+                            nTransaction   |-> 0,
+                            nPartition     |-> 0,
+                            maxEpoch       |-> 0,
+                            nCrash         |-> 0,
+                            pc             |-> <<"Init">>,
+                            nClientRequest |-> 0]
+
+Init == /\ InitServerVars
+        /\ InitLeaderVars
+        /\ InitElectionVars
+        /\ InitFollowerVars
+        /\ InitVerifyVars
+        /\ InitMsgVars
+        /\ InitEnvVars
+        /\ InitRecorder
+-----------------------------------------------------------------------------
+ZabTurnToLeading(i) ==
+        /\ zabState'       = [zabState   EXCEPT ![i] = DISCOVERY]
+        /\ learners'       = [learners   EXCEPT ![i] = {i}]
+        /\ connecting'     = [connecting EXCEPT ![i] = { [ sid       |-> i,
+                                                           connected |-> TRUE ] }]
+        /\ electing'       = [electing   EXCEPT ![i] = { [ sid          |-> i,
+                                                           peerLastZxid |-> <<-1,-1>>,
+                                                           inQuorum     |-> TRUE ] }]
+        /\ ackldRecv'      = [ackldRecv  EXCEPT ![i] = { [ sid       |-> i,
+                                                           connected |-> TRUE ] }]
+        /\ forwarding'     = [forwarding EXCEPT ![i] = {}]
+        /\ initialHistory' = [initialHistory EXCEPT ![i] = history'[i]]
+        /\ tempMaxEpoch'   = [tempMaxEpoch   EXCEPT ![i] = acceptedEpoch[i] + 1]
+
+ZabTurnToFollowing(i) ==
+        /\ zabState' = [zabState EXCEPT ![i] = DISCOVERY]
+        /\ initialHistory' = [initialHistory EXCEPT ![i] = history'[i]]
+        /\ packetsSync' = [packetsSync EXCEPT ![i].notCommitted = << >>, 
+                                              ![i].committed = << >> ]
+          
+(* Fast Leader Election *)
+FLEReceiveNotmsg(i, j) ==
+        /\ IsON(i)
+        /\ ReceiveNotmsg(i, j)
+        /\ UNCHANGED <<zabState, acceptedEpoch, lastCommitted, learners, connecting, 
+                      initialHistory, electing, ackldRecv, forwarding, tempMaxEpoch,
+                      lastSnapshot, followerVars, verifyVars, envVars, msgs>>
+        /\ UpdateRecorder(<<"FLEReceiveNotmsg", i, j>>)
+
+FLENotmsgTimeout(i) ==
+        /\ IsON(i)
+        /\ NotmsgTimeout(i)
+        /\ UNCHANGED <<zabState, acceptedEpoch, lastCommitted, learners, connecting, 
+                       initialHistory, electing, ackldRecv, forwarding, tempMaxEpoch, 
+                       lastSnapshot, followerVars, verifyVars, envVars, msgs>>
+        /\ UpdateRecorder(<<"FLENotmsgTimeout", i>>)
+
+FLEHandleNotmsg(i) ==
+        /\ IsON(i)
+        /\ HandleNotmsg(i)
+        /\ LET newState == state'[i]
+           IN
+           \/ /\ newState = LEADING
+              /\ ZabTurnToLeading(i)
+              /\ UNCHANGED packetsSync
+           \/ /\ newState = FOLLOWING
+              /\ ZabTurnToFollowing(i)
+              /\ UNCHANGED <<learners, connecting, electing, ackldRecv, 
+                            forwarding, tempMaxEpoch>>
+           \/ /\ newState = LOOKING
+              /\ UNCHANGED <<zabState, learners, connecting, electing, ackldRecv,
+                             forwarding, tempMaxEpoch, packetsSync, initialHistory>>
+        /\ UNCHANGED <<lastCommitted, lastSnapshot, acceptedEpoch,
+                       connectInfo, verifyVars, envVars, msgs>>
+        /\ UpdateRecorder(<<"FLEHandleNotmsg", i>>)
+
+\* On the premise that ReceiveVotes.HasQuorums = TRUE, 
+\* corresponding to logic in FastLeaderElection.
+FLEWaitNewNotmsg(i) ==
+        /\ IsON(i)
+        /\ WaitNewNotmsg(i)
+        /\ LET newState == state'[i]
+           IN
+           \/ /\ newState = LEADING
+              /\ ZabTurnToLeading(i)
+              /\ UNCHANGED packetsSync
+           \/ /\ newState = FOLLOWING
+              /\ ZabTurnToFollowing(i)
+              /\ UNCHANGED <<learners, connecting, electing, ackldRecv, forwarding,
+                             tempMaxEpoch>>
+           \/ /\ newState = LOOKING
+              /\ PrintT("Note: New state is LOOKING in FLEWaitNewNotmsgEnd," \o 
+                    " which should not happen.")
+              /\ UNCHANGED <<zabState, learners, connecting, electing, ackldRecv,
+                             forwarding, tempMaxEpoch, initialHistory, packetsSync>>
+        /\ UNCHANGED <<lastCommitted, lastSnapshot, acceptedEpoch,
+                       connectInfo, verifyVars, envVars, msgs>>
+        /\ UpdateRecorder(<<"FLEWaitNewNotmsg", i>>)
+-----------------------------------------------------------------------------
+InitialVotes == [ vote    |-> InitialVote,
+                  round   |-> 0,
+                  state   |-> LOOKING,
+                  version |-> 0 ]
+
+InitialConnectInfo == [sid        |-> NullPoint,
+                       syncMode   |-> NONE,
+                       nlRcv      |-> FALSE ]
+
+\* Equals to for every server in S, performing action ZabTimeout.
+ZabTimeoutInCluster(S) ==
+        /\ state' = [s \in Server |-> IF s \in S THEN LOOKING ELSE state[s] ]
+        /\ lastProcessed' = [s \in Server |-> IF s \in S THEN InitLastProcessed(s)
+                                                         ELSE lastProcessed[s] ]
+        /\ logicalClock' = [s \in Server |-> IF s \in S THEN logicalClock[s] + 1 
+                                                        ELSE logicalClock[s] ]
+        /\ currentVote' = [s \in Server |-> IF s \in S THEN
+                                                       [proposedLeader |-> s,
+                                                        proposedZxid   |-> lastProcessed'[s].zxid,
+                                                        proposedEpoch  |-> currentEpoch[s] ]
+                                                       ELSE currentVote[s] ]
+        /\ receiveVotes' = [s \in Server |-> IF s \in S THEN [v \in Server |-> InitialVotes]
+                                                        ELSE receiveVotes[s] ]
+        /\ outOfElection' = [s \in Server |-> IF s \in S THEN [v \in Server |-> InitialVotes]
+                                                         ELSE outOfElection[s] ]
+        /\ recvQueue' = [s \in Server |-> IF s \in S THEN << [mtype |-> NONE] >> 
+                                                     ELSE recvQueue[s] ]
+        /\ waitNotmsg' = [s \in Server |-> IF s \in S THEN FALSE ELSE waitNotmsg[s] ]
+        /\ leadingVoteSet' = [s \in Server |-> IF s \in S THEN {} ELSE leadingVoteSet[s] ]
+        /\ UNCHANGED <<electionMsgs, currentEpoch, history>>
+        /\ zabState' = [s \in Server |-> IF s \in S THEN ELECTION ELSE zabState[s] ]
+        /\ connectInfo' = [s \in Server |-> IF s \in S THEN InitialConnectInfo
+                                                       ELSE connectInfo[s] ]
+        /\ CleanInputBufferInCluster(S)
+
+(* Describe how a server transitions from LEADING/FOLLOWING to LOOKING.*)
+FollowerShutdown(i) ==
+        /\ ZabTimeout(i)
+        /\ zabState'    = [zabState    EXCEPT ![i] = ELECTION]
+        /\ connectInfo' = [connectInfo EXCEPT ![i] = InitialConnectInfo]
+
+LeaderShutdown(i) ==
+        /\ LET cluster == {i} \union learners[i]
+           IN ZabTimeoutInCluster(cluster)
+        /\ learners'   = [learners   EXCEPT ![i] = {}]
+        /\ forwarding' = [forwarding EXCEPT ![i] = {}]
+
+RemoveElecting(set, sid) ==
+        LET sid_electing == {s.sid: s \in set }
+        IN IF sid \notin sid_electing THEN set
+           ELSE LET info == CHOOSE s \in set: s.sid = sid
+                    new_info == [ sid          |-> sid,
+                                  peerLastZxid |-> <<-1, -1>>,
+                                  inQuorum     |-> info.inQuorum ]
+                IN (set \ {info}) \union {new_info}
+RemoveConnectingOrAckldRecv(set, sid) ==
+        LET sid_set == {s.sid: s \in set}
+        IN IF sid \notin sid_set THEN set
+           ELSE LET info == CHOOSE s \in set: s.sid = sid
+                    new_info == [ sid       |-> sid,
+                                  connected |-> FALSE ]
+                IN (set \ {info}) \union {new_info}
+
+\* See removeLearnerHandler for details.
+RemoveLearner(i, j) ==
+        /\ learners'   = [learners   EXCEPT ![i] = @ \ {j}] 
+        /\ forwarding' = [forwarding EXCEPT ![i] = IF j \in forwarding[i] 
+                                                   THEN @ \ {j} ELSE @ ]
+        /\ electing'   = [electing   EXCEPT ![i] = RemoveElecting(@, j) ]
+        /\ connecting' = [connecting EXCEPT ![i] = RemoveConnectingOrAckldRecv(@, j) ]
+        /\ ackldRecv'  = [ackldRecv  EXCEPT ![i] = RemoveConnectingOrAckldRecv(@, j) ]
+-----------------------------------------------------------------------------
+\* Actions of situation error. 
+PartitionStart(i, j) ==
+        /\ CheckPartition \* test restrictions of partition
+        /\ i /= j
+        /\ IsON(i)
+        /\ IsON(j)
+        /\ \lnot HasPartitioned(i, j)
+        /\ \/ /\ IsLeader(i)   /\ IsMyLearner(i, j)
+              /\ IsFollower(j) /\ IsMyLeader(j, i)
+              /\ LET newLearners == learners[i] \ {j}
+                 IN \/ /\ IsQuorum(newLearners)   \* just remove this learner
+                       /\ RemoveLearner(i, j)
+                       /\ FollowerShutdown(j)
+                       /\ Clean(i ,j)
+                    \/ /\ ~IsQuorum(newLearners)  \* leader switches to looking
+                       /\ LeaderShutdown(i)
+                       /\ UNCHANGED <<connecting, electing, ackldRecv>>
+           \/ /\ IsLooking(i)
+              /\ IsLooking(j)
+              /\ IdCompare(i, j)
+              /\ UNCHANGED <<varsL, zabState, connectInfo, msgs, learners,
+                             forwarding, connecting, electing, ackldRecv>>
+        /\ partition' = [partition EXCEPT ![i][j] = TRUE, ![j][i] = TRUE ]
+        /\ UNCHANGED <<acceptedEpoch, lastCommitted, lastSnapshot, tempMaxEpoch,
+                       initialHistory, verifyVars, packetsSync, status>>
+        /\ UpdateRecorder(<<"PartitionStart", i, j>>)
+
+PartitionRecover(i, j) ==
+        /\ IsON(i)
+        /\ IsON(j)
+        /\ IdCompare(i, j)
+        /\ HasPartitioned(i, j)
+        /\ partition' = [partition EXCEPT ![i][j] = FALSE, ![j][i] = FALSE ]
+        /\ UNCHANGED <<serverVars, leaderVars, electionVars, followerVars,
+                       verifyVars, msgVars, status>>
+        /\ UpdateRecorder(<<"PartitionRecover", i, j>>)
+
+NodeCrash(i) ==
+        /\ CheckCrash(i)
+        /\ IsON(i)
+        /\ status' = [status EXCEPT ![i] = OFFLINE ]
+        /\ \/ /\ IsLooking(i)
+              /\ UNCHANGED <<varsL, zabState, connectInfo, msgs, learners,
+                             forwarding, connecting, electing, ackldRecv>>
+           \/ /\ IsFollower(i)
+              /\ LET connectedWithLeader == HasLeader(i)
+                 IN \/ /\ connectedWithLeader
+                       /\ LET leader == connectInfo[i].sid
+                              newCluster == learners[leader] \ {i}
+                          IN 
+                          \/ /\ IsQuorum(newCluster)
+                             /\ RemoveLearner(leader, i) 
+                             /\ FollowerShutdown(i)
+                             /\ Clean(leader, i)
+                          \/ /\ ~IsQuorum(newCluster)
+                             /\ LeaderShutdown(leader)
+                             /\ UNCHANGED <<electing, connecting, ackldRecv>>
+                    \/ /\ ~connectedWithLeader
+                       /\ FollowerShutdown(i)
+                       /\ CleanInputBuffer({i})
+                       /\ UNCHANGED <<learners, forwarding, connecting, electing, ackldRecv>>
+           \/ /\ IsLeader(i)
+              /\ LeaderShutdown(i)
+              /\ UNCHANGED <<electing, connecting, ackldRecv>>
+        /\ UNCHANGED <<acceptedEpoch, lastCommitted, lastSnapshot, tempMaxEpoch,
+                       initialHistory, verifyVars, packetsSync, partition>>
+        /\ UpdateRecorder(<<"NodeCrash", i>>)
+
+NodeStart(i) ==
+        /\ IsOFF(i)
+        /\ status' = [status EXCEPT ![i] = ONLINE ]
+        /\ lastProcessed' = [lastProcessed  EXCEPT ![i] = InitLastProcessed(i)]
+        /\ lastCommitted' = [lastCommitted  EXCEPT ![i] = lastSnapshot[i]]
+        /\ UNCHANGED <<state, currentEpoch, zabState, acceptedEpoch, history, 
+                       lastSnapshot, initialHistory, leaderVars, electionVars, 
+                       followerVars, verifyVars, msgVars, partition>>
+        /\ UpdateRecorder(<<"NodeStart", i>>)
+-----------------------------------------------------------------------------
+(* Establish connection between leader and follower, containing actions like 
+   addLearnerHandler, findLeader, connectToLeader.*)
+ConnectAndFollowerSendFOLLOWERINFO(i, j) ==
+        /\ IsON(i)     /\ IsON(j)
+        /\ IsLeader(i) /\ \lnot IsMyLearner(i, j)
+        /\ IsFollower(j) /\ HasNoLeader(j) /\ MyVote(j) = i
+        /\ learners'   = [learners   EXCEPT ![i] = learners[i] \union {j}] 
+        /\ connectInfo' = [connectInfo EXCEPT ![j].sid = i]
+        /\ Send(j, i, [ mtype |-> FOLLOWERINFO,
+                        mzxid |-> <<acceptedEpoch[j], 0>> ])  
+        /\ UNCHANGED <<serverVars, electionVars, leadingVoteSet, connecting, 
+                       electing, ackldRecv, forwarding, tempMaxEpoch,
+                       verifyVars, envVars, electionMsgs, packetsSync>>
+        /\ UpdateRecorder(<<"ConnectAndFollowerSendFOLLOWERINFO", i, j>>)
+
+\* waitingForNewEpoch in Leader
+WaitingForNewEpoch(i, set) == (i \in set /\ IsQuorum(set)) = FALSE
+WaitingForNewEpochTurnToFalse(i, set) == /\ i \in set
+                                         /\ IsQuorum(set) 
+
+\* There may exists some follower in connecting but shuts down and
+\* connects again. So when leader broadcasts LEADERINFO, the
+\* follower will receive LEADERINFO, and receive it again after
+\* sending FOLLOWERINFO. So connected makes sure each follower
+\* will only receive LEADERINFO at most once before timeout. 
+UpdateConnectingOrAckldRecv(oldSet, sid) ==
+        LET sid_set == {s.sid: s \in oldSet}
+        IN IF sid \in sid_set
+           THEN LET old_info == CHOOSE info \in oldSet: info.sid = sid
+                    follower_info == [ sid       |-> sid,
+                                       connected |-> TRUE ]
+                IN (oldSet \ {old_info} ) \union {follower_info}
+           ELSE LET follower_info == [ sid       |-> sid,
+                                       connected |-> TRUE ]
+                IN oldSet \union {follower_info}
+
+(* Leader waits for receiving FOLLOWERINFO from a quorum including itself,
+   and chooses a new epoch e' as its own epoch and broadcasts LEADERINFO.
+   See getEpochToPropose in Leader for details. *)
+LeaderProcessFOLLOWERINFO(i, j) ==
+        /\ CheckEpoch  \* test restrictions of max epoch
+        /\ IsON(i)
+        /\ IsLeader(i)
+        /\ PendingFOLLOWERINFO(i, j)
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLearner(i, j)
+               lastAcceptedEpoch == msg.mzxid[1]
+               sid_connecting == {c.sid: c \in connecting[i]}
+           IN 
+           /\ infoOk
+           /\ \/ \* 1. has not broadcast LEADERINFO 
+                 /\ WaitingForNewEpoch(i, sid_connecting)
+                 /\ \/ /\ zabState[i] = DISCOVERY
+                       /\ UNCHANGED violatedInvariants
+                    \/ /\ zabState[i] /= DISCOVERY
+                       /\ PrintT("Exception: waitingForNewEpoch true," \o
+                          " while zabState not DISCOVERY.")
+                       /\ violatedInvariants' = [violatedInvariants EXCEPT !.stateInconsistent = TRUE]
+                 /\ tempMaxEpoch' = [tempMaxEpoch EXCEPT ![i] = IF lastAcceptedEpoch >= tempMaxEpoch[i] 
+                                                                THEN lastAcceptedEpoch + 1
+                                                                ELSE @]
+                 /\ connecting'   = [connecting   EXCEPT ![i] = UpdateConnectingOrAckldRecv(@, j) ]
+                 /\ LET new_sid_connecting == {c.sid: c \in connecting'[i]}
+                    IN
+                    \/ /\ WaitingForNewEpochTurnToFalse(i, new_sid_connecting)
+                       /\ acceptedEpoch' = [acceptedEpoch EXCEPT ![i] = tempMaxEpoch'[i]]
+                       /\ LET newLeaderZxid == <<acceptedEpoch'[i], 0>>
+                              m == [ mtype |-> LEADERINFO,
+                                     mzxid |-> newLeaderZxid ]
+                          IN DiscardAndBroadcastLEADERINFO(i, j, m)
+                    \/ /\ ~WaitingForNewEpochTurnToFalse(i, new_sid_connecting)
+                       /\ Discard(j, i)
+                       /\ UNCHANGED acceptedEpoch
+              \/  \* 2. has broadcast LEADERINFO 
+                 /\ ~WaitingForNewEpoch(i, sid_connecting)
+                 /\ Reply(i, j, [ mtype |-> LEADERINFO,
+                                  mzxid |-> <<acceptedEpoch[i], 0>> ] )
+                 /\ UNCHANGED <<tempMaxEpoch, connecting, acceptedEpoch, violatedInvariants>>
+        /\ UNCHANGED <<state, currentEpoch, lastProcessed, zabState, history, lastCommitted, 
+                       followerVars, electionVars, initialHistory, leadingVoteSet, learners, 
+                       electing, ackldRecv, forwarding, proposalMsgsLog, epochLeader, 
+                       lastSnapshot, electionMsgs, envVars>>
+        /\ UpdateRecorder(<<"LeaderProcessFOLLOWERINFO", i, j>>)
+        
+(* Follower receives LEADERINFO. If newEpoch >= acceptedEpoch, then follower 
+   updates acceptedEpoch and sends ACKEPOCH back, containing currentEpoch and
+   lastProcessedZxid. After this, zabState turns to SYNC. 
+   See registerWithLeader in Learner for details.*)
+FollowerProcessLEADERINFO(i, j) ==
+        /\ IsON(i)
+        /\ IsFollower(i)
+        /\ PendingLEADERINFO(i, j)
+        /\ LET msg      == msgs[j][i][1]
+               newEpoch == msg.mzxid[1]
+               infoOk   == IsMyLeader(i, j)
+               epochOk  == newEpoch >= acceptedEpoch[i]
+               stateOk  == zabState[i] = DISCOVERY
+           IN /\ infoOk
+              /\ \/ \* 1. Normal case
+                    /\ epochOk   
+                    /\ \/ /\ stateOk
+                          /\ \/ /\ newEpoch > acceptedEpoch[i]
+                                /\ acceptedEpoch' = [acceptedEpoch EXCEPT ![i] = newEpoch]
+                                /\ LET epochBytes == currentEpoch[i]
+                                       m == [ mtype  |-> ACKEPOCH,
+                                              mzxid  |-> lastProcessed[i].zxid, 
+                                              mepoch |-> epochBytes ] 
+                                   IN Reply(i, j, m)
+                             \/ /\ newEpoch = acceptedEpoch[i]
+                                /\ LET m == [ mtype  |-> ACKEPOCH,
+                                              mzxid  |-> lastProcessed[i].zxid,
+                                              mepoch |-> -1 ]
+                                   IN Reply(i, j, m)
+                                /\ UNCHANGED acceptedEpoch
+                          /\ zabState' = [zabState EXCEPT ![i] = SYNCHRONIZATION]
+                          /\ UNCHANGED violatedInvariants
+                       \/ /\ ~stateOk
+                          /\ PrintT("Exception: Follower receives LEADERINFO," \o
+                             " whileZabState not DISCOVERY.")
+                          /\ violatedInvariants' = [violatedInvariants EXCEPT !.stateInconsistent = TRUE]
+                          /\ Discard(j, i)
+                          /\ UNCHANGED <<acceptedEpoch, zabState>>
+                    /\ UNCHANGED <<varsL, connectInfo, learners, forwarding, electing,
+                                   connecting, ackldRecv>>
+                 \/ \* 2. Abnormal case - go back to election
+                    /\ ~epochOk 
+                    /\ FollowerShutdown(i)
+                    /\ Clean(i, connectInfo[i].sid)
+                    /\ RemoveLearner(connectInfo[i].sid, i)
+                    /\ UNCHANGED <<acceptedEpoch, violatedInvariants>>
+        /\ UNCHANGED <<history, lastCommitted, tempMaxEpoch, initialHistory, lastSnapshot,
+                       proposalMsgsLog, epochLeader, packetsSync, envVars>>
+        /\ UpdateRecorder(<<"FollowerProcessLEADERINFO", i, j>>)
+-----------------------------------------------------------------------------    
+RECURSIVE UpdateAckSidHelper(_,_,_,_)
+UpdateAckSidHelper(his, cur, end, target) ==
+        IF cur > end THEN his
+        ELSE LET curTxn == [ zxid   |-> his[1].zxid,
+                             value  |-> his[1].value,
+                             ackSid |-> IF target \in his[1].ackSid THEN his[1].ackSid
+                                        ELSE his[1].ackSid \union {target},
+                             epoch  |-> his[1].epoch ]
+             IN <<curTxn>> \o UpdateAckSidHelper(Tail(his), cur + 1, end, target)
+
+\* There originally existed one bug in LeaderProcessACK when 
+\* monotonicallyInc = FALSE, and it is we did not add ackSid of 
+\* history in SYNC. So we update ackSid in syncFollower.
+UpdateAckSid(his, lastSeenIndex, target) ==
+        IF Len(his) = 0 \/ lastSeenIndex = 0 THEN his
+        ELSE UpdateAckSidHelper(his, 1, Minimum( { Len(his), lastSeenIndex} ), target)
+
+\* return -1: this zxid appears at least twice; Len(his) + 1: does not exist;
+\* 1 ~ Len(his): exists and appears just once.
+RECURSIVE ZxidToIndexHelper(_,_,_,_)
+ZxidToIndexHelper(his, zxid, cur, appeared) ==
+        IF cur > Len(his) THEN cur  
+        ELSE IF TxnZxidEqual(his[cur], zxid) 
+             THEN CASE appeared = TRUE -> -1
+                  []   OTHER           -> Minimum( { cur, 
+                            ZxidToIndexHelper(his, zxid, cur + 1, TRUE) } )
+             ELSE ZxidToIndexHelper(his, zxid, cur + 1, appeared)
+
+ZxidToIndex(his, zxid) == IF ZxidEqual( zxid, <<0, 0>> ) THEN 0
+                          ELSE IF Len(his) = 0 THEN 1
+                               ELSE LET len == Len(his) IN
+                                    IF \E idx \in 1..len: TxnZxidEqual(his[idx], zxid)
+                                    THEN ZxidToIndexHelper(his, zxid, 1, FALSE)
+                                    ELSE len + 1
+
+\* Find index idx which meets: 
+\* history[idx].zxid <= zxid < history[idx + 1].zxid
+RECURSIVE IndexOfZxidHelper(_,_,_,_)
+IndexOfZxidHelper(his, zxid, cur, end) ==
+        IF cur > end THEN end
+        ELSE IF ZxidCompare(his[cur].zxid, zxid) THEN cur - 1
+             ELSE IndexOfZxidHelper(his, zxid, cur + 1, end)
+
+IndexOfZxid(his, zxid) == IF Len(his) = 0 THEN 0
+                          ELSE LET idx == ZxidToIndex(his, zxid)
+                                   len == Len(his)
+                               IN 
+                               IF idx <= len THEN idx
+                               ELSE IndexOfZxidHelper(his, zxid, 1, len)
+
+RECURSIVE queuePackets(_,_,_,_,_)
+queuePackets(queue, his, cur, committed, end) == 
+        IF cur > end THEN queue
+        ELSE CASE cur > committed ->
+                LET m_proposal == [ mtype |-> PROPOSAL, 
+                                    mzxid |-> his[cur].zxid,
+                                    mdata |-> his[cur].value ]
+                IN queuePackets(Append(queue, m_proposal), his, cur + 1, committed, end)
+             []   cur <= committed ->
+                LET m_proposal == [ mtype |-> PROPOSAL, 
+                                    mzxid |-> his[cur].zxid,
+                                    mdata |-> his[cur].value ]
+                    m_commit   == [ mtype |-> COMMIT,
+                                    mzxid |-> his[cur].zxid ]
+                    newQueue   == queue \o <<m_proposal, m_commit>>
+                IN queuePackets(newQueue, his, cur + 1, committed, end)
+
+RECURSIVE setPacketsForChecking(_,_,_,_,_,_)
+setPacketsForChecking(set, src, ep, his, cur, end) ==
+        IF cur > end THEN set
+        ELSE LET m_proposal == [ source |-> src,
+                                 epoch  |-> ep,
+                                 zxid   |-> his[cur].zxid,
+                                 data   |-> his[cur].value ]
+             IN setPacketsForChecking((set \union {m_proposal}), src, ep, his, cur + 1, end)
+
+\* Func lead() calls zk.loadData(), which will call takeSnapshot().
+LastSnapshot(i) == IF zabState[i] = BROADCAST THEN lastSnapshot[i]
+                   ELSE CASE IsLeader(i) -> 
+                            LET lastIndex == Len(history[i])
+                            IN IF lastIndex = 0 THEN [ index |-> 0,
+                                                       zxid  |-> <<0, 0>> ]
+                               ELSE [ index |-> lastIndex,
+                                      zxid  |-> history[i][lastIndex].zxid ]
+                        []   OTHER -> lastSnapshot[i]
+
+\* To compress state space, 
+\* 1. we merge sending SNAP and outputting snapshot buffer into sending SNAP, and
+\* 2. substitute sub sequence of history for snapshot of data tree.
+SerializeSnapshot(i, idx) == IF idx <= 0 THEN << >>
+                             ELSE SubSeq(history[i], 1, idx)
+
+(* See queueCommittedProposals in LearnerHandler and startForwarding in Leader
+   for details. For proposals in committedLog and toBeApplied, send <PROPOSAL,
+   COMMIT>. For proposals in outstandingProposals, send PROPOSAL only. *)
+SendSyncMsgs(i, j, lastSeenZxid, lastSeenIndex, mode, needRemoveHead) ==
+        /\ LET lastCommittedIndex == IF zabState[i] = BROADCAST 
+                                     THEN lastCommitted[i].index
+                                     ELSE Len(history[i])
+               lastProposedIndex  == Len(history[i])
+               queue_origin == IF lastSeenIndex >= lastProposedIndex 
+                               THEN << >>
+                               ELSE queuePackets(<< >>, history[i], 
+                                    lastSeenIndex + 1, lastCommittedIndex,
+                                    lastProposedIndex)
+               set_forChecking == IF lastSeenIndex >= lastProposedIndex 
+                                  THEN {}
+                                  ELSE setPacketsForChecking( { }, i, 
+                                        acceptedEpoch[i], history[i],
+                                        lastSeenIndex + 1, lastProposedIndex)
+               m_trunc == [ mtype |-> TRUNC, mtruncZxid |-> lastSeenZxid ]
+               m_diff  == [ mtype |-> DIFF,  mzxid |-> lastSeenZxid ]
+               m_snap  == [ mtype |-> SNAP,  msnapZxid |-> lastSeenZxid,
+                                             msnapshot |-> SerializeSnapshot(i, lastSeenIndex) ]
+               newLeaderZxid == <<acceptedEpoch[i], 0>>
+               m_newleader == [ mtype |-> NEWLEADER,
+                                mzxid |-> newLeaderZxid ]
+               queue_toSend == CASE mode = TRUNC -> (<<m_trunc>> \o queue_origin) \o <<m_newleader>>
+                               []   mode = DIFF  -> (<<m_diff>>  \o queue_origin) \o <<m_newleader>>
+                               []   mode = SNAP  -> (<<m_snap>>  \o queue_origin) \o <<m_newleader>>
+           IN /\ \/ /\ needRemoveHead
+                    /\ DiscardAndSendPackets(i, j, queue_toSend)
+                 \/ /\ ~needRemoveHead
+                    /\ SendPackets(i, j, queue_toSend)
+              /\ proposalMsgsLog' = proposalMsgsLog \union set_forChecking
+        /\ forwarding' = [forwarding EXCEPT ![i] = @ \union {j} ]
+        /\ \/ /\ mode = TRUNC \/ mode = DIFF 
+              /\ history' = [history EXCEPT ![i] = UpdateAckSid(@, lastSeenIndex, j) ]
+           \/ /\ mode = SNAP
+              /\ UNCHANGED history \* txns before minCommitted don't need to be committed again
+
+(* Leader syncs with follower by sending DIFF/TRUNC/SNAP/PROPOSAL/COMMIT/NEWLEADER.
+   See syncFollower in LearnerHandler for details. *)
+SyncFollower(i, j, peerLastZxid, needRemoveHead) ==
+        LET \* IsPeerNewEpochZxid == peerLastZxid[2] = 0
+            lastProcessedZxid == lastProcessed[i].zxid
+            minCommittedIdx   == lastSnapshot[i].index + 1
+            maxCommittedIdx   == IF zabState[i] = BROADCAST THEN lastCommitted[i].index
+                                 ELSE Len(history[i])
+            committedLogEmpty == minCommittedIdx > maxCommittedIdx
+            minCommittedLog   == IF committedLogEmpty THEN lastProcessedZxid
+                                 ELSE history[i][minCommittedIdx].zxid
+            maxCommittedLog   == IF committedLogEmpty THEN lastProcessedZxid
+                                 ELSE IF maxCommittedIdx = 0 THEN << 0, 0>>
+                                      ELSE history[i][maxCommittedIdx].zxid
+
+            \* Hypothesis: 1. minCommittedLog : txn with index of lastSnapshot + 1
+            \*             2. maxCommittedLog : LastCommitted, to compress state space.
+            \*             3. merge queueCommittedProposals,startForwarding and 
+            \*                sending NEWLEADER into SendSyncMsgs.
+
+        IN \/ \* case1. peerLastZxid = lastProcessedZxid,
+              \*        sned DIFF & StartForwarding(lastProcessedZxid)
+              /\ ZxidEqual(peerLastZxid, lastProcessedZxid)
+              /\ SendSyncMsgs(i, j, peerLastZxid, lastProcessed[i].index, 
+                                    DIFF, needRemoveHead)
+           \/ /\ ~ZxidEqual(peerLastZxid, lastProcessedZxid)
+              /\ \/ \* case2. peerLastZxid > maxCommittedLog,
+                    \*        send TRUNC(maxCommittedLog) & StartForwarding
+                    /\ ZxidCompare(peerLastZxid, maxCommittedLog)
+                    /\ SendSyncMsgs(i, j, maxCommittedLog, maxCommittedIdx, 
+                                          TRUNC, needRemoveHead)
+                 \/ \* case3. minCommittedLog <= peerLastZxid <= maxCommittedLog
+                    /\ ~ZxidCompare(peerLastZxid, maxCommittedLog)
+                    /\ ~ZxidCompare(minCommittedLog, peerLastZxid)
+                    /\ LET lastSeenIndex == ZxidToIndex(history[i], peerLastZxid)
+                           exist == /\ lastSeenIndex >= minCommittedIdx
+                                    /\ lastSeenIndex <= Len(history[i])
+                           lastIndex == IF exist THEN lastSeenIndex
+                                        ELSE IndexOfZxid(history[i], peerLastZxid)
+                           \* Maximum zxid that < peerLastZxid
+                           lastZxid  == IF exist THEN peerLastZxid
+                                        ELSE IF lastIndex = 0 THEN <<0, 0>>
+                                             ELSE history[i][lastIndex].zxid
+                       IN 
+                       \/ \* case 3.1. peerLastZxid exists in committedLog,
+                          \*           DIFF + queueCommittedProposals(peerLastZxid + 1)
+                          \*                + StartForwarding
+                          /\ exist
+                          /\ SendSyncMsgs(i, j, peerLastZxid, lastSeenIndex, 
+                                                DIFF, needRemoveHead)
+                       \/ \* case 3.2. peerLastZxid does not exist in committedLog,
+                          \*           TRUNC(lastZxid) + queueCommittedProposals(lastZxid + 1)
+                          \*                           + StartForwarding
+                          /\ ~exist
+                          /\ SendSyncMsgs(i, j, lastZxid, lastIndex, 
+                                                TRUNC, needRemoveHead)
+                 \/ \* case4. peerLastZxid < minCommittedLog,
+                    \*        send SNAP(lastProcessed) + StartForwarding
+                    /\ ZxidCompare(minCommittedLog, peerLastZxid)
+                    /\ SendSyncMsgs(i, j, lastProcessedZxid, maxCommittedIdx,
+                                          SNAP, needRemoveHead)
+
+\* compare state summary of two servers
+IsMoreRecentThan(ss1, ss2) == \/ ss1.currentEpoch > ss2.currentEpoch
+                              \/ /\ ss1.currentEpoch = ss2.currentEpoch
+                                 /\ ZxidCompare(ss1.lastZxid, ss2.lastZxid)
+
+\* electionFinished in Leader
+ElectionFinished(i, set) == /\ i \in set
+                            /\ IsQuorum(set)
+
+\* There may exist some follower shuts down and connects again, while
+\* it has sent ACKEPOCH or updated currentEpoch last time. This means
+\* sid of this follower has existed in elecingFollower but its info 
+\* is old. So we need to make sure each sid in electingFollower is 
+\* unique and latest(newest).
+UpdateElecting(oldSet, sid, peerLastZxid, inQuorum) ==
+        LET sid_electing == {s.sid: s \in oldSet }
+        IN IF sid \in sid_electing 
+           THEN LET old_info == CHOOSE info \in oldSet : info.sid = sid
+                    follower_info == 
+                             [ sid          |-> sid,
+                               peerLastZxid |-> peerLastZxid,
+                               inQuorum     |-> (inQuorum \/ old_info.inQuorum) ]
+                IN (oldSet \ {old_info} ) \union {follower_info}
+           ELSE LET follower_info == 
+                             [ sid          |-> sid,
+                               peerLastZxid |-> peerLastZxid,
+                               inQuorum     |-> inQuorum ]
+                IN oldSet \union {follower_info}
+
+LeaderTurnToSynchronization(i) ==
+        /\ currentEpoch' = [currentEpoch EXCEPT ![i] = acceptedEpoch[i]]
+        /\ zabState'     = [zabState     EXCEPT ![i] = SYNCHRONIZATION]
+
+(* Leader waits for receiving ACKEPOPCH from a quorum, and check whether it has most recent
+   state summary from them. After this, leader's zabState turns to SYNCHRONIZATION.
+   See waitForEpochAck in Leader for details. *)
+LeaderProcessACKEPOCH(i, j) ==
+        /\ IsON(i)
+        /\ IsLeader(i)
+        /\ PendingACKEPOCH(i, j)
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLearner(i, j)           
+               leaderStateSummary   == [ currentEpoch |-> currentEpoch[i], 
+                                         lastZxid     |-> lastProcessed[i].zxid ]
+               followerStateSummary == [ currentEpoch |-> msg.mepoch,  
+                                         lastZxid     |-> msg.mzxid ]
+               logOk == \* whether follower is no more up-to-date than leader
+                        ~IsMoreRecentThan(followerStateSummary, leaderStateSummary)
+               electing_quorum == {e \in electing[i]: e.inQuorum = TRUE }
+               sid_electing == {s.sid: s \in electing_quorum }
+           IN /\ infoOk
+              /\ \/ \* electionFinished = true, jump ouf of waitForEpochAck. 
+                    \* Different from code, here we still need to record info
+                    \* into electing, to help us perform syncFollower afterwards.
+                    \* Since electing already meets quorum, it does not break
+                    \* consistency between code and spec.
+                    /\ ElectionFinished(i, sid_electing)
+                    /\ electing' = [electing EXCEPT ![i] = UpdateElecting(@, j, msg.mzxid, FALSE) ]
+                    /\ Discard(j, i)
+                    /\ UNCHANGED <<varsL, zabState, forwarding, connectInfo, 
+                                   learners, epochLeader, violatedInvariants>>
+                 \/ /\ ~ElectionFinished(i, sid_electing)
+                    /\ \/ /\ zabState[i] = DISCOVERY
+                          /\ UNCHANGED violatedInvariants
+                       \/ /\ zabState[i] /= DISCOVERY
+                          /\ PrintT("Exception: electionFinished false," \o
+                             " while zabState not DISCOVERY.")
+                          /\ violatedInvariants' = [violatedInvariants EXCEPT 
+                                                    !.stateInconsistent = TRUE]
+                    /\ \/ /\ followerStateSummary.currentEpoch = -1
+                          /\ electing' = [electing EXCEPT ![i] = UpdateElecting(@, j, 
+                                                                msg.mzxid, FALSE) ]
+                          /\ Discard(j, i)
+                          /\ UNCHANGED <<varsL, zabState, forwarding, connectInfo, 
+                                         learners, epochLeader>>
+                       \/ /\ followerStateSummary.currentEpoch > -1
+                          /\ \/ \* normal follower 
+                                /\ logOk
+                                /\ electing' = [electing EXCEPT ![i] = 
+                                            UpdateElecting(@, j, msg.mzxid, TRUE) ]
+                                /\ LET new_electing_quorum == {e \in electing'[i]: e.inQuorum = TRUE }
+                                       new_sid_electing == {s.sid: s \in new_electing_quorum }
+                                   IN 
+                                   \/ \* electionFinished = true, jump out of waitForEpochAck,
+                                      \* update currentEpoch and zabState.
+                                      /\ ElectionFinished(i, new_sid_electing) 
+                                      /\ LeaderTurnToSynchronization(i)
+                                      /\ LET newLeaderEpoch == acceptedEpoch[i]
+                                         IN epochLeader' = [epochLeader EXCEPT ![newLeaderEpoch]
+                                                = @ \union {i} ] \* for checking invariants
+                                   \/ \* there still exists electionFinished = false.
+                                      /\ ~ElectionFinished(i, new_sid_electing)
+                                      /\ UNCHANGED <<currentEpoch, zabState, epochLeader>>
+                                /\ Discard(j, i)
+                                /\ UNCHANGED <<state, lastProcessed, electionVars, leadingVoteSet,
+                                               electionMsgs, connectInfo, learners, history, forwarding>>
+                             \/ \* Exists follower more recent than leader
+                                /\ ~logOk 
+                                /\ LeaderShutdown(i)
+                                /\ UNCHANGED <<electing, epochLeader>>
+        /\ UNCHANGED <<acceptedEpoch, lastCommitted, lastSnapshot, connecting, ackldRecv,
+                       tempMaxEpoch, initialHistory, packetsSync, proposalMsgsLog, envVars>>
+        /\ UpdateRecorder(<<"LeaderProcessACKEPOCH", i, j>>)
+
+\* Strip syncFollower from LeaderProcessACKEPOCH.
+\* Only when electionFinished = true and there exists some
+\* learnerHandler has not perform syncFollower, this 
+\* action will be called.
+LeaderSyncFollower(i, j) ==
+        /\ IsON(i)
+        /\ IsLeader(i)
+        /\ LET electing_quorum == {e \in electing[i]: e.inQuorum = TRUE }
+               electionFinished == ElectionFinished(i, {s.sid: s \in electing_quorum } )
+               toSync == {s \in electing[i] : /\ ~ZxidEqual( s.peerLastZxid, <<-1, -1>>)
+                                              /\ s.sid \in learners[i] }
+               canSync == toSync /= {}
+           IN
+           /\ electionFinished
+           /\ canSync
+           /\ \E s \in toSync: s.sid = j
+           /\ LET chosen == CHOOSE s \in toSync: s.sid = j
+                  newChosen == [ sid          |-> chosen.sid,
+                                 peerLastZxid |-> <<-1, -1>>, \* <<-1,-1>> means has handled.
+                                 inQuorum     |-> chosen.inQuorum ] 
+              IN /\ SyncFollower(i, chosen.sid, chosen.peerLastZxid, FALSE)
+                 /\ electing' = [electing EXCEPT ![i] = (@ \ {chosen}) \union {newChosen} ]
+        /\ UNCHANGED <<state, currentEpoch, lastProcessed, zabState, acceptedEpoch, 
+                    lastCommitted, initialHistory, electionVars, leadingVoteSet,
+                    learners, connecting, ackldRecv, tempMaxEpoch, followerVars, 
+                    lastSnapshot, epochLeader, violatedInvariants, electionMsgs, envVars>>
+        /\ UpdateRecorder(<<"LeaderSyncFollower", i, j>>)
+
+TruncateLog(his, index) == IF index <= 0 THEN << >>
+                           ELSE SubSeq(his, 1, index)
+
+(* Follower receives DIFF/TRUNC, and then may receives PROPOSAL,COMMIT,NEWLEADER,
+   and UPTODATE. See syncWithLeader in Learner for details. *)
+FollowerProcessSyncMessage(i, j) ==
+        /\ IsON(i)
+        /\ IsFollower(i)
+        /\ msgs[j][i] /= << >>
+        /\ \/ msgs[j][i][1].mtype = DIFF 
+           \/ msgs[j][i][1].mtype = TRUNC
+           \/ msgs[j][i][1].mtype = SNAP
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLeader(i, j)
+               stateOk == zabState[i] = SYNCHRONIZATION
+           IN /\ infoOk
+              /\ \/ \* Follower should receive packets in SYNC.
+                    /\ ~stateOk
+                    /\ PrintT("Exception: Follower receives DIFF/TRUNC/SNAP," \o
+                             " whileZabState not SYNCHRONIZATION.")
+                    /\ violatedInvariants' = [violatedInvariants EXCEPT !.stateInconsistent = TRUE]
+                    /\ UNCHANGED <<history, initialHistory, lastProcessed, lastCommitted, connectInfo>>
+                 \/ /\ stateOk
+                    /\ \/ /\ msg.mtype = DIFF
+                          /\ connectInfo' = [connectInfo EXCEPT ![i].syncMode = DIFF]         
+                          /\ UNCHANGED <<history, initialHistory, lastProcessed, lastCommitted,
+                                    violatedInvariants>>
+                       \/ /\ msg.mtype = TRUNC
+                          /\ connectInfo' = [connectInfo EXCEPT ![i].syncMode = TRUNC]
+                          /\ LET truncZxid  == msg.mtruncZxid
+                                 truncIndex == ZxidToIndex(history[i], truncZxid)
+                                 truncOk    == /\ truncIndex >= lastCommitted[i].index
+                                               /\ truncIndex <= Len(history[i])
+                             IN
+                             \/ /\ ~truncOk
+                                /\ PrintT("Exception: TRUNC error.")
+                                /\ violatedInvariants' = [violatedInvariants EXCEPT 
+                                                !.proposalInconsistent = TRUE]
+                                /\ UNCHANGED <<history, initialHistory, lastProcessed, lastCommitted>>
+                             \/ /\ truncOk
+                                /\ history' = [history EXCEPT 
+                                                    ![i] = TruncateLog(history[i], truncIndex)]
+                                /\ initialHistory' = [initialHistory EXCEPT ![i] = history'[i]]
+                                /\ lastProcessed' = [lastProcessed EXCEPT 
+                                                    ![i] = [ index |-> truncIndex,
+                                                             zxid  |-> truncZxid] ]
+                                /\ lastCommitted' = [lastCommitted EXCEPT 
+                                                    ![i] = [ index |-> truncIndex,
+                                                             zxid  |-> truncZxid] ]
+                                /\ UNCHANGED violatedInvariants
+                       \/ /\ msg.mtype = SNAP
+                          /\ connectInfo' = [connectInfo EXCEPT ![i].syncMode = SNAP]
+                          /\ history' = [history EXCEPT ![i] = msg.msnapshot]
+                          /\ initialHistory' = [initialHistory EXCEPT ![i] = history'[i]]
+                          /\ lastProcessed' = [lastProcessed EXCEPT 
+                                                    ![i] = [ index |-> Len(history'[i]),
+                                                             zxid  |-> msg.msnapZxid] ]
+                          /\ lastCommitted' = [lastCommitted EXCEPT 
+                                                    ![i] = [ index |-> Len(history'[i]),
+                                                             zxid  |-> msg.msnapZxid] ]
+                          /\ UNCHANGED violatedInvariants
+        /\ Discard(j, i)
+        /\ UNCHANGED <<state, currentEpoch, zabState, acceptedEpoch, electionVars,
+                       leaderVars, tempMaxEpoch, packetsSync, lastSnapshot,
+                       proposalMsgsLog, epochLeader, electionMsgs, envVars>>
+        /\ UpdateRecorder(<<"FollowerProcessSyncMessage", i, j>>)
+
+\* See variable snapshotNeeded in Learner for details.
+SnapshotNeeded(i) == \/ connectInfo[i].syncMode = TRUNC
+                     \/ connectInfo[i].syncMode = SNAP
+
+\* See variable writeToTxnLog in Learner for details.
+WriteToTxnLog(i) == IF \/ connectInfo[i].syncMode = DIFF
+                       \/ connectInfo[i].nlRcv = TRUE
+                    THEN TRUE ELSE FALSE
+
+\* See lastProposed in Leader for details.
+LastProposed(i) == IF Len(history[i]) = 0 THEN [ index |-> 0, 
+                                                 zxid  |-> <<0, 0>> ]
+                   ELSE
+                   LET lastIndex == Len(history[i])
+                       entry     == history[i][lastIndex]
+                   IN [ index |-> lastIndex,
+                        zxid  |-> entry.zxid ]
+
+\* See lastQueued in Learner for details.
+LastQueued(i) == IF ~IsFollower(i) \/ zabState[i] /= SYNCHRONIZATION 
+                 THEN LastProposed(i)
+                 ELSE \* condition: IsFollower(i) /\ zabState = SYNCHRONIZATION
+                      LET packetsInSync == packetsSync[i].notCommitted
+                          lenSync  == Len(packetsInSync)
+                          totalLen == Len(history[i]) + lenSync
+                      IN IF lenSync = 0 THEN LastProposed(i)
+                         ELSE [ index |-> totalLen,
+                                zxid  |-> packetsInSync[lenSync].zxid ]
+
+IsNextZxid(curZxid, nextZxid) ==
+            \/ \* first PROPOSAL in this epoch
+               /\ nextZxid[2] = 1
+               /\ curZxid[1] < nextZxid[1]
+            \/ \* not first PROPOSAL in this epoch
+               /\ nextZxid[2] > 1
+               /\ curZxid[1] = nextZxid[1]
+               /\ curZxid[2] + 1 = nextZxid[2]
+
+FollowerProcessPROPOSALInSync(i, j) ==
+        /\ IsON(i)
+        /\ IsFollower(i)
+        /\ PendingPROPOSAL(i, j)
+        /\ zabState[i] = SYNCHRONIZATION
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLeader(i, j)
+               isNext == IsNextZxid(LastQueued(i).zxid, msg.mzxid)
+               newTxn == [ zxid   |-> msg.mzxid,
+                           value  |-> msg.mdata,
+                           ackSid |-> {},    \* follower do not consider ackSid
+                           epoch  |-> acceptedEpoch[i] ] \* epoch of this round
+           IN /\ infoOk
+              /\ \/ /\ isNext
+                    /\ packetsSync' = [packetsSync EXCEPT ![i].notCommitted 
+                                = Append(packetsSync[i].notCommitted, newTxn) ]
+                 \/ /\ ~isNext
+                    /\ PrintT("Warn: Follower receives PROPOSAL," \o
+                        " while zxid != lastQueued + 1.")
+                    /\ UNCHANGED packetsSync
+        \* logRequest -> SyncRequestProcessor -> SendAckRequestProcessor -> reply ack
+        \* So here we do not need to send ack to leader.
+        /\ Discard(j, i)
+        /\ UNCHANGED <<serverVars, electionVars, leaderVars, connectInfo,
+                       verifyVars, electionMsgs, envVars>>
+        /\ UpdateRecorder(<<"FollowerProcessPROPOSALInSync", i, j>>)
+
+RECURSIVE IndexOfFirstTxnWithEpoch(_,_,_,_)
+IndexOfFirstTxnWithEpoch(his, epoch, cur, end) == 
+            IF cur > end THEN cur 
+            ELSE IF his[cur].epoch = epoch THEN cur
+                 ELSE IndexOfFirstTxnWithEpoch(his, epoch, cur + 1, end)
+
+LastCommitted(i) == IF zabState[i] = BROADCAST THEN lastCommitted[i]
+                    ELSE CASE IsLeader(i)   -> 
+                            LET lastInitialIndex == Len(initialHistory[i])
+                            IN IF lastInitialIndex = 0 THEN [ index |-> 0,
+                                                              zxid  |-> <<0, 0>> ]
+                               ELSE [ index |-> lastInitialIndex,
+                                      zxid  |-> history[i][lastInitialIndex].zxid ]
+                         []   IsFollower(i) ->
+                            LET completeHis == history[i] \o packetsSync[i].notCommitted
+                                packetsCommitted == packetsSync[i].committed
+                                lenCommitted == Len(packetsCommitted)
+                            IN IF lenCommitted = 0 \* return last one in history
+                               THEN LET lastIndex == Len(history[i])
+                                        lastInitialIndex == Len(initialHistory[i])
+                                    IN IF lastIndex = lastInitialIndex
+                                       THEN IF lastIndex = 0
+                                            THEN [ index |-> 0,
+                                                   zxid  |-> <<0, 0>> ]
+                                            ELSE [ index |-> lastIndex ,
+                                                   zxid  |-> history[lastIndex].zxid ]
+                                       ELSE IF lastInitialIndex < lastCommitted[i].index
+                                            THEN lastCommitted[i]
+                                            ELSE IF lastInitialIndex = 0
+                                                 THEN [ index |-> 0,
+                                                        zxid  |-> <<0, 0>> ]
+                                                 ELSE [ index |-> lastInitialIndex,
+                                                        zxid  |-> history[lastInitialIndex].zxid ]
+                               ELSE                \* return tail of packetsCommitted
+                                    LET committedIndex == ZxidToIndex(completeHis, 
+                                                     packetsCommitted[lenCommitted] )
+                                    IN [ index |-> committedIndex, 
+                                         zxid  |-> packetsCommitted[lenCommitted] ]
+                         []   OTHER -> lastCommitted[i]
+
+TxnWithIndex(i, idx) == IF ~IsFollower(i) \/ zabState[i] /= SYNCHRONIZATION 
+                        THEN history[i][idx]
+                        ELSE LET completeHis == history[i] \o packetsSync[i].notCommitted
+                             IN completeHis[idx]
+
+(* To simplify specification, we assume snapshotNeeded = false and 
+   writeToTxnLog = true. So here we just call packetsCommitted.add. *)
+FollowerProcessCOMMITInSync(i, j) ==
+        /\ IsON(i)
+        /\ IsFollower(i)
+        /\ PendingCOMMIT(i, j)
+        /\ zabState[i] = SYNCHRONIZATION
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLeader(i, j)
+               committedIndex == LastCommitted(i).index + 1
+               exist == /\ committedIndex <= LastQueued(i).index
+                        /\ IsNextZxid(LastCommitted(i).zxid, msg.mzxid)
+               match == ZxidEqual(msg.mzxid, TxnWithIndex(i, committedIndex).zxid )
+           IN /\ infoOk 
+              /\ \/ /\ exist
+                    /\ \/ /\ match
+                          /\ LET writeToTxnLog == WriteToTxnLog(i)
+                             IN
+                             \/ /\ ~writeToTxnLog \* zk.processTxn() & packetsNotCommitted.remove()
+                                /\ LET committedTxn == packetsSync[i].notCommitted[1]
+                                   IN 
+                                   /\ history' = [ history EXCEPT ![i] 
+                                               = Append(@, committedTxn)]
+                                   /\ lastCommitted' = [ lastCommitted EXCEPT ![i]
+                                                     = [index |-> Len(history'[i]),
+                                                        zxid  |-> committedTxn.zxid ] ]
+                                   /\ lastProcessed' = [ lastProcessed EXCEPT ![i]
+                                                     = lastCommitted'[i] ]
+                                   /\ packetsSync' = [ packetsSync EXCEPT ![i].notCommitted
+                                                   = Tail(@) ]
+                             \/ /\ writeToTxnLog  \* packetsCommitted.add()
+                                /\ packetsSync' = [ packetsSync EXCEPT ![i].committed
+                                                = Append(packetsSync[i].committed, msg.mzxid) ]
+                                /\ UNCHANGED <<history, lastCommitted, lastProcessed>>
+                          /\ UNCHANGED violatedInvariants
+                       \/ /\ ~match
+                          /\ PrintT("Warn: Follower receives COMMIT," \o
+                               " but zxid not the next committed zxid in COMMIT.")
+                          /\ violatedInvariants' = [violatedInvariants EXCEPT 
+                                    !.commitInconsistent = TRUE ]
+                          /\ UNCHANGED <<history, lastCommitted, lastProcessed, packetsSync>>
+                 \/ /\ ~exist
+                    /\ PrintT("Warn: Follower receives COMMIT," \o
+                         " but no packets with its zxid exists.")
+                    /\ violatedInvariants' = [violatedInvariants EXCEPT 
+                                !.commitInconsistent = TRUE ]
+                    /\ UNCHANGED <<history, lastCommitted, lastProcessed, packetsSync>>
+        /\ Discard(j, i)
+        /\ UNCHANGED <<state, currentEpoch, zabState, acceptedEpoch,
+                       lastSnapshot, initialHistory, electionVars, leaderVars,
+                       connectInfo, epochLeader, proposalMsgsLog, electionMsgs, envVars>>
+        /\ UpdateRecorder(<<"FollowerProcessCOMMITInSync", i, j>>)
+
+\* Assuming that everytime committing two txns, node takes snapshot.
+ShouldSnapshot(i) == lastCommitted[i].index - lastSnapshot[i].index >= 2
+
+(* There are mainly three places where calling takeSnapshot():
+   1. zk.loadData() in lead() when node becomes leader;
+   2. syncRequestProcessor.run() tells when to snapshot;
+   3. node processing NEWLEADER in learner.syncWithLeader();
+ *)
+ TakeSnapshot(i) == LET snapOk == lastSnapshot[i].index <= lastCommitted[i].index
+                    IN \/ /\ snapOk
+                          /\ lastSnapshot' = [ lastSnapshot EXCEPT ![i] = lastCommitted[i] ]
+                          /\ UNCHANGED violatedInvariants
+                       \/ /\ ~snapOk
+                          /\ PrintT("Exception: index of snapshot greater than" \o
+                                    "index of committed.")
+                          /\ violatedInvariants' = [violatedInvariants EXCEPT 
+                                                    !.commitInconsistent = TRUE ]
+                          /\ UNCHANGED lastSnapshot
+
+RECURSIVE ACKInBatches(_,_)
+ACKInBatches(queue, packets) ==
+        IF packets = << >> THEN queue
+        ELSE LET head == packets[1]
+                 newPackets == Tail(packets)
+                 m_ack == [ mtype |-> ACK,
+                            mzxid |-> head.zxid ]
+             IN ACKInBatches( Append(queue, m_ack), newPackets )
+
+(* Update currentEpoch, and logRequest every packets in
+   packetsNotCommitted and clear it. As syncProcessor will 
+   be called in logRequest, we have to reply acks here. *)
+FollowerProcessNEWLEADER(i, j) ==
+        /\ IsON(i)
+        /\ IsFollower(i)
+        /\ PendingNEWLEADER(i, j)
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLeader(i, j)
+               packetsInSync == packetsSync[i].notCommitted
+               m_ackld == [ mtype |-> ACKLD,
+                            mzxid |-> msg.mzxid ]
+               ms_ack  == ACKInBatches( << >>, packetsInSync )
+               queue_toSend == <<m_ackld>> \o ms_ack \* send ACK-NEWLEADER first.
+           IN /\ infoOk
+              /\ currentEpoch' = [currentEpoch EXCEPT ![i] = acceptedEpoch[i] ]
+              /\ history'      = [history      EXCEPT ![i] = @ \o packetsInSync ]
+              /\ packetsSync'  = [packetsSync  EXCEPT ![i].notCommitted = << >> ]
+              /\ connectInfo'  = [connectInfo  EXCEPT ![i].nlRcv = TRUE,
+                                                      ![i].syncMode = NONE ]
+              /\ \/ /\ SnapshotNeeded(i)
+                    /\ TakeSnapshot(i)
+                 \/ /\ ~SnapshotNeeded(i)
+                    /\ UNCHANGED <<lastSnapshot, violatedInvariants>>
+              /\ DiscardAndSendPackets(i, j, queue_toSend)
+        /\ UNCHANGED <<state, lastProcessed, zabState, acceptedEpoch, lastCommitted, 
+                       electionVars, leaderVars, initialHistory,
+                       proposalMsgsLog, epochLeader, electionMsgs, envVars>>
+        /\ UpdateRecorder(<<"FollowerProcessNEWLEADER", i, j>>)
+
+\* quorumFormed in Leader
+QuorumFormed(i, set) == i \in set /\ IsQuorum(set)
+
+UpdateElectionVote(i, epoch) == UpdateProposal(i, currentVote[i].proposedLeader,
+                                    currentVote[i].proposedZxid, epoch)
+
+\* See startZkServer in Leader for details.
+StartZkServer(i) ==
+        LET latest == LastProposed(i)
+        IN /\ lastCommitted' = [lastCommitted EXCEPT ![i] = latest]
+           /\ lastProcessed' = [lastProcessed EXCEPT ![i] = latest]
+           /\ lastSnapshot'  = [lastSnapshot  EXCEPT ![i] = latest]
+           /\ UpdateElectionVote(i, acceptedEpoch[i])
+
+LeaderTurnToBroadcast(i) ==
+        /\ StartZkServer(i)
+        /\ zabState' = [zabState EXCEPT ![i] = BROADCAST]
+
+(* Leader waits for receiving quorum of ACK whose lower bits of zxid is 0, and
+   broadcasts UPTODATE. See waitForNewLeaderAck for details.  *)
+LeaderProcessACKLD(i, j) ==
+        /\ IsON(i)
+        /\ IsLeader(i)
+        /\ PendingACKLD(i, j)
+        /\ LET msg    == msgs[j][i][1]
+               infoOk == IsMyLearner(i, j)
+               match  == ZxidEqual(msg.mzxid, <<acceptedEpoch[i], 0>>)
+               currentZxid == <<acceptedEpoch[i], 0>>
+               m_uptodate == [ mtype |-> UPTODATE,
+                               mzxid |-> currentZxid ] \* not important
+               sid_ackldRecv == {a.sid: a \in ackldRecv[i]}
+           IN /\ infoOk
+              /\ \/ \* just reply UPTODATE.
+                    /\ QuorumFormed(i, sid_ackldRecv)
+                    /\ Reply(i, j, m_uptodate)
+                    /\ UNCHANGED <<ackldRecv, zabState, lastCommitted, lastProcessed,
+                                   lastSnapshot, currentVote, violatedInvariants>>
+                 \/ /\ ~QuorumFormed(i, sid_ackldRecv)
+                    /\ \/ /\ match
+                          /\ ackldRecv' = [ackldRecv EXCEPT ![i] = UpdateConnectingOrAckldRecv(@, j) ]
+                          /\ LET new_sid_ackldRecv == {a.sid: a \in ackldRecv'[i]}
+                             IN
+                             \/ \* jump out of waitForNewLeaderAck, and do startZkServer,
+                                \* setZabState, and reply UPTODATE.
+                                /\ QuorumFormed(i, new_sid_ackldRecv)
+                                /\ LeaderTurnToBroadcast(i)
+                                /\ DiscardAndBroadcastUPTODATE(i, j, m_uptodate)
+                             \/ \* still wait in waitForNewLeaderAck.
+                                /\ ~QuorumFormed(i, new_sid_ackldRecv)
+                                /\ Discard(j, i)
+                                /\ UNCHANGED <<zabState, lastCommitted, lastProcessed,
+                                               lastSnapshot, currentVote>>
+                          /\ UNCHANGED violatedInvariants
+                       \/ /\ ~match
+                          /\ PrintT("Exception: NEWLEADER ACK is from a different epoch. ")
+                          /\ violatedInvariants' = [violatedInvariants EXCEPT 
+                                        !.ackInconsistent = TRUE]
+                          /\ Discard(j, i)
+                          /\ UNCHANGED <<ackldRecv, zabState, lastCommitted, 
+                                         lastSnapshot, lastProcessed, currentVote>>
+        /\ UNCHANGED <<state, currentEpoch, acceptedEpoch, history, logicalClock, receiveVotes, 
+                    outOfElection, recvQueue, waitNotmsg, leadingVoteSet, learners, connecting, 
+                    electing, forwarding, tempMaxEpoch, initialHistory, followerVars, 
+                    proposalMsgsLog, epochLeader, electionMsgs ,envVars>>
+        /\ UpdateRecorder(<<"LeaderProcessACKLD", i, j>>)
+
+TxnsWithPreviousEpoch(i) ==
+            LET completeHis == IF ~IsFollower(i) \/ zabState[i] /= SYNCHRONIZATION 
+                               THEN history[i] 
+                               ELSE history[i] \o packetsSync[i].notCommitted
+                end   == Len(completeHis)
+                first == IndexOfFirstTxnWithEpoch(completeHis, acceptedEpoch[i], 1, end)
+            IN IF first > end THEN completeHis
+               ELSE SubSeq(completeHis, 1, first - 1)
+
+TxnsRcvWithCurEpoch(i) ==
+            LET completeHis == IF ~IsFollower(i) \/ zabState[i] /= SYNCHRONIZATION 
+                               THEN history[i] 
+                               ELSE history[i] \o packetsSync[i].notCommitted
+                end   == Len(completeHis)
+                first == IndexOfFirstTxnWithEpoch(completeHis, acceptedEpoch[i], 1, end)
+            IN IF first > end THEN << >>
+               ELSE SubSeq(completeHis, first, end) \* completeHis[first : end]
+
+\* Txns received in current epoch but not committed.
+\* See pendingTxns in FollowerZooKeeper for details.
+PendingTxns(i) == IF ~IsFollower(i) \/ zabState[i] /= SYNCHRONIZATION 
+                  THEN SubSeq(history[i], lastCommitted[i].index + 1, Len(history[i]))
+                  ELSE LET packetsCommitted == packetsSync[i].committed
+                           completeHis == history[i] \o packetsSync[i].notCommitted
+                       IN IF Len(packetsCommitted) = 0 
+                          THEN SubSeq(completeHis, Len(history[i]) + 1, Len(completeHis))
+                          ELSE SubSeq(completeHis, LastCommitted(i).index + 1, Len(completeHis))
+
+CommittedTxns(i) == IF ~IsFollower(i) \/ zabState[i] /= SYNCHRONIZATION 
+                    THEN SubSeq(history[i], 1, lastCommitted[i].index)
+                    ELSE LET packetsCommitted == packetsSync[i].committed
+                             completeHis == history[i] \o packetsSync[i].notCommitted
+                         IN IF Len(packetsCommitted) = 0 THEN history[i]
+                            ELSE SubSeq( completeHis, 1, LastCommitted(i).index )
+
+\* Each zxid of packetsCommitted equals to zxid of 
+\* corresponding txn in txns.
+RECURSIVE TxnsAndCommittedMatch(_,_)
+TxnsAndCommittedMatch(txns, packetsCommitted) ==
+        LET len1 == Len(txns)
+            len2 == Len(packetsCommitted)
+        IN IF len2 = 0 THEN TRUE 
+           ELSE IF len1 < len2 THEN FALSE 
+                ELSE /\ ZxidEqual(txns[len1].zxid, packetsCommitted[len2])
+                     /\ TxnsAndCommittedMatch( SubSeq(txns, 1, len1 - 1), 
+                                               SubSeq(packetsCommitted, 1, len2 - 1) )
+
+FollowerLogRequestInBatches(i, leader, ms_ack, packetsNotCommitted) ==
+        /\ history' = [history EXCEPT ![i] = @ \o packetsNotCommitted ]
+        /\ DiscardAndSendPackets(i, leader, ms_ack)
+
+\* Since commit will call commitProcessor.commit, which will finally 
+\* update lastProcessed, we update it here atomically.
+FollowerCommitInBatches(i) ==
+        LET committedTxns == CommittedTxns(i)
+            packetsCommitted == packetsSync[i].committed
+            match == TxnsAndCommittedMatch(committedTxns, packetsCommitted)
+        IN 
+        \/ /\ match 
+           /\ lastCommitted' = [lastCommitted EXCEPT ![i] = LastCommitted(i)]
+           /\ lastProcessed' = [lastProcessed EXCEPT ![i] = lastCommitted'[i]]
+           /\ UNCHANGED violatedInvariants
+        \/ /\ ~match
+           /\ PrintT("Warn: Committing zxid without see txn. /" \o
+                "Committing zxid != pending txn zxid.")
+           /\ violatedInvariants' = [violatedInvariants EXCEPT 
+                        !.commitInconsistent = TRUE ]
+           /\ UNCHANGED <<lastCommitted, lastProcessed>>
+
+(* Follower jump out of outerLoop here, and log the stuff that came in
+   between snapshot and uptodate, which means calling logRequest and 
+   commit to clear packetsNotCommitted and packetsCommitted. *)
+FollowerProcessUPTODATE(i, j) ==
+        /\ IsON(i)
+        /\ IsFollower(i)
+        /\ PendingUPTODATE(i, j)
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLeader(i, j)
+               packetsNotCommitted == packetsSync[i].notCommitted
+               ms_ack == ACKInBatches(<< >>, packetsNotCommitted)
+           IN /\ infoOk
+              \* Here we ignore ack of UPTODATE.
+              /\ UpdateElectionVote(i, acceptedEpoch[i])
+              /\ FollowerLogRequestInBatches(i, j, ms_ack, packetsNotCommitted)
+              /\ FollowerCommitInBatches(i)
+              /\ packetsSync' = [packetsSync EXCEPT ![i].notCommitted = << >>,
+                                                    ![i].committed = << >> ]
+              /\ zabState' = [zabState EXCEPT ![i] = BROADCAST ]
+        /\ UNCHANGED <<state, currentEpoch, acceptedEpoch, logicalClock, lastSnapshot,
+                receiveVotes, outOfElection, recvQueue, waitNotmsg, leaderVars, envVars,
+                initialHistory, connectInfo, epochLeader, proposalMsgsLog, electionMsgs>>
+        /\ UpdateRecorder(<<"FollowerProcessUPTODATE", i, j>>)
+-----------------------------------------------------------------------------
+IncZxid(s, zxid) == IF currentEpoch[s] = zxid[1] THEN <<zxid[1], zxid[2] + 1>>
+                    ELSE <<currentEpoch[s], 1>>
+
+(* Leader receives client propose and broadcasts PROPOSAL. See processRequest
+   in ProposalRequestProcessor and propose in Leader for details. Since 
+   prosalProcessor.processRequest -> syncProcessor.processRequest ->
+   ackProcessor.processRequest -> leader.processAck, we initially set 
+   txn.ackSid = {i}, assuming we have done leader.processAck.
+   Note: In production, any server in traffic can receive requests and 
+         forward it to leader if necessary. We choose to let leader be
+         the sole one who can receive write requests, to simplify spec 
+         and keep correctness at the same time.
+*)
+LeaderProcessRequest(i) ==
+        /\ CheckTransactionNum \* test restrictions of transaction num
+        /\ IsON(i)
+        /\ IsLeader(i)
+        /\ zabState[i] = BROADCAST
+        /\ LET inBroadcast == {s \in forwarding[i]: zabState[s] = BROADCAST}
+           IN IsQuorum(inBroadcast)
+        /\ LET request_value == GetRecorder("nClientRequest") \* unique value
+               newTxn == [ zxid   |-> IncZxid(i, LastProposed(i).zxid),
+                           value  |-> request_value, 
+                           ackSid |-> {i}, \* assume we have done leader.processAck
+                           epoch  |-> acceptedEpoch[i] ]
+               m_proposal == [ mtype |-> PROPOSAL,
+                               mzxid |-> newTxn.zxid,
+                               mdata |-> request_value ]
+               m_proposal_for_checking == [ source |-> i,
+                                            epoch  |-> acceptedEpoch[i],
+                                            zxid   |-> newTxn.zxid,
+                                            data   |-> request_value ]
+           IN /\ history' = [history EXCEPT ![i] = Append(@, newTxn) ]
+              /\ \/ /\ ShouldSnapshot(i)
+                    /\ TakeSnapshot(i)
+                 \/ /\ ~ShouldSnapshot(i)
+                    /\ UNCHANGED <<lastSnapshot, violatedInvariants>>
+              /\ Broadcast(i, m_proposal)
+              /\ proposalMsgsLog' = proposalMsgsLog \union {m_proposal_for_checking}
+        /\ UNCHANGED <<state, currentEpoch, lastProcessed, zabState, acceptedEpoch,
+                       lastCommitted, electionVars, leaderVars, followerVars,
+                       initialHistory, epochLeader, electionMsgs, envVars>>
+        /\ UpdateRecorder(<<"LeaderProcessRequest", i>>)
+
+(* Follower processes PROPOSAL in BROADCAST. See processPacket
+   in Follower for details. *)
+FollowerProcessPROPOSAL(i, j) ==
+        /\ IsON(i)
+        /\ IsFollower(i)
+        /\ PendingPROPOSAL(i, j)
+        /\ zabState[i] = BROADCAST
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLeader(i, j)
+               isNext == IsNextZxid( LastQueued(i).zxid, msg.mzxid)
+               newTxn == [ zxid   |-> msg.mzxid,
+                           value  |-> msg.mdata,
+                           ackSid |-> {},
+                           epoch  |-> acceptedEpoch[i] ]
+               m_ack  == [ mtype |-> ACK,
+                           mzxid |-> msg.mzxid ]
+          IN /\ infoOk
+             /\ \/ /\ isNext
+                   /\ history' = [history EXCEPT ![i] = Append(@, newTxn)]
+                   /\ \/ /\ ShouldSnapshot(i)
+                         /\ TakeSnapshot(i)
+                      \/ /\ ~ShouldSnapshot(i)
+                         /\ UNCHANGED <<lastSnapshot, violatedInvariants>>
+                   /\ Reply(i, j, m_ack)
+                \/ /\ ~isNext
+                   /\ PrintT("Exception: Follower receives PROPOSAL, while" \o 
+                        " the transaction is not the next.")
+                   /\ violatedInvariants' = [violatedInvariants EXCEPT 
+                                !.proposalInconsistent = TRUE]
+                   /\ UNCHANGED <<history, lastSnapshot, msgs>>
+        /\ UNCHANGED <<state, currentEpoch, lastProcessed, zabState, acceptedEpoch,
+                 lastCommitted, electionVars, leaderVars, followerVars, initialHistory,
+                 epochLeader, proposalMsgsLog, electionMsgs, envVars>>
+        /\ UpdateRecorder(<<"FollowerProcessPROPOSAL", i, j>>)
+
+\* See outstandingProposals in Leader
+OutstandingProposals(i) == IF zabState[i] /= BROADCAST THEN << >>
+                           ELSE SubSeq( history[i], lastCommitted[i].index + 1,
+                                 Len(history[i]) )
+
+LastAckIndexFromFollower(i, j) == 
+        LET set_index == {idx \in 1..Len(history[i]): j \in history[i][idx].ackSid }
+        IN Maximum(set_index)
+
+\* See commit in Leader for details.
+LeaderCommit(s, follower, index, zxid) ==
+        /\ lastCommitted' = [lastCommitted EXCEPT ![s] = [ index |-> index,
+                                                           zxid  |-> zxid ] ]
+        /\ LET m_commit == [ mtype |-> COMMIT,
+                             mzxid |-> zxid ]
+           IN DiscardAndBroadcast(s, follower, m_commit)
+
+\* Try to commit one operation, called by LeaderProcessAck.
+\* See tryToCommit in Leader for details.
+\* commitProcessor.commit -> processWrite -> toBeApplied.processRequest
+\* -> finalProcessor.processRequest, finally processTxn will be implemented
+\* and lastProcessed will be updated. So we update it here.
+LeaderTryToCommit(s, index, zxid, newTxn, follower) ==
+        LET allTxnsBeforeCommitted == lastCommitted[s].index >= index - 1
+                    \* Only when all proposals before zxid has been committed,
+                    \* this proposal can be permitted to be committed.
+            hasAllQuorums == IsQuorum(newTxn.ackSid)
+                    \* In order to be committed, a proposal must be accepted
+                    \* by a quorum.
+            ordered == lastCommitted[s].index + 1 = index
+                    \* Commit proposals in order.
+        IN \/ /\ \* Current conditions do not satisfy committing the proposal.
+                 \/ ~allTxnsBeforeCommitted
+                 \/ ~hasAllQuorums
+              /\ Discard(follower, s)
+              /\ UNCHANGED <<violatedInvariants, lastCommitted, lastProcessed>>
+           \/ /\ allTxnsBeforeCommitted
+              /\ hasAllQuorums
+              /\ \/ /\ ~ordered
+                    /\ PrintT("Warn: Committing zxid " \o ToString(zxid) \o " not first.")
+                    /\ violatedInvariants' = [violatedInvariants EXCEPT 
+                            !.commitInconsistent = TRUE]
+                 \/ /\ ordered
+                    /\ UNCHANGED violatedInvariants
+              /\ LeaderCommit(s, follower, index, zxid)
+              /\ lastProcessed' = [lastProcessed EXCEPT ![s] = [ index |-> index,
+                                                                 zxid  |-> zxid ] ]
+
+(* Leader Keeps a count of acks for a particular proposal, and try to
+   commit the proposal. See case Leader.ACK in LearnerHandler,
+   processRequest in AckRequestProcessor, and processAck in Leader for
+   details. *)
+LeaderProcessACK(i, j) ==
+        /\ IsON(i)
+        /\ IsLeader(i)
+        /\ PendingACK(i, j)
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLearner(i, j)
+               outstanding == LastCommitted(i).index < LastProposed(i).index
+                        \* outstandingProposals not null
+               hasCommitted == ~ZxidCompare( msg.mzxid, LastCommitted(i).zxid)
+                        \* namely, lastCommitted >= zxid
+               index == ZxidToIndex(history[i], msg.mzxid)
+               exist == index >= 1 /\ index <= LastProposed(i).index
+                        \* the proposal exists in history
+               ackIndex == LastAckIndexFromFollower(i, j)
+               monotonicallyInc == \/ ackIndex = -1
+                                   \/ ackIndex + 1 = index
+                        \* TCP makes everytime ackIndex should just increase by 1
+           IN /\ infoOk 
+              /\ \/ /\ exist
+                    /\ monotonicallyInc
+                    /\ LET txn == history[i][index]
+                           txnAfterAddAck == [ zxid   |-> txn.zxid,
+                                               value  |-> txn.value,
+                                               ackSid |-> txn.ackSid \union {j} ,
+                                               epoch  |-> txn.epoch ]   
+                       IN \* p.addAck(sid)
+                       /\ history' = [history EXCEPT ![i][index] = txnAfterAddAck ] 
+                       /\ \/ /\ \* Note: outstanding is 0. 
+                                \* / proposal has already been committed.
+                                \/ ~outstanding
+                                \/ hasCommitted
+                             /\ Discard(j, i)
+                             /\ UNCHANGED <<violatedInvariants, lastCommitted, lastProcessed>>
+                          \/ /\ outstanding
+                             /\ ~hasCommitted
+                             /\ LeaderTryToCommit(i, index, msg.mzxid, txnAfterAddAck, j)
+                 \/ /\ \/ ~exist
+                       \/ ~monotonicallyInc
+                    /\ PrintT("Exception: No such zxid. " \o 
+                           " / ackIndex doesn't inc monotonically.")
+                    /\ violatedInvariants' = [violatedInvariants 
+                            EXCEPT !.ackInconsistent = TRUE]
+                    /\ Discard(j, i)
+                    /\ UNCHANGED <<history, lastCommitted, lastProcessed>>
+        /\ UNCHANGED <<state, currentEpoch, zabState, acceptedEpoch, electionVars,
+                    leaderVars, initialHistory, followerVars, proposalMsgsLog, epochLeader, 
+                    lastSnapshot, electionMsgs, envVars>>
+        /\ UpdateRecorder(<<"LeaderProcessACK", i, j>>)
+
+(* Follower processes COMMIT in BROADCAST. See processPacket
+   in Follower for details. *)
+FollowerProcessCOMMIT(i, j) ==
+        /\ IsON(i)
+        /\ IsFollower(i)
+        /\ PendingCOMMIT(i, j)
+        /\ zabState[i] = BROADCAST
+        /\ LET msg == msgs[j][i][1]
+               infoOk == IsMyLeader(i, j)
+               pendingTxns == PendingTxns(i)
+               noPending == Len(pendingTxns) = 0
+           IN
+           /\ infoOk 
+           /\ \/ /\ noPending
+                 /\ PrintT("Warn: Committing zxid without seeing txn.")
+                 /\ UNCHANGED <<lastCommitted, lastProcessed, violatedInvariants>>
+              \/ /\ ~noPending
+                 /\ LET firstElementZxid == pendingTxns[1].zxid
+                        match == ZxidEqual(firstElementZxid, msg.mzxid)
+                    IN 
+                    \/ /\ ~match
+                       /\ PrintT("Exception: Committing zxid not equals" \o
+                                " next pending txn zxid.")
+                       /\ violatedInvariants' = [violatedInvariants EXCEPT 
+                               !.commitInconsistent = TRUE]
+                       /\ UNCHANGED <<lastCommitted, lastProcessed>>
+                    \/ /\ match
+                       /\ lastCommitted' = [lastCommitted EXCEPT 
+                                ![i] = [ index |-> lastCommitted[i].index + 1,
+                                         zxid  |-> firstElementZxid ] ]
+                       /\ lastProcessed' = [lastProcessed EXCEPT 
+                                ![i] = [ index |-> lastCommitted[i].index + 1,
+                                         zxid  |-> firstElementZxid ] ]
+                       /\ UNCHANGED violatedInvariants
+        /\ Discard(j, i)
+        /\ UNCHANGED <<state, currentEpoch, zabState, acceptedEpoch, history,
+                    electionVars, leaderVars, initialHistory, followerVars,
+                    lastSnapshot, proposalMsgsLog, epochLeader, electionMsgs, envVars>>
+        /\ UpdateRecorder(<<"FollowerProcessCOMMIT", i, j>>)
+-----------------------------------------------------------------------------
+(* Used to discard some messages which should not exist in network channel.
+   This action should not be triggered. *)
+FilterNonexistentMessage(i) ==
+        /\ \E j \in Server \ {i}: /\ msgs[j][i] /= << >>
+                                  /\ LET msg == msgs[j][i][1]
+                                     IN 
+                                        \/ /\ IsLeader(i)
+                                           /\ LET infoOk == IsMyLearner(i, j)
+                                              IN
+                                              \/ msg.mtype = LEADERINFO
+                                              \/ msg.mtype = NEWLEADER
+                                              \/ msg.mtype = UPTODATE
+                                              \/ msg.mtype = PROPOSAL
+                                              \/ msg.mtype = COMMIT
+                                              \/ /\ ~infoOk
+                                                 /\ \/ msg.mtype = FOLLOWERINFO
+                                                    \/ msg.mtype = ACKEPOCH
+                                                    \/ msg.mtype = ACKLD
+                                                    \/ msg.mtype = ACK
+                                        \/ /\ IsFollower(i)
+                                           /\ LET infoOk == IsMyLeader(i, j) 
+                                              IN
+                                              \/ msg.mtype = FOLLOWERINFO
+                                              \/ msg.mtype = ACKEPOCH
+                                              \/ msg.mtype = ACKLD
+                                              \/ msg.mtype = ACK
+                                              \/ /\ ~infoOk
+                                                 /\ \/ msg.mtype = LEADERINFO
+                                                    \/ msg.mtype = NEWLEADER
+                                                    \/ msg.mtype = UPTODATE
+                                                    \/ msg.mtype = PROPOSAL
+                                                    \/ msg.mtype = COMMIT   
+                                        \/ IsLooking(i)
+                                  /\ Discard(j, i)
+        /\ violatedInvariants' = [violatedInvariants EXCEPT !.messageIllegal = TRUE]
+        /\ UNCHANGED <<serverVars, electionVars, leaderVars, envVars,
+                       followerVars, proposalMsgsLog, epochLeader, electionMsgs>>
+        /\ UnchangeRecorder        
+-----------------------------------------------------------------------------
+\* Defines how the variables may transition.
+Next == 
+        (* FLE module *)
+            \/ \E i, j \in Server: FLEReceiveNotmsg(i, j)
+            \/ \E i \in Server:    FLENotmsgTimeout(i)
+            \/ \E i \in Server:    FLEHandleNotmsg(i)
+            \/ \E i \in Server:    FLEWaitNewNotmsg(i)
+        (* situation errors like failure, network partition *)
+            \/ \E i, j \in Server: PartitionStart(i, j)
+            \/ \E i, j \in Server: PartitionRecover(i, j)
+            \/ \E i \in Server:    NodeCrash(i)
+            \/ \E i \in Server:    NodeStart(i)
+        (* Zab module - Discovery and Synchronization part *)
+            \/ \E i, j \in Server: ConnectAndFollowerSendFOLLOWERINFO(i, j)
+            \/ \E i, j \in Server: LeaderProcessFOLLOWERINFO(i, j)
+            \/ \E i, j \in Server: FollowerProcessLEADERINFO(i, j)
+            \/ \E i, j \in Server: LeaderProcessACKEPOCH(i, j)
+            \/ \E i, j \in Server: LeaderSyncFollower(i, j)
+            \/ \E i, j \in Server: FollowerProcessSyncMessage(i, j)
+            \/ \E i, j \in Server: FollowerProcessPROPOSALInSync(i, j)
+            \/ \E i, j \in Server: FollowerProcessCOMMITInSync(i, j)
+            \/ \E i, j \in Server: FollowerProcessNEWLEADER(i, j)
+            \/ \E i, j \in Server: LeaderProcessACKLD(i, j)
+            \/ \E i, j \in Server: FollowerProcessUPTODATE(i, j)
+        (* Zab module - Broadcast part *)
+            \/ \E i \in Server:    LeaderProcessRequest(i)
+            \/ \E i, j \in Server: FollowerProcessPROPOSAL(i, j)
+            \/ \E i, j \in Server: LeaderProcessACK(i, j)
+            \/ \E i, j \in Server: FollowerProcessCOMMIT(i, j)
+        (* An action used to judge whether there are redundant messages in network *)
+            \/ \E i \in Server:    FilterNonexistentMessage(i)
+
+Spec == Init /\ [][Next]_vars
+-----------------------------------------------------------------------------
+\* Define safety properties of Zab 1.0 protocol.
+
+CheckDuringAction == \A p \in DOMAIN violatedInvariants: violatedInvariants[p] = FALSE
+
+\* There is most one established leader for a certain epoch.
+Leadership1 == \A i, j \in Server:
+                   /\ IsLeader(i) /\ zabState[i] \in {SYNCHRONIZATION, BROADCAST}
+                   /\ IsLeader(j) /\ zabState[j] \in {SYNCHRONIZATION, BROADCAST}
+                   /\ acceptedEpoch[i] = acceptedEpoch[j]
+                  => i = j
+
+Leadership2 == \A epoch \in 1..MAXEPOCH: Cardinality(epochLeader[epoch]) <= 1
+
+\* PrefixConsistency: The prefix that have been committed 
+\* in history in any process is the same.
+PrefixConsistency == \A i, j \in Server:
+                        LET smaller == Minimum({lastCommitted[i].index, lastCommitted[j].index})
+                        IN \/ smaller = 0
+                           \/ /\ smaller > 0
+                              /\ \A index \in 1..smaller:
+                                   TxnEqual(history[i][index], history[j][index])
+
+\* Integrity: If some follower delivers one transaction, then some primary has broadcast it.
+Integrity == \A i \in Server:
+                /\ IsFollower(i)
+                /\ lastCommitted[i].index > 0
+                => \A idx \in 1..lastCommitted[i].index: \E proposal \in proposalMsgsLog:
+                    LET txn_proposal == [ zxid  |-> proposal.zxid,
+                                          value |-> proposal.data ]
+                    IN  TxnEqual(history[i][idx], txn_proposal)
+
+\* Agreement: If some follower f delivers transaction a and some follower f' delivers transaction b,
+\*            then f' delivers a or f delivers b.
+Agreement == \A i, j \in Server:
+                /\ IsFollower(i) /\ lastCommitted[i].index > 0
+                /\ IsFollower(j) /\ lastCommitted[j].index > 0
+                =>
+                \A idx1 \in 1..lastCommitted[i].index, idx2 \in 1..lastCommitted[j].index :
+                    \/ \E idx_j \in 1..lastCommitted[j].index:
+                        TxnEqual(history[j][idx_j], history[i][idx1])
+                    \/ \E idx_i \in 1..lastCommitted[i].index:
+                        TxnEqual(history[i][idx_i], history[j][idx2])
+
+\* Total order: If some follower delivers a before b, then any process that delivers b
+\*              must also deliver a and deliver a before b.
+TotalOrder == \A i, j \in Server: 
+                LET committed1 == lastCommitted[i].index 
+                    committed2 == lastCommitted[j].index  
+                IN committed1 >= 2 /\ committed2 >= 2
+                    => \A idx_i1 \in 1..(committed1 - 1) : \A idx_i2 \in (idx_i1 + 1)..committed1 :
+                    LET logOk == \E idx \in 1..committed2 :
+                                     TxnEqual(history[i][idx_i2], history[j][idx])
+                    IN \/ ~logOk 
+                       \/ /\ logOk 
+                          /\ \E idx_j2 \in 1..committed2 : 
+                                /\ TxnEqual(history[i][idx_i2], history[j][idx_j2])
+                                /\ \E idx_j1 \in 1..(idx_j2 - 1):
+                                       TxnEqual(history[i][idx_i1], history[j][idx_j1])
+
+\* Local primary order: If a primary broadcasts a before it broadcasts b, then a follower that
+\*                      delivers b must also deliver a before b.
+LocalPrimaryOrder == LET p_set(i, e) == {p \in proposalMsgsLog: /\ p.source = i 
+                                                                /\ p.epoch  = e }
+                         txn_set(i, e) == { [ zxid  |-> p.zxid, 
+                                              value |-> p.data ] : p \in p_set(i, e) }
+                     IN \A i \in Server: \A e \in 1..currentEpoch[i]:
+                         \/ Cardinality(txn_set(i, e)) < 2
+                         \/ /\ Cardinality(txn_set(i, e)) >= 2
+                            /\ \E txn1, txn2 \in txn_set(i, e):
+                             \/ TxnEqual(txn1, txn2)
+                             \/ /\ ~TxnEqual(txn1, txn2)
+                                /\ LET TxnPre  == IF ZxidCompare(txn1.zxid, txn2.zxid) THEN txn2 ELSE txn1
+                                       TxnNext == IF ZxidCompare(txn1.zxid, txn2.zxid) THEN txn1 ELSE txn2
+                                   IN \A j \in Server: /\ lastCommitted[j].index >= 2
+                                                       /\ \E idx \in 1..lastCommitted[j].index: 
+                                                            TxnEqual(history[j][idx], TxnNext)
+                                        => \E idx2 \in 1..lastCommitted[j].index: 
+                                            /\ TxnEqual(history[j][idx2], TxnNext)
+                                            /\ idx2 > 1
+                                            /\ \E idx1 \in 1..(idx2 - 1): 
+                                                TxnEqual(history[j][idx1], TxnPre)
+
+\* Global primary order: A follower f delivers both a with epoch e and b with epoch e', and e < e',
+\*                       then f must deliver a before b.
+GlobalPrimaryOrder == \A i \in Server: lastCommitted[i].index >= 2
+                         => \A idx1, idx2 \in 1..lastCommitted[i].index:
+                                \/ ~EpochPrecedeInTxn(history[i][idx1], history[i][idx2])
+                                \/ /\ EpochPrecedeInTxn(history[i][idx1], history[i][idx2])
+                                   /\ idx1 < idx2
+
+\* Primary integrity: If primary p broadcasts a and some follower f delivers b such that b has epoch
+\*                    smaller than epoch of p, then p must deliver b before it broadcasts a.
+PrimaryIntegrity == \A i, j \in Server: /\ IsLeader(i)   /\ IsMyLearner(i, j)
+                                        /\ IsFollower(j) /\ IsMyLeader(j, i)
+                                        /\ zabState[i] = BROADCAST
+                                        /\ zabState[j] = BROADCAST
+                                        /\ lastCommitted[j].index >= 1
+                        => \A idx_j \in 1..lastCommitted[j].index:
+                                \/ history[j][idx_j].zxid[1] >= currentEpoch[i]
+                                \/ /\ history[j][idx_j].zxid[1] < currentEpoch[i]
+                                   /\ \E idx_i \in 1..lastCommitted[i].index: 
+                                        TxnEqual(history[i][idx_i], history[j][idx_j])
+=============================================================================
+\* Modification History
+\* Last modified Tue Jan 17 21:21:28 CST 2023 by huangbinyu
+\* Last modified Mon Nov 22 22:25:23 CST 2021 by Dell
+\* Created Sat Oct 23 16:05:04 CST 2021 by Dell